PUBLIC DISCLOSURE ON THE ASSESSMENT OF OBSERVANCE OF THE PRINCIPLES FOR FINANCIAL MARKET INFRASTRUCTURES NATIONAL INTERBANK TRANSACTION MANAGEMENT AND EXCHANGE (NITMX), CO., LTD. 1 Aug 2018
Usage of this report This report is intended solely for the information and use of National ITMX Co., Ltd. ( NITMX ), is not intended to be, and should not be used by any other person or entity. No other person or entity is entitled to rely, in any manner, or for any purpose, on this report. NITMX or Deloitte Touche Tohmatsu Jaiyos Advisory Co., Ltd does not accept or assume responsibility or liability to anyone for any reliance, which may be placed on this report by any party. 2
Responding Institution Jurisdiction Authority Regulating National ITMX Co., Ltd. ( NITMX ) Thailand Bank of Thailand Date of Disclosure 1 Aug 2018 1 EXECUTIVE SUMMARY The Principles for Financial Market Infrastructures (PFMI) are the international standards for financial market infrastructures, i.e., payment systems, securities settlement systems, central securities depositories, etc., which were published by the Committee on Payments and Market Infrastructures International Organization of Securities Commissions (CMPI- IOSCO) in 2012. National ITMX ( the Company or NITMX ) is considered an FMI by the Bank of Thailand, and therefore must adhere to applicable principles by completing an assessment. This report is prepared by Deloitte Touche Tohmatsu Jaiyos Advisory Co., Ltd appointed by NITMX to conduct an assessment on the Company s observance based on Principles for Financial Market Infrastructures: Disclosure Framework and Assessment Methodology. The purpose is to assess the Company s compliance of the PFMI, and by doing so, to identify potential risks and/or deficiencies to address for improvements. Information taken into consideration during the assessment included the Company s policies, operating rules and procedures, interviews with key stakeholders, details of the Company s system services and mechanisms and statistics. The following is the summary of assessment: 2 ABOUT NATIONAL ITMX, CO., LTD. The Company was founded under the name ATM Pool Company Limited in 1993, which was renamed National Interbank Transaction Management and Exchange (ITMX) Company Limited in July 2005 in order to expand and extend the Company s business scope as per Bank of Thailand Strategic Payment Roadmap. This was created to satisfy Thailand s requirement to keep up with continuing advancement in electronics commerce and payment system of the world. 3
Under direction from the Payment Systems Committee (PSC), Bank of Thailand, the Company is set up to be the key inter-bank payment infrastructure and central data processing operator that exchanges, manages, and processes data across member banks/organizations in order to support e-payment, electronic fund transfer, etc. The system supports all kinds of electronic payments and funds transfer from various channels including ATMs, counters, internet, phone and mobile channels. To foster the interoperability among banks, the system utilizes open platforms that are secured, efficient, and has the ability to respond rapidly to the ever-changing business environment. It provides payment infrastructure to bring Thailand's electronic commerce and payment system to the same level as international best practices. The shareholders of National ITMX are major domestic commercial banks in Thailand. National ITMX services to member banks and receives its revenues in forms of membership fees and switching fees. Source: http://www.itmx.co.th/homepage/companyinfo 2.1 Legal and Regulatory Framework The Company s services and activities are regulated by the Bank of Thailand and governed by Thai Law. Prospective member banks of the Company are required to sign a Master Agreement, which specifies the terms and conditions that apply to all the transactions entered into between them. The Company applies the following jurisdictions in all Master Agreements with its member banks and cross borders: Substantive Law the provision of law to interpret terms and conditions in the Master Agreement. This law discusses what is allowed and what is not allowed to be done by the involved parties. Adjective Law articulates the rules on how it is going to be enforced. For Master Agreements between the Company and its member banks, Thai Law is used for both Substantive and Adjective Laws, whereas for Master Agreements between the Company and its cross border partners, Substantive Law under Singapore Law and Adjective Law under Thai Law are used. Additionally, the Company has a Certificate of License from The Electronic Transactions Commission to operate and provide services to its member banks. 2.2 Enterprise Risk Management Framework The Company has implemented the Enterprise Risk Management (ERM) Framework that supports the Management s decision making in terms of measurement, identification and monitoring of identified and potential risks of the organization. It includes risk policies, processes and procedures along with the Company s risk appetite. 4
