BANKING BUSINESS THEMED EXAMINATION PROGRAMME: PRUDENTIAL REPORTING SUMMARY FINDINGS

Transcription

1 BANKING BUSINESS THEMED EXAMINATION PROGRAMME: PRUDENTIAL REPORTING SUMMARY FINDINGS Issued: September 2014

2 CONTENTS 1 Introduction Objectives and limitations Methodology Regulatory requirements Findings Procedures for producing the Return Review and sign off of the Return Independent review of the production of the Return Use of spreadsheets Core module customer classification Credit module reporting of maturities Credit module reporting of group exposures Credit module reporting of corporate exposures Credit module reporting residential mortgage exposures Liquidity module misapplication of LBAs Liquidity module reporting on a worst-case basis Liquidity module reporting of average and lowest liquidity position Liquidity module reporting based on contractual maturity Other Prudential Data module misreporting fiduciary activity Other Prudential Data module geographic breakdown of deposits Other Prudential Data module use of exchange rates Other Prudential Data module schedule of memoranda Other Prudential Data module reporting of Large Exposures Conclusion Acknowledgements Page 2 of 10 September 2014

3 1 Introduction 1.1 Objectives and limitations This report provides a final overview of the findings from a series of themed examinations conducted by the Banking division of the Jersey Financial Services Commission (the Commission ) on the topic of prudential reporting by Jersey banks. The report incorporates interim findings published in March 2012, together with matters identified during a further thirteen onsite examinations conducted between 2012 and The Commission regularly undertakes on-site examinations on specific themes to assess the extent to which regulated entities are operating in accordance with their regulatory obligations under the respective Laws, Orders, Codes of Practice and Guidance Notes. These examinations focus on identifying instances where depositors, customers or the registered entity itself may be at risk or where standards and practices required by the regulatory regime are not being observed The Commission s on-site examination programme is designed to: assess the risks faced by the entity and review the controls, procedures, policies and processes in place to mitigate those risks; obtain a greater understanding of the entity s activities, thereby enabling the Commission to focus attention on higher risk areas; and take into account existing relevant information, review the resolution of any previous examination issues and to obtain assurance on any deficiencies highlighted through off-site supervision The purpose of this paper is to summarise the key findings from these examinations. It is not intended to comprehensively describe all risks that may be associated with non-adherence to regulatory obligations and not all Jersey deposit-takers face the issues described below. However, the observations made reflect areas of potential risk and are provided for general guidance. 1.2 Methodology This report draws upon the findings of 20 on-site examinations conducted by the Commission s staff between 2011 and The examinations focussed upon the production of the prudential return that deposit-takers are required to submit to the Commission on a quarterly basis (the Return ) and covered the following areas: procedures governing the production process; staff involved in the production process, their roles and reporting lines; IT applications involved in the production process; manual workarounds and areas identified for future development; the accuracy and completeness of the Return against the Commission s published guidance; September 2014 Page 3 of 10

4 overview and sign off of the Return; audit and compliance monitoring and findings; and backups and contingencies both systems and key person reliance Commission staff examined these areas with reference to the most recent Return submitted by the deposit-taker. Each examination resulted in an individual examination report setting out the Commission s findings and recommendations in respect of the firm examined. 1.3 Regulatory requirements Prudential returns must be supplied to the Commission in accordance with the specific requirements of section 6 of the Codes of Practice for Deposit-taking Business (the Codes ), issued under Article 19A of the Banking Business (Jersey) Law They are to be completed on a quarterly basis as at 31 March, 30 June, 30 September and 31 December by each Jersey deposit-taker registered under the aforementioned law The Return comprises of the following seven modules and should be completed in accordance with the guidance provided in the Schedule to the Codes: Core Financial Data; Credit Risk; Operational Risk; Market Risk; Trading Book; Liquidity Risk; and Other Prudential Data Submissions must be made using the Commission s electronic reporting process, which involves a secure website and use of a unique PIN and pass code. The Return must be submitted to the Commission on or before the 20th working day after the reporting date. 2 Findings 2.1 Procedures for producing the Return The Commission found that a number of the banks examined had not fully documented their procedures for the production of the Return. In such cases, the production of the Return relied heavily upon the skill and background knowledge of the reporting staff. Page 4 of 10 September 2014

