## _cr15214 ## Source details **Canonical URL:** [_cr15214](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr15214.pdf) ## Other formats - [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr15214.pdf.md) - [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr15214.pdf.json) --- ### EXECUTIVE SUMMARY — INTRODUCTION - Review assessed progress towards implementation of the Basel Committee Core Principles for Effective Banking Supervision (BCP). - Detailed BCP assessment in 2006 based on 1999 principles; current FSAP used 2012 version of the BCPs. - Each entity—Republika Srpska (RS) and Federation of Bosnia and Herzegovina (FBiH)—completed a full self-assessment reviewed by assessors during the mission. - Technical note produced with principle-by-principle summaries for each entity; compliance ratings not assigned. - Analysis completed during October 27-November 18, 2014; reflects the regulatory and supervisory framework as of that date. ### INSTITUTIONAL SETTING AND MARKET STRUCTURE - Political and regulatory structure: - Bosnia and Herzegovina divided into two semi-autonomous Entities: Federation of Bosnia and Herzegovina (FBiH) and Republika Srpska (RS); Brcko District is a third distinct entity. - Regulatory and supervisory responsibilities for banking, insurance and capital markets lie at the Entity level; CBBH and DIA reside at the national (State) level. - Banking sector concentration and ownership (end-2013 unless noted): - Banking sector = 86 percent of financial system assets; equivalent to 84 percent of GDP. - Foreign subsidiaries account for 82 percent of banking sector assets; domestically-owned 16 percent; public banks 2 percent. - Twenty seven banks operate (17 in BiH and 10 in RS; entity share 70 and 30 percent respectively). - Five largest banks represented about half of banking sector assets in 2013. - Footnote: the first largest banks presented 70 and 80 percent of FBiH and RS banking assets in each entity respectively. - Ownership of foreign banks and market shares: - Largest foreign banks from Austria and Italy; together with Slovenia make up 3/4 of banking sector assets in FBiH and half in RS. - Examples: Raiffeisen, Hypo, Sparkasse (Austria); Unicredit, Intesa (Italy); NLB (Slovenia). - Non-banking financial system: - Insurance companies: 5 percent of financial system assets. - Leasing companies, investment funds, microcredit organizations: 3 percent each of financial system assets. - Life insurance = 0.3 percent of GDP; nonlife insurance share below 2 percent of GDP. - One stock exchange in each Entity; capital markets underdeveloped. - Payment infrastructure: - RTGS settles high-value transfers and net balances from the giro clearing system (GCS) and card switching network. ### KEY STATISTICS AND MACRO-FINANCIAL INDICATORS - Bank credit to private sector annual growth: "around 25 percent" over 2003-07. - Credit-to-GDP: rose from "around 35 to 45 percent" over 2003-07. - Deposit insurance coverage increased to KM 35,000 (€17,000). - System-wide NPLs ratio: 15.5 percent at end-June 2014 (compared to 3 percent at onset of global financial crisis). - Provisions to NPL ratio: 68 percent. - Sector-wide regulatory capital: over 17 percent of risk-weighted assets as of end-June 2014. - According to authorities, restructured loans: about 1 percent of total loans so far. - Historical events: Hypo Alpe Adria Bank nationalized by Austria in 2009; on October 30, 2014 it announced sale of SEE network (footnote). ### MAIN FINDINGS — SUPERVISION, REGULATION, AND RISKS - Overall supervisory oversight improved since 2006; shortcomings remain. - Progress noted: - Enhancement of regulatory framework and supervisory processes. - Draft/new Law on Banks under preparation to address supervisory powers, resolution tools, and consolidated supervision. - Issuance of regulations on corporate governance, credit risk management and capital; comprehensive risk management regulations drafted. - Harmonization between entities largely achieved; joint planning for further regulation and operational improvements continues. - Cooperation and coordination complexities: - Overlapping mandates (e.g., State-level SCFS and RS Committee for Coordination). - Key risk information (e.g., CAMEL/CAMELS ratings) not always shared with relevant stakeholders (other banking agency, CBBH, DIA) creating information asymmetries. - Development of an integral contingency plan is under way. - Problem banks and resolution constraints: - Several banks under special/enhanced supervision; may remain in that category for extended periods. - Recovery and resolution constrained by weak lending profitability, difficulties in raising capital, and Agencies’ concerns about triggering system-wide deposit runs. - Related-party transactions and concentration risk: - Violations of related and connected party regulatory limits frequently identified. - Opaque ownership structures in several domestic banks hinder identification of related parties. - Root causes: predominantly formal licensing/approval processes and inadequate corporate governance and risk management in some banks. - Enforcement limitations: - Agencies have limited enforcement powers to impose fines on supervisory board members. - Authority to replace or restrict powers of controlling owners outside provisional administration could be enhanced to act on supervisory judgment concerning safety and soundness. - Loan loss provisioning and accounting concerns: - Provisioning based on IAS and prudential requirements, but provisioning levels may be inadequate. - Onsite reviews and AQRs by external accountants revealed under-provisioning; supervisors required increased provisions or reclassification. - External audit quality: - Several domestic banks implemented IFRS 2009 (last translation into local language). - Some external auditors base opinion on the Law on Accounting and Auditing rather than IFRS, complicating comparability and raising audit quality concerns. - Quality assurance of financial audits is barely developing. - External auditor appointment occurs yearly with a maximum of five years; Agencies cannot rescind external auditors though they can consent to appointments and refuse audit reports. - Risk: yearly change of auditor adversely affects audit continuity and quality; appointing an external auditor for a minimum of three years and granting Agencies power to rescind could improve incentives and audit quality. - Institutional independence risks: - Agencies possess operational independence under law, but government actions may impact future independence. - In FBiH, opaque ownership creates difficulties identifying ultimate beneficial owners; claims of political connections could not be confirmed by assessors. - In RS, development bank support to domestically owned banks may constrain BARS when addressing non-viable banks. ### FSAP KEY RECOMMENDATIONS — SUMMARY (FROM TABLE 1) - Time definitions: - "I-Immediate" = within one year. - "NT-near-term" = 1–3 years. - "MT-medium-term" = 3–5 years. - Immediate (I): - Identify the ultimate beneficiary owners and their holdings – CP 6. - Conduct additional AQRs in banks with weak solvency and liquidity indicators – CP 16, 17, 18, 24. - Adopt the new Law on Banks addressing supervisory powers, resolution, consolidated supervision, appeal of supervisory decisions, definitions of branches, licensing, transfer of significant ownership, major acquisitions, prudential reporting – CP 1, 4-7, 10, 11, 12, 27. - Enhance resolution and recovery process to avoid non-viable banks operating for extended periods – CP 8. - Strengthen LOBA (legal protection of BARS, appointment of member MB, director and deputy director) – CP 2. - Enhance coordination and information exchange between CBBH, BARS, FBA and DIA (including in crisis times) – CP 3. - Deepen assessment of license, fit and proper (board members, significant owners), transfer of significant ownership, major acquisitions – CP 4-7. - Explicitly assess net risk of limitations of cooperation with supervisory authorities of parents of D-SIB and mitigate this risk – CP 3, 13. - Deepen identification of inherent ML/TF risk profiles of banks – CP 29. - Enhance cooperation and information exchange with FID/SIPA – CP 29. - Strengthen interaction with the external auditor (BARS) – CP 27. - Evaluate quality of external audit and the quality assurance system in relation to AQR outcomes – CP 27. - Enhance disclosure on group structure including ultimate beneficiary owner and insider lending – CP 28. - Near-term (NT): - Conduct crisis simulation exercise to test cooperation in times of crisis at state and entity level – CP 3. - Broaden and link to supervisory judgment enforcement action based on safety and soundness concerns – CP 11. - Develop a remedial action program focusing on new tools and earlier step-up enforcement and heavier fines – CP 11. - Implement contingency plan to harmonize domestic cooperation and information exchange between banking agencies, the Central Bank and Deposit Insurance – CP 3. - Medium-term (MT): - Work towards full compliance with IFRS for banks and make the audit opinion explicitly refer to IFRS instead of Law on Accounting and Auditing – CP 27. - Issue prudential guidance to promote adequate provisioning and conservative assumptions for trigger events and objective evidence under IAS – CP 18. ### DETAILED RECOMMENDATIONS AND FOLLOW-UP (PRIORITY AREAS) - Legal powers and primary law: - Adopt new LOB and LOBA to explicitly provide powers for consolidated supervision, prudential conditions on licensing and ownership transfers, authority to rescind external auditors, and resolution powers. - Enforcement and remedial program: - Develop and publish a graduated remedial action program with clear benchmarks, escalation triggers, delegated responsibilities and processing timeframes; increase administrative fines and enable fines on supervisory board members and controlling owners. - Strengthen ability to enforce corporate governance and risk management by increasing recognition of supervisory judgment in law. - Crisis preparedness and coordination: - Establish a resolution authority and resolution funding or ensure contingency funding arrangements beyond deposit insurance. - Conduct crisis simulation exercises; finalize and implement an integral contingency plan; ensure SCFS discusses all problem banks regularly. - AML/CFT: - Timely enact necessary amendments to the Criminal Code and conduct a national ML/TF risk assessment and national strategy. - Enhance cooperation and feedback loop between banking agencies and FID/SIPA; make supervisory intensity risk-based according to inherent ML/TF profiles. - Audit and accounting: - Implement IFRS 2014; continuously translate IFRS; require audit opinions explicitly refer to IFRS. - Change auditor appointment practices to minimum three-year terms and grant Agencies power to rescind auditors; evaluate external audit quality and quality assurance systems in relation to AQR findings. - Provisioning and asset quality: - Conduct additional AQRs where needed; issue prudential guidance for conservative provisioning under IAS, including collateral haircuts, valuation standards and impairment assumptions. - Consolidated and cross-border supervision: - Define consolidated supervision scope; set consolidated prudential requirements and powers to intervene in groups. - Formalize MOUs with home supervisors (notably Austria and Italy); realistically assess cooperation with Russia. ### DETAILED THEMATIC FINDINGS (SELECTED CORE PRINCIPLES) - CPs 1–3 (Responsibilities, independence, cooperation): - Gaps: no explicit consolidated supervision power; limited power to impose prudential conditions; limited power to sanction supervisory board members; no power to rescind external auditor; no explicit resolution power. - Independence: LOBA provides operational independence but appointment processes and political economy create practical risks; courts may suspend supervisory actions via appeals. - Cooperation: CAMEL/CAMELS ratings and other critical information not routinely shared across agencies; MOUs with Austria/Italy pending formalization. - CPs 4–7 (Permissible activities, licensing, ownership transfers, major acquisitions): - LOB lacks clear definitions for branches, representative offices and operational units. - Licensing and ownership assessments historically formal/documentary rather than substantive; difficulty identifying ultimate beneficial owners. - Transfer of significant ownership process lacks power to impose prudential conditions/ring-fencing; thresholds and information requirements recommended to be strengthened. - CPs 8–10 (Supervisory approach, tools, reporting): - Supervisory model: mix of onsite and offsite; CAMELS ratings (1–5 scale; “S” market sensitivity not rated pending market risk decision). - Prudential reporting not comprehensive: no consolidated reports, no pillar 2 capital, limited market/country risk reporting. - Onsite focus: loan quality, corrective action implementation, risk management effectiveness; offsite monitors quarterly and uses UBPR, EWS. - CP 11 (Corrective and sanctioning powers): - Authorities can impose fines, orders, temporary management, and revoke licenses; fines on individuals limited and administrative fines deemed insignificant. - No comprehensive remedial action program; problem banks may remain in weak status prolongedly. - CPs 12–13 (Consolidated and cross-border supervision): - Consolidated supervision not implemented; no prudential consolidated reporting or supervisory powers over groups. - Need for enhanced cooperation with home supervisors; MOUs with Austria/Italy to be formalized; Russia's position unclear. - CPs 14–16 (Corporate governance, risk management, capital): - Governance: Decisions issued on diligent behavior, suitability and remuneration; need additional guidance on risk appetite statements and strategic plans. - Risk management: improvements made; gaps remain for IRRBB, country risk and market risk; holistic bank-wide risk decision drafted. - Capital: Decision on Minimum Standards maintains minimum capital adequacy ratio at 12 percent; transitional Basel III elements included: - capital conservation buffer 2.5 percent of risk-weighted assets; - leverage ratio at least 6 percent starting December 31, 2015; - reducing loan loss reserves included in supplemental capital to 1.625 percent by December 31, 2015 and 1.25 percent by December 31, 2016; - amortize revaluation reserves by December 31, 2016; - depreciate subordinated debt in last 5 years to maturity by December 31, 2015; - limits on supplemental capital relative to core capital phased as of December 31, 2015 and December 31, 2016; - capital requirements for market risk to apply when secondary regulations (1/1/2017) enter into force. - CP 17–19 (Credit risk, problem assets, concentration): - Credit risk: Decision on Minimum Standards sets policies, underwriting and concentration limits; onsite/offsite monitoring in place. - Problem assets/provisions: classification into five categories; provisioning percentages by category: A 2 percent; B 5–15 percent; C 16–40 percent; D 41–60 percent; E 100 percent. - Category B includes loans 90 days delinquent; C up to 180 days; D up to 270 days. - Concentration: legal basic credit limit 40 percent of total core capital (under review to align to 25 percent); large exposure defined >15 percent of core capital; aggregate large exposures limit 300 percent of core capital. - CPs 20–21 (Related parties, country risk): - Related parties: broad definition; limits for natural persons 1 percent (single) and 10 percent (aggregate) of core capital; related legal person limit 25 percent aggregate. - Country/transfer risk: no dedicated decision yet; regulation drafted. - CPs 22–25 (Market risk, IRRBB, liquidity, operational risk): - Market risk: decision drafted; implementation planned January 1, 2017. - IRRBB: regulations drafted; not yet issued. - Liquidity: specific maturity-matching requirements and ten-day minimum liquidity (10 percent average; not less than 5 percent any day); contingency planning required; LCR and NSFR to be analyzed for Basel III implementation. - Operational risk: basic indicator approach in place; outsourcing and information systems decisions issued; targeted inspections of outsourcing from September 2014. - CPs 26–29 (Internal control & audit, financial reporting, disclosure, AML/CTF): - Internal control/internal audit: decisions in place; supervisory checks performed. - Financial reporting and external audit: IFRS 2009 translation last available; IFRS 2014 not fully implemented; external auditors sometimes base opinion on Law on Accounting and Auditing rather than IFRS; few firms with permission to audit banks; AQRs revealed under-provisioning raising audit quality concerns. - Disclosure: statutory requirements to publish audited and semi-annual reports; disclosure of group structure and ultimate beneficiary owners weak. - AML/CTF: 2009 MONEYVAL mutual evaluation identified strategic deficiencies; new Law on AML/TF adopted (47/14 in 2014) and Decision 48/12; significant deficiencies remain; MONEYVAL public statements June and September 2014 urged enhanced due diligence for persons and institutions from/in BiH. ### PRIORITY AND TABLED ACTIONS (SELECTED TABLED MEASURES) - Legal and supervisory powers: - Adopt new LOB and LOBA; include explicit consolidated supervision powers, powers to impose prudential license conditions, authority to rescind auditors, and resolution powers. - Supervision and enforcement: - Identify UBOs; deepen AQRs; develop and publish remedial action program; increase fines and ability to sanction supervisory board members and controlling owners; require minimum three-year external auditor appointment and rescission powers for agencies. - Crisis management and resolution: - Establish a resolution authority and resolution funding; ensure DIA technical readiness; clarify LOLR limitations under CBBH law. - AML/CFT: - Enact necessary Criminal Code amendments; conduct national ML/TF risk assessment and national strategy; enhance coordination between State and Entity agencies and with FID/SIPA. - Accounting and audit: - Translate and implement IFRS continuously; align audit opinion to IFRS; evaluate external audit quality relative to AQRs. *Prepared by José Tuya, IMF consultant, and Marc Schrijver, World Bank; analysis completed during October 27-November 18, 2014.* *Source: _cr15214 (IMF country report content).* ### EXECUTIVE SUMMARY ___________________________________________________________________________ 4 ### _cr15214 - EXECUTIVE SUMMARY ___________________________________________________________________________ 4 ### INTRODUCTION - A review assessed progress towards implementation of the Basel Committee Core Principles for Effective Banking Supervision (BCP). - A detailed BCP assessment was conducted in 2006 based on the 1999 version of the principles. - For the current FSAP, each entity—Republika Srpska (RS) and Federation of Bosnia and Herzegovina (FBiH)—completed a full self-assessment reviewed by the assessors and discussed during the mission. - The review produced a technical note with attachments providing detailed principle-by-principle summaries for each entity; compliance ratings were not assigned because the focus was on measuring progress and not all essential criteria were verified. - The analysis uses the 2012 version of the BCPs and was completed during October 27-November 18, 2014; it reflects the regulatory and supervisory framework in place as of the date of completion. ### OVERVIEW OF INSTITUTIONAL SETTING AND MARKET STRUCTURE - Bosnia and Herzegovina is divided into two semi-autonomous political Entities—the Federation of Bosnia and Herzegovina and the Republika Srpska—each with its own Parliament, government, judicial system and stock exchange. - Regulatory and supervisory responsibilities for banking, insurance and capital markets lie at the Entity level with laws and regulations harmonized to a degree. - A central (State) level administration exists with few enumerated powers; the Central Bank of Bosnia and Herzegovina (CBBH) and the Deposit Insurance Agency (DIA) reside at the national level. - The Brcko District is a third distinct entity and has been self-governing since 2000. ### BOX 1 — THE 2012 REVISED CORE PRINCIPLES (KEY POINTS) - Revised to reflect lessons from the 2008/2009 financial crisis and recommendations from G-20 and FSB. - Greater emphasis on: - supervisory intensity and resources for systemically important banks; - application of a system-wide, macro perspective to micro-prudential supervision; - effective crisis preparation, recovery and resolution measures; - fostering market discipline via corporate governance, disclosure and transparency. - Supervisors required to assess both banks’ internal risk profiles and risks banks pose to the banking/financial system, taking into account macroeconomic environment and build-up/concentration of risk. - Number of principles increased from 25 to 29. - Number of essential criteria expanded from 196 to 231, including 35 new essential criteria and 16 additional criteria for jurisdictions that choose to be assessed against them. - Emphasizes proportionality in supervisory expectations and standards. ### MAIN FINDINGS - Overall supervisory oversight improved since 2006, but shortcomings remain. - Progress noted: enhancement of regulatory framework and supervisory processes; draft/new Law on Banks under preparation to address supervisory powers, resolution tools, and consolidated supervision; issuance of regulations on corporate governance, credit risk management and capital; comprehensive risk management regulations drafted. - Harmonization between entities largely achieved and joint planning for further regulation and operational improvements continues. - Cooperation and coordination among institutions are complex and have potential repercussions in financial stress: - Overlapping mandates exist (e.g., State-level SCFS and RS Committee for Coordination of Supervision of the Financial Sector). - Key risk information (e.g., CAMEL ratings) is not always shared with relevant stakeholders (other banking agency, CBBH, DIA), creating information asymmetries. - Development of an integral contingency plan is under way. - Problem banks: - Several banks identified and placed under special/enhanced supervision; banks may remain in that category for extended periods. - Recovery and resolution constrained by weak lending profitability, difficulties in raising capital, and Agencies’ concerns about triggering system-wide deposit runs. - Related-party transactions and concentration risk: - Supervisory activities frequently identify violations of related and connected party regulatory limits. - Several domestic banks have opaque ownership structures, hindering identification of related parties. - Root causes include predominantly formal licensing/approval processes and inadequate corporate governance and risk management at some banks. - Enforcement limitations: - Regulations assign responsibilities to supervisory boards but Agencies have limited enforcement powers to impose fines on supervisory board members. - Authority to replace or restrict powers of controlling owners outside provisional administration could be enhanced to include actions based on supervisory judgment concerning safety and soundness. - Loan loss provisioning and accounting concerns: - Provisioning is based on International Accounting Standards (IAS) and prudential requirements, but provisioning levels may be inadequate. - Supervisory standards should encourage conservative implementation by banks of factors to determine incurred losses under IAS. - Onsite reviews and Asset Quality Reviews (AQR) by external accountants revealed under-provisioning and prompted supervisors to require increased provisions or reclassification of assets. - External audit quality and practices: - Several domestic banks implemented IFRS 2009, which is the last translation into local language. - Some external auditors base their opinion on the law on accounting and auditing rather than IFRS, complicating comparability of financial statements and raising uncertainty over audit quality. - Quality assurance of financial audits is barely developing. - External auditor appointment occurs yearly with a maximum of five years; Agencies cannot rescind external auditors though they can consent to appointments and refuse audit reports. - Risk exists that yearly change of auditor adversely affects audit continuity and quality; appointing an external auditor for a minimum of three years and granting Agencies power to rescind could improve incentives and audit quality. - Institutional independence risks: - Under the legal framework Agencies possess operational independence, but government actions may impact future independence. - In FBiH, opaque ownership of some domestic banks creates difficulties identifying ultimate beneficial owners; claims of political connections could not be confirmed by assessors. - In RS, increasing support from the development bank to (mostly) domestically owned banks may place BARS in a difficult position when addressing non-viable banks, potentially constraining options to protect safety and soundness. ### FSAP KEY RECOMMENDATIONS ON BANKING OVERSIGHT (EXTRACT FROM TABLE 1) - Immediate (I): - Identify the ultimate beneficiary owners and their holdings – CP 6. - Conduct additional AQRs in banks with weak solvency and liquidity indicators – CP 16, 17, 18, 24. - Adopt the new Law on Banks addressing deficiencies in supervisory powers and consolidated supervision, appeal of supervisory decisions, definitions of branches, licensing, transfer of significant ownership, major acquisitions, prudential reporting – CP 1, 4-7, 10, 11, 12, 27. - Enhance resolution and recovery process to avoid non-viable banks operating for extended periods – CP 8. - Strengthen LOBA (legal protection of BARS, appointment of member MB, director and deputy director) – CP 2. - Enhance coordination and information exchange between CBBH, BARS, FBA and DIA and improve information sharing (including in crisis times) – CP 3. - Deepen assessment of license, fit and proper (board members, significant owners), transfer of significant ownership, major acquisitions – CP 4-7. - Explicitly assess net risk of limitations of cooperation with supervisory authorities of parents of D-SIB and mitigate this risk – CP 3, 13. - Deepen identification of inherent ML/TF risk profiles of banks – CP 29. - Enhance cooperation and information exchange with FID/SIPA – CP 29. - Strengthen interaction with the external auditor (BARS) – CP 27. - Evaluate quality of external audit and the quality assurance system in relation to AQR outcomes – CP 27. - Enhance disclosure on group structure of banks including ultimate beneficiary owner and insider lending – CP 28. - Near-term (NT): - Conduct crisis simulation exercise to test cooperation in times of crisis at both state and entity level – CP 3. - Broaden and link to supervisory judgment enforcement action based on safety and soundness concerns – CP 11. - Develop a remedial action program focusing on new tools and earlier step-up enforcement and heavier fines to expedite corrective action – CP 11. - Implement contingency plan to harmonize domestic cooperation and information exchange between banking agencies, the Central Bank and Deposit Insurance – CP 3. - Medium-term (MT): - Work towards full compliance with IFRS for banks and make the audit opinion explicitly refer to IFRS instead of Law on Accounting and auditing – CP 27. - Issue prudential guidance to promote adequate provisioning and conservative assumptions for trigger events and objective evidence under IAS – CP 18. - Time definitions: - "I-Immediate" is within one year; "NT-near-term" is 1–3 years; "MT-medium-term" is 3–5 years. ### DETAILED RECOMMENDATIONS AND FOLLOW-UP - The technical note contains detailed recommended actions to improve compliance with the Basel Core Principles and the effectiveness of regulatory and supervisory frameworks; attachments provide principle-by-principle implementation reviews for FBiH and RS and a comparison of Basel II weights and FBA/RS weights. - Harmonization of regulations between entities has largely been achieved; joint planning for further regulations and operational improvements continues. - Priority areas for reform include legal powers (new Law on Banks), enhanced enforcement tools, improved crisis preparedness and coordination, strengthened anti-money laundering and terrorist financing risk assessment, improved audit quality and IFRS adoption, expanded AQRs where needed, and improved disclosure of ownership and related-party exposures. *Prepared by José Tuya, IMF consultant, and Marc Schrijver, World Bank; analysis completed during October 27-November 18, 2014.