Moreover, the Company has a policy on risk tolerance which states that the risk of variability or deviation are often communicated in terms of acceptable or unacceptable outcomes or limited levels of risk. 2.3 Scope of Assessment Payment system committee under Bank of Thailand (BOT) defined National ITMX Co., Ltd as Prominently Important Retail Payment Systems: PIRPS. It requires National ITMX Co. Ltd to do an assessment in alignment with the following 14 Principles for Financial Market Infrastructures (PFMIs). 5
2.4 Assessment Methodology This assessment has been carried out using PFMI s Rating framework for assessments of principles as set out below: Criteria Observed (O) Broadly observed (BO) Partly observed (PO) Not observed (NO) Not applicable (NA) Description The FMI observes the principle. Any identified gaps and shortcomings are not issues of concern and are minor, manageable and of a nature that the FMI could consider taking them up in the normal course of its business. The FMI broadly observes the principle. The assessment has identified one or more issues of concern that the FMI should address and follow up on in a defined timeline. The FMI partly observes the principle. The assessment has identified one or more issues of concern that could become serious if not addressed promptly. The FMI should accord a high priority to addressing these issues. The FMI does not observe the principle. The assessment has identified one or more serious issues of concern that warrant immediate action. Therefore, the FMI should accord the highest priority to addressing these issues. The principle does not apply to the type of FMI being assessed because of the particular legal, institutional, structural or other characteristics of the FMI. 6
3 GENERAL BACKGROUND 3.1 Products, Services and Participants The Company offers the following products and services to its member banks: Single Payment System Services Bulk Payment System Services Local Switching System Services NSW Bank Gateway System Services Card Fraud Monitoring and Detection Services ITMX e-gp Bank Gateway PromptPay PromptCard Below is the list of the Company s member banks and cross border partners: Member Banks Bank of Thailand Bangkok Bank Public Company Limited (BBL) Kasikorn Bank Public Company Limited (KBank) Krung Thai Bank Public Company Limited (KTB) JP Morgan Chase Bank, Bangkok Branch (JPMC) TMB Bank Public Company Limited (TMB) Bank of Ayudhya Public Company Limited (BAY) Mega International Commercial Bank Public Company Limited (MEGA ICBC) Bank of America National Association (AMERICA) Government Savings Bank (GSB) The Hong Kong and Shanghai Banking Corporation Limited (HSBC) Deutsche Bank Aktiengesellschaft (DB) Islamic Bank of Thailand (ISBT) Tisco Bank Public Company Limited (TISCO) Kiatnakin Bank Public Company Limited (KK) Industrial and Commercial Bank of China (Thai) Public Company Limited (ICBC Thai) Thai Credit Retail Bank Public Company Limited (TCRB) Land and Houses Bank Public Company Limited (LH Bank) Siam Commercial Bank Government Housing Bank ANZ Bank (Thai) Public 7
Public Company Limited (GHB) Company Limited (ANZ) Citibank, N.A. (CITI), Bangkok Branch Sumitomo Mitsui Banking Corporation (SMBC) Standard Chartered Bank (Thai) Public Company Limited (SCBT) CIMB Thai Bank Public Company Limited (CIMBT) United Overseas Bank (Thai) Public Company Limited (UOBT) Bank for Agriculture and Agricultural Cooperatives (BAAC) Mizuho Corporate Bank Limited (MHCB) BNP Paribas, Bangkok Branch (BNPP) Bank of China (BOC) Thanachart Bank Public Company Limited (TBank) Sumitomo Mitsui Trust Bank (Thai) PCL (SMTB) Krungthai Card Public Company Limited (KTC) AEON Thana Sinsap (Thailand) Public Company Limited (AEON) Cross Border Partners Malaysia (Paynet) Vietnam (Napas) Indonesia (Rintis, Artajasa) Philippines (BancNet + MegaLink) South Korea (KFTC) 3.2 How does the Company s Products and Services Work? A summary of how the Company s products and services works is detailed on its website. It can be accessed via the link below: http://www.itmx.co.th/homepage/service/index 8
3.3 Who Can Use the Company s Products and Services? The Company s products and services can be utilized by banks and other financial institutions that have direct access to the Company s infrastructure. 9