5 2.1.2 As a result, the banks in question were exposed to an unacceptable level of keyperson risk, particularly in cases where the production process remained heavily reliant upon manual workarounds. Further, in the absence of fully documented procedures, it is difficult ensure that the production of the Return is being properly overseen and reviewed because the reviewer will not have a documented process to check against Banks are encouraged to ensure that they have documented written procedures for the production of the Return, incorporating any manual adjustments or workarounds. Ideally, the procedures should be capable of accommodating adjustments to the bank s business model, rather than simply mirroring the bank s reporting needs at a single point in time. The reporting procedures should also be subject to regular review to ensure that they continue to reflect the Commission s guidance. 2.2 Review and sign off of the Return Whilst all of the banks examined ensured that the Return was subject to a review prior to submission, in a number of cases, this consisted of little beyond an undocumented sense check of the figures against the reviewer s knowledge of the bank s activities during the reporting period. In order for there to be a consistent and comprehensive review of the Return each quarter, it is important that banks document which checks must be completed and can evidence that they have been performed through the use of a checklist or equivalent It is important that such checks do not overlook the non-financial data that forms part of the Return, for example statistics on staff headcount and suspicious activity reports. 2.3 Independent review of the production of the Return In a number of cases, the Commission found that the process for producing the Return had not been subject to regular independent review against the Commission s guidance. Where this was the case, the Commission noted that some banks had wrongly assumed that such testing fell within the scope of the annual certification of the year-end Return performed by their external auditor The Commission regards a regular independent review of the production process as an important safeguard and would therefore encourage banks to consider the scope of the work performed in this respect by their external auditors and, if necessary, to extend or supplement this with a periodic review of the bank s procedures for producing the Return. This should be undertaken by a suitably independent person (e.g. the external auditor or an internal compliance, audit or group finance function). 2.4 Use of spreadsheets In the majority of the banks examined, the production of the Return involved data being extracted from the general ledger and core banking systems and fed into bespoke spreadsheets created for compiling the Return. Such spreadsheets are likely to represent End User Developed Applications ( EUDAs ) and should therefore be subject to additional access and audit controls. September 2014 Page 5 of 10

6 2.4.2 The Commission has issued separate findings on this topic within its report on Information Security published in February Banks should identify EUDAs and ensure that they are subject to appropriate controls based on the level of risk that they represent, such as: file or folder level access controls; sheet and cell level protection; file naming conventions; version control; and data integrity checks A number of banks were found to have produced the Return by overwriting spreadsheets that had been used the previous quarter. This practice carries a high risk of mis-statement and error and the Commission would therefore strongly encourage the development and use of template documents when producing the Return. 2.5 Core module customer classification There are a number of parts of the Return that require a bank to report based on the classification of its customers. The Commission found that, in some cases, banks had arrived at this classification by reference to product type rather than to the characteristics of the underlying customer. It is important to avoid such assumptions as they may be unsound and could impact other parts of the Return such as the Liquidity module and the Depositor Compensation Scheme data provided in the Other Prudential Information module. 2.6 Credit module reporting of maturities When completing the Credit module of the Return, banks are required to report their exposures based upon the original tenor of their maturity, as opposed to their residual time to maturity The Commission has identified that a number of banks have failed to follow this guidance and have reported their exposures based upon their residual time to maturity. This approach can potentially overstate a bank s risk asset ratio because exposures with an original maturity exceeding three months may attract a higher risk weighting Banks must ensure that they are reporting in accordance with the relevant guidance when completing the Credit module. 2.7 Credit module reporting of group exposures The Commission found that some banks had misreported exposures to their own banking group. This tended to occur where the bank had an exposure to a subsidiary within its own group and had wrongly assumed that the risk weighting assigned to its parent would apply to the exposure. Page 6 of 10 September 2014