* ### 5. The financial system in Bosnia and Herzegovina is dominated by a moderately ### 5. The financial system in Bosnia and Herzegovina is dominated by a moderately ### Banking sector structure and concentration - The banking sector accounts for 86 percent of the financial system assets, which are equivalent to 84 percent of GDP as of end-2013. - The banking system comprises mostly foreign subsidiaries—82 percent of the banking sector assets, while domestically-owned and public banks account for 16 and 2 percent respectively. - Twenty seven banks operate currently in the country (17 in BiH and 10 in RS, with a share of 70 and 30 percent of the banking system). - The five largest banks represented about half of banking sector assets in 2013. - Interbank linkages are limited; interconnectedness between banks and the insurance sector, as well as between the banks and the RS development bank, is more significant. - Footnote: the first largest banks presented 70 and 80 percent of FBiH and RS banking assets in each entity respectively. ### Ownership of foreign banks and market shares - The largest foreign banks operating in Bosnia and Herzegovina are from Austria and Italy. - Together with Slovenia these banks make up ¾ of banking sector assets in FBiH and half in RS. - Examples of major foreign banks: Raiffeisen, Hypo, Sparkasse (all Austria), Unicredit, Intesa (both Italy), and NLB (Slovenia). - Note: intra-group links often connect BIH subsidiaries to the ultimate owner-bank via different other subsidiaries. - While most foreign subsidiaries have taken a cautious position after the recent crisis, a couple of new foreign banks, albeit small, have been relatively aggressive in expanding their market share. ### Non-banking financial system and infrastructure - The rest of the non-banking financial system is small: - Insurance companies: 5 percent of financial system assets. - Leasing companies, investment funds, and microcredit organizations: 3 percent of financial system assets each. - The share of nonlife insurance (in terms of assets) is below 2 percent of GDP, while life insurance accounts for only 0.3 percent of GDP. - There is one stock exchange in each Entity; capital markets remain underdeveloped. - The real-time gross settlement (RTGS) system settles high-value credit funds transfers and net balances submitted by the giro clearing system (GCS) and card switching network; it also handles large-value payments that stem from the capital markets and international payment clearing services. ### Preconditions for effective banking supervision — A. Sound and Sustainable Macroeconomic Policies - Bank credit to the private sector grew at an average annual rate of around 25 percent over 2003-07. - Credit-to-GDP rose from around 35 to 45 percent over this period. - The CBBH lowered bank high reserve requirements in several steps during the crisis to free-up liquidity. - The 2009 SBA with the IMF, participation in the European Bank Coordination Initiative (EBCI) or “Vienna Initiative,” and the two-step increase of deposit insurance coverage to KM 35,000 (€17,000) helped preserve market and depositors’ confidence. - The Standing Committee for Financial Stability (SCFS) was established; the CBBH is, according to the Law on the Central Bank, in charge of coordination of activities between the two banking agencies. - System-wide NPLs ratios stood at 15.5 percent at end-June 2014, compared to just 3 percent at the onset of the global financial crisis. - The provisions to NPL ratio is at 68 percent. - Sector-wide regulatory capital is at over 17 percent of risk-weighted assets as of end-June 2014. - According to the authorities, only about 1 percent of total loans have been restructured so far. - Footnote: Three small banks were nationalized or liquidated following the crisis; Hypo Alpe Adria Bank was nationalized by the Government of Austria in 2009 and on October 30, 2014, it announced that it will sell its SEE network to U.S. equity fund Advent International and the European Bank for Reconstruction and Development (EBRD) as co-investor. ### Supervision and regulatory reforms — progress and actions - BiH has adopted a strategy to safeguard financial sector stability and plans to adopt banking laws in line with Basel II. - A detailed asset quality review is being conducted for six banks under the enhanced supervision regime. - Vakufska Banka, Hypo Alpe-Adria, Privredna, and MOJA Banka in FBiH have completed the AQRs; Bobar and Banka Srpska’ AQRs in RS are yet to be finalized. - CBBH and both banking agencies, with assistance from IMF and EU, have made progress in drafting new banking laws. ### Key risks to the financial sector - Main risks: slow NPL resolution, high dependence from parent banks, and potential weak demand. - Foreign bank subsidiaries remain reliant on parent bank support, rendering the system vulnerable to external developments. - Monetary and financial conditions have tightened, reflecting lower credit growth and liquidity, and less risk appetite. ### Macroprudential framework and financial stability reporting — B - The macroprudential toolkit is underdeveloped and relies mostly on required reserve management. - The CBBH conducts top-down stress tests on the main financial risks and, jointly with the banking agencies, has developed a methodology to identify systemic domestic banks. - The annual Financial Stability Report, prepared by the CBBH, contains stress test results, FSIs, and financial infrastructure information. ### Legal, judicial, and audit framework — C - Legal impediments in the Law on Obligations and the Law on Protection of Consumers impede banks from transferring non-cancelled NPLs to an entity other than a bank, hindering NPL resolution. - Recommendation: amend relevant laws in each entity to enable all NPLs to be transferred to non-bank entities, subject to safeguards (including consolidated group supervision by banking agencies and maintenance on a credit register). - Absence of an effective alternative to bankruptcy prevents streamlined restructuring, leading to more companies being placed into bankruptcy and a backlog in courts. - Current monitoring and enforcement do not ensure compliance with IFRS; audit public oversight systems are nascent and will take at least three to five years to implement effectively. - Regulatory agencies need to continue monitoring IFRS compliance and hire or train staff in IFRS and at a minimum ISA 700. - Preliminary results point to a decrease in audit quality and numerous instances of non-compliance with ISA and IFRS; contributing factors include downward pressure on audit fees, rapid rotation, and late appointment of statutory auditors. ### Crisis management, recovery, and resolution framework — D - Further progress required to strengthen the framework for recovery and resolution; significant deficiencies remain in resolution powers, institutional responsibility, recovery and resolution planning, and resolution funding. - There is a need for the establishment of a resolution authority and resolution funding; current FBA and BARS powers are insufficient and they are not formally designated as resolution authorities. - No resolution fund exists in BiH other than the deposit insurance fund; open bank resolution of systemically important banks may require funding beyond the deposit insurance fund. - The CBBH has no LOLR facility—prohibited by CBBH law—and gaps remain in the banking crisis resolution framework. - The SCFS provides a formalized coordination framework across agencies. ### Deposit insurance and information sharing — E - The DIA administers a pay-box form of deposit insurance financed by annual levies on banks, supported by a €50 million standby facility with the EBRD. - The DIA has developed infrastructure for an effective deposit insurance framework, including MOUs with the FBA and BARS, regular testing of depositor data, and pay-out procedures. - Current level of funding is sufficient to cover all insured deposits in the small domestically-owned banks. - Information sharing and coordination between the DIA and other safety-net participants need strengthening; the current MoU with the banking agencies is more than ten years old and information is not exchanged automatically. - Recommendation: all problem banks in BiH should be regularly discussed in the SCFS. ### Market discipline and domestically-owned banks — F - Sector-wide indicators appear broadly sound, but pockets of higher vulnerabilities exist among domestic banks: lower liquidity and capital ratios, and large concentration risks. - Asset quality of domestic banks deteriorated more substantially than that of foreign banks; profitability of domestic banks dropped more than foreign banks and capital ratios declined faster. - The AQRs of five domestic banks under enhanced supervision revealed capital shortages, of which only two have been corrected; results of AQRs by reputable external auditors on two domestic banks are long overdue. - Some domestically-owned banks rely heavily on public sector support; in RS the development bank (IRBRS) and six development funds hold sizeable shares and subordinated debt in some domestically-owned banks, provide large credit lines for on-lending, and place deposits in four domestic banks. - Solvency of a number of domestic banks is under severe pressure: - Weak banks faced significantly higher funding costs and catered mostly to sub-par borrowers. - Some have benefited from public sector capital support without diluting existing shareholders, contributing to moral hazard. - Recommendation: authorities should develop, as a high priority, a thorough planning process to facilitate recovery where practicable or implement cost-effective resolution consistent with system stability and protection of insured depositors. - Recommendation: all resolution options should be assessed, including ensuring the technical readiness of the DIA to pay-out depositors promptly. ### Anti-money laundering and terrorist financing — G - The 2009 Mutual Evaluation Report conducted by MONEYVAL identified strategic deficiencies in BiH’s AML/CFT framework, including deficient and inconsistent criminalization of money laundering across state and entity legislation and lack of effective implementation of customer due diligence measures. - BiH agreed to an action plan to remedy these shortcomings; although important progress has been made, notably with the enactment of a new AML law, significant deficiencies remain. - MONEYVAL issued public statements on BiH in June and September 2014, calling upon members to apply enhanced due diligence measures to transactions with persons and financial institutions from or in the BiH. - Further delay in addressing key AML/CFT deficiencies may result in additional scrutiny from the Financial Action Task Force, with potentially greater negative repercussions for BiH, notably on correspondent banking relationships. *Source: _cr15214 - 5. The financial system in Bosnia and Herzegovina is dominated by a moderately (IMF).* ### 28. Timely and effective implementation of the action plan is recommended, notably ### 28. Timely and effective implementation of the action plan is recommended, notably ### Recommendations and immediate priorities - Timely and effective implementation of the action plan is recommended, notably through the enactment of the necessary amendments to the Criminal Code. - Staff also recommends that the authorities conduct a national assessment of the ML/TF risks and develop a national strategy in line with its findings. - Staff further encourages the authorities to promote greater coordination and cooperation amongst State and Entity level agencies. ### Main findings — overview (Federation of Bosnia and Herzegovina) - The system of banking supervision oversight is significantly improved since the last review in 2006, but further enhancements are necessary. - The current Law on Banks has been strengthened after 2006 with regard to transfer of significant ownership, anti-money laundering, consumer protection and provisional administrator. - FBA is developing a new Law on Banks to address deficiencies in supervisory powers, recovery and resolution, and consolidated supervision; these reforms will probably also impact the Law on the Banking Agency. - Regulatory framework broadened by issuance of regulations on corporate governance, credit risk management and capital. - Harmonization in regulation between the entities has been largely achieved and joint planning continues for implementation of additional regulations and operational improvements. ### Responsibilities, independence, accountability, and cooperation (CPs 1-3) - There are clear checks and balances for independence of both supervisory agencies, but the context in which both entities operate could become difficult. - Political economy factors may underlie opaque ownership structures of domestic banks. - Banks and the FBA have trouble identifying ultimate beneficiary owners and their holdings, leading to opaque ownership structures. - Parliamentary proposals to amend the LOBA could compromise operational independence of the supervisor. - The framework for appeals by financial institutions should be strengthened: currently a court may temporarily suspend the decision of the FBA after an appeal or delay its execution, which could be damaging for a sector sensitive to early and timely intervention. - Cooperation and coordination in BiH is very complex due to administrative set-up and may have potential repercussions in times of financial sector stress. - SCFS on the state level and the Committee for Coordination of Supervision of the Financial Sector at the level of the RS seem to have overlapping mandates. - Crucial information (e.g., CAMEL rating) is not always shared with relevant stakeholders (the other banking agency, CBBH, and the DIA) creating information asymmetries. - Development of an integral contingency plan is an encouraging step. ### Ownership, licensing, and structure (CPs 4-7) - FBA does not have a clear picture of the ownership structure of several domestic banks, including identification of the ultimate beneficiary owner and its holdings. - Related party lending and group exposures are not fully identified. - Root cause: licensing and approval process has been mostly formal instead of substantial and without imposing prudential conditions when needed. - Licensing assessments focus on prescribed content rather than assessing criteria of safety and soundness covering suitability, ownership structure, (group) governance (including fit-and-proper of board members and senior management), strategic and operational plans, internal control, risk management and projected financial conditions (including capital base). - Approval of major acquisitions focuses mostly on required documentation and impact on capital position; no explicit assessment whether new acquisition or investment exposes the bank to unnecessary risk, impedes efficient supervision, or whether the bank has sufficient resources to manage the acquisition or investment. - LOB does not have clear distinctions between bank subsidiaries, branches, representative offices and other operational offices and the activities they can engage in. ### Methods of ongoing banking supervision (CPs 8-10) - Ongoing supervision is conducted through a blend of onsite and offsite activities detailed in supervisory manuals. - Annually a supervisory plan is developed for each bank reflecting the bank’s risk profile determined by: - results of offsite analyses and onsite inspections, assigned CAMELS rating, bank’s annual business plan, early warning system (EWS) risk indicators, Uniform Bank Performance Report (UBPR), and other public or confidential information. - Onsite inspections focus on loan portfolio quality, implementation of corrective action, effectiveness of risk management systems and internal controls. - Offsite monitoring performs quarterly analyses on banks and the system as a whole and monitors compliance with corrective action—4/5 rated banks include regular meetings with bank management. - Banks’ risk profile is graded by CAMELS categories: Capital, Assets, Management, Earnings, Liquidity and Sensitivity to market risk. - Rating scale is 1-5 with 5 being the highest risk. - Criteria and numerical rating methodology have been detailed in a regulation and published in the Official Gazette. - A number of prudential ratios and qualitative factors (e.g., quality of risk management) are used; comparison to system averages is factored in. - Currently the “S” is not rated pending issuance of the market risk decision. - FBA collects, reviews and analyzes prudential reports and conducts controls to ascertain accuracy: formal IT controls, substantive controls by off-site, on-site inspections (since 2009 together with IT inspectors) and assessments of compliance by external auditors. - Prudential returns are not comprehensive: FBA does not receive prudential reports on consolidated basis, nor reports on pillar 2 capital, country risk exposure or market risk except foreign exchange positions. - Supervisory board nor the external auditor have to attest the prudential returns. ### Corrective and sanctioning powers (CP 11) - FBA can impose fines, issue orders requiring increases in capital, cease and desist unsafe and unsound practices, impose temporary management and revoke licenses. - Authority to fine individual supervisory board members is limited; fines under administrative procedures are insignificant. - Banking law is currently being re-drafted. - FBA has not developed a remedial action program that aggregates all tools, describes circumstances when they may be applied and outlines benchmarks for applying a hierarchy of actions. - A comprehensive remedial action program would enhance transparency, ensure consistency, provide clear internal guidance and facilitate timely corrective action. - Problem banks may remain in that status for extended periods without defined prospects for recovery or resolution. - Supervising problem banks is labor-intensive and resolution costs increase the longer instability persists. - Authorities face constraints in resolving banks due to inadequate sources of market capital, a weakened economy limiting recovery opportunities, and lack of depositor confidence that may trigger system-wide deposit runs. ### Consolidated and cross-border supervision (CPs 12-13) - Consolidated supervision as a concept and practice has not been implemented by FBA. - No prudential requirements both quantitative and qualitative for consolidated supervision. - Supervisory agencies do not have the supervisory power to intervene in groups. - Need for excellent cooperation and information exchange with Austria, Italy and Russia (beyond formal arrangements), as these countries are the (grand) parents of D-SIB in both the FBiH and the RS. - Recently both FBA and BARS received confirmation from the Austrian supervisor (FMA) that there are no hindrances anymore to formalize and sign the Memorandum of Understanding (MOU). - Agencies should be realistic about the value of the MOU. - Current arrangements with supervisors of Slovenia and Turkey do not address cross-border cooperation and coordination in times of crisis. ### Corporate governance (CP 14) - FBA has issued Decisions on the Diligent Behavior of Members of Bank’s Bodies (corporate governance) and Suitability Assessment of Banks’ Bodies (fit and proper). - Bank compliance would be enhanced by additional guidance on FBA expectations for: - risk appetite statements: quantitative metrics such as value-at-risk, leverage ratio, range of tolerance for problem loan levels, and acceptable stress test losses; and - strategic plans: comprehensive assessment of current and expected risks, state business objectives and how achieving objectives will affect the bank’s risk profile. ### Prudential requirements, regulatory framework, accounting, and disclosure (CPs 15-29) - Major improvement has been made to regulatory risk management requirements. - Areas needing attention: market and country risk, interest rate risk in the banking book and guidance on holistic risk management requirements. - Authorities plan to address these as part of Pillar 2 and ICAAP implementation. - A risk management decision has been drafted providing a bank-wide view and introducing broader risks such as strategic risk. - Enhancements to capital requirements continue with adoption of the Decision on Minimum Standards for Capital Management of Banks and Capital Hedge (Capital Decision). - Being phased-in, enhancements incorporate elements of Basel II and III such as: capital conservation buffers, leverage ratio, elimination of Tier III capital, amortizing revaluation reserves, limiting loan loss reserves to 1.25 percent of Tier II, and stricter definitions of capital elements. - Currently credit risk weighted assets calculated in compliance with most Basel I requirements; weighted operational risk calculated according to the basic indicator approach, largely in compliance with Basel II. - In 2014, amendments and addenda were executed to the Decision on Capital to strengthen capital structure, introduce protective layers for capital conservation, restrain financial leverage, and pursue convergence with Basel III (and adoption of deadlines for harmonization). - Adoption is a transitional solution until full implementation of Basel II/III as per banking agencies’ strategy. - Adequacy of provisioning levels in some banks is questionable and IAS requirements from FBA need to be strengthened. - Onsite inspections and independent reviews identify improper classification of loans and valuation of collateral. - Issuing requirements on haircuts for real estate collateral and guarantees and assumptions for defining impairment would enhance identification of impaired loans and enforcement by FBA. - Related party lending and concentration risk are concerns at many domestic banks; onsite inspections often disclose violations of related and connected party lending limits reflecting internal control deficiencies and poor governance. - The outcome of the AQR raises questions on the quality of financial audits: - Several domestic banks implement IFRS 2009 since this is the last version translated into local language. - Some external auditors base their opinion on the Law on accounting and auditing instead of IFRS, complicating comparability and raising uncertainty about audit quality. - Quality assurance of financial audit is barely developing. - External auditors are appointed yearly with a maximum of five years; agencies do not have the power to rescind an external auditor (they can consent to appointment and refuse an auditor’s report). - Risk that changing auditors every year adversely affects continuity and audit quality; appointing an external auditor for at least three years, together with power to rescind, could improve candor and continuity. ### Anti-money laundering / Counter-terrorist financing (ML/TF) - FBA needs to put more effort into identifying inherent ML/TF risks. - A new law and regulation on AML/TF has been adopted and supervisory processes aligned, but concerns remain: - More attention needed to understand inherent ML/TF risk profile of banks and to make supervisory intensity risk-based. - Follow-up of findings could be strengthened. - Poor feedback loop appears to exist between the FBA and the FID. - Supervision of branches outside the FBiH, but with headquarters inside the FBiH, seems not to be inspected on-site for ML/TF activities. ### Table summary — Key findings (selected Core Principles and comments) - 1. Responsibilities, objectives and powers: Deficiencies in supervisory powers (see details in Appendix). - 2. Independence, accountability, resourcing and legal protection for supervisors: Although there seem to be clear checks and balances for independence, the context in which FBA operates is rather intervened with political economy. Court could too easily suspend FBA decision. - 3. Cooperation and collaboration: Domestic: FBA, BARS and CBBH could exchange more information. Foreign: cooperation with Austria, Italy and Russia is suboptimal. - 4. Permissible activities: LOB does not distinguish clearly between bank branches, representative offices, and operational units. - 5. Licensing criteria: FBA does not have explicit power to set prudential conditions on newly licensed banks. License assessment is mostly formal instead of substantive. - 6. Transfer of significant ownership: Deficiencies in identification of ultimate beneficiary owner. FBA does not have explicit powers to set prudential conditions on transfer of significant ownership. Strengthened requirements of transfer of significant ownership not yet implemented. - 7. Major acquisitions: Assessment of major acquisitions is mostly formal instead of substantial. - 8. Supervisory approach: Annual joint planning by onsite and offsite yields a coordinated approach. - 9. Supervisory techniques and tools: Bank performance reports, early warning system and CAMELS ratings provide risk profile information to calibrate the supervisory scope for each bank. - 10. Supervisory reporting: Prudential return not comprehensive. - 11. Corrective and sanctioning powers of supervisors: Corrective action is required from banks and the banking law is being amended to enhance some powers. The power to fine individual supervisory board members is weak. - 12. Consolidated supervision: Consolidated supervision has not been implemented yet. - 13. Home-host relationships: FBA has not optimal cooperation and information exchange modalities in place with home countries of several D-SIB. - 14. Corporate governance: A set of regulations on corporate governance, suitability and remuneration has been issued in 2013. However, additional guidance on risk appetite statements and strategic planning is warranted. - 15. Risk management process: Risk management regulations for some risks have been issued but are still missing for IRRBB, country risk and market risk. A broader risk management regulation has been drafted covering these areas. - 16. Capital adequacy: Implementation of capital standards will continue to be phased-in and specific target dates have been detailed in regulation. - 17. Credit risk: General requirements and risk management expectations are in the decision on credit risk. - 18. Problem assets, provisions, and reserves: IFRS and a prudential requirement are followed. Collateral is not deducted when determining prudential reserves. Compliance with provisioning requirements is weak in some banks. - 19. Concentration risk and large exposure limits: Concentration limit violations are common in some banks due to poor recordkeeping and related party lending. - 20. Transactions with related parties: Related party regulations establish a broad definition and place strict limits on related party lending. However, related party transactions are an issue at some banks. *Source: IMF staff assessment as presented in the provided chapter content.