4 SUMMARY OF KEY POINTS ARISING FROM ASSESSMENT OF EACH PRINCIPLE Principles Summary 1 Legal Basis An FMI should have a well-founded, clear, transparent, and enforceable legal basis for each material aspect of its activities in all relevant jurisdictions. 2 Governance National ITMX Company, Ltd. (the Company ) is a legal entity owned by Thai banks, namely the following: Bangkok Bank Krungthai Bank Kasikorn Bank Siam Commercial Bank Krungsri Bank Thai Military Bank United Overseas Bank Standard Chartered Bank (Thai) CIMB Thai Thanachart Bank In order to operate the payment services, the Company has a Certificate of License from The Electronic Transactions Commission to provide services to its member banks. The Company s services and activities are regulated by the Bank of Thailand. Prospective member banks of the Company are required to sign a Master Agreement which specifies the terms and conditions that apply to all the transactions entered into between them. For Master Agreements between the Company and its member banks, Thai Law is used for both Substantive and Adjective Laws, whereas for Master Agreements between the Company and its cross border partners, Substantive Law under Singapore Law and Adjective Law under Thai Law are used. An FMI should have governance arrangements that are clear and Based on the Board Manual, the roles and responsibilities of the Board of Directors (BOD) consist of the following: 10
transparent, promote the safety and efficiency of the FMI, and support the stability of the broader financial system, other relevant public interest considerations, and the objectives of relevant stakeholders. 3 Framework for the comprehensive management of risks An FMI should have a sound risk-management framework for comprehensively managing legal, credit, liquidity, operational, and other risks. Identify the Company s policies, strategy and goals, Approve Company s policies and Company s direction, Govern the management team to operate in alignment with the policies, Control and monitor the Company s Risk Management Policy and setup risk appetite, Review and approve Business Plan as well as the Company budget, Approve related risks and BOT policies, Monitor and contribute to the improvement of the Company s processes in cases when external auditors detected process gaps/issues, Responsible in sourcing for the external auditors to independently evaluate the management and Company s operations, Maintain the Company s sustainability by achieving short term profit in consideration of the business risks, and Define the role and responsibilities of Company committees, Management Director and Management Team. The Board of Directors (BOD) consist of 9 members 6 of which are from major banks in Thailand, 1 is from Thai Bankers Association, 1 is the Managing Director, and 1 member is independent. On an annual basis, each member of the Board of Directors (BOD) fills-in the Self-Assessment Form in order to evaluate themselves and the BOD as a whole. Results of the performance evaluation are communicated to the Chairman of the Company through Secretary Office. The Company has set up a Risk Management Policy which states the rules and regulations, effective date, risk management principles, roles and responsibilities of the Board, Audit and Risk Committee, and other key officers. Also, the Company has a procedure manual that outlines the risk management process, reporting procedures, and the evaluation of the effectiveness of the Company s risk and internal control procedures. The Company performs a risk assessment to identify, analyze and evaluate the risk of disrupting the organisation s prioritized activities and processes, systems, 11
information, people, assets, and other resources that support them. The Company maintains a Corporate Risk Register which includes the description of risks, corresponding ratings, how to mitigate these risks, and the responsible party for the mitigation. Such risk register is reviewed on an annual basis based on the Risk Management Policy of the Company. The Master Agreement between the Company and its member banks provides a clause with regard to risk management between the parties. The Company has the Recovery & Resolution strategy which is to hold cash in a dedicated accounts amounting to 6 months of expenditure. This dedicated account can only be drawn upon in the event of a financial crisis and with the approval of the Board of Directors. The Recovery & Resolution strategy is approved by the management. 8 Settlement Finality An FMI should provide clear and certain final settlement, at a minimum by the end of the value date. Where necessary or preferable, an FMI should provide final settlement intraday or in real time. 9 Money Settlements Based on the technical specifications, if the response code exchanged between the banks is to 00, then it means that transaction is final; this is the indication of settlement finality. Should there be any dispute, a dispute resolution mechanism is in place, which should be followed by the parties. The Company performs settlements on the following slots: Cross Borders once a day (business day) at 3:00 PM Member Banks once per business day per scheme/service (i.e., PromptPay, Single Payment, etc.) An FMI should conduct its money settlements in central bank money