Standard RA4.2. Reporting of operational risk events. Regulations and guidelines

Size: px

Start display at page:

Download "Standard RA4.2. Reporting of operational risk events. Regulations and guidelines"

Dorcas Chandler
6 years ago
Views:

1 Standard RA4.2 Reporting of operational risk events Regulations and guidelines

2 THE FINANCIAL SUPERVISION AUTHORITY until further notice J. No. 4/120/ (11) TABLE OF CONTENTS 1 Application Target group 3 2 Objectives and structure Purpose of the standard Structure of the standard 5 3 Legal basis 6 4 Immediate reporting of disruptions and faults in operations 7 5 Substantial mistakes in the publication of the value of fund units 9 6 Further information 10 7 Record of amendments 11

3 THE FINANCIAL SUPERVISION AUTHORITY until further notice J. No. 4/120/ (11) 1 APPLICATION 1.1 Target group (1) This reporting standard is applicable to the following companies, generally referred to here as supervised entities: credit institutions investment firms fund management companies Finnish holding companies of credit institutions' or investment firms' consolidation groups the central body of cooperative banks as referred to in the Act on Cooperative Banks and Other Cooperative Credit Institutions Finnish parent companies of financial and insurance conglomerates primarily engaged in financial activities.

4 THE FINANCIAL SUPERVISION AUTHORITY until further notice J. No. 4/120/ (11) 2 OBJECTIVES AND STRUCTURE 2.1 Purpose of the standard (1) This reporting standard specifies the supervised entities' obligations of reporting operational risks and it is connected to Standard 4.4b on management of operational risks (under section 4 Capital adequacy and risk management in the set of regulations). (2) The supervised entity shall notify the Financial Supervision Authority (FSA) without delay of substantial disruptions and damaging events in the operations and as soon as possible submit a detailed written report on the event. (3) In addition, this reporting standard provides instructions on the reporting to the FSA of substantial mistakes in the publication of the value of fund units as referred to in section 98 of the Mutual Funds Act. (4) This reporting standard renders the FSA Guideline on the reporting of cases of malpractice in credit institutions and crimes against credit institutions obsolete. Thus the FSA no longer requires regular reports on internal cases of malpractice and crimes in the supervised entities nor on crimes and malpractice committed by external parties. (5) The FSA draws the supervised entities' attention to the provision in section 5.6 of the Standard on management of operational risk, according to which the senior management shall receive regular reports on operational risks and damage incurred. The reports shall comprise financial information, qualitative analyses, assessments of compliance with internal and external instructions, as well as information on external events of importance to decision making and changes in the operating environment.

5 THE FINANCIAL SUPERVISION AUTHORITY until further notice J. No. 4/120/ (11) 2.2 Structure of the standard (1) Chapter 4 provides instructions on the reporting to the FSA of problems related to IT systems and customer services. Chapter 5 on the continuous reporting of substantial mistakes in the publication of the value of fund units only concerns fund management companies.

6 THE FINANCIAL SUPERVISION AUTHORITY until further notice J. No. 4/120/ (11) 3 LEGAL BASIS (1) The FSA ruling is based on section 15, subsection 2 of the Act on the Financial Supervision Authority. The provisions on the reporting of substantial mistakes in the publication of the value of fund units are based on section 98 of the Mutual Funds Act.

7 THE FINANCIAL SUPERVISION AUTHORITY until further notice J. No. 4/120/ (11) 4 IMMEDIATE REPORTING OF DISRUPTIONS AND FAULTS IN OPERATIONS (1) The supervised entity shall without delay submit an informal notification to the FSA, when substantial disruptions and faults in services provided to the customers and in payment and IT systems have occurred. Faults and disruptions damaging or jeopardising the supervised entity's capacity to continue its business activities or fulfil its obligations shall also be reported to the FSA without delay. (2) The informal notification and the written report mentioned below at (4) shall, as a minimum requirement, be submitted concerning disruptions of the following type: unauthorized access to IT systems spreading of malicious software to IT systems denial-of-service attacks (3) The following disruptions shall also be reported, if they affect the quality of the services provided to the customers: software failure data communication failure computer downtime and hardware failure (4) As soon as possible after the advance notification, the supervised entity shall submit a written report to the FSA comprising the following information: reason for the disruption length of the disruption how the disruption was remedied

8 THE FINANCIAL SUPERVISION AUTHORITY until further notice J. No. 4/120/ (11) to what extent the disruption affected the supervised entity's services estimate of the scope of the damage what measures will be taken to prevent corresponding disruptions information on the supervised entity's contact person.

9 THE FINANCIAL SUPERVISION AUTHORITY until further notice J. No. 4/120/ (11) 5 SUBSTANTIAL MISTAKES IN THE PUBLICATION OF THE VALUE OF FUND UNITS Issued on 2 October 2007 Valid from 2 October 2007 (1) According to section 98 of the Mutual Funds Act, the fund management company shall without delay rectify substantial mistakes in the publication of the value of fund units. All mistakes having affected the published value of fund units shall be reported to the FSA without delay. (2) The report to the FSA shall, as a minimum requirement, comprise the following information: the false value and the corrected value the relative size of the mistake in comparison to the correct value of the mutual fund the error period the origin of the error the subscriptions and redemptions in euro amounts and numbers during the error period measures taken by the fund management company to prevent recurrence of the error information on the supervised entity's contact person. If the fund management company cannot submit all the above-mentioned data immediately, the company may report the mistake based on the available data and supplement the report as soon as possible.

10 THE FINANCIAL SUPERVISION AUTHORITY until further notice J. No. 4/120/ (11) 6 FURTHER INFORMATION Please find the necessary contact information in the list of Persons responsible for standards provided on the FSA website. For further information, please contact:

11 THE FINANCIAL SUPERVISION AUTHORITY until further notice J. No. 4/120/ (11) 7 RECORD OF AMENDMENTS (1) When it entered into force on 1 January 2005, this standard rendered the following FIN-FSA guideline obsolete: Guideline on the reporting of cases of malpractice in credit institutions and crimes against credit institutions. (2) The standard has been changed as follows: Issued on 2 October 2007, valid from 2 October 2007: A changed FIN-FSA interpretation has been taken into account in paragraph (2) of chapter 5. All versions of the standard have been gathered under Regulation/FSA standards on FIN-FSA's website.

How to read a standard

Standard 4.7 Reporting of liquidity risk Regulations and guidelines How to read a standard A standard is a collection of subject-specific regulations and guidelines which both obliges and guides supervised