* ### 21. Country and transfer risks A decision/regulation on country risk has not been ### 21. Country and transfer risks A decision/regulation on country risk has not been issued. Regulation has been drafted. ### Major regulatory gaps and preparedness - Country risk: A decision/regulation on country risk has not been issued. Regulation has been drafted. - Market risk: A decision/regulation on market risk has not been issued and a capital charge for market risk has not been adopted. Regulation has been drafted. - Interest rate risk in the banking book: Interest rate risk regulations have not been issued. Regulation has been drafted. - Liquidity risk: Liquidity risk is closely monitored. - Operational risk: A decision has been issued since 2007 and is effectively supervised. The decision also addresses outsourcing. - Internal control and audit: Recommendation 2006 are implemented. - Financial reporting and external audit: - IFRS 2014 is not fully implemented. - FBA does not have power to rescind external auditor. - AQR questions quality of external audit. - Disclosure and transparency: Disclosure of group structure is weak. - Abuse of financial services: FBA has limited knowledge on inherent ML/TF risk profile of banks. Cooperation between FBA and FID could be enhanced. Cross entity branches seems not to be supervised (on-site) for ML/TF risks. ### Findings for Republika Srpska — accountability, cooperation, and legal framework - Law on Banks: Strengthened after 2006 with regard to anti-money laundering, consumer protection and provisional administrator. BARS is working on a new Law on Banks to address deficiencies in supervisory powers, recovery and resolution, and consolidated supervision. - Regulatory framework: Broadened by issuance of regulations on corporate governance, credit risk management and capital. Harmonization between entities has been largely achieved; joint planning continues for additional regulations and operational improvements. - Independence and conflicts: - Clear checks and balances for independence for BARS, but substantive interdependence between the government and the domestic banking sector could create pressure when addressing non-viability issues. - Government interests may influence resolution decisions beyond depositors, bondholders and shareholders. - Legal protection weaknesses: - Missing legal protection and indemnification for persons appointed by BARS (temporary administrators, liquidators). - Appeal framework weak; courts can suspend BARS decisions after appeal, risking timely intervention. - Coordination and information sharing: - Cooperation and coordination are very complex due to administrative arrangements; overlapping mandates (SCFS on the state level and Committee for coordination on the level of the RS). - Information asymmetry: banking agencies know individual bank conditions but do not fully share CAMEL ratings with each other, the Central Bank, and only partly with the DIA. - Development of an integral contingency plan is encouraging. ### Ownership, licensing, and structure - Ownership transparency: BARS does not have a clear picture of ownership structure of several domestic banks, including ultimate beneficiary owners and holdings. - Related party and group exposures: Not fully identified due to weaknesses in licensing and approval processes. - Licensing assessments: Mostly formal and focused on documentation rather than comprehensive safety-and-soundness criteria (suitability, ownership structure, (group) governance, fit-and-proper, strategic and operational plans, internal control, risk management, projected financial conditions). - LOB (Law on Banks): Does not clearly distinguish branches, representative offices and other operational offices and their permissible activities. ### Methods of ongoing supervision (CPs 8–10) - Supervisory process: Building blocks in place—mix of onsite and offsite activities, risk profiling, CAMELS-based risk ratings, process manuals for onsite and offsite supervision adopted. - Stress testing: BARS updates supervisory strategies using stress test results provided by the CBBH. However, stress testing of individual banks or risks is not incorporated regularly; regulations on banks’ use of stress testing have not been issued. - Offsite/onsite coordination: Close coordination—offsite input into onsite planning, quarterly analytical reports, follow-up by offsite with reporting to onsite. - Prudential reporting: BARS collects, reviews and analyzes prudential reports and conducts controls for accuracy, but reports are not comprehensive: - No consolidated prudential reports (see CP 12). - No reports on Pillar 2 capital (see CP 16). - No reports on country risk exposure (see CP 21). - No market risk reports except foreign exchange positions (see CP 22). ### Corrective and sanctioning powers (CP11) — observations and recommended program elements - Current powers and limitations: - BARS can demand controlling owners to inject additional capital, but options are limited when owners cannot inject capital. - Selling shares is difficult given economic conditions; resolving small banks risks system-wide deposit runs. - Development bank has been placing subordinated debt to improve regulatory capital. - Risks to deposit insurance fund magnified if controlling owners remain after refusing to inject capital. - Need for a remedial action program: - Existing regulations should be amended to create a comprehensive remedial action program, clarify hierarchy of enforcement actions, introduce new tools, and provide enforceable guidance on corporate governance and risk management. - Transparency: BARS should publish situations triggering supervisory action and describe supervisory actions and subsequent responses if institutions fail to act. - Internal procedures: Should identify officials authorized to initiate enforcement, define the process from field inspector level through review and finalization, and establish processing timeframes. - Annual report: Publish remedial actions taken (institution names may be withheld) to enhance accountability and defend court cases. - Suggested enforcement triggers and measures (as compiled in guidance): - Capital falling below certain levels with actions varying by trigger points and management response. - Recurring inaccurate regulatory filings or delinquencies could result in daily fines until corrected; current fines could be increased based on recurrence and significance. - Inadequate operating policies/processes (corporate governance, risk management) should be defined as unsafe and unsound practices with possible sanctions and fines. - Violations of law (e.g., related party dealings) should carry automatic fines on bank and individuals depending on gravity. - Banks falling into low CAMELS categories should face enhanced supervision and be required to have recovery and resolution plans with strict timeframes to avoid extended periods in categories 4 and 5. - Significant financial penalties should be applied to management, supervisory board members and controlling owners (would require amendments to the law). - Strict guidelines for ending temporary administration, potentially including clearing problem assets and injecting capital prior to ending administration. - Accountability and oversight: - Detailed remedial program enhances accountability and requires documentation when action is not taken. - BARS’ internal audit or internal control system should review the Remedial Action Program and its implementation. ### Consolidated and cross-border supervision (CP 12–13) - Consolidated supervision: Not implemented by BARS—no prudential requirements (quantitative or qualitative) for consolidated supervision and no supervisory powers to intervene in groups. - Cross-border cooperation: Need for strong cooperation and information exchange with Austria, Italy and Russia (beyond formal arrangements) because these countries are parents of D-SIBs in both the FBiH and the RS. - MOUs: Recent confirmation from the Austrian supervisor (FMA) removed hindrances to formalize and sign the MOU; practical expectations for the MOU should be realistic. ### Corporate governance (CP14) - Decisions issued: BARS has issued Decisions on Diligence of the Bank’s Management Body (corporate governance) and on the Assessment of Suitability of Members of Banks’ Management Bodies (fit and proper); regulations are comprehensive. - Additional guidance: Guidance for developing a risk appetite statement and relating it to the business plan would enhance compliance, given governance issues in many banks. ### Prudential requirements, accounting, disclosure (CPs 15–29) - Risk management: Significant improvement in risk management requirements but work remains on market, country, and interest rate in the banking book risks. - Holistic risk management: Issuing a decision on holistic risk management requirements and risk aggregation and relating it to risk appetite and business plan would enhance effectiveness; guidance could be developed with Pillar 2 and ICAAP implementation. - Basel II/III strategy and implementation: - BARS adopted a strategy for implementing Basel II/III. - Credit risk weighted assets are calculated in compliance with most Basel I requirements. - Weighted operational risk is calculated according to the basic indicator approach, significantly in compliance with Basel II. - In 2014, amendments and addenda to the Decision on Capital aimed to strengthen capital structure, introduce protective layers for capital conservation, restrain financial leverage, and converge with Basel III requirements; adoption is transitional until full implementation of Basel II/III in line with the strategy. - Provisioning and accounting: - IAS 39 and prudential provisioning and loan classification standards are followed by banks. - Banks required to follow IFRS, but BARS also requires prudential provisioning based on loan classification (primarily time in delinquency)—prudential requirements serve as a floor to provisioning levels. - Onsite inspections frequently identify provisioning deficiencies and related concerns about adequacy. - Supervisory requirements for collateral valuation, impairment definition and loss assumptions are needed to encourage conservative benchmarks for objective evidence of impairment. - Additional training for supervision staff required to enforce provisioning and review banks’ assumptions under an IAS environment. - Related party and concentration violations: - Onsite inspections frequently identify related party and concentration violations, reflecting deficiencies in corporate governance and risk management and acting as early indicators of future insolvency if not addressed. - Powers of BARS to effect significant fines on supervisory board members through an administrative process are limited; misdemeanor channel is cumbersome and court decisions unpredictable. - External audit quality and auditor appointment: - AQR outcome raises questions on the quality of financial audits of banks. - Several domestic banks implement IFRS 2009 (last translated version). - Some external auditors base opinions on the Law on accounting and auditing instead of IFRS, complicating comparability and raising audit-quality uncertainty. - Quality assurance of financial audit is barely developing. - External auditors are appointed on a yearly basis with a maximum of five years; agencies lack power to rescind an external auditor (they can consent to appointment and refuse the report). - Yearly change of auditor may harm audit continuity and quality; appointing an external auditor for a minimum of three years together with the power to rescind could improve incentives, continuity and audit quality. ### Anti–money laundering/terrorist financing (AML/TF) - Inherent ML/TF risk identification: BARS needs to put more effort into identifying inherent ML/TF risks. - Legal/regulatory alignment: New law and regulation on AML/TF recently adopted; supervisory processes aligned with these. - Remaining weaknesses: - More attention needed to understand inherent ML/TF risk profiles of banks and to make supervisory intensity risk-based. - Follow-up of findings should be strengthened. - Feedback loop between BARS and FID is insufficient. - Supervision of branches outside the FBiH, but with headquarters inside the FBiH, appears not to be inspected on-site for ML/TF activities. ### Table 3 — Republika Srpska: Summary of Key Findings (selected entries) - CP 1 Responsibilities, objectives and powers: Some deficiencies in supervisory powers. - CP 2 Independence, accountability, resourcing and legal protection for supervisors: - Although there seems to be clear checks and balances for independence the context in which BARS operates could become difficult because of substantive interdependence between government and domestic banking sector. - Legal protection is inadequate. - Court could too easily suspend decision of BARS. - CP 3 Cooperation and collaboration: - Domestic: Cooperation between FBA, BARS and CBBH is not optimal. - Foreign: Cooperation with Austria, Italy and Russia is not optimal. *Source: _cr15214 - 21. Country and transfer risks A decision/regulation on country risk has not been issued. Regulation has been drafted.* ### 4. Permissible activities LOB does not have a clear distinction between bank ### _cr15214 - 4. Permissible activities LOB does not have a clear distinction between bank ### Key findings (Core Principle comments) - 4. Permissible activities LOB does not have a clear distinction between bank branches, representative offices and operational units. - 5. Licensing criteria BARS does not have explicit powers to set prudential conditions on newly licensed banks. License assessment is mostly formal, instead of focusing on substance. - 6. Transfer of significant ownership Deficiencies in identification of ultimate beneficiary owner. BARS does not have explicit powers to set prudential conditions on transfer of significant ownership. Strengthened requirements of transfer of significant ownership not yet implemented. - 7. Major acquisitions Assessment of major acquisitions is mostly formal instead of focusing on substance. - 8. Supervisory approach A blend of onsite and offsite activities provides BARS with an assessment of the bank’s risk profile. - 9. Supervisory techniques and tools A number of supervisory tools, including risk rating the banks’ risk profile and detailed performance reports, help supervisors to determine bank soundness. - 10. Supervisory reporting Prudential reports not comprehensive yet. Supervisory board does not attest the prudential return. - 11. Corrective and sanctioning powers of supervisors The ability to fine supervisory board members is limited by the current low fines that can be imposed under administrative powers. - 12. Consolidated supervision Consolidated supervision has not been implemented. - 13. Home-host relationships BARS has not established an optimal cooperation and information exchange with home country D-SIBs. - 14. Corporate governance Governance regulation was issued in 2013. However, additional guidance on business planning and risk appetite statements is warranted. - 15. Risk management process A risk management decision from a bank-wide perspective has not being issued. Decisions have also not been issued for IIRBB, country and market risks, but have been drafted. - 16. Capital adequacy Current plans are to implement certain requirements from Basel II/III and specific benchmark dates are detailed in regulation. - 17. Credit risk The credit risk decision was updated in 2011 and provides requirements of the supervisory board to set standards. - 18. Problem assets, provisions, and reserves A dual standard is in place as banks must comply with IAS and also with a prudential (regulatory) provisioning standards. The prudential standard sets a floor and may result in banks having to increase provisions. - 19. Concentration risk and large exposure limits Concentration violations recur in some banks. - 20. Transactions with related parties Related party lending violations are frequently addressed in examination reports. The violation warrants strong supervisory response, including fines. - 21. Country and transfer risks Provisioning guidelines are not in place. - 22. Market risk Regulation has been drafted and will be implemented as part of the capital regulation - 23. Interest rate risk in the banking book Regulations have been drafted on interest rate risk in the banking book. - 24. Liquidity risk Comprehensively through balance sheet ratios. - 25. Operational risk Guidelines issued on outsourcing and general operational risk. - 26. Internal control and audit Recommendations from 2006 are implemented. - 27. Financial reporting and external audit IFRS 2014 is not fully implemented. BARS does not have power to rescind external auditors. AQRs question the quality of external audits - 28. Disclosure and transparency Disclosure of group structures is weak. - 29. Abuse of financial services BARS has limited knowledge on inherent ML/TF risk profile of banks. Cooperation between BARS and FID could be enhanced. Cross entity branches seems not to be supervised on-site for ML/TF risks. ### Detailed recommended actions (Table 4: Federation of Bosnia and Herzegovina and Republika Srpska) - Principle 1 - Strengthen supervisory powers (see details in CP 1 of appendix 1 and 2). - Adopt new LOB (see details in CP 1 of appendix 1 and 2). - Principle 2 - Adopt staggered appointment members MB, director and deputy director. - Develop more granular qualification criteria. - Strengthen legal protection for BARS - Adopt appeal provision that prevent court from suspension supervisory decision. - Principle 3 - Enhance information sharing between CBBH, BARS and FBA. - Align coordination between CB, BARS and FBA - Principle 4 - Provide a clear definition for bank branches, representative offices and other operational units and the activities they can conduct. - Principle 5-7 - Include supervisory powers in primary law that can impose prudential conditions for license and transfer of ownership. - Make the assessment of license and other approvals more substantive (assessing criteria instead of checking documents). - Identify those banks that have opaque ownership structure, make ownership structure transparent including identifying the ultimate beneficiary owners and its holdings. - Principle 10 - Develop prudential returns on consolidated basis, pillar 2, country risk exposures, market risk and restructured loans. - Principle (11) - Develop a remedial action program focusing on new tools and earlier step-up enforcement and heavier fines to expedite corrective action. - Increase supervisory administrative authority to impose fines on supervisory board members and increase the amount of the fines. - Improve ability of supervisors to enforce corporate governance and risk management decisions by increased recognition of supervisory judgment in law. - Prompt recovery and resolution actions to avoid non-viable banks from operating for extended periods. - Principle 12 - Adopt consolidated supervision including definitions, prudential requirements and adopt extra supervisory powers. - Principle 13 - Address cross border cooperation and coordination in times of crisis in current and new MOUs. - Principle (14) - Issue additional guidance on issues to address in strategic plans and risk appetite statements by banks. - Principle (15) - Issue a risk management decision based on a bank-wide approach. And consider risks created by poor strategic planning and reputation risks. Implement the draft regulation on risk management. - Principle (18) - Issue prudential guidance to improve provisioning under IAS. - Principle (19/20) - Enhance enforcement and increase penalties to encourage banks to improve internal controls and compliance. - Principle (21-23) - Implement draft decisions to address country, market and interest rate in the banking book risks. - Principle 27 - Implement IFRS 2014 and let audit opinion refer directly to IFRS. - Change law so that BARS does not appoint auditor for one year but for minimal three years; BARS has the power to rescind the appointment of an auditor. - Improve interaction with external auditor. - Evaluate quality external audit and system of quality assurance (follow-up for banking agencies and Ministries of Finance). - Principle 28 - Enhance disclosure information on group structures, including ultimate beneficiary owner. - Principle 29 - Determine the inherent ML/TF risk. - Enhance cooperation with FID - Coordinate AML/TF on-site supervision of cross border branches. *Source: _cr15214 - 4. Permissible activities LOB does not have a clear distinction between bank (IMF country report content).* ### Appendix I. Federation of Bosnia and Herzegovina: Principle- ### Appendix I. Federation of Bosnia and Herzegovina: Principle-by-Principle Implementation Review ### A. Supervisory powers, responsibilities and functions (Principle 1) - Legal framework for banking supervision (narrow view) consists of: - Law on the Central Bank - Law on the Banking Agency (LOBA) - Law on Banks (LOB) - CBBH objective: “to achieve and maintain the stability of the domestic currency (article 2).” CBBH does not have an explicit objective to achieve and maintain financial stability in BiH. - LOBA (adopted 1996; Official Gazette No 9/96, 27/98, 20/00, 45/00, 59/02, 13/03, 19/03, 47/06, 59/06, 48/08, 34/12 and 77/12) establishes FBA purpose: “to improve safety, quality and legal performance in a market-oriented and stable banking in the FBiH.” - LOBA amendments: 2008 (supervision of micro credit organisations and leasing companies); 2012 (article 19 confidentiality harmonized with EU directive; Ombudsman established—article 4a-h). - LOB adoption and amendments: - Adopted 1995 (Official Gazette No. 2/95, 9/96 and 25/97), superseded by new LOB in 1998 (Official Gazette No. 39/98, 32/00, 48/01, 27/02, 41/02, 58/02, 13/03, 19/03, 28/03 and 66/13). - LOB amendments: 2011 (consumer protection—article 98); 2013 (significant ownership—articles 2, 23, 24; AML—article 47; provisional administrator mandate—article 53.2; creditor’s priorities—article 63). - Working groups (2014) preparing a new LOB in FBiH and RS. - Gaps in FBA statutory supervisory powers (identified; see cross-references to CPs): - No explicit power for consolidated supervision (CP 12). - No power to impose prudential conditions on licenses and other approvals (CP 5–7). - No explicit power to obtain periodic reporting and on-site inspection information on: 1) names and holdings of significant shareholders; 2) names and holdings of persons who exert controlling influence; 3) identity of beneficiary owners of shares held by nominees, custodians or other vehicles (CP 6). - No power to sanction/fine supervisory board members and significant owners or remove ownership rights if necessary (CP 11). - No power to rescind the external auditor (CP 27). - No explicit power to launch bank resolution (CP 8). - Prudential requirements (capital, related lending, large exposures, major acquisitions, transfer of significant ownership) are often set in secondary regulation rather than primary law—reduces legal certainty and enforcement power. - Recommendations (Principle 1 summary): - Strengthen supervisory powers listed above. - Adopt new LOBA. - Adopt new LOB. ### B. Independence, accountability, resourcing and legal protection (Principle 2) - Legal independence: - LOBA article 5: “The FBA is fully autonomous and independent.” - Governance: - Managing Board (MB): five members, appointed for a period of five years (article 8); MB supervises FBA operations, passes statute, general acts, financial plan and reports (article 9). - Director duties: issuing/revoking licenses, undertaking measures towards banks, MCO and leasing companies, appointing staff, advocating in court (article 11). Director and deputy participate in MB without voting rights (article 10). - Statute adoption: MB adopts statute with parliament’s approval (article 20) — may slow statute changes. - Appointment process: - MB members appointed by Parliament of the FBiH for five years on reconciled proposal of government (article 8). - Selection committee of five members appointed by government; public announcement; interviews; ranked list submitted to government. - Qualification criteria in LOBA: “citizens of the Federation with a high reputation in financial expertise and high moral qualities (article 14).” - Practical note: selection committee’s additional criteria not transparent; ethnicity reportedly influential in practice. - MB renewal pending (last appointment was six years ago in 2008). Director and deputy also appointed by parliament for five years; appointments pending since 2008 due to political timing. - Continuation clause: members continue until parliament makes new appointments (article 12). - Removal grounds (article 15): convicted for a felony making them undignified; unable to perform duties due to health; authorized state organ determines involvement in serious infraction affecting interests/authority of FBA. - Accountability and reporting: - Director and deputy responsible to Parliament (article 9). - Annual report to Parliament through government within three months from end of reporting year; report must be approved by MB (article 27). - 2012 LOBA amendment abolished right to release director/deputy if they reject adoption of annual report (IMF-supported). - Legal protection (article 5 LOBA): members, director, deputy, employees, provisional and liquidation administrators, and other recommended/appointed persons cannot be prosecuted or held civilly liable for actions conducted in good faith within their authority; FBA reimburses legal costs for actions in good faith. - Litigation: FBA has twenty six pending court proceedings (5 micro credit organizations, 1 leasing company, 20 banks). Some court decisions have suspended FBA actions against micro credit organisations; risk courts may suspend critical FBA decisions (see CP 11). - Funding and resourcing: - Directly financed by financial sector via fixed and variable fees: - Fixed fee per bank: KM 20.000. - Percentage of total assets: 0.015 percent. - Variable fees per approval (licenses, appointments, transfers). - No government funding; salaries regulated by LOBA and FBA rulebook; employees not subject to Law on Civil Services. - Budget under pressure due to increased responsibilities (supervision of foreign exchange operations, MCO, leasing) and reluctance to raise fees (pressure on interest rates). - Training needs: IFRS, Basel, corporate governance, risk management, enforcement, ICT. - Comments: - Operational independence supported by law and budget model, but political economy creates practical risks to independence (political influence, opaque ownership, custody accounts). - Courts can suspend FBA decisions; appeal provisions should be strengthened to prevent suspension of corrective actions. - Recommendations (Principle 2): - Adopt staggered appointments for MB, director and deputy director. - Make selection committee qualification criteria transparent and adopt in LOBA. - Adopt provision preventing courts from suspending corrective action decisions by FBA. - Implement risk-based supervision to save resources and build capacity. - Invest in staff quality: corporate governance, risk management, enforcement, IFRS, Basel, ICT. ### C. Cooperation and collaboration (Principle 3) - Domestic counterparties and institutional landscape: - State level: Fiscal Council of BiH (FCBiH), CBBH, Deposit Insurance of BiH (DIA), Association of Banks (ABBiH), Financial Intelligent Unit as part of the SIPA (FIUBiH). No resolution authority yet. - Federation: Minister of Finance (FMOF), Insurance Agency (FIA), Securities Exchange Commission (FSEC). - RS: Minister of Finance (RSMOF), Insurance Agency (RSIA), Securities Exchange Commission (RSSEC). - Key bilateral/multilateral arrangements (selected): - FBA–BARS: Agreement on Cooperation (June 2003); Cooperation Agreement (March 3, 2006). - FBA–BARS–CBBH: Memorandum and principles of Cooperation (June 12, 2008); Internal guidelines for stress tests (March 2013); Memorandum on Methodology for Determination of List of SIB in BiH (June 30, 2013). - FBA–BARS–DIA: Letter of Agreement (October 7, 2003) — DIA membership prerequisite: minimum rating of 3 on composite basis, with no individual rating component of 5. - FBA–BARS–DIA–FCBiH: Memorandum and Establishment of Standing Committee for Financial Stability (December 22, 2009). - FBA, BARS, DIA, CBBH, FCBiH: Contingency plan (2014): work in progress; objective to define measures and procedures to safeguard banking system stability. - FBA–FIA (July 19, 2004); FBA–SIPA (October 1, 2007); FBA–FSEC (October 7, 2014); FBA–ABBiH–others (2007). - Foreign cooperation: - FBiH banking system: 17 banks; 10 owned by foreign banks (9 foreign banking groups, 1 non-banking group). Foreign parents domiciled in Slovenia, Turkey, Austria, Italy and Russia. - Signed MOUs: Bank of Slovenia (November, 2001); Agency for Regulation and Supervision of Turkey (June, 2009). - MOUs in place or partial with Serbia (July, 2004), Croatia (November, 2003), Montenegro (March, 2007), SEE MoU (February, 2008). - No formal MOUs with Austria and Italy historically due to confidentiality alignment issues; LOB amended September 2012 to align with EU directives—expectation MOUs to be formalized. - No arrangements with Russia (authorities state Russia does not have policy of information exchange). - Protection of confidential information: - LOBA article 19 restricts disclosure except to specified bodies; condition for exchange is a signed agreement with confidentiality obligations and use for supervisory/administrative/court proceedings only. - Incident in RS: inspection minutes were given to prosecutor then leaked and broadcast—highlighting confidentiality risk; no MoU between FBA and prosecutors’ office in FBiH. - Practical cooperation observations and gaps: - FBA shares information with BARS, CBBH and DIA to a certain extent, but does not share CAMEL ratings routinely: - DIA does not receive continuous CAMEL ratings; developed own rating methodology. - FBA does not share CAMEL ratings with BARS or CBBH (CBBH receives quarterly financial indicators). - FIU does not give feedback on suspicious transaction reports to FBA—FBA lacks information on AML risk landscape (CP 29). - No clear crisis coordination ownership; overlapping committees and unclear responsibility for financial stability. - Contingency planning at state level is in progress; preconditions for macroprudential policy referenced. - Recommendations (Principle 3): - Simplify arrangements between different bodies to enhance effectiveness of cooperation, especially in crises. - Conduct crisis simulation exercises covering state and entity level events. - FBA should share CAMEL ratings with BARS, CBBH and DIA; determine when to share with SCFS; set up joint rating system with BARS and DIA. - FBA should address lack of information feedback from FIU. - Formalize MOUs with supervisors of Austria and Italy. - Determine whether risks from lack of adequate arrangements with home supervisors (e.g., Russia) are acceptable or should be mitigated. ### D. Permissible activities and name usage (Principle 4) - LOB does not define the term “bank” explicitly; article 1 describes scope: regulates entities engaging in “receiving money deposits and extending credits, as well as other business operations in accordance with this Law.” - No clear, comprehensive definitions on bank subsidiaries, branches, representative offices or other operational units inside/outside FBiH; different articles give direction but are not comprehensive. - Article 5 LOB: bank with headquarters outside FBiH may receive deposits and extend credit through a branch. - Article 4 LOB: representative offices permitted but not allowed to do banking activities. - Article 36 LOB: bank branches and subsidiaries cannot be established without written authorization of FBA. - Article 15 LOB: includes foreign bank branches. - Use of the word “bank” and deviations limited to institutions licensed and supervised by FBA (articles 2 and 3); LOB states “no one shall engage in the business of receiving money deposits.” - Licensing: bank obtains legal entity status upon court registry entry (article 13); publication required on FBA and CBBH websites (article 16). - Activities list: article 39 LOB lists permitted activities; 2013 amendment added factoring, forfeiting and insurance mediation services. - The license shall