where practical and available. If central bank money is not used, an FMI should minimize and strictly control the credit and liquidity risk arising from the use of commercial bank money. Settlement for Member Banks The Company creates a settlement file and submits to BOT CSS system before cut-off time. The BOT CSS system sends the instruction to Bahtnet system in BOT to validate the account balance of the member bank. If there is enough balance for the settlement, BOT directly calls to member banks to transfer the amount based on the settlement file. The member bank then transfers the required amount based on the settlement file to the accounts in the Bahtnet system. Once completed, the Bahtnet system sends the status message to BOT CSS system. The Company then 12
validates the status in the CSS system from time to time. Bahtnet system will, at the same time, automatically update the status of the settlement wherein the member banks will login to see the settlement status. Settlement for Cross Borders The Company s Finance Department gets the foreign exchange rate from the settlement bank. The member bank then sends data (settlement file and recon file) to the Company every before 9:00 AM of each day. After which, the Company consolidates data and calculates net settlement for member banks. If the Company's net settlement is greater than the switches, APN switches transfer money to the Company's account in USD, which will be transferred to the member banks in Thai Baht. On the other hand, if APN switches net settlement is greater than the Company's, member bank transfers money to the Company in Thai Baht, then company transfers money to APN switches in USD. 13 Participant Default Rules and Procedures An FMI should have effective and clearly defined rules and procedures to manage a participant default. These rules and procedures should be designed to ensure that the FMI can take timely action to contain losses and liquidity pressures and continue to meet its obligations. The Company maintains a documented Unwind Process for each service which contains the procedures in cases of member banks default (i.e., termination, bankruptcy, etc.). These procedures are documented under Section 8 of the mentioned document. In case member banks have internal liquidity issues, the Company will begin unwind process when BOT informs the Company's Bahtnet Controller that there is/are member banks which have not enough money to do settlement. BOT will authorize to cancel the transactions. The Company will contact member banks (in contact list) that it will proceed with the unwind procedure. The Company will then request from member banks to stop and delete transactions that are sent from member banks (this will come from the file prior to posting to customers account). After which, the Company will perform adjustments to settlements which will be relayed to the BOT. BOT will then perform validation of the information. After which, the Company will inform member banks of the adjusted settlements, will prepare Settlement Report in the Company's Web Portal, and will send Multilateral Funds Transfer (MFT) in BOT-CSS for addition or deduction of bank account of member banks on net position within defined BOT date. Finally, BOT will add/deduct bank account of member banks on net position in Bahtnet system as specified in MFT. In case BOT ordered the member banks to cancel the transactions, it will inform the Company's compliance 13
function to notify member banks to cancel the transactions. The Company will then inform such member bank to cancel the transactions. Finally, the Company will verify and prepare the settlement information before ordering the transfer by MFT file via BOT-CSS. The Company performs an annual testing/drill related to its member bank s default procedures. Test results are then communicated to the Company s Management, BOT, and member banks. 15 General Business Risk An FMI should identify, monitor, and manage its general business risk and hold sufficient liquid net assets funded by equity to cover potential general business losses so that it can continue operations and services as a going concern if those losses materialize. Further, liquid net assets should at all times be sufficient to ensure a recovery or orderly wind-down of critical operations and services. 