7 2.7.2 Banks must ensure that they reflect the credit rating (or lack thereof) of the relevant legal entity when reporting exposures to members of their own banking group. 2.8 Credit module reporting of corporate exposures Under the Standardised Approach to credit risk, claims on corporates are assigned a risk weighting between 20% and 150%, based on the credit rating of the legal entity concerned. The Commission identified that, in some cases, banks did not hold details of the credit ratings of their corporate counterparties and had therefore applied the 100% risk weighting appropriate for unrated entities to all of their corporate exposures. In cases where the bank is unaware of the current credit rating of the counterparty (or it does not know whether a credit rating exists) the prudent approach would be to apply the 150% risk weighting relevant for entities rated below BB Credit module reporting residential mortgage exposures Residential mortgage exposures meeting certain criteria under Appendix H of the Commission s Guide to the Standardised Approach to Credit Risk attract a favourable risk weighting treatment. Where the lending in question is to a corporate structure, Appendix H requires that the bank must have recourse to the beneficial owner. In a number of cases, the Commission identified that banks did not have direct recourse to the beneficial owner but were instead relying on a guarantee from a trustee or a personal investment company. Guarantees of this nature can be more difficult to enforce and the associated mortgage exposures do not meet the criteria for favourable treatment Liquidity module misapplication of LBAs The Commission has approved individual LBAs for a number of Jersey incorporated banks whereby the bank may replace the contractual outflow of funds with behaviourally predicted outflows when reporting its liquidity position. The manner in which the Commission will consider LBA requests is the subject of a separate guidance note available on the Commission s website During the course of the on-site examinations, it was found that five banks had misinterpreted the LBAs that had been approved by the Commission and were consequently misreporting their liquidity position. The Commission would urge any bank that has been granted LBAs to verify that these are being properly applied in accordance with the correspondence issued by the Commission at the time of approval. Banks should also consider whether their LBAs remain appropriate by regularly performing updated analysis of their deposit outflow data and liquidity stress testing Liquidity module reporting on a worst-case basis The Commission s Guide for completing the liquidity module states that a worstcase basis should be used when determining the timing of future cashflows, with assets recorded at the latest possible maturity and liabilities at the earliest This approach was not always observed in practice, particularly where banks were reporting items classified as Other Assets (A.9) and Other Liabilities (B.9). Some examples of inappropriate reporting are provided below: September 2014 Page 7 of 10

8 Item Time bucket used Appropriate treatment Capital investments in Inflow at sight 5 years and over subsidiaries Plant, equipment and Inflow at sight 5 years and over premises Debtors and prepayments Inflow at sight Realistic worst case Expired loan facilities pending renewal Inflow at sight Expected maturity of renewed facility Current taxation Outflow 5 years and over When payable Items in suspense (liabilities Outflow 5 years and over Realistic worst case only) Interest payable Outflow 5 years and over When contractually due 2.12 Liquidity module reporting of average and lowest liquidity position Banks are required to report their average and lowest daily liquidity position during the reporting period in both the sight to 1 week and the sight to 1 month time bands. The Commission found that some Jersey incorporated banks had calculated their average and lowest daily liquidity position using internal liquidity monitoring tools that did not follow the same methodology as the Commission s reporting Guide. This approach must be avoided as it could potentially lead to the Commission being misled as to the true liquidity position of the bank In the case of Jersey branches where daily liquidity monitoring is not being undertaken at branch level, the average and lowest reporting fields should be left blank Liquidity module reporting based on contractual maturity The Commission s reporting Guide for the liquidity module requires that cashflows should be reported based on the contractual maturity of the relevant asset or liability. The Commission noted that, in some cases, banks were reporting cashflows based on the re-pricing date of the relevant asset or liability, as opposed to the contractual maturity date. Again, this approach must be avoided as it could result in the bank reporting a misleading liquidity position Other Prudential Data module misreporting fiduciary activity Where a bank acts in a fiduciary capacity by placing or holding assets on behalf of customers in its own name, the transactions should be reported in the fiduciary activity section of the Other Prudential Data module of the Return. In a number of cases, the Commission found that banks had misinterpreted this requirement and consequently failed to report the full extent of the fiduciary activity that they were undertaking. This omission was especially prevalent where banks were acting as a trustee or custodian Assets held in a fiduciary capacity do not directly impact upon a bank s capital requirements; however, this section of the Return is important because it provides the Commission with an indication of the potential operational risks that a bank may be running through its fiduciary activities. Page 8 of 10 September 2014