specify authorized banking activities (article 14). - Recommendation (Principle 4): - Improve and harmonize definitions of branches, representative offices and operational units (including Brcko District and outside BiH) in LOB and align with BiH and EU Directives. - Clearly define activities and prudential requirements for different operational units (see CP 5 on licensing). ### E. Licensing criteria and transfer/major acquisitions (Principles 5–7) - Licensing authority and criteria (Principle 5): - FBA acts as licensing authority in practice; LOBA article 4 states “a task of the FBA is to issue licenses” but LOBA does not explicitly grant power to set criteria, approve/reject licenses, or impose prudential conditions/limitations on newly licensed banks. - LOB requires application documents (article 7): founding contract, qualification/experience of board members, amount of capital, business plan, list of owners. - Instruction for licensing and other approvals (strengthened February 2014) details required documentation and covers subsidiaries, branches, representative offices and other operational units. - Article 9 LOB: license granted if amount KM 15 million has been paid, FBA confident bank will comply with law/regulations, and projections for future financial condition documented. - Suitability (fit-and-proper) requirements: Instruction (articles 107–125) prescribes documents but not detailed suitability criteria; separate “Decision on suitability assessment bank’s bodies” and “Decision on diligent behavior” describe good reputation, experience, conflicts, independence. - Assessment practice: License Department conducts assessments; last bank license assessment in 2007; assessments historically compliance-based; strengthened criteria since February 2014. - Precondition gap: heavy dependence on bank-provided due diligence; limited access to cross-jurisdictional criminal/administrative records; no regional database or Interpol connection for supervisory antecedents. - Transfer of significant ownership (Principle 6): - Article 2a LOB defines significant ownership as interest of at least 10 percent of aggregate voting right. - Article 21 (amended August 2013): acquisition/increase of thresholds 10 percent, 33 percent, 50 percent and 66.7 percent require FBA approval; applicants must submit information per Instruction. - Instruction (articles 87–93; since February 2014) specifies documents for legal and private persons (registration, audited financial statements, strategic orientation, curriculum vitae, tax liabilities, certificate of non-conviction, etc.). - Grounds for rejection (article 23 LOB updated August 2013; article 89 Instruction): poor financial condition of applicant, lack of competence/experience/trustworthiness, unfair competition/dominance, unreliable/uncheckable information, no proof of origin of money. - FBA lacks explicit power to impose prudential conditions/ ring-fencing on transfer of significant ownership; FBA can modify/reverse changes that occurred without notification/approval (article 67.7 LOB). - FBA receives quarterly reports listing 15 largest shareholders; Central Registry contains 10 largest shareholders. Despite reporting, identification of ultimate beneficial owners remains difficult—custody accounts and opaque structures impede detection of related party lending and group exposures. - August 2013 amendment (article 24 LOB) obliges significant owners to notify FBA; not yet effective in practice. - Recommendations (Principle 6): - Expand definition of significant ownership and define “controlling interest.” - Change thresholds from 10, 33, 50 and 66.7 percent to 10, 20, 30, 50 percent to align with EU requirements. - Strengthen power to impose prudential conditions (ring-fencing). - Adapt prudential reporting and on-site inspection powers to obtain names/holdings of significant shareholders, controlling influencers and identity of beneficial owners held via nominees/custodians. - Implement targeted inspections to identify opaque ownership structures, ultimate beneficial owners, related parties and group exposures and mitigate risks. - Major acquisitions and investments (Principle 7): - Article 22 LOB: FBA must approve significant bank ownership share in another legal entity; banks required to seek approval for participations exceeding 5 percent of bank’s core capital or when sum of participations exceeds 20 percent of core capital. - Participation limits: - Single participation cannot exceed 15 percent of bank’s core capital. - Sum of participations cannot exceed 50 percent of core capital. - Participation in non-financial legal entity cannot exceed 10 percent of core capital; sum in non-financial legal entities cannot exceed 25 percent; participation in non-financial legal entity cannot exceed 49 percent ownership of that entity. - Loans to these legal entities are considered participations and bound by participation rules. - Instruction (articles 94–97) prescribes documentation for approvals (court registration, financial indicators, reflection in net capital position) but does not set explicit risk assessment criteria (e.g., whether acquisition exposes bank to unnecessary risks or impedes effective supervision; no cross-border acquisition criteria). - Article 26 LOB: status changes, mergers, acquisitions or divisions require FBA authorization; article 27 and Instruction article 101 set refusal grounds: resulting bank fails minimum capital, inadequate competence/experience of board, unreliable information. - Recommendations (Principle 7): - Establish approval criteria and definitions for types/amounts of acquisitions/investments that need prior approval or notification. - Explicitly state power to approve/reject and impose prudential conditions in LOB and LOBA. - Prescribe LOB criteria that acquisitions/investments may not expose bank to undue risks or impede supervision. - Prescribe cross-border acquisition/investment criteria (flow of information for consolidated supervision, host supervision efficacy, ability to supervise on consolidated basis). - Require notification for acquisitions/investments not needing prior approval. ### F. Supervisory approach, techniques, reporting and enforcement (Principles 8–11) - Supervisory approach (Principle 8): - Integrated process: onsite inspections + offsite analysis using regulatory reports and other documentation. - Offsite supervision: Decision on banking supervision requires ongoing offsite monitoring and periodic (quarterly) analysis of each bank and overall banking system; methodology in Manual for Offsite Supervisors; CAMELS-based component assessments and composite rating. - Systemically Important Banks (SIB) methodology (CBBH with agencies, 2013): factors weighted — size 30 percent, interconnectedness 25 percent, complexity (securities activities) 15 percent, and level of total loans, deposits, loans to trade sector, and loans to individuals at 7.5 percent each. - Annual submissions required from banks: strategic business plans, annual budget, capital plan (used to analyze business focus, strategic direction and parent support for subsidiaries). - Manuals: Decision on Bank Supervision and Procedures; Manual for Offsite Supervisors; Manual for Onsite Supervisors; Criteria for Internal Rating (CAMELS). - Offsite contributes FSIs and stress test inputs to CBBH Financial Stability Division. - Supervisory techniques and tools (Principle 9): - Onsite examination types: full, targeted (risk-based), compliance examinations, execution of orders; primary focus on asset quality and credit risk management; also liquidity, capital management, information systems, compliance, consumer protection. - Rating system: CAMELS with scores 1–5; 4 or 5 = problem banks under heightened oversight with formal measures; 3 = supervisory concern; 1–2 = sound. - Powers under law: - Withdraw banking licenses (article 17). - Appoint interim administrators (article 53). - Impose monetary fines (article 65). - Issue orders, warnings and decisions (article 67). - Corrective measures: warnings, additional reporting, written orders, conditions on operations, penalties, suspensions of board/management, suspension of voting rights, forced sale of shares, license conditions, appointment of advisors or external auditors paid by bank, temporary administrators, license suspension. - Appeals do not stay execution of corrective measures; administrative suits do not stay execution either. - Onsite/offsite coordination: annual plans, quarterly operational plans, pre-inspection offsite inputs, post-inspection follow-up and monitoring. - Supervisory reporting (Principle 10): - LOBA article 23 requires banks to submit reports and information per CBBH regulations. - Prudential reports prescribed in “Decision on the form of reports which banks submit to the banking agency” and two amendments; required reporting includes: capital, asset classification, non-performing assets, credit risk concentrations, 15 largest shareholders, related party transactions, liquidity, foreign currency risk, effective interest rate. - No prudential reporting on consolidated basis (CP 12), nor on country risk, market risk (except FX positions) and Pillar 2 of Basel 2 (CP 16). FBA aims to develop consolidated and additional reports, including on restructured loans. - Submission formalities: supervisory board list submitted in original paper signed by chairman (article 1.2a); internal auditor certifies reports (article 1.2b). No fine specified for inaccurate filings. - Accuracy controls: programmatic cross-table checks; substantive offsite supervisor checks; onsite cross-checks (credit files vs general ledger vs credit registry); since 2009 IT supervisors included in inspection teams; external auditor long-form review per decision on audit program (not same standard as financial statement audit opinion). - Corrective and sanctioning powers (Principle 11): - Early Warning System (EWS) used to identify problems early and initiate meetings, written warnings, additional reporting or orders. - Problem banks (CAMELS 4 or 5): special supervision strategy; Program for Business Rehabilitation and Bank Recovery required (minimum contents: Capital Management Plan, Non-Performing Assets Management Plan, strengthen risk function, improve credit risk management, reorganize budgets, define responsibilities, management/supervisory board changes, internal control improvements, independent internal audit, information system, etc.). - Escalation: failure to implement corrective measures or recurrences within 6 months -> FBA may prohibit controlling owners from exercising rights and require disposal of shares; third recurrence within six months may lead to license suspension. - Enforcement observations: - Law authorizes fines but authority to fine individual supervisory board members not clearly stated. - No coherent remedial/enforcement program published with benchmarks and transparent escalation triggers; suggested enhancements include: - Publish remedial action program with clear triggers (capital thresholds, recurring inaccurate filings, inadequate policies/procedures including corporate governance and risk management, law violations such as related party dealings). - Apply significant financial penalties to management, supervisory board members and controlling owners (requires legal amendments). - Strict guidelines for ending temporary administration (problem asset clearing, capital injection pre-conditions, avoid approvals based on future commitments). - Examples of enforcement actions: - Two small institutions required management replacement after poor CAMELS ratings. - Supervisory board members replaced in two cases (dating back to 2005). - Bank A (rating 4): rehabilitation and recovery plan required; capital ratio of 14.5 percent and NPL and risk management plans; condition improving. - Bank B: placed under interim administration and sold to investor group. - Fines imposed for late filings. - Recommendations (Principles 8–11): - Formalize and publish a graduated remedial action program with clear benchmarks, escalation, delegated responsibilities and reporting. - Amend law to enable fines and sanctions against individual supervisory board members and controlling owners; clarify personal liability. - Increase fines and consequences for recurring inaccuracies and serious unsafe and unsound practices. - Monitor and report remedial actions in annual report (without necessarily naming institutions). ### G. Consolidated supervision and home-host relations (Principles 12–13) - Consolidated supervision (Principle 12): - Consolidated supervision concept and practice not implemented by FBA. - No definitions or prudential requirements (quantitative or qualitative) for consolidated supervision. - FBA not empowered to review overseas activities, visit foreign offices, meet host supervisors, limit group activities or locations. - FBiH banking structure: 17 banks; 10 foreign-owned (9 foreign banking groups and 1 non-banking group); FBA is host supervisor for foreign-owned banks (including four D-SIBs). - Domestic banks often have opaque group structures; activities may include leasing, micro finance, insurance and non-financial participations—underscores need for consolidated supervision. - FBA performs limited review of parent activities using information from home supervisors (CP 13). - Planned: adopt consolidated supervision in new LOB and grant powers to require consolidated reporting and information from entities in a group and intervene in group. - Recommendations (Principle 12): - Define entities under consolidated supervision (banking groups, financial conglomerates, financial holdings). - Set quantitative prudential requirements on consolidated basis: capital adequacy, large exposure limits, related party limits, liquidity. - Set qualitative requirements: prudential reporting (regular and ad-hoc), fit-and-properness of owners, board members, senior managers; risk management. - Establish powers to intervene in governance, risk management, capital, liquidity and group structure. - Home-host relationships (Principle 13): - FBA is host supervisor for foreign-owned banks; formal MOUs exist with Bank of Slovenia and Turkish supervisor. - No formal MOUs historically with Austria and Italy due to confidentiality misalignment (LOB amendment September 2012 aligns LOB with EU Directive; expected formalization). - No arrangement with Russia (authorities state Russia does not exchange information). - Existing MOUs do not explicitly address cross-border cooperation/coordination in crisis situations. - Recommendations (Principle 13): - Renew and extend MOUs with home supervisors (Austria, Italy and others) to address cross-border cooperation and crisis coordination. - Address home/host issues beyond MOUs via SCFS strategic action plans and continuous assessment/mitigation of net risks. ### H. Prudential regulations and requirements: corporate governance, risk management, capital (Principles 14–16) - Corporate governance (Principle 14): - LOB Chapter III (a) defines supervisory board and management responsibilities. - Article 31j defines supervisory board competences: supervise bank operations and management; adopt management reports, internal/external audit reports; submit annual report to general meeting; appoint management and external auditor; appointment of remuneration and nomination committees; propose profit distribution; approve transactions with assets 15 percent to 33 percent of accounting value of entire assets; establish internal control/audit; establish provisions for loan losses; approval for issuance of new shares up to one third of existing class; approve internal acts, business policies; establish committees and decide matters not delegated elsewhere. - 2013 FBA decisions effective January 1, 2014: - Decision on Diligent Behavior of Members of Bank’s Bodies: conduct rules, conflict of interest prevention/management, specialized committees, professional/ethical standards, corporate social responsibility. - Decision on Suitability Assessment of Members of Bank’s Bodies: obligations for initial and continuous fit-and-proper assessments. - Decision on Remuneration Policy and Practices: compensation structure to be harmonized with risk-taking strategy and long-term bank interests; covers all components and key categories whose actions affect bank risk profile. - Corporate governance reviews conducted via offsite and onsite activities; FBA targets banks without majority shareholders (widely held domestic banks) where governance problems and capital deficiencies are more frequent. - Comments and recommendations: - Clarify personal liability of supervisory board members in law/regulation to enhance enforcement. - Provide additional training to FBA staff on governance compliance reviews and enforcement involving supervisory board members. - Provide guidance on risk appetite statements (quantitative metrics: VaR, leverage ratio, tolerance ranges for problem loans, acceptable stress losses) and strategic plan content aligning risk appetite and business objectives with risk management framework. - Risk management process (Principle 15): - FBA decisions cover credit, liquidity, market, operational, IT, outsourcing risk, AML/CFT; banks required to adopt adequate risk programs/policies proportionate to size and complexity and update them annually or semiannually. - Banks required to set authority levels, conservative concentration limits (individual clients/depositors, related groups, industry, geographic region, counterparties by rating, country classes, securities types, maturity and instruments). - Supervisory evaluation includes whether internal policies are comprehensive and aligned with strategic plan and capital support; banks submit three-year capital adequacy maintenance plans annually. - Stress testing: liquidity stress requirement exists; no general stress testing requirements issued by FBA. - FBA has drafted a risk management decision to establish bank-wide governance and an independent risk management function (identification, assessment, monitoring, capital planning and reporting) pending industry consultation. - Gaps: detailed regulations/procedures lacking for interest rate risk in banking book, market risk and country risk; capital requirements not yet applied to these risks (see CP 16, 19, 22). - Capital adequacy (Principle 16) — description of laws and decisions (partial extract provided): - LOB Article 20 prescribes minimum shareholders' and net capital: 15 million KM. - Article 41 sets minimum net capital at 12 percent of risk-weighted assets; not less than 1/2 of capital must be core capital. - Decision on Minimum Standards for Capital Management of Banks and Capital Hedge: - Maintains minimum capital adequacy ratio at 12 percent and introduces additional capital requirements and some elements of BASEL III. - Article 4: banks must adopt a capital maintenance program to ensure capital adequacy adjusted for changing conditions. - Article 6: board must develop procedures to manage level and composition of capital; management must develop capital projections for three years, identify internal and external capital sources and factors that may cause need to raise capital. - Articles 8–11: define core capital inclusions/deductions and supplementary capital items. - Article 12 defines leverage ratio; Articles 13–14 define risk assets and off-balance sheet conversion ratios; Article 18 provides method of capital adequacy calculation. - Note: Appendix III lists main risk-weight differences between Basel I and current FBA weights (appendix content not included in extract). - Observations and gaps: - FBA has adopted capital guidance with some Basel III elements but maintains a minimum capital adequacy ratio of 12 percent (higher than Basel II/III minimums). - Further detail and implementation of Pillar 2, consolidated capital adequacy, prudential deductions and capital treatment for market/country/IRRBB risks noted as areas for development (cross-references to CP 12, CP 16, CP 19, CP 22). *Source: Appendix I. Federation of Bosnia and Herzegovina: Principle-by-Principle Implementation Review (IMF staff report extract)._cr15214 - Appendix I. Federation of Bosnia and Herzegovina: Principle-* ### introduction of capital buffers, limiting the profit distribution if the bank does not have the ### _cr15214 - introduction of capital buffers, limiting the profit distribution if the bank does not have the ### Capital buffers, leverage ratio, and related transitional measures - Introduction of capital conservation buffer at the rate of 2.5 percent of risk-weighted assets. - Countercyclical capital buffer which, if necessary, may be prescribed under a special FBA decision. - Buffer for systemic risk that, if necessary, may be prescribed by FBA under a special decision. - Banks should meet the requirements for capital buffers with the balance as of December 31, 2016, at the latest; the buffer will not be shown by the bank as special category of core capital, but it will be taken into account as part of the calculation of regulatory capital. - Regulatory financial leverage ratio introduced as a ratio of the core capital and total assets; banks required to maintain the leverage ratio at least 6 percent, starting on December 31, 2015. - Additional implementation adjustments and transitional provisions: - Implementation of the capital conservation buffer as of December 31, 2016; - reducing the amount of loan loss reserves included in supplemental capital to 1.625 percent by December 31, 2015, and 1.25 percent by December 31, 2016; - allowable revaluation reserves to be amortized and extinguished by December 31, 2016; - implementation of requirement to depreciate subordinated debt in the last 5 years to maturity date (December 31, 2015); - amount of bank’s supplementary capital cannot be: - more than one-half of the core capital, beginning on December 31, 2015, whereby the core capital referred to in Article 8 is at least 8 percent of total risk of assets, - more than one third of the core capital, beginning as of December 31, 2016, whereby the core capital is at least 9 percent of total risk of assets, - ensuring and maintaining leverage ratio, of at least 6 percent, starting on December 31, 2015; - banks which, due to changes in the structure of the core and supplementary capital become noncompliant with concentration limits will need to correct the violation by December 31, 2015; - calculation of capital requirements for market risk will apply when the secondary regulations (1/1/2017) that prescribe capital requirements and methodology for calculating capital requirements for market risk enter into force. - Overall, the capital standard retains differences from Basel I, such as; fixed assets carrying a risk weight of 0. - Comment: A capital charge for market risk is not in place. The capital adequacy regime currently in place is a hybrid of Basel I and incorporates the definitions of core capital elements from Basel III. ### Limitations on profit distribution, dividends and bonuses - Temporary limitations for payment of dividends and bonuses introduced by FBA in 2013 and included in the new Decision (in force in 2014). - Based on article 11 of the new Decision: - the bank may not pay dividends in cash for common shares to its shareholders, bonuses from the bank's profit, nor purchase own shares, unless own funds are at least 14.5 percent and if core capital of the bank in article 8 is at least 8.5 percent of risk-weighted assets. ### Supervisory framework, CAMELS and additional capital authority - FBA rates capital adequacy based on a number of factors outlined under the CAMELS rating system: quality of capital, risk profile, risk management systems, trend in problem assets, compliance with laws and regulations, quality of earnings and access to capital markets. - FBA has authority to impose additional capital requirements for banks, higher than the regulatory minimum, depending on the assessment of their risk profile and/or the effectiveness of their established risk management process. - Banks file quarterly reports that are reviewed offsite on the capital structure, total risk-weighted assets and capital ratios to determine compliance with FBA requirements and implementation of internal capital adequacy programs. - Onsite supervision focuses on: - whether the policies and procedures are adequate and whether they are implemented; - the capital level and review of accuracy of the calculation of capital and compliance with the minimum capital requirements; - the level, structure and quality of capital of the bank and assessment of capital strength and adequacy in relation to the existing risks and future plans; - scope and adequacy of the audit function in relation to the capital of the bank, and compliance with the law, decisions and other regulations. - FBA gives recommendations or remedial measures in cases when there are deficiencies in the policies, practices, procedures or the internal control and internal audit system, or if violations of rules and regulations are identified. ### Credit risk (Principle 17) — standards and supervisory practices - The Decision on Minimum Standards for Credit Risk and Asset Classification Management in Banks sets standards and criteria for banks to follow in credit risk management activities. - Responsibilities (Articles 3 and 4): - management and the supervisory board to develop and implement programs, policies and procedures for credit risk management (lending, portfolio management, and collateral management). - supervisory board responsible for completeness, continuity, and effectiveness of the credit risk management function, management and maintenance of prudent practices in determining acceptable risk levels, and ensuring implementation of adequate monitoring and audit. - Required contents of credit programs/policies include: - policies for identifying credit risk and managing that risk; - procedures for evaluation of loan applications and/or proposals for other placements, investments and contingent off-balance sheet liabilities; - loan underwriting procedures, required documentation, monitoring and/or follow up supervision, reporting and collection; - written loan policies containing at minimum: 1. the approach and/or the philosophy of credit risk which defines (manages) the entire scope of risk that the bank is assuming; 2. the types of loans the bank will fund; 3. a decision-making authority for lending and creating reserves and managing write-offs; and 4. adequate (reasonable) and prudent portfolio concentration limits, in compliance with FBA regulations and at least for: individual clients, group of related clients, single industry branch, geographic regions, foreign countries and group of countries, types of securities, maturity and form of instruments. - Offsite supervision based on quarterly reports focuses on asset quality and adequacy of loan loss provisioning, impaired assets, credit risk concentration, sector exposure, impact of the credit risk on other segments of operations, compliance with legislation and decisions. - Onsite credit reviews scope and frequency based on the bank’s risk profile, risk appetite, systemic importance and capital strength; onsite work assesses policy adequacy, compliance, internal controls and audit, asset quality, adequacy of loan loss provisioning and credit risk concentration; supervisors initiate corrective actions where appropriate. - Comment: A detailed decision has been issued covering credit risk management and the duties of the Board; compliance is monitored through onsite and offsite supervision. ### Problem assets, provisions and reserves (Principle 18) — classification and provisioning rules - Article 3 and Article 4 (Decision on Minimum Standards for Credit Risk and Asset Classification Management) require supervisory board and management to adopt comprehensive credit risk management programs and monitor asset mix and quality; provisions must be adequate to cover unrecoverable debts and/or write-offs. - Banks must establish their own asset classification system (article 12) and classify loans per articles 15, 16 and 22. - Article 15: loans classified into five categories: performing, special mention, substandard, doubtful and loss. - Article 16: factors to be considered when classifying loans in each category. - Article 22: specifies the level of provisioning required for each loan classification category. - Article 14 Paragraph 5 defines impaired assets: principal and/or interest past due for over 90 days (classified in categories C, D, and E). - Article 13 Paragraph 3: small loans (10,000 KM or less) not individually classified must be reported to monitor performance, delinquencies, restructuring and write-off. - Article 13 Paragraphs 6 and 7: require detailed records on classified and nonperforming loans reviewed at least quarterly. - Banks must adopt and implement internal methodology for identifying impaired loans in compliance with IAS/IFRS and accounting and auditing regulations; minimum standards defined in the Instructions on the Amended Manner for Creating, Recording and Reporting on Loan Loss Provisions. - Chapter III (Instructions) defines default status when: - the bank believes the borrower is unlikely to fully settle his liabilities towards the bank, regardless of ability to collect on collateral, including partial or full loan write-off, loan refinancing due to financial hardship and borrower liquidation or bankruptcy; - the borrower is overdue more than 90 days. - Loan classification categories and prudential provisioning percentages: - category A - good assets: 2 percent; - category B – special mention assets: 5–15 percent; - category C – substandard assets: 16–40 percent; - category D – doubtful assets: 41–60 percent; and - category E – loss: 100 percent - Category B includes loans 90 days delinquent, Category C includes loans up to 180 days delinquent and Category D up to 270 days. - Banks assess value of financial resources and contingent liabilities under IAS 39 and 37; provisions and reserves are expenses in the income statement, while regulatory assessment of potential loan losses is of accounting nature. Differences where regulatory requirements call for higher amounts are recognized in the calculation of capital as missing provisions for loan losses; supervisors take corrective actions if provisions are insufficient. - Onsite examinations use predetermined samples to examine individual exposures and determine adequacy of reserves; if significant increase of impaired assets is identified, the bank must develop a plan for impaired asset management and submit regular reports about its implementation. FBA convenes banks as needed to discuss implementation and organization of collection units. - Article 6 Paragraph 1 Item 1 (Decision on Minimum Scope, Form and Contents of the Program and Report on Economic-Financial Audit in Banks): external auditor must give an assessment of the bank’s asset quality in line with the Decision on Minimum Standards for Credit Risk and Asset Classification Management; once a year the supervisor receives the economic-financial audit report and accompanying findings. - In 2013, FBA adopted decisions for detailed examinations of assets of 4 banks conducted by foreign audit companies; the review resulted in the banks increasing their reserves for loan losses. - Comments and supervisory observations: - Concern that provisioning levels at some banks are inadequate, particularly as estimated by banks for impaired loans under IAS. - Currently banks required to provision based on both IAS and prudential standards; prudential categories use delinquency thresholds (Category B: 90 days; Category C: up to 180 days; Category D: up to 270 days). - As highlighted in 2006 BCP review, the terms of delinquency are too long and provisioning ranges too wide but provide a floor and cross-check to reinforce provision levels established under IAS. - Adjustments to capital for inadequate prudential provisions are not transparent in IAS published financial statements. - Recommended supervisory actions: issue supervisory standards to ensure conservative assumptions for defining impaired loans; provide training to FBA staff on IAS (assumptions on impairment, discounting to present value methods, reviewing collateral valuations); issue guidance on standards for real estate valuations and haircuts (selling and foreclosure costs, current market situation, instructions to appraisers); consider impact of law on guarantor protection in setting provisions as the law limits access to guarantees. ### Concentration risk and large exposure limits (Principle 19) — standards and responsibilities - The FBA adopted the Decision on Minimum Standards for Risk Concentration Management in Banks, setting standards for banks to implement policies for minimizing credit risk in operations (article 2). - Article 4: bank management responsible to ensure implementation of limits on credit risk concentrations in line with the law, the decision, the program and policies adopted by the supervisory board. - Management responsibilities include, at minimum, ensuring implementation of concentration limits consistent with supervisory requirements. *Source: IMF staff summary of Decision texts and supervisory practices as presented in the referenced IMF country financial sector assessment content.* ### 1. create and propose program, policies, plans and procedures to the supervisory ### _cr15214 - 1. create and propose program, policies, plans and procedures to the supervisory ### Responsibilities of bank management and supervisory board - Management must: - create and propose program, policies, plans and procedures to the supervisory board; - implement the program, policies, procedures and other regulations of a bank related to credit risk concentration and ensure that their implementation is monitored and controlled within the Law, this Decision, the program and policies; - ensure the implementation and development of specific reporting systems on credit risk concentration of the bank following the elements approved by the supervisory board; - maintain systems providing overview and classification of information regarding credit risk exposure of a bank to single counterparties or group of connected counterparties, by type of loan, industrial concentration, geographical regions, type of collateral and financial guarantors; - at least every three months, report to the board and FBA in detail about significant risk concentrations, that is about VIKR, their components and form. - Article 3, paragraph 2, item 2 of the Decision on Minimum Standards for Risk Concentration Management in Banks: the supervisory board is required to adopt written policies and procedures addressing concentration risk management, and capital needs related to concentrations. - Article 4 of the decision: bank’s management must ensure limitation of credit risk concentrations in accordance with the Law, the program and policies of the supervisory board. - Article 5: total credit exposure of the bank to a single counterparty or group of connected counterparties is the total of outstanding credit and off-balance-sheet commitments to lend. ### Legal limits, collateral and classification - The Law on Banks and the Decision on Minimum Standards for Banks’ Risk Concentration define the basic credit limit of 40 percent of total core capital of the bank. - Collateral and coverage requirements: - All amounts of 5 percent up to maximum of 25 percent of core capital of the bank have to be collateralized. - Amounts over 25 percent of core capital of the bank have to be covered with cash deposits and immediately marketable collateral of high quality (first-class collateral). - Limit for unsecured loans is 5 percent of core capital. - Article 14 of the Decision on Minimum Standards for Credit Risk and Asset classification Management in Banks defines first-class collateral as cash, government securities or precious metals (20 percent margin) pledged to and under the control of the lending bank. ### Definition of group of connected counterparties and grounds for identification - Article 42, Paragraph 3 of the Law on Banks: two or more borrowers shall be considered a “group of connected counterparties” where their interrelations make it likely that exposure to the group poses a single risk to the bank. - Article 6, paragraph (1) of the decision on concentrations: two or more beneficiaries represent “group of connected counterparties,” if, due to their interrelations, bank’s exposure toward them represents a single exposure to credit risk, that is if one of them, or all of them have direct or indirect possibility of control, i.e., influence over another, in case of financial difficulties of one of them or several of them, it caused or could cause financial problems for the others. - Grounds for identification of groups of connected counterparties: 1. same owner and/or co-ownership of the legal entity; 2. ownership and/or co-ownership of a spouse or persons who live in the same household, or have related or mutual investments; 3. mutual members of the supervisory board and/or management; 4. cross guarantees; 5. direct production and/or commercial and/or financial (directly business) relation and interrelation. ### Reporting, supervision and enforcement - During onsite inspections the following aspects are checked: - compliance with legal restrictions; - quality of adopted internal policies relating to the management of credit risk concentrations; - monitoring and compliance with the adopted internal limits; - quality of the records on connected parties and bank related parties; - reports submitted to the management and the supervisory board regarding concentrations. - The FBA has the authority to require additional capital to address high concentration risks. - Article 4, paragraph 2, item 5 of the Decision on Minimum Standards for Risk Concentration Management in Banks: quarterly, the banks must report to the Board and FBA in detail on significant concentrations. - The onsite supervision examines the mode of operation of the information systems for identifying, managing and reporting in relation to risk concentrations. - Offsite supervisors assess risk concentration at the level of individual banks and at the level of banking system, can issue warnings to individual banks, and in case of breach of legal limitations impose remedial measures. - Banks submit regular quarterly data on sectoral structure of the loans with the amounts of provisioning and reports on the currency structure of loans. - Some banks with increased risk concentrations are obliged to submit to FBA quarterly reports on new exposures exceeding KM 500,000. ### Large credit exposures and system limits - A large credit exposure is defined as credit to single counterparties or group of connected counterparties amounting to more than 15 percent of the bank’s core capital. - The bank’s total aggregate outstanding principal amount of all large credit exposures may not exceed the equivalent of 300 percent of the bank’s core capital. - Comments: concentration violations are often encountered in the domestic banks, mostly because of reductions in capital attributed to loan losses and declining profitability and in other instances due to improper recordkeeping and related party borrowing. - Ongoing regulatory adjustments: - A review of existing laws and regulations regarding concentrations and large exposures, as well as reconciling existing limits with limits according to international regulatory framework is underway. - The amendments to the Law on Banks will bring limits in line with international standards by limiting the maximum exposure to single counterparties or group of counterparties to 25 percent of the core capital of the bank (instead of the current 40 percent). - There is also ongoing preparation of a draft Decision on Large Exposures of Banks. - Regulations being developed will stipulate an obligation and criteria for implementation of bottom-up stress testing by the banks. ### Transactions with related parties — definitions and supervisory expectations - Principle 20 Transactions with related parties: supervisor requires banks to enter into any transactions with related parties on an arm’s length basis; to monitor these transactions; to take appropriate steps to control or mitigate the risks; and to write off exposures to related parties in accordance with standard policies and processes. - Article 2a of the Law on Banks defines related parties as two or more legal entities and/or natural persons who individually or jointly have: - direct or indirect control of a bank’s supervisory board, management, or a significant ownership interest; or - by mutual agreement act in concert to create a significant ownership Interest in order to affect the operations of a bank. - Article 46, paragraph 2 of the Law on Banks defines entities related to the bank as the following: 1. Chairman and members of the supervisory board, members of the management, members of the audit board and members of their immediate family within the third degree of consanguinity or marriage, or persons who are living in the same household, or who have interconnected or joint investments; 2. Individuals with significant ownership interest in the bank and members of their immediate family within the third degree of consanguinity or marriage, or persons who are living in the same household, or who have interconnected or joint investments; 3. Legal entities holding any common shares, preferred shares or any voting rights in the bank; 4. Legal entities in which the bank holds significant ownership interest; 5. Legal entities in which significant ownership interest is held by same legal or natural person holding significant ownership interest in the bank; 6. Legal entities in which the holder of significant ownership interest, a member of the supervisory board or management is one of the persons mentioned under items 1 through 5 of this paragraph. *Source: _cr15214 - 1. create and propose program, policies, plans and procedures to the supervisory* ### 7. Related parties as defined in article 1, paragraph 2 of this Law, and the related parties of ### _cr15214 - 7. Related parties as defined in article 1, paragraph 2 of this Law, and the related parties of ### Definition of related parties and related party transactions - Related parties can include the bank’s subsidiaries, affiliates, and any party (including their subsidiaries, affiliates and special purpose entities) that the bank exerts control over or that exerts control over the bank, the bank’s major shareholders, Board members, senior management and key staff, their direct and related interests, and their close family members as well as corresponding persons in affiliated companies. - Related party transactions include on-balance sheet and off-balance sheet credit exposures and claims, as well as dealings such as service contracts, asset purchases and sales, construction contracts, lease agreements, derivative transactions, borrowings, and write-offs. - The term transaction is interpreted broadly to include transactions entered into with related parties and situations where an unrelated party with whom a bank has an existing exposure subsequently becomes a related party. ### Regulatory limits and capital treatment for related party exposures - Loans to related parties are subject to limits: - Transactions with individuals (natural person) are restricted to up to 1 percent of a bank’s core capital and with all individuals in total of up to 10 percent of bank’s core capital. - Related legal person limit is 25 percent. Both limits are in the aggregate. - Article 6 of the Decision on Minimum Standards for Risk Concentration Management in Banks with Bank Related Parties: in a group of related parties, a total credit exposure to single counterparties is the sum of credit exposures to all of the bank related parties. - Article 10 of the Decision on Minimum Standards for Capital Management of Banks and Capital Hedge: deduction items in calculating capital adequacy comprise all receivables from shareholders with significant ownership interest in the bank (over 10 percent of voting shares) that were approved contrary to the Law, FBA regulations and business policy, as well as all large exposures of the bank to a credit risk (over 15 percent of the amount of the bank’s core capital) to shareholders with significant ownership interest in the bank, made without prior consent of FBA in writing. - Article 46, Paragraph 1 of the Law on Banks: banks cannot offer related parties more favorable conditions than to any other non-related party. ### Governance and approval requirements for related party transactions - Banks may perform business transactions with related parties only with approval granted by the supervisory board or other officials in charge of approving such transactions, appointed by the supervisory board; related-party members do not have the right to participate in the voting and approvers must have access to all relevant information when deciding. - Article 31-k of the Law on Banks: the chairman and members of the supervisory board may not make decisions on issues that concern relationships of the bank and other legal entities in which the chairman or member of supervisory board shall have direct or indirect financial interest. ### Supervisory findings and comments on enforcement - Related party lending and concentration risk are concerns at many domestic banks. - The FBA’s ability to enforce compliance with related party regulation is hampered because supervisory board members are not subject to fines from the FBA. - The banking law does not provide the FBA with sufficient power to fine and sanction supervisory board members and controlling owners. ### Country and transfer risk (Principle 21) — description, findings, and supervisory action - Existing regulatory framework does not explicitly set requirements for banks concerning country and transfer risk; no obligation for banks to adopt policies and procedures in this area. - Partial incorporation exists in: - Decision on Minimum Standards for Bank Capital Management and Capital Hedge (when using risk-weighted assets for capital adequacy calculations). - Decision on Minimum Standards for Credit Risk Management and Asset Classification in Banks (treatment of first-class secured assets and liabilities; establishing limits on concentration by geographical region, country of origin or groups of countries; grouping of asset items). - Compliance with these decisions is regularly monitored within onsite and offsite supervisory processes as part of capital adequacy assessment. - As part of drafting Pillar 2 regulations, the FBA is reviewing options to require country risk and transfer risk management either via a new Decision on Risk Management or amendments to the existing Decision on Minimum Standards for Credit Risk and Asset Classification Management in Banks, planned to be completed by the end of 2014. - The FBA monitors and banks report on concentrations. - Comment: existing regulatory requirements only partially treat country and transfer risk; regulations have been drafted to address country and transfer risk management in the process of determining compliance with capital requirements. ### Market risk (Principle 22) — description, findings, and implementation timetable - Decision on Minimum Standards for Market Risk Management in Banks (2007) defines minimum standards; created in accordance with the Amendment for Capital Requirements that Include Market Risk, of November 2005. - Implementation was repeatedly extended due to changes in international regulatory framework and low market risk in FBiH banks. - Regulatory market risk requirements are being included in the FBA Strategy and the prepared draft Decision for Calculating Capital of Banks; implementation planned to begin on January 1, 2017, applying a standardized approach for capital requirements. - Comment: the 2007 decision has not yet been implemented; a new decision on bank capital calculation is being prepared with planned implementation from January 1, 2017. ### Interest rate risk in the banking book (Principle 23) - Existing regulatory framework does not explicitly establish requirements for interest rate risk in the banking book. - The Decision on Minimum Standards for Market Risk Management in Banks includes obligations for measuring risk related to changes in interest rates, but it is not binding for banks. - A team has been established to draft a decision on interest rate risk management in the banking book to set minimum requirements for interest rate risk management, reporting, and stress testing. - Comment: regulatory work is underway to develop requirements on IRRBB and harmonize with international standards and Pillar 2; a draft risk management regulation will address IRRBB. ### Liquidity risk (Principle 24) — requirements, limits, reporting, supervision, and planned Basel III measures - Decision on Minimum Standards for Bank’s Liquidity Risk Management: supervisory board responsible to ensure a bank has and implements an adequate liquidity risk management program and liquidity policy; management prepares and proposes program and policy; at least quarterly reports to the supervisory board; contingency plans required; identification of sources and volume of liquidity funds; appointment and prompt notification to FBA of person responsible for liquidity management; adequate information systems; internal control and internal audit supervision of liquidity management. - Article 6 limits for maturity matching of financial assets and liabilities: - invest at least 85 percent of funds with maturity date of up to 30 days in placements with maturity date of up to 30 days; - invest at least 80 percent of funds with maturities of up to 90 days in placements with maturity date of up to 90 days; - include at least 75 percent of sources of funds with maturity of up to 180 days in placements with maturity date of up to 180 days. - Ten-day minimum liquidity requirement: - maintaining average ten-day minimum liquidity in cash funds of at least 10 percent of short term liabilities, taking into account that the level of cash funds cannot be less than 5 percent. - FBA enforcement: can mandate corrective action, introduce additional limitations, or order stricter limits on maturity matching. - Reporting obligations to FBA: - Reports on liquidity position every ten-day period; - Maturity matching of assets and liabilities (monthly report). - Sectoral context: no FBiH banks have bank subsidiaries in other countries; some are members of international bank groups and apply parent bank Basel principles. - Required contents of bank liquidity policies (Articles 5, 6 and 9) include but are not limited to: - (1) structure (type) of bank’s assets and liabilities; - (2) large liabilities items, especially deposits and depositors; - (3) structure of stable and unstable liabilities, especially deposits and depositors; - (4) liabilities with renegotiated maturity and where further renegotiation is expected; - (5) price structure and stability of liabilities, especially depositors; - (6) currency structure of assets and liabilities; - (7) available regional and global market sources; - (8) identify sources and volume of liquid funds necessary for continuous operations, noting reserve requirements at the Central Bank are extraordinary and temporary; - (9) rely on stable sources of funds, or contractual maturity dates; - (10) provide diversified sources of funds by maturity, type and number of clients, market and instruments; - (11) appoint competent and responsible persons for liquidity matters and ensure internal control/internal audit coverage, including subsidiaries; - (12) define business policy including planning reliable funding for development and minimizing structural maturity mismatches; - (13) regularly prepare contingency plans for emergency situations and liquidity shocks. - FBA monitoring: offsite supervision analyzes daily, ten-day, and monthly reports; issues warning letters and meetings if negative trends identified; may order corrective actions, more frequent reporting, and schedule targeted onsite inspections when limits are breached. - Onsite inspection reviews internal documents, funding contracts, internal audit findings, management reports, minutes, ALCO Committee materials, plans and projections, reporting accuracy, IT support per the Onsite Supervision Manual. - CAMELS liquidity assessment factors include: - adequacy of liquidity sources for current and future needs; - availability of assets convertible to cash without excessive losses; - access to money and cash markets and other cash sources; - degree of diversification of funding and various balance sheet and off-balance sheet items; - degree of reliance on short-term volatile funding, including short-term loans and brokerage deposits; - trend and stability of deposits; - ability to sell securities and asset "buckets"; - supervisory board and management ability to identify, measure, monitor and control liquidity, including effectiveness of liquidity strategy, reporting systems and contingency plans; - compliance with laws and regulations; - impact of other risks (credit, legal, market, operational, etc.). - Comment: as part of implementing Basel III, the FBA will analyze the existing framework and adopt the liquidity coverage ratio—LCR, and the Net Stable Funding Ratio, NSFR, and require regular liquidity stress tests by banks. ### Operational risk (Principle 25) — framework and minimum standards - Decision on Minimum Standards for Operational Risk (OR) Management in Banks prescribes minimum standards and criteria a bank is required to apply. - Article 3: a bank must establish a system for operational risk management that, as a minimum, includes (text continues beyond provided excerpt). *Source: IMF country report content excerpt.* ### 1. policies and procedures for OR management which will provide: ### _cr15214 - 1. policies and procedures for OR management which will provide: ### Definition of Operational Risk - The Committee has defined operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. The definition includes legal risk but excludes strategic and reputational risk. - 36 - BOSNIA AND HERZEGOVINA - 82 ### Required policies and procedures for OR management 1. policies and procedures for OR management which will provide: - (a) identification of the existing OR potential sources and sources that may arise from introducing new business products, systems, or activities; - (b) measurement of OR, by accurate and timely assessment of that risk; - (c) continuous control of OR which provides maintenance to a level that is acceptable to the bank's risk profile, its reduction and its reduction to a minimum; - (d) continuous monitoring of OR by analysis of the situation, and of changes and trends in the bank's exposure to that risk, and - (e) establishment of minimum capital adequacy for the protection of losses arising from OR (hereinafter. 