9 2.15 Other Prudential Data module geographic breakdown of deposits Banks are required to provide a geographic breakdown of their deposit liabilities within the Other Prudential Data module of the Return. The relevant guidance for this section of the Return sets out which countries should be included under each of the following regional headings: Jersey resident depositors; Jersey financial intermediaries; UK, Guernsey and Isle of Man; Other EU members; European non-eu members; Middle East; Far East; North America; and Detail (other) The Commission found that a number of banks had failed to follow this guidance and had consequently misreported the geographic source of their deposit liabilities. Banks should check that their reporting is accurate and have procedures in place to deal with changes (e.g. new countries or EU accession countries) Other Prudential Data module use of exchange rates The Other prudential Data module includes information that must be extracted from the most recently published accounts of the ultimate parent bank. In cases where the parent bank accounts were in a different base currency to that of the reporting bank, the Commission found that the exchange rate used tended to be taken as at the date of the parent accounts, rather than the date of the Return. It is important that consistent rates are used throughout the Return and the Commission would therefore expect that any parental bank figures are re-calculated each quarter, where relevant Other Prudential Data module schedule of memoranda The schedule of memoranda should contain items on which further detail is required, either as a result of a specific request from the Commission (e.g. DCS data) or where there has been a material change as defined in the Guide to the Other Prudential Data module. The Commission found that a number of banks had not established a process by which material movements are flagged and considered for inclusion in the schedule of memoranda. Banks should adopt procedures to ensure that relevant movements are identified and reported to the Commission Other Prudential Data module reporting of Large Exposures All Jersey banks are required to provide a statement of their Large Exposures, being those in excess of 10% of Agreed Capital Resources. Whilst banks were found to be largely in compliance with the reporting requirements, there were some instances where the exposure had been reported based on the amount outstanding, as opposed to the total facility amount. The Commission also identified some examples where multiple exempt Large Exposures to the same counterparty had been reported on the basis of the shortest residual maturity, as opposed to the required maturity date of the largest single exposure. September 2014 Page 9 of 10

10 3 Conclusion 3.1 The foregoing is not intended as formal regulatory guidance, nor should it be taken to cover all relevant aspects of the subjects touched upon. 3.2 Overall, the Commission was pleased to note that banks generally were operating within the requirements of the relevant legislation, Codes and guidance. That said, this exercise has highlighted some potential areas for improvement and the Commission would therefore encourage all deposit-takers to consider the findings in this report in the context of their own business. 4 Acknowledgements 4.1 The Commission wishes to thank those banks that participated in this exercise for their cooperation and assistance. 4.2 The Commission would welcome comments on any of the contents of this report and would also be happy to address any concerns or questions that the reader may have in this respect. Any such communications should be addressed to the relevant Supervision manager or, where this does not apply, to: Darren Boschat Deputy Director, Banking Jersey Financial Services Commission Telephone: d.boschat@jerseyfsc.org Page 10 of 10 September 2014