2. clearly defined lines of authority and responsibility in the process of assuming and managing OR; 3. a system that ensures that all bank employees are familiar with their responsibilities in the process of OR management; 4. a system for regular reporting to the supervisory board (and the bank's management Board on the functioning of the system for managing OR; and 5. the obligation of a periodic review and the duty of the bank's supervisory board (NO) that, at least annually carries-out an analysis and assessment of the adequacy of the established system for managing OR. ### Specific risk areas to be identified (in accordance with Article 4) 1. inadequate information and other systems in the bank; 2. disruption in operations and malfunctions in systems such as failures related to information technology, telecommunication problems, work disruptions, etc.; 3. problems of adequate integration or sustainability of information and other systems in circumstance of developing a network of different organizational units and/or status changes of the bank; 4. illegal and inappropriate conduct of bank employees, such as fraud and unauthorized access to accounts of the clients, misuse of confidential information, giving false or inaccurate information about the condition of the bank, non-prompt performance, errors in data entry, non-compliance with good business work practices, etc.; 5. actions or inaction that may or have caused court and other legal actions against the bank; 6. external illegal acts, such as robbery, unauthorized entry into the database of the bank, including unauthorized use of ATM machines, unauthorized transfer of funds, illegally obtaining bank documents, etc.; *Source: _cr15214 - 1. policies and procedures for OR management which will provide:* ### 7. damage to physical assets and events that cannot be predicted, such as natural and ### _cr15214 - 7. damage to physical assets and events that cannot be predicted, such as natural and ### Operational risk — framework, capital, and onsite inspection findings - The Bank allocates capital for operational risk based on the basic indicator approach (BIA), and records all losses and creates a database pertaining to that. - Through onsite inspections, the FBA assesses whether banks have an appropriate framework for operational risk (OR) management, including: - banks' appetite for risk, risk profile, market and macro-prudential conditions; - assessment and application of policies and procedures for identifying, measuring, managing and monitoring OR exposure; - defined organizational lines of authority and responsibility for taking over and managing OR; - existence and work of an appropriate body monitoring OR indicators; - methods of collection and classification of data, functioning of information support, database of damages - historical data, maturity and scope, analyses of scenarios; - quality, frequency and content of communication with competent authorities; - methods of management - reduction, alleviation and prevention of OR; - new products and risk assessment, capital requests for the OR budget and reporting; - employees' training, role of internal auditing, impact and reporting to groups. - The Decision on Minimum Standards of Management of Outsourcing requires banks to provide a procedure for conducting and managing outsourcing and related risks. - Mandatory elements and topics defined in the Decision on Outsourcing include: - Concept of outsourcing; Outsourcing conditions; Internal regulations; System of risk management related to outsourcing; Responsibilities of the supervisory board; Responsibilities of management of the bank; Program and policies for risk management of outsourcing; Contractual relation of the bank and service providers; Data access; Quality management; Notifications to the FBA; Auditing of outsourced activities. - Article 6 obliges ex-ante evaluation of outsourcing impact on: financial results, expenses, solvency, liquidity and the bank's capital, the bank's risk profile, quality of service and the bank's reputation, continuity of business, level of difficulties and time necessary for choosing an alternate service provider or returning outsourced services to within the bank. - Management and monitoring of outsourcing risks are defined in Articles 9, 10, and 11; effective control in Articles 16 and 23; emergency plan elements in Article 18 Item 11 and Article 22; Decision on Minimum Standards of Information System Management in Banks in Articles 28–30; mandatory service-level agreement elements in Article 14. - Targeted onsite inspections verify compliance with outsourcing and information system management standards. Minor irregularities prompt recommendations; major non-compliance leads to orders with deadlines. - Comment: A draft Decision on Calculating Bank Capital includes capital requirements for operational risk to use the standard approach in addition to the BIA; the draft aligns with the EU regulatory package (CRR/CRD) as much as possible given B&H market specificity. The draft will start to be effective from January 1, 2017. ### Internal control and internal audit (Principle 26) - Principle: supervisors determine banks have adequate internal control frameworks, including delegation arrangements, separation of functions (committing the bank, paying funds, accounting), reconciliation processes, safeguarding assets, and independent internal audit and compliance to test adherence. - Legal and regulatory framework: - LOB article 31 j assigns supervisory board responsibility for internal controls and internal auditing. - FBA Decisions: Decision on Minimum Standards for Internal Control in Banks; Decision on Minimum Standards for Internal and External Auditing in Banks. - Decisions require a system of internal control and independent internal audit in all organizational parts (Decision on Minimum Standards for Internal and External Auditing in Banks, articles 3 and 5; Decision on Minimum Standards for Internal Control in Banks, article 2). - FBA assessment practice: - Reviews supervisory manual on internal audit and internal control and inspection reports. - Assesses elements including delegating authorities, separation of functions, reconciliation processes, and safeguarding assets. - Comments: No comments with regard to internal control and internal audit. ### Financial reporting and external audit (Principle 27) — findings and recommendations - Principle: supervisors determine banks maintain adequate records, prepare financial statements in accordance with internationally accepted accounting policies, publish information reflecting financial condition and performance, and have adequate governance and oversight of external audit. - Legal and regulatory framework: - LOB article 48: banks and subsidiaries must maintain accounts and prepare annual financial statements in accordance with law, international standards, and FBA regulation (IFRS and IASB guidance referenced per Law on Accounting and Auditing article 33). - Law on Accounting and Audit article 37: the person authorized to represent the legal person (practically the management board) is held responsible for the financial statement. - Law on Accounting and Audit article 53: external auditor shall opine whether financial statements fairly present the bank's financial situation and whether statements are prepared in accordance with IAS and IFRS. - Decision on minimum scope, form and content of the program and report on economic–financial audit requires audits be performed in accordance with law, accounting standards, and banking regulations. - Implementation and practice: - Banks started implementing IFRS in 2010 after translation of IFRS 2009 into Bosnian. Since 2009 there has not been an update of the IFRS translation. - Several domestic banks implemented IFRS 2009 and not IFRS 2014; some foreign banks implemented the actual IFRS as part of larger groups. - In 2013 two external auditors of three domestically owned banks based their opinion on the Law on Accounting and Auditing instead of IFRS; four external auditors of 14 banks base their audit opinion on IFRS. - Only 6 auditor firms have permission to audit banks (big four plus two domestic audit firms) out of a total of 102 audit firms. - FBA practice: appoints the auditor on a yearly basis with a maximum term of five year; FBA may reject audited financial statements (article 23 of LOBA) but does not have the power to refuse or rescind an external auditor. - Detailed asset quality reviews (AQRs) of five domestic banks under enhanced supervision revealed material under-provisioning of which only two have been corrected (including impact on capital). Results of AQRs for two domestic banks are long overdue. - Comments: - In the FBiH only the IFRS 2009 translation exists; most domestic banks implemented IFRS 2009 only. - Most external auditors base opinions on the law rather than IFRS, complicating comparability across the sector. - Yearly auditor appointment with maximum term of 5 years and lack of FBA power to rescind auditors may adversely affect continuity and oversight. - AQRs revealed material under-provisioning, raising questions about audit quality. Audit quality assurance systems are in their infancy with little capacity and no in-depth review of auditors’ work. - Recommendations: - Translate IFRS upon a continuous basis. - Provide training to supervisors on IFRS. - Establish the power under which conditions FBA can reject and rescind an external auditor’s appointment. - Change the yearly appointment of an external auditor into the power to rescind an external auditor. - Precondition: - Evaluate the quality of the external audit and the quality assurance system in relation to the outcomes of the AQR. ### Disclosure and transparency (Principle 28) - Principle: supervisors determine banks regularly publish information that is easily accessible and fairly reflects financial condition, performance, risk exposures, risk management strategies and corporate governance. - Legal and regulatory requirements: - LOB article 50: banks shall within 75 days after the end of the preceding financial year submit to the FBA its financial statement and its external auditor’s report for the preceding financial year within 5 month after the end of the preceding financial year. - Each bank shall publish the external auditor’s report in abbreviated form in one or more of the daily newspapers in BiH within 15 days after receiving it and submit a copy of the abbreviated form to the FBA. - At the end of each six months, banks must publish non audited semi-annual reports including a balance sheet and information on supervisory and management board members and shareholders owning 5 percent or more of voting rights. Banks are required to publish the non-audited semi-annual report within 30 days after the expiration of the first six month period in one or more local newspapers and make copies available at each location. - Decision on the minimum scope, form and content of the audit program and statement prescribes mandatory elements of the abbreviated auditor’s report, including basic bank information, auditor’s opinion and comments, balance sheet, and income statement. - FBA practice and observations: - FBA publishes on its website a report containing regulatory statements of each individual bank—balance sheet and income statement, and the opinion of the external auditor. - The off-site department of FBA checks whether banks publish data that faithfully reflect financial status. In practice, only some annual reports (including audit opinion) were found by assessors on the FBA website. - Disclosed information observed includes quantitative (balance sheet, profit and loss statement, cash flow statement) and qualitative (business model, risk management, related parties, accounting policies, audit opinion). Some banks implemented IFRS 7 disclosure—mostly foreign banks. - FBA has not implemented pillar 3 of Basel II requiring disclosure on the relation between risk profile and capital. - Comments: - While law and regulation require periodic disclosure, not all required information was disclosed at the time of assessment. - More effort could be invested to disclose group structure information, such as ultimate beneficiary owner and insider lending. - Recommendation: - Disclose information on the group structure including ultimate beneficiary owners and insider lending. ### Abuse of financial services — AML/CTF supervision (Principle 29) - Principle: supervisors determine banks have adequate policies and processes, including strict customer due diligence (CDD) rules to prevent use of banks for criminal activities. - Legal and institutional framework: - FBA has authority to supervise and evaluate banks' compliance with AML/TF standards based on article 4 of the LOBA. - LOB article 47 (including 2013 amendments) sets obligations: not to acquire/convert/transfer assets suspected to be criminal proceeds; not to initiate transactions suspected for money laundering or financing of terrorism; establish internal control and internal audit policies to detect/prevent such transactions; satisfactorily establish true identity of clients; submit monthly reports to FBA on transactions reported to the Financial Intelligent Department (FID). - A state-level Law on prevention of money laundering and financing of terrorist activities (47/14) adopted in 2014 replaces Law 53/09 and establishes roles of FID (SIPA), FMA, banks, etc. - Decision on minimum standard for prevention of ML/TF (48/12) prescribes detailed minimum scope, form and content of banks' AML/TF activities. - Required bank policies/procedures (Law 47/14 and Decision 48/12): - Client acceptance policy (Decision article 5-8); client identification policy (Decision article 9–24); continuous monitoring of accounts and transactions policy (Decision article 25–30); risk management policy (Decision article 31–42). - Policies address high risk accounts, politically exposed persons and correspondent banking. - Suspicious clients/transactions must be reported to FID before transaction is made; banks report monthly to FBA all suspicious transactions reported to FID. - FBA also reports to FID if it becomes aware of suspicious transactions (article 81 Law on AML/TF). - FID receives, collects, investigates, analyzes information, submits to Prosecutor’s Office when prescribed and gives feedback to FBA (article 82). - Supervisory practice: - Supervisors have a comprehensive AML manual covering key elements. Comprehensive AML/TF inspections are conducted every two years; specialist AML unit consists of director, three senior inspectors and two inspectors. - Assessors observed supervisors adequately assess internal audit, compliance officers, screening, training, and IT for transaction/account monitoring. - Corrective actions per LOB (article 67) and Law on AML/TF (articles 83 and 84) can be used after inspections. - Observed shortcomings and remarks: 1. Supervisors' understanding of inherent ML/TF risk profiles of banks could be improved. Current focus is more on quality of risk management than on inherent risk arising from client, product, or location exposures. FID indicated the real estate sector seems most vulnerable to ML activities but did not connect these risks to the banking sector. 2. Follow-up of findings: deficiencies follow regular procedure (reporting, bank comments, written order with deadlines), but FBA often conducts follow-up during the next supervisory cycle rather than shortly after initial inspection. 3. Feedback loop between FBA and FID could be enhanced; sharing knowledge on suspicious transactions and sector vulnerabilities would improve supervisors' understanding of inherent bank risk profiles. 4. FBA does not conduct on-site ML/TF inspections at branches in FBiH with headquarters outside FBiH; these branches are still required to comply with AML/CTF laws and regulations. - Comments: - FBA exerts reasonable effort; new Law on AML/TF (2014) and Decision (2012) cover key prevention, detection and reporting elements. - Improvements needed in identifying inherent ML/TF risk profiles, adopting risk-based supervisory intensity, strengthening follow-up of findings, enhancing cooperation with FID, and clarifying on-site inspection responsibilities for cross-entity branches. - Recommendations: - Put more effort in identifying the inherent ML/TF risk profiles of banks. - Conduct risk based inspections instead of inspections according to fixed cycle. - Enhance the follow-up of findings. - Enhance the cooperation between FBA and FID. - Discuss with BARS who conducts on-site inspections in the cross entity branches in the area of ML/TF. - See also precondition on AML/TF paragraph 40 and 41. *Source: _cr15214 - 7. damage to physical assets and events that cannot be predicted, such as natural and* ### Appendix II. Republika Srpska: Principle-by-Principle ### Appendix II. Republika Srpska: Principle-by-Principle ### A. Supervisory Powers, Responsibilities, and Functions — Principle 1: Responsibilities, objectives and powers - Legal framework for banking supervision comprises: - Law on the Central Bank - Law on the Banking Agency (LOBA) - Law on Banks (LOB) - Key findings: - Law on the Central Bank: objective to achieve and maintain stability of the domestic currency (article 2); no explicit objective to achieve and maintain financial stability in BiH. - CBBH role: coordination of agencies responsible for bank licensing and supervision (monthly meetings and submission of monthly reports, article 2). - LOBA (1998): main objective of BARS is to safeguard and strengthen banking system stability (article 3); tasks include issuing/revoking licenses, supervising and undertaking measures. - LOBA amendments: 2006 (expanded supervisory remit), 2011 (Ombudsman as independent unit, articles 10–17), 2013 (confidentiality harmonized with EU directive, articles 29–32). - LOB (2003): covers licensing, capital, ownership, management, operational requirements, accounting, auditing, bankruptcy, penalties; amendments in 2011 (consumer protection, article 98) and 2013 (AML article 101; voluntary liquidation and provisional administrator articles 107–119). - Supervisory powers currently lacking at BARS (see referenced CPs): - consolidated supervision (CP 12) - impose prudential conditions on licenses and approvals (CP 5–7) - sanction and fine supervisory board members and significant owners and remove ownership rights (CP 11) - rescind the external auditor (CP 27) - launch resolution of a bank (CP 8) - share information and cooperate with foreign authorities (CP 3 and 13) - Prudential requirements (capital, related lending, large exposures, major acquisitions, transfer of significant ownership) often in secondary regulation rather than primary law. - Recommendations: - Strengthen supervisory powers (detailed items above). - Adopt new LOBA (as consequence of new LOB). - Adopt new LOB. ### A. Supervisory Powers — Principle 2: Independence, accountability, resourcing and legal protection - Governance and appointment: - BARS MB (managing board) consists of five members appointed for five years (article 19); MB supervises BARS operations (article 20); statute passed by MB and approved by government (article 36). - Director duties: issuing/revoking licenses, undertaking measures, appointing staff, representing BARS in court (article 22). Director and deputy participate in MB without voting rights (article 21). - Appointment procedure: selection committee of five appointed by government; public announcement; selection, ranking, proposal to government, appointment by National Assembly (article 19). - Qualification: citizens of RS with university degree in economy or law; may not own shares/stocks/debt securities in a bank or financial organization (article 25). - Independence and accountability: - LOBA: “the BARS shall be autonomous and independent” (article 7). - Director and deputy responsible to MB and National Assembly; MB responsible to National Assembly. Annual report due to National Assembly not later than June 30 for previous year (article 39); semi-annual to government. - Legal protection: - Members, director, deputy and employees not liable for damage arising from duties unless intentional or negligent (article 7 LOBA; article 110 LOB for temporary administrators). Provision substantively weaker since 2000 and amended seven times. - Missing: explicit legal protection/indemnification for appointees (e.g., liquidators); reimbursement for legal processes initiated against employees acting in good faith. - Resourcing and fees: - BARS financed directly by financial sector via fixed and variable fee structure: - fixed fee: lump sum per bank KM 20.000 plus percentage of total assets 0.015 percent - variable fees: per approval (license, appointment, transfer of ownership) - No government funding; salary regulated by LOBA and secondary rules; staff salary level between public sector and banking sector; turnover low but budget under pressure due to expanded responsibilities and training needs. - Comments: - Operational independence supported by LOBA and governance structure, but appointment process susceptible to political influence (examples noted). - Accountability reasonably organized but appeals process could be strengthened (specific provision in LOB rather than relying solely on Law on Administrative Procedures). - Context risk: substantial interdependence between government and domestic banking sector (government deposits, credit lines, capital instruments) may create pressure on BARS in bank non-viability cases. - Recommendations: - Adopt staggered appointments for MB, director, deputy director. - Make selection committee qualification criteria granular and transparent in LOBA. - Expand legal protection scope to include indemnification. - Add provision in LOB to prevent courts from suspending BARS decisions too easily. - Implement risk-based supervision to allocate resources and build capacity. - Invest in staff training: corporate governance, risk management, enforcement, IFRS, Basel, ICT. ### A. Supervisory Powers — Principle 3: Cooperation and collaboration - Domestic cooperation architecture: - BARS cooperates with: state-level Fiscal Council of BiH (FCBiH), CBBH, Deposit Insurance of BiH (DIA), Association of Banks (ABBiH), Financial Intelligence Unit (FIU) as part of SIPA; no resolution authority yet. - Entity level contacts: FBiH (FMOF, FIA, FSEC); RS (RSMOF, RSIA, RSSEC). - Legal instruments: Law on Central Bank (CBBH coordination, no financial stability mandate), LOBA (articles 9.2–3 cooperation; articles 29–32 confidentiality), Law on RS Financial sector supervision coordination committee (May 14, 2009) establishing Committee (members: RS Minister of Finance, RS President of Securities Exchange Commission, Director BARS, Director IARS). - Key inter-agency arrangements (selected): - FBA–BARS (June 2003): Agreement on Cooperation in Supervision over Bank Operations. - FBA–BARS (2006): Cooperation Agreement (joint on-site exams, exchange of information). - FBA–BARS–CBBH (2008 June 12): Memorandum and Principles of Cooperation and Exchange of Data. - FBA–BARS–BBH (2013 March): Internal guidelines for stress test preparation and prudential instrument use. - FBA–BARS–CBBH (2013 June 30): Memorandum on Methodology for Determination of List of SIB in BiH. - FBA–BARS–DIA (2003 Oct 7): Letter of Agreement (data to be provided to DIA upon request); DIA requires minimum rating of 3 on composite basis with no individual rating component of 5 for membership. - FBA–BARS–DIA–FCBiH (2009 Dec 22): MoU establishing Standing Committee for Financial Stability (SCFS) — forum for assessing threats to financial stability. - FBA, BARS, DIA, CBBH, FCBiH (2014): Contingency plan (work in progress); CBBH must make written request to get information from BARS (page 4). - Practical cooperation issues: - CAMEL/CAMELS ratings not consistently shared: BARS shares CAMEL ratings with DIA only upon comprehensive inspection reports; does not routinely share with FBA or CBBH. DIA developed own rating system due to insufficient data flow. - FIU does not provide feedback on suspicious transaction reports to BARS; BARS lacks clarity on AML risk picture in RS (see CP 29). - No established resolution authority or clear state-level crisis coordination mechanism; overlapping committees with potential unclear leadership in crisis. - Foreign cooperation: - RS banks: 10 banks, 6 owned by foreign banks (Slovenia, Serbia, Austria, Italy, Russia). Systemically important in RS: NLB (Slovenia), Sberbank (Austria, Russia), Hypo (Austria), Nova (domestic), UniCredit (Austria and Italy). - MOUs exist with Slovenia (2001), Serbia (2004), Turkey (2009). Formal arrangements with Austria and Italy pending due to prior confidentiality misalignment; no arrangements with Russia (Russia generally does not exchange supervisory information). - BARS participates in supervisory colleges for Slovenia and Serbia; participation in Austria and Italy colleges absent for several years (confidentiality issues). - Confidentiality risks: - Articles 29–32 LOBA define confidentiality and permitted disclosure only to listed bodies under signed agreements for supervisory use. 2011 prosecutor request incident: inspection minutes provided by BARS and later leaked to TV — risk to supervisory confidentiality and bank trust. - Recommendations: - Simplify and streamline inter-agency arrangements to enhance crisis cooperation. - Conduct crisis simulation exercises covering state and entity levels. - BARS should share CAMEL ratings with FBA, CBBH and DIA; set rules for when to share with SCFS; establish a joint rating system with FBA and DIA. - Address lack of FIU feedback to BARS. - Formalize MoUs with supervisors of Austria and Italy. - Assess and determine acceptable risk of not having arrangements with home supervisors (e.g., Russia) and mitigate if necessary. ### A. Prudential Regulations — Principle 4: Permissible activities - Definitions and licensing: - Bank defined as legal entity performing deposit taking and credit extending activities (article 1 LOB). - No clear definition of branch, representative office, or other operational units in LOB; requirements for establishment referenced in Decision on Licensing (articles 17, 84 of LOB). - Use of word “bank” limited to licensed and supervised institutions (article 2 LOB). Investment and Development Bank uses “bank” but does not take deposits and is governed by separate law; exposure ~USD 1 billion. - BARS maintains registration of licensed banks; list published on BARS and CBBH websites. - Permitted activities (article 87 LOB): - receiving money deposits or other repayable funds, making and purchasing loans, participating/buying/selling for own account or customers, issuing/managing payment instruments, purchase/sale of securities, and other activities. Banks’ activities must be specified in banking license (article 16 LOB). - 2011 amendment (article 87) permits insurance brokerage. - Factoring or forfeiting not explicitly stated (FBiH explicitly permits). - Comments and recommendations: - LOB lacks clear distinctions and comprehensive regulation for branches, representative offices, and activities they may engage in. - Recommendations: - Define branches, representative offices and operational units in RS and outside RS (including FBiH, Brcko District, outside BiH) and harmonize with FBiH and EU Directives. - Clearly define activities and prudential requirements for operational units (see CP 5 on licensing). - Add provision that bank license specifies authorized banking activities. ### A. Prudential Regulations — Principle 5: Licensing criteria - Licensing authority and powers: - BARS issues licenses (article 5 LOBA) but LOBA does not explicitly state power to set criteria or impose prudential conditions/limitations on newly licensed banks. - Documentation and criteria: - LOB requires application to include founding contract, qualifications/experience of Board members, amount of capital, business list of owners and data on founders’ soundness (article 8). - Detailed requirements in “Decision on licensing and other approvals” (strengthened May 2014) covering subsidiaries, branches, representative offices, operational units in RS, FBiH, Brcko District, outside BiH. - Article 10 LOB: license granted once amount KM 15 million paid, BARS confident bank will comply with law/regulations, and projections for future financial condition documented. - Foreign parent subsidiary licensing requires banking license from parent’s home authority, consultations, and receipt of inspection report of founder bank. - Article 10 LOB requires board members have university degree and appropriate experience; detailed suitability criteria in “Decision on suitability assessment bank’s bodies” and “Decision on diligent behavior of members of bank’s bodies”. - Significant ownership suitability documents detailed in “Decision on licensing and other approvals” (article 17). - Assessment practice: - Assessment largely compliance-based, document-focused; last license assessment in 2005 characterized as light-touch (including projected financial condition). - Suitability checks by legal affairs/general administration sector: criminal records, references, contacts with other regulators, open sources, credit registry. - Preconditions for robust fit-and-proper checks are weak: BARS relies on banks’ due diligence; no regional database, no Interpol connection, no consolidated record of supervisory antecedents. - Suitability assessment of significant owners in practice formal and limited — opaque ownership structures impede identification of ultimate beneficiary owners. - Recommendations: - Amend LOBA to explicitly grant BARS power to set criteria and impose prudential conditions/limitations on newly licensed banks. - Expand license criteria in LOB and connect to detailed procedures in Decision on licensing and other approvals, listing minimum level/quality of documents. - Expand fit-and-proper criteria for board members and align with licensing decisions. - Expand suitability criteria for significant shareholders: transparency of ownership, fitness-and-propriety, capacity to provide additional capital. - Make assessments more qualitative and substantive; include on- and off-site supervisors in substantive assessment. - Precondition: - Set up regional database to record supervisory antecedents and criminal activities of board members. ### A. Prudential Regulations — Principle 6: Transfer of significant ownership - Legal definitions and process: - Significant ownership = interest of at least 10 percent of aggregate voting rights (article 1 LOB). “Controlling interest” not defined. - Article 23 LOB: acquisitions increasing ownership to thresholds 10, 33, 50, and 66.7 percent require BARS approval; applicants must submit information as specified in Instruction for licensing and other approvals. - Instruction article 17 lists required documents for legal and natural persons. - Grounds for rejection (article 25 LOB and Instruction article 17): - uncertain financial condition of applicant, lack of competence/experience jeopardizing bank/depositors, unfair competition, unreliable information. - Limitations and weaknesses: - BARS does not have power to impose prudential conditions on transfers (e.g., ring-fencing). - No clear power to modify/reverse unauthorized changes in control except during receivership (article 125 LOB). - Ownership data flow: quarterly reports list 15 largest shareholders; BARS receives extract from RS Securities Central Registry. However, information insufficient to identify ultimate beneficiary owners and holdings; example: two domestic banks assessed had opaque ownership structures hindering related-party and group exposure identification. - Practically, assessments are formal rather than substantive; example of 36 percent acquisition showed inadequate assessment. - Recommendations: - Expand definition of significant ownership and define “controlling interest.” - Address direct vs. indirect control in article 23. - Increase information requirements to identify ultimate beneficiary owners and holdings (ownership structure up to ultimate beneficiary owner, strategic orientation, convictions). - Adapt prudential reporting to reflect changes in ownership information requirements. - Change thresholds from 10, 33, 50, 66.7 percent to 10, 20, 30, 50 percent to align with EU requirements. - Establish power to change ownership structure and impose prudential conditions. - Establish supervisory powers for periodic reporting and on-site inspections to obtain names/holdings of significant shareholders, controllers, and beneficial owners held by nominees/custodians. - Implement risk-based inspections targeting banks with opaque ownership structures and remediate (identify UBOs, related parties, group exposures, intervene where necessary). ### A. Prudential Regulations — Principle 7: Major acquisitions - Legal framework and powers: - Article 24 LOB: banks must obtain BARS approval for significant ownership share of a bank in another legal entity; acquisitions exceeding 5 percent of bank’s core capital or sum of participations exceeding 20 percent of core capital require approval. - Participation limits: individual participation ≤ 15 percent of bank’s core capital; sum of participations ≤ 50 percent; participation in non-financial legal entity ≤ 10 percent of core capital; sum in non-financial entities ≤ 25 percent; participation cannot exceed 49 percent ownership of non-financial entity. Loans to these legal entities considered participations. - Article 28 LOB: status changes, mergers, acquisitions require prior BARS authorization; banks must submit economic justification and operations plan. Article 29 allows BARS to refuse if resulting bank would not meet capital, board, depositor protection requirements. - Gaps and practice: - No definitions of acquisition/investment types/amounts requiring notification beyond above thresholds. - Decision on licensing and other approvals (article 18) lists required documents (court registration, financial indicators, treatment of investment in net capital) but lacks assessment criteria addressing whether acquisition exposes bank to undue risk, impedes supervision, or whether bank has resources to manage acquisition. - No explicit criteria or assessment for cross-border acquisitions (flow of information, consolidated supervision ability). - Participations less than 5 percent are not required to be deducted for regulatory capital; no aggregate deduction limit specified. - Recommendations: - Establish approval criteria for major assessments similar to major acquisitions. - Define types and amounts of acquisitions/investments that trigger notification. - Explicitly grant power in LOBA and LOB to approve/reject and impose prudential conditions on major acquisitions/investments. - Prescribe in LOB criteria for approval/rejection, including not exposing bank to unnecessary risks or impeding supervision. - Prescribe cross-border criteria: adequate information flow for consolidated supervision, host-country supervision efficacy, ability to supervise on consolidated basis. - Require notification to BARS of acquisitions/investments even when approval not necessary. ### A. Supervisory Approach and Tools — Principle 8 & 9: Supervisory approach; techniques and tools - Supervisory model: - Mix of onsite and offsite supervision with close coordination. - CAMELS rating used (capital, asset quality, management, earnings, liquidity, sensitivity to market risk). Market risk currently not rated due to lack of BARS-imposed requirements; standards drafted with implementation not anticipated until January 2017. - Stress testing: limited use for bank-specific supervision; CBBH coordinates systemic/top-down stress tests; BARS uses CBBH stress-test results and provides quarterly bank data to CBBH. - Offsite manual and onsite inspections manual exist (detailed procedures, planning, scope, inspection areas). - Supervisory planning and techniques: - Annual coordinated supervisory plan adopted by MB based on financial/operational position and problem banks (enhanced supervision). - Coordination between offsite and onsite: offsite analysis guides onsite scope; regular quarterly offsite reports; ex-post briefings; offsite inputs into inspection preparation; onsite presents findings and corrective measures. - Onsite findings discussed with bank management; follow-up reports and enforcement if corrections not timely. - Supervisory tools evidenced: inspection reports (full/targeted), offsite analysis, CAMELS calculations, corrective actions. Plans to implement early warning system. - Reporting and verification: - Prudential reporting mandated (LOB article 106; LOBA article 38); specifics in “Decision on the form of reports which banks submit to the banking agency.” - Required prudential reports: capital, asset classification, non-performing assets, credit risk concentrations, 15 largest shareholders, transactions with related parties, liquidity, foreign currency risk, effective interest rate. Reporting intervals prescribed. - No requirement currently to submit prudential reports on consolidated basis (see CP 12), or pillar 2, country risk, market risk (except FX positions). - Data accuracy controls: programmatic cross-table checks; offsite substantive control requesting corrections; onsite cross-checks against credit files, GL, credit registry; IT supervisors now join inspection teams; external auditor reviews long-form against laws/regulations (not same as financial statement audit opinion). - Comments: - Onsite/offsite processes provide in-depth supervision and adequate information for enforcement. - Increased use of stress testing and fuller market risk/pillar 2/country risk reporting would enhance forward-looking risk assessment. - Recommendations (selected): - Implement early warning system and increase stress-testing use in bank-specific supervision. - Develop prudential reporting on consolidated basis and expand reports for pillar 2, country risk exposures, market risk, and restructured loans. ### A. Supervisory Reporting — Principle 10 - Reporting framework: - LOBA article 38: banks must submit reports/data as defined by BARS. - LOB article 106: banks obliged to prepare/submit reports on business operations, liquidity, solvency, profitability for solo and subsidiaries and consolidated basis “in form, contents and at such intervals as prescribed by BARS” — but in practice consolidated reports are not required (see CP 12). - Prudential reports prescribed in Decision on form of reports; see section above for required items. - Verification and accuracy: - Controls include programmatic cross-table checks, offsite substantive review, onsite verification, IT supervisor reviews, and external auditor long-form review (legal/regulatory compliance). - No fine specified for inaccurate prudential reports. - Recommendations: - Develop prudential reporting on consolidated basis. - Develop additional prudential reports aligned with pillar 2 Basel 2, country risk exposures, market risk and restructured loans. ### A. Corrective and Sanctioning Powers — Principle 11 - Supervisory actions and tools (articles 125 and 125a LOB, articles 123 and 123a LOB): - Written warnings; demand supervisory board convene shareholders’ meeting for rehabilitation; written orders with special requirements/restrictions (restrict new credit exposures, interest rate or deposit growth restrictions); suspension of management/supervisory board members; prohibition on concluding contracts harming depositors (article 98 LOB); cash fines; appointing advisor for bank; appointing external auditor at bank expense; appointing temporary manager; revoking banking license (article 19 LOB). - Corrective measures issued via orders; objection to director does not postpone execution; administrative dispute does not postpone execution (no bank invoked this in last five years). - BARS has used advisors, temporary managers, external auditors for problem banks; imposed financial penalties and criminal referrals when appropriate. - Internal auditor tasked with auditing execution of orders and reporting within 30 days. - Observed practice: - Initial measures typically written warnings; onsite inspections produce draft decisions/orders for MB Board of Supervision and Corrective Measures to finalize. - Temporary operational requirements used for banks under special supervision (composite ranking 4 or 5): e.g., prohibit extending credit to related parties; prohibit payment of bonuses to supervisory/management members. - Comments and improvement areas: - While tools exist, there is no coherent remedial action program (transparent framework linking severity to remedial steps). - Suggested components for improvement: - Define/enhance enforcement toolkit: ability to impose administrative fines on individuals, increase fines, escalate instruments (publication, fines, activity restrictions). - Benchmarks/milestones tied to CAMELS, capital levels, repeat violations, inaccurate/late reporting; caution on mandatory application limiting supervisory judgment. - Reinforce remedial action based on supervisory judgment even before CAMELS rating changes. - Develop systemic contingency planning with central bank, DIA, finance ministry. - Begin bank-specific recovery and resolution planning for banks rated “4” and above (costs of liquidation, insured funds, related party liabilities, recovery options). ### A. Consolidated Supervision — Principle 12 - Status and findings: - Consolidated supervision concept and practice not implemented at BARS; no definitions or both qualitative/quantitative prudential requirements in force. - BARS lacks powers to review overseas activities, visit foreign offices, meet host supervisors, limit group activities or location of activities. - RS banking structure: 10 banks, 6 foreign-owned (Slovenia, Serbia, Austria, Italy, Russia); BARS is host supervisor for these banks; four domestic banks — group structures unclear (financial/non-financial activities present). - Need to define consolidated supervision, identify ultimate beneficiaries, and apply consolidated prudential oversight. - Comments: - BARS reviews main parent activities to some extent using home supervisor information (see CP 13). - Consolidated supervision planned for new LOB. - Recommendations: - Define entities within consolidated supervision: banking groups, financial conglomerates, financial holdings. - Set quantitative consolidated prudential requirements: consolidated capital adequacy, large exposure limits, related party limits, consolidated liquidity requirements. - Set qualitative prudential requirements: consolidated prudential reporting (ad-hoc and regular), fit-and-properness for owners/boards/senior managers, group risk management standards. - Establish supervisory powers to intervene in groups on governance, risk management, capital, liquidity and group structure. ### A. Home-Host Relationships — Principle 13 - Findings: - BARS is host supervisor for foreign-owned banks in RS; formal MOUs in place with Bank of Slovenia (2001), National Bank of Serbia (2004), and Turkey (2009). MOUs cover cooperation, joint inspections, collegia participation, information exchange. - No formal MOUs with Austria, Italy, and Russia (Austria and Italy near formalization; Russia not available for arrangements). - BARS participation in supervisory colleges: attends Slovenia and Serbia colleges; absent from Austria and Italy colleges for several years due to previous confidentiality issues (expected resolution). - Arrangements do not explicitly address cross-border crisis cooperation/coordination. - Risks and recommendations: - Given several foreign systemically important parents (Austria, Italy, Russia), formalize MOUs with Austria and Italy and assess acceptability/mitigation of lacking arrangement with Russia. - Renew MOUs and include cross-border crisis coordination provisions. - Address home/host issues beyond MOUs within SCFS and prepare a strategic action plan to assess and mitigate net risks (see CP 3). ### B. Prudential Regulations and Requirements — Principle 14: Corporate governance (intro) - Legal responsibilities: - Article 63 LOB prescribes responsibilities and competencies of supervisory board and bank management. - Supervisory board responsibilities include (article 63 excerpts): - overseeing bank operations and management work; - approving financial statements (semi-annual and annual) and auditor reports; - appointing bank management and external auditor; - ensuring establishment and implementation of internal controls; - ensuring internal and external audits performed; - establishing necessary loan provisioning from net profits and determining dividends. - Note: Decisions on Corporate Governance were issued in 2013. *Source: _cr15214 - Appendix II. Republika Srpska: Principle-by-Principle* ### 1. The Decision on Diligence of Members of Bank Bodies regulates the rules of conduct ### 1. The Decision on Diligence of Members of Bank Bodies regulates the rules of conduct ### Regulation of conduct and duties - Regulates the rules of conduct of members of bank bodies in the course of the performance of their authorities, including: - the prevention / management of the conflict of interest, - establishment of specialized boards for professional assistance and support to the supervisory board of the bank, - application of professional, ethical standards and principles of corporate and social responsibility etc. ### Decision on Assessment of Members of Bodies (fit-and-proper) - Puts an emphasis on obligations of the bank to: - prescribe and apply criteria for the assessment of suitability of members of bank’ bodies, - perform initial and continuous assessment, - ensure continuous fulfillment of criteria for suitability of members of bank’s bodies. *Source: _cr15214 - 1. The Decision on Diligence of Members of Bank Bodies regulates the rules of conduct* ### 3. The Decision on Policy and Practice of Remuneration to Employees in the Bank ### 3. The Decision on Policy and Practice of Remuneration to Employees in the Bank ### Remuneration and corporate governance - Regulates structure of remuneration that should be harmonized with the strategy of assuming risk, corporate values and long-term interests of the bank, and should cover all components of remuneration (salaries, discretionary pension and similar benefits on individual and discretionary basis) for key categories of employees whose professional actions have a significant effect on the risk profile of the bank. - Compliance reviews on corporate governance requirements are performed through onsite and offsite supervision. - Procedures, processes, and checklists for supervisory reviews of inspections of operations of management bodies in banks are part of the Manual for Onsite Supervisors. - Based on results from onsite inspections, inspectors assess the “M” in CAMELS and assign a grade reflecting any weaknesses in operations. Corrective action is required when deficiencies are noted. - Comment: In 2013, BARS issued decisions concerning corporate governance to align with future implementation of Pillar 2 principles and BCP requirements; decisions are comprehensive but additional guidance would aid bank compliance and effectiveness (examples: inclusion of independent directors, performance assessment, formulation of corporate governance statements and disclosure, establishing personnel management programs and orderly succession). ### Risk appetite, business planning, and supervisory expectations - Requirements established for the supervisory board to define its risk appetite and establish business plans, but BARS expectations on issues to be addressed by banks are limited. - Guidance examples for risk appetite statement: quantitative metrics such as value-at-risk, leverage ratio, range of tolerance for problem loan levels, and acceptable stress test losses. - Strategic (business) plan guidance may include: comprehensive assessment of current and expected risks, statement of business objectives, and how achieving objectives will affect the risk profile. The strategic plan and the risk appetite statement should balance and be supported by a robust risk management framework. ### Principle 15 — Risk management process: description and findings - Principle: supervisor determines that banks have a comprehensive risk management process to identify, measure, evaluate, monitor, report and control or mitigate all material risks and assess adequacy of capital and liquidity; includes contingency arrangements and recovery plans. - Article 63 of the Law on Banks and Article 3 of the Decision on Minimum Standards for Internal Controls Systems in Banks obligate the supervisory board to: - adopt and ensure the establishment of an efficient organizational structure of the bank, adopt the business plan with clear objectives and business policy covering acceptable and unacceptable risks and responsibilities for identification, monitoring, and control of those risks; - ensure the business plan contains strategic and operational plans; - ensure the business plan clearly defines lines of competencies and responsibilities and reporting lines; - ensure governance levels continuously monitor and control execution of functions of lower levels. - Decisions on risk management require supervisory board to adopt an adequate risk management program for each area, proportional to size and complexity, periodically updated to risk profile and market demands. - Decisions require written policies defining risk appetite, approval authority levels, limits for concentration of risk exposure (including limits for individual clients / depositors, group of connected counterparties, branch of industry, geographic region, individual bank or group of banks, foreign country or class of countries, type of securities, maturity and form of instruments). - Article 80 of the Law on Banks: director responsible to implement program and policies, establish communication lines, and supervise application. - Supervisors assess whether internal policies and procedures are: - sufficiently comprehensive (covering all the risks of the bank); - adjusted to the risk appetite and whether the capital of the bank is supporting the risk assumed in operations; - inclusive of risk from the macroeconomic environment and updated timely. - Onsite inspections assess implementation of strategic plan, policies and procedures, and supervisory board efficiency supervising management. - Comment: BARS has not issued detailed regulations concerning interest rate risk in the banking book, market risk and country risk or apply capital requirements to those risks; no overarching decision on risk management for the bank as a whole. Planned Basel II and Pillar 2 implementation provides opportunity to address these holistically. Risk management standards should address roles of the “three pillars of defense,” internal controls, internal audit and independent risk management; differentiate internal audit (not permanent, variable scope) from internal risk management (ongoing). ### Principle 16 — Capital adequacy: description and findings - Article 90 of the Law on Banks requires banks to maintain shareholders’ capital and net capital at least at the level of KM 15 million, and, a 12 percent of total risk-weighted assets. - Law establishes: - if capital lower than minimum prescribed, BARS may revoke the license (Article 19); - if capital declines below 6 percent of risk weighted assets, BARS may introduce temporary management (Article 108). - If bank receives rating of 4 “C” in CAMELS, bank is placed under continuous oversight and subject to formal enforcement action. - Article 17 of the Decision on Capital: BARS may impose capital requirements that exceed the minimum prescribed under the Law depending on assessment of risks and management. - Structure of capital under Decision on Capital: - Articles 7 and 10: net capital = core capital + supplemental capital − items deducted from capital; - Article 8: core capital = items unconditionally, fully, and without restrictions available to absorb losses and subordinated to other liabilities, reduced by regulatory adjustments; - Article 9: items meeting conditions for supplemental capital. - Articles 11 and 17 require banks to maintain net capital at level of 12 percent of risk-weighted assets. - Operational risk: basic indicator method in place. - Decision on market risk adopted but not implemented. - BARS monitors compliance on quarterly offsite reports. - BARS adopted strategy for implementation of Basel II/III; credit risk weighted assets mostly in compliance with Basel I (differences listed elsewhere); weighted operational risk calculated according to basic indicator approach. - 2014 amendments aimed to strengthen capital structure, introduce capital conservation layers, restrain leverage, converge with Basel III—adoption transitional until full implementation. - Article 17: BARS authority to impose special capital requirements exceeding minimum. - Comments: plan for full implementation of Pillar 2 and ICAAP expected to be completed in late 2014; capital charge for market risk not currently in place. - Harmonization periods and transitional requirements (as provided): - Implementation of the capital conservation buffer as of December 31, 2016, and counter-cyclical buffer for systemic risk within the deadline which would be introduced, as necessary, and the period of harmonization prescribed by a special decision of the FBA; - reducing the amount of loan loss reserves included in supplemental capital to 1.625 percent by December 31, 2015, and 1.25 percent by December 31, 2016; - allowable revaluation reserves to be amortized and extinguished by December 31, 2016; - implementation of requirement to depreciate subordinated debt in the last 5 years to maturity date - December 31, 2015; - amount of bank’s supplementary capital cannot be: - more than one-half of the core capital, beginning on December 31, 2015, whereby the core capital referred to in Article 8 of this decision is at least 8 percent of total risk of assets, - more than one third of the core capital, beginning as at December 31, 2016, whereby the core capital referred to in Article 8 of this decision is at least 9 percent of total risk of assets, - ensuring and maintaining a leverage ratio, at least 6 percent, starting on December 31, 2015; - banks which, due to changes in the structure of the core and supplementary capital, in the process of harmonization, become noncompliant with concentration limits will need to correct the violation by December 31, 2015; - calculation of capital requirements for market risk will apply when the secondary regulations that prescribe capital requirements and methodology for calculating capital requirements for market risk enter into force. ### Principle 17 — Credit risk: description and findings - Articles 3 and 4 of the Decision on Minimum Standards for Credit Risk Management and Classification of Assets (revised 2013) obligate supervisory board and management to adopt, maintain, and develop comprehensive program with policies and procedures for credit risk management; supervisory board ensures compliance and acceptable level of credit risk; management to design and present proposals timely. - Article 5: program must contain depending on nature and complexity: - defined policies for identification of credit risk and management; - procedures for assessment of credit applications; - procedures for approvals, documentation, monitoring, inspection, reporting and collection. - Article 6: program must reflect loan portfolio mix and risk level and establish risk limit controlling parameters and written policies addressing: - risk appetite and management; - loan portfolio mix; - lending approval authority levels and provisioning requirements; - concentration limits for individuals, connected lending, geographic regions, industries, country risk and collateral. - Offsite supervision: continuous monitoring based on quarterly reports with emphasis on asset quality, adequacy of loan loss provisioning, nonperforming assets, credit risk concentration, sector exposures, contagion risk, compliance. Early detection and written warnings with deadlines. - Onsite inspections assess policies, practices, procedures and compliance. - Comment: detailed decision issued covering credit risk management and Board duties; compliance monitored onsite and offsite. Copies of loan portfolio reviews were shared. ### Principle 18 — Problem assets, provisions and reserves: description and findings - Supervisory board required to adopt written policies and procedures to measure, monitor and establish risk parameters for loan portfolio (Article 63 Law on Banks). - Decision on Minimum Standards for Credit Risk Management and Classification of Assets: - Article 14 defines nonperforming assets as past due principal and/or interest for longer than 90 days from initially contracted maturity (classified in categories C, D, or E). - Banks must adopt and apply adequate internal methodologies for valuing loans and financial assets in compliance with IAS and IFRS and local standards. - Minimum requirements for risk management in Instructions on Amended Method for Forming, Recording, and Reporting Disclosure of Loan Loss Provisioning. - Supervisory board responsible for separation of credit granting and collection/restructuring/write-off functions. - Banks must implement loan review systems, ensure proper classification and provisioning, report quality of loan portfolio at least quarterly. - Articles 13, 15, 16: regular reviews, careful assessment, classification of each credit; maintain list of individual nonperforming loans; loans must be classified at least quarterly. - Banks required to form provisioning depending on risk assessment (Article 22). - Instructions: internal methodology for measuring/grading credits; loans in excess of 10,000 must be reviewed individually, smaller loans may be reviewed on a portfolio basis. - Inspection: onsite and external audit assess policies, procedures, provisioning adequacy; BARS takes external auditor opinion into account but final assessment based on onsite inspection review and specified sample. - Comments: - Reviews identified deficiencies in provisioning. - Prudential provisioning categories: Category B includes loans 90 days delinquent, Category C up to 180 days delinquent, Category D up to 270 days—thresholds considered too long and provisioning ranges too broad. - Examples provided where BARS required banks to increase provisions. - Recommendation: training for BARS staff on IAS to discuss impairment assumptions, discounting to present value methods, collateral valuation; BARS standards on discount rates, loss rates, macroeconomic considerations, real estate valuation standards, haircuts for selling/foreclosure costs would enhance IAS provisioning. - Under current scheme, prudential standard serves as a floor and if IAS yields a lower provision, banks must deduct difference from regulatory capital; process not transparent as not reflected in published financial statements. ### Principle 19 — Concentration risk and large exposure limits: description and findings - Decision on Minimum Standards for Managing Risk Concentration in Banks (Articles 3, 4, 13) prescribes adoption of procedures and policies for risk concentration management, monitoring, and capital planning. - Article 5 defines balance sheet and off-balance sheet items included in total exposure to credit risk toward one beneficiary. - Article 12: banks must establish information systems for monitoring and managing risk concentrations. - Policies and procedures must be reviewed at minimum semi-annually; banks report to BARS quarterly on significant concentrations (large exposures). - Inspection assesses compliance of internal enactments, compliance with limits, quality of records on connected persons, and reporting. - Article 10 restricts sum of all large exposures to credit risk (exposures that exceed 15 percent of core capital) to 300 percent of core capital (pursuant to Article 91 of the Law on Banks and this Decision). - Comments: - Banking law revision in process to change maximum exposure to single counterparties or group to 25 percent of core capital (instead of current 40 percent). - Draft Decision on Large Exposures of Banks in preparation; criteria for bottom-up stress testing by banks under consideration. - Concentration of assets recurring issue; recommendation to increase enforcement to encourage correction of violations and adequate monitoring and identification of connected parties. ### Principle 20 — Transactions with related parties: description and findings - Law definitions: - Related parties: persons with direct or indirect control over supervisory board, bank management, or significant ownership interest, or acting together to exert influence. - Related banks: banks sharing supervisory board members or common ownership of at least 10 percent of common shares. - Article 100 lists treated related persons: president/members of supervisory board, management, audit committee, their immediate families up to third degree of kin or marriage, household members, persons with mutual investments; significant shareholders and their immediate families; legal persons with common shares; legal persons where bank holds significant interests; legal persons with significant interests held by same persons; related persons of shareholders. - Decision on Minimum Standards for Bank Operations with Persons Affiliated with Banks and Article 6 of Decision on Managing Risk Concentration define groups of connected counterparties and relations grounds (common ownership, family, common board members, crossed guarantees, direct commercial/financial links). - Banks must treat sum of exposures to group of connected counterparties or related parties as total exposure to one beneficiary. - Article 100: banks cannot offer more favorable terms to related parties than to non-related parties. - Article 3 decision: transactions with related parties require prior supervisory board approval; related party member cannot vote on transactions involving itself or affiliated person. - Article 64 Law on Banks: supervisory board members cannot decide on issues concerning relations between bank and legal persons in which they have direct or indirect financial interest. - Exposure limits: - Limits for exposure towards related physical persons: 1 percent of core capital towards a related physical person and 10 percent towards all related physical persons. - Article 96: banks must not deposit funds, grant credits, or invest in one related bank in total amount exceeding 25 percent of core capital, nor in all related banks in amount exceeding 40 percent of core capital. - Total exposure to all persons related to the bank treated as total exposure toward one beneficiary, maximum exposure up to 25 percent of core capital (must be covered with collateral for amounts exceeding 5 percent of core capital), while for exposure secured with high quality collectable collateral (first rate collateral) the limit is up to 40 percent of core capital (Article 91 of Law on Banks and Article 8 of Decision on Managing Risk Concentration). - Article 10 Decision on Capital: in calculation of net capital, items deducted include receivables from shareholders with significant ownership interest (exceeding 10 percent) approved in contravention of Law, Agency decisions, or operational policies, and exposures exceeding 15 percent of core capital towards significant shareholders approved without prior consent of Agency. - Comments: - Related party definition broad; BARS makes final assessment and corrective action. - Related party violations often identified in inspections (causes include improper recordkeeping, failing to identify related parties, exceeding borrowing limits, nonperforming related party loans). - Recommendation: stricter penalties should be considered, particularly for recurring violations. ### Principle 21 — Country and transfer risks: description and findings - Existing regulatory framework does not stipulate detailed requirements for country and transfer risk; no obligations for banks to adopt policies and procedures specific to these risks. - Elements partially covered under Decision on Minimum Standards for Credit Risk Management and Asset Classification and Decision on Minimum Standards for Foreign Currency Risk Management; country risk partially incorporated through Decision on Capital (in risk weighted assets). - Article 6 Decision on Minimum Standards for Credit Risk Management: banks must adopt policies and procedures covering limits for concentration toward geographic regions and individual countries/classes of countries; internal limits cannot be lower than legal/bylaw limits. - Agency monitors exposures on nonresidents and securities bought from foreign central governments via offsite reports and reviews; onsite inspections review contracts on investments abroad, purchased securities of foreign central governments, and significant exposures to nonresidents. - BARS plans to adopt country risk requirements as part of Strategy implementation. - Comments: no standards for provisioning for country risk; regulatory requirements only partially treat country and transfer risk; drafting decisions for country and transfer risk management initiated with target completion end of 2014. ### Principle 22 — Market risk: description and findings - Decision on Minimum Standards for Market Risk Management in Banks (2007) prescribes minimum standards; drafted in line with Amendment for Capital Requirements that Include Market Risks (November 2005). - Implementation postponed due to changes in international regulatory framework and limited market risk in RS banks; decision incorporation into capital strategy planned. - Draft Decision on Calculation on Capital Requirements for Market Risk (planned to enter into force on January 1, 2017) will apply standardized approach. - Comments: 2007 decision not implemented; new capital calculation decision being drafted with planned implementation from January 1, 2017. ### Principle 23 — Interest rate risk in the banking book: description and findings - Existing regulatory framework does not establish regulatory requirements for interest rate risk management in the banking book nor obligation for banks to adopt policies and procedures. - Decision on Minimum Standards for Market Risk Management covers interest rate risk measurement but has not been implemented. - BARS will draft Pillar 2 regulatory framework to incorporate interest rate risk in the banking book, requiring systems appropriate to type, scope, complexity and risk profile, reporting, and stress testing. - Comments: work underway; Pillar 2 requirements preparation anticipated to be completed by the end of 2014. ### Principle 24 — Liquidity risk: description and findings - Procedures for monitoring liquidity risk are outlined in manuals for onsite and offsite supervision. - Supervisor determines whether bank has implemented strategy for prudent management of liquidity risk and compliance with liquidity requirements. - Offsite supervision monitors and analyzes financial and other reports submitted electronically; department inspects accuracy before placing in BARS information database. - Pursuant to Law on Banks Article 90 and Decision on Minimum Standards for Liquidity Risk Management in Banks Article 6, banks are under obligation to comply with requirements for liquidity. *Source: _cr15214 - 3. The Decision on Policy and Practice of Remuneration to Employees in the Bank* ### 1. maturity matching of assets and liabilities, where banks have to: ### _cr15214 - 1. maturity matching of assets and liabilities, where banks have to: ### Maturity matching requirements - Banks must: - invest at least 85 percent of assets with maturities of up to 30 days into investments with maturities of up to 30 days; - invest at least 80 percent of assets with maturities of up to 90 days into investments with maturities of up to 90 days; - invest at least 75 percent of sources of assets with maturities of up to 180 days into investments (asset instruments) with maturities of up to 180 days. ### Liquidity governance and monitoring - Bank policies should address diversification of funding sources, and stability of those sources. - BARS monitors, through reporting, the 15 largest depositors of the bank on the quarterly basis. - Maintenance of cash liquidity: - Maintain average ten days of liquidity in cash assets at the level of at least 10 percent of the amount of short-term funds but not less than 5 percent on any given day. - Decision on Minimum Standards for Liquidity Risk Management—banks must meet the following regulatory requirements: - supervisory board of the bank has to ensure that the bank has, and that it implements, an appropriate program for liquidity risk management, which also includes liquidity policies, which it is under obligation to analyze periodically and adjust to changes in economic and market related conditions; - bank management has to prepare and submit to the supervisory board proposals for programs and policies for liquidity risk management; - procedures to assess current and projected liquidity needs; - design and establish reporting systems for supervisory board; - bank management plans for contingent situations and shocks that may pose a threat on bank liquidity; - bank policies have to identify sources and scope of liquid assets that are necessary for ensuring continuous and stable operations; - the bank has to define, apply, and continuously develop detailed and efficient procedures for monitoring, inspection, and management of bank liquidity, which have to correspond to the size and complexity of the bank, policies for liquidity management, and information management system, as well as to investment policy; - the bank has to appoint a person responsible for liquidity management and inform the BARS on his appointment; - the bank has to establish an information management system that is adequate for the needs of the bank in liquidity management; - the system of liquidity management of the bank has to be subject to continuous and periodic inspections by internal controls and internal audit of the bank. - Sectoral note: - The banking sector in RS does not contain any banks that have their banking subsidiaries in other states. - Some of the banks in RS are members of groups of international banks; however the banks are under obligation to apply local regulations, and international banks support them from the aspect of maintaining their liquidity positions. - Implementation note: - As part of implementing Basel III, the FBA will analyze the existing regulatory framework and adopt: the liquidity coverage ratio—LCR, and the Net Stable Funding Ratio, NSFR, as an obligation for regularly conducting liquidity stress tests by banks. ### Operational risk framework (Principle 25) - Supervisor determines that banks have adequate operational risk management frameworks that take into account their risk appetite, risk profile and market and macroeconomic conditions. This includes prudent policies and processes to identify, assess, evaluate, monitor, report and control or mitigate operational risk on a timely basis. - Article 3 of the Decision on Minimum Standards for Operational Risk Management in Banks requires banks to establish: - policies and procedures for operational risk management that: - identify existing potential sources of operational risk (OR) and sources that may onset upon introducing new operating products, systems, or activities; - measure OR, by performing accurate and timely assessment of that risk; - continuous control of OR with the objective of maintaining this risk on a level acceptable for the risk profile of the bank; - ensure continuous monitoring of OR by analyzing the stock, changes, and trends of exposure of the bank to that risk; and - establishment of the amount of the minimum adequate capital for protection from onset of losses on the basis of OR; - clearly defined authorities and lines of responsibilities in the process of assuming and managing OR; - a system that ensures that all employees of the bank are informed of their obligations in the process of OR management; - a system for regular reporting of the supervisory board and bank management on the functioning of the system for OR management; and - obligation of periodic reexamination, as well as the obligation of the supervisory board of the bank to perform, at least once a year, analysis and adequacy assessment of the system established for OR management. - Article 4 on identification of potential sources of OR—banks must identify risks that result from: - inadequate information management and other systems in the bank; - disturbances in operations and malfunctioning in the systems, such as malfunctions related to information technology, telecommunication problems, interruptions in work; - problems with the adequate integration or sustainability of information technology and other systems, in case of development of a network of different organizational parts and/or status changes in the bank; - illegal and inadequate conduct of employees of the bank, such as fraud and unauthorized access to client accounts, abuse of confidential information, provision of false or incorrect information on the condition of the bank, tardiness in performing tasks, errors in data entry, failure to comply with good business practices in work, etc; - acting or failing to act that may cause or have caused court and other disputes against the bank; - external illegal actions, such as robberies, unauthorized entry into the database of the bank, including unauthorized utilization of ATMs, unauthorized transfer of assets, illegal acquisition of bank documents, etc.; - damages to physical assets and events that cannot be anticipated, such as natural and other disasters, terrorism, etc. - Capital treatment and reporting: - Banks are under obligation to determine capital requirements for operational risk according to the basic indicator approach and to record all losses and form a database on that. - BARS, since 2009, has been implementing minimum standards for operational risk management – basic indicator approach (bylaws – decision and regulatory reporting). *Source: _cr15214 - 1. maturity matching of assets and liabilities, where banks have to:* ### introduction of a more advanced approach – standardized approach for calculation of ### _cr15214 - introduction of a more advanced approach – standardized approach for calculation of ### Operational risk framework and inspections - The BARS assesses whether banks have an adequate framework for operational risk management covering appetite for risk, risk profile, and market related and macro-prudential conditions. - Expected prudential policies and processes include timely identification, assessment, appraisal, monitoring, reporting, and control or mitigation of operational risk. - In comprehensive (scope) onsite inspections, BARS inspects: - assessment and application of policies and procedures for identification, measurement, management, and control of exposure to operational risk; - organization, defined authorities and lines of responsibilities for OR management; existence and operations of the corresponding body; - monitoring of OR indicators; method of collection and classification of data; information technology support; database on harmful events, historical data—age and comprehensiveness; - scenario analyses; quality, frequency and contents of information to competent bodies; - methods of management—reduction, mitigation, and prevention of OR; new products and risk assessment; - capital requirement for OR calculation and reporting; training of employees; role of internal audit; influence and reporting of the group. - Regulatory developments: - A Decision on Minimum Standards of Information Systems Management in Banks and a Decision on Minimum Standards for Outsourcing Management were adopted in early 2014. - A draft of the Decision on Calculating Bank Capital includes capital requirements for operational risk and anticipates application of the standard approach in addition to the basic indicator approach. The draft is intended to become effective on January 1, 2017. - From September of 2014, outsourced activities became subject to targeted inspections by the Department for Information Technology Systems (previously inspected only within comprehensive onsite inspections). ### Outsourcing rules and supervisory powers - Banks intending to outsource a materially significant activity must inform the BARS 90 days before concluding the contract and submit the supervisory board decision on intended outsourcing. - Documentation required (per Article 18 of the Decision on Outsourcing) includes: - assessment of risks connected with intended outsourcing; - results of in-depth analysis of the service provider; - exit strategy for intended outsourcing; - responsible persons and departments for supervision and management of the contractual relation; - internal enactments (program and policies for risk management connected with outsourcing, assessment of material significance etc); - draft contract. - Outsourcing contracts must comply with Article 14 of the Decision on Outsourcing; banks must ensure contractual provisions match outsourcing-related risks and stipulate expected quality and level of services and method of supervision (Article 16). - If BARS determines inadequate risk management related to intended/existing outsourcing, it may order specific conditions or prohibit the outsourcing. ### Principle 26 — Internal control and audit: description and findings - LOB article 63 assigns responsibility for establishing and conducting internal controls and internal auditing to the supervisory board. - BARS issued a Decision on Minimum Standards for Internal Control in Banks and a Decision on Minimum Standards for Internal and External Auditing in Banks. - The Decisions (Articles 2, 3, 5) require a system of internal control and an independent internal audit in all organizational parts of the bank. - BARS assesses the framework of internal control and the functioning of an independent internal auditor, including delegation of authorities, separation of functions, reconciliation, and safeguarding assets. - Comments: No comments with regard to internal control and internal audit. ### Principle 27 — Financial reporting and external audit: description and findings - LOB article 103 requires banks and subsidiaries to maintain accounts and records at all times and prepare annual financial statements presented in form and content corresponding to law, international standards, and BARS regulation; international standards referred to are IFRS and IASB guidance. - LOB article 104 requires external auditor’s opinion on whether financial statements fairly present the financial situation and are prepared in accordance with IAS and IFRS. - Practice and implementation issues: - Banks started implementing IFRS in 2010 after translation of IFRS 2009 into Serbian. Newer IFRS versions have not been translated since 2009, so most (domestic) banks implemented IFRS 2009 and not IFRS 2014. - Some foreign banks follow IFRS 2014 as part of larger groups; smaller domestic banks depend on translation of 2009 IFRS. - Different external auditors treated this variably: some declared financial statements present fairly in accordance with IFRS; others refer to the Law on Accounting and Auditing, creating confusion. - There are only 6 audit firms with permissions to audit banks (“Big Four” and two domestic firms). Audit firms must be registered with the Ministry of Finance and auditors of banks need consent from BARS (Article 11 of Decision on minimum standards for banks’ internal and external audit function). - In practice BARS appoints the auditor on a yearly basis with a maximum term of five year, whereas article 38 of the LOBA states BARS may reject financial statements and request new financial statements and audit opinion from an external auditor appointed by BARS. BARS does not have power to rescind an external auditor. - Several qualified audit opinions occurred in the last five years. - Detailed asset quality reviews (AQRs) of five domestic banks under enhanced supervision revealed material under-provisioning of which only two have been corrected (including impact on capital). Results of the AQRs for two domestic banks are long overdue. - Comments (RS specifics): - Only IFRS 2009 was translated in RS; most domestic banks implemented IFRS 2009, foreign-group banks implemented actual IFRS. - Many external auditors base opinions on the law on accounting and auditing instead of IFRS, hindering comparability. - Appointment of external auditor annually with maximum term of 5 years and inability of BARS to rescind auditors has led to frequent turnover, risking continuity. - Cooperation between BARS and external auditors could be formalized; no periodic meetings and auditors do not routinely notify BARS of material events. - AQR findings of material under-provisioning raise questions on audit quality; audit quality assurance systems are in infancy with little capacity and no in-depth review of auditors’ work. - Recommendations (financial reporting & audit): - Address implementation of IFRS at MOF (full translation of IFRS). - Change law so auditor is not appointed one year, and can be sent away. - Change law so auditor audits compliance with IFRS (not with local law). - Improve interaction with external auditor (tripartite, notification). - Invest in IFRS (Don’t leave old system before ready). - Precondition: - Evaluate the quality of the external audit and the quality assurance system in relation to the outcomes of the AQR. ### Principle 28 — Disclosure and transparency: description and findings - LOB article 105 requires banks to submit to BARS their financial statement within 75 days after end of preceding financial year and external auditor’s report within 5 month after the end of the preceding financial year. Each bank shall publish the external auditor’s report in abbreviated form in one or more daily newspapers in BiH within 15 days after receiving it and submit a copy to BARS. - At the end of each six months banks must publish non-audited semi-annual reports including a balance sheet, names of supervisory and management board members and shareholders owning 5 percent or more of voting rights. Banks must publish non-audited semi-annual reports within 30 days after the first six months in one or more local newspapers and make copies available at each location. - Decision on the minimum scope, form and content of the program and statement on economic-financial audit prescribes minimum elements of the abbreviated auditor’s report, including: - basic bank information (title, address, phone, fax, swift code), composition of SB and auditing board, names of management, name of internal auditor, number of subsidiaries, number of employees, name of external auditor, names of shareholders with 5 percent or more voting rights; - auditor’s opinion and comments; - bank’s balance sheet; - bank’s income statement. - Disclosure practices: - Banja Luka Stock Exchange publishes financial statements and external auditor opinions on its website. - All 10 banks in RS published summary audit reports of 2013 in two daily newspapers and submitted evidence to BARS. BARS publishes summarized audit reports for all banks since 2000 on its homepage. - In practice the stock exchange verifies whether banks publish data that faithfully reflect financial status, but information is not easily accessible. - Disclosed information includes quantitative and qualitative items; some banks implemented IFRS 7 on disclosure (mostly foreign banks). - BARS has not implemented Pillar 3 of Basel II requiring disclosure of relation between risk profile and capital. - Comments: - Law and regulation require periodic disclosure; stock exchange publishes and verifies data but accessibility is poor. - More effort needed to disclose group structure including ultimate beneficiary owners and insider lending. - Recommendations (disclosure): - Disclose information on group structure including ultimate beneficiary owners and insider lending. - Address accessibility on the website of the stock exchange. ### Principle 29 — Abuse of financial services (AML/TF): description and findings - BARS authority for AML/TF supervision derives from article 5g of LOBA. - LOB article 101 (including 2011 amendments) requires banks to: - not acquire, convert, or transfer money/assets known or reasonably assumed to be proceeds of criminal offenses; - not initiate or facilitate transactions known or reasonably assumed to be for money laundering or financing of terrorism; - establish internal control and internal audit, and policies/procedures to detect and prevent transactions involving criminal activities, money laundering, or terrorism financing; - satisfactorily establish true identity of persons establishing business relations or performing transactions; - submit monthly report to BARS on transactions reported to the Financial Intelligent Department (FID). - State-level regulation: Law on prevention of money laundering and financing of terrorist activities (47/14) adopted in 2014 replaces Law on AML/TF (53/09). Decision on the minimum standard for prevention of ML/TF (289/12) prescribes minimum scope, form and content of banks’ AML/TF activities. - Required bank policies and procedures (Law on AML/TF 47/14 and Decision 289/12): - client acceptance policy (Decision article 5-8), - client identification policy (Decision Article 9-24), - continuous monitoring of accounts and transactions policy (Decision Article 25–30), - risk management policy (Decision Article 31–42). - Roles and processes: - Suspicious clients/transactions must be reported to FID before the transaction is made; at end of each month banks report to BARS all suspicious transactions they informed the FID about. - BARS reports to FID if it becomes aware of additional suspicious clients/transactions (article 81 Law on AML/TF). - FID receives, collects, records, investigates and analyzes information and submits it to Prosecutor’s Office when prescribed and gives feedback to BARS (article 82 Law on AML/TF). - Supervisory practice: - Supervisors have a comprehensive AML manual covering key elements. Supervisors conduct comprehensive AML/TF inspection every two years and ad hoc inspections for suspicious transactions, executed by a specialist unit within BARS. - BARS assesses internal audit, compliance officers, screening, training, and IT for monitoring. Corrective actions under LOB (article 125) and Law on AML/TF (articles 83 and 84) are available. - Observations and remarks: 1. Supervisory awareness of inherent ML/TF risk profiles could be strengthened—current focus is on quality of risk management rather than inherent risk from client/product/location exposure. FID noted the real estate sector as most vulnerable, but did not connect risks to the banking sector. 2. Follow-up of findings: deficiencies are processed through reporting, bank comments, and written orders with deadlines. In practice BARS conducts follow-up not immediately but during the next supervisory cycle inspection. 3. Cooperation between BARS and FID is arranged in an MOU; feedback loop could be enhanced by sharing knowledge—BARS holds information on suspicious transactions and inherent bank risk profiles; FID holds sector-sensitive information (e.g., real estate). Feedback on nature of suspicious transactions from FID could help BARS. 4. BARS appears not to conduct on-site inspection of ML/TF activities at branches located outside the RS but with head-quarters inside the RS; those branches must comply with AML/CTF laws and reporting. - Comments: - BARS makes reasonable efforts and recent legal/regulatory updates (Law 47/14, Decision 289/12) cover key AML/TF elements. Observed areas for improvement: identifying inherent ML/TF risk profiles and risk-based supervisory intensity (see CP 8), strengthening follow-up (CP 11), enhancing BARS–FID feedback loop, clarifying which authority conducts onsite inspection of cross-entity branches (discuss with FBA). - Recommendations (AML/TF): - Put more effort in identifying the inherent ML/TF risk profiles of banks. - Conduct risk based inspections instead of inspections according to fixed cycle. - Enhance the follow-up of findings. - Enhance the cooperation between BARS and FID. - Discuss with FBA who executes the onsite inspection of AML/TF in the cross entity branches. - See also precondition on AML/TF paragraph 40 and 41. *Source: _cr15214 - introduction of a more advanced approach – standardized approach for calculation of capital requirements for operational risk (excerpt).* ### Appendix III. Differences Between Basel II Weights and ### Appendix III. Differences Between Basel II Weights and FBA/RS Weights ### Cash assets and short-term deposits - cash; demand deposits and termed deposits with maturity of up to 30 days in accounts of banks that are, according to the most recent ranking performed by Standard & Poor’s, Fitch – IBCA, Thompson Bank, ranked BBB at least, or Baa3 at least id the ranking was performed by Moody’s. - FBA/RS weight: 0 percent - Basel II weight: 0 percent; 20 percent (appears for another category in table) ### Receivables from central governments, central banks, and related guarantees - receivables from central governments of countries in zone A (OECD members); - FBA/RS weight: 0 percent for country members of EU - FBA/RS: For other countries, depending on the credit rating - receivables on the basis of direct and indirect debt from RS government, FBiH government, and Council of Ministers of BiH; securities issued by those persons and receivables secured by their unconditional guarantees payable on first call; - FBA/RS weight: 0 percent (if national discretion is applied) - receivables from CBBH and central banks of countries in zone A and receivables secured by their unconditional guarantees payable on first call; - FBA/RS weight: 0 percent (if national discretion is applied) - FBA/RS note: 0 percent for country members of EU; For other countries, depending on the credit rating ### Fixed assets and investments secured by cash deposits - fixed assets insured in full amount (buildings, equipment, and land); - FBA/RS weight: 100 percent - investments or portion of investments of the bank that are secured with collateral in the form of cash deposits with the same bank, under the condition that the contract regulates that right until the collection of the receivable of the bank, the cash deposit is, as collateral, tied to the specific credit relation; - FBA/RS weight: 0 percent ### Receivables from banks and other financial institutions - receivables from banks from countries in zone A, except on the basis of subordinated debts; - FBA/RS weight: 20 percent - Basel II: Depending on the credit rating (table indicates variation by credit rating) - receivables from banks with headquarters in countries of zone B with current maturity of up to 1 year, except on the basis of subordinated debts; - FBA/RS: Depending on the credit rating - receivables from international development banks; - FBA/RS weight: 0 percent - receivables from regional governments / lower level governments from countries in zone A; - FBA/RS: Depending on the credit rating - receivables from institutions that are financed from the budgets of BiH, FBiH, and RS, and from the budgets of central governments of countries in zone A; - FBA/RS: Depending on the credit rating - financial instruments in the process of collection; - FBA/RS weight: 20 percent - receivables from banks in BiH; - FBA/RS weight: 50 percent ### All remaining assets and out-of-balance sheet credit equivalents - FBA/RS weight: 100 percent - Basel II exposure-class weights listed in table: - 75 percent - exposure class - retail - 50 percent - operating real estate - 35 percent - housing real estate - 100 percent - other exposures - 150 percent - high risk exposures *Source: _cr15214 - Appendix III. Differences Between Basel II Weights and (PDF).* --- _Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2015/_cr15214.pdf_