16 Custody and Investment Risks An FMI should safeguard its own and its participants assets and minimize the risk of loss on and delay in access to these assets. An FMI s investments should be in The Company performs a risk assessment to identify, analyze and evaluate the risk of disrupting the organisation s prioritized activities and processes, systems, information, people, assets, and other resources that support them. As evidenced in the Company s Liquidity Policy, it has liquid assets, which consist of fixed deposits that can be redeemed quickly for working capital. In order to assess, check and review the amount of operating expense related to liquid assets, the Company has a strategy to monitor and review the costs at least more than twice per year to comply with the Liquidity Policy. Based on Liquidity Policy, the Company will do cash flow projection and statement of cash flow to control cash and to cover the debt payment in short term (1 month), intermediate (6-12 months) and long term (> 1year). If the Company does not have enough cash, it will convert its assets to cash. The Company has the Recovery & Resolution strategy, which is to hold cash in a dedicated accounts amounting to 6 months of expenditure. This dedicated account can only be drawn upon in the event of a financial crisis and with the approval of the Board of Directors. The Recovery & Resolution strategy is approved by the management. The Company does not use the service of any external custodians as it does not hold member banks assets (i.e., bonds, shares, and any money market instruments); only electronic messages are received from the member banks to facilitate the service. The Company has an Investment Policy which details the project investment policy/framework, risk assessment, 14
instruments with minimal credit, market, and liquidity risks. return of investments, prioritization of projects, criteria to approve the projects and how to monitor and track the project progress. 17 Operational Risk An FMI should identify the plausible sources of operational risk, both internal and external, and mitigate their impact through the use of appropriate systems, policies, procedures, and controls. Systems should be designed to ensure a high degree of security and operational reliability and should have adequate, scalable capacity. Business continuity management should aim for timely recovery of operations and fulfilment of the FMI s obligations, including in the event of a wide-scale or major disruption. 18 Access and Participation Requirements An FMI should have objective, risk-based, and publicly disclosed criteria for participation, which permit fair and open access. The Company has an Enterprise Risk Management (ERM) Framework that is designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. The Company s Data Center Operations Team has an internal SLA with regard to the monitoring of systems and day to day operations. This is documented in the Company s Procedures on Incident Management. The Company has procedures on Capacity Management, which explains the monitoring and forecasting of the capacity of the Company s IT Infrastructure in terms of network, system, and database. It also indicates the procedures to be performed, should there be any shortage from the capacity of IT Infrastructure. The Company has been certified with ISO270001 (Information Security Management System) which is designed to protect the Company s technology environment against IT security threats, which may affect its effectiveness. The Company maintains a Business Continuity Plan (BCP), which documents the procedures that guide the organisation to respond, recover, resume and restore company s mission critical business functions to a predefined level of operations following a disruption. BCP testing is conducted on an annual basis to ensure that the plan is effective in continuing business operations despite the business interruptions. There are existing Master Agreements between the following which are in accordance with Thai Law: Between the Company and its member banks; and Between the Company and its Cross Borders This document specifies the terms and conditions that apply to all the transactions entered into between them. Meetings and/or workshops with member banks and cross borders are conducted to discuss concerns about the contracts. Should there be any changes in the services 15
indicated in the Master Agreement, an Amendment for such Service is created. The Company has a documented Policy on New Member Bank which details the procedures as to the selection of new member banks under Section 5. 19 Tiered Participation Arrangements An FMI should identify, monitor, and manage the material risks to the FMI arising from tiered participation arrangements. Rating: Not Applicable This principle does not apply to the Company since based on the Policy on New Member, non-member banks are not allowed to directly connect to the Company s switches. 21 Efficiency and Effectiveness An FMI should be efficient and effective in meeting the requirements of its participants and the markets it serves. The Company will consult and inform Thai Bankers Association and its member banks about their new product and service. Once they agree, they will design the settlement agreement, they will have governance and use of technology and procedures. The Company has a documented Policy on New Member Bank which details the procedures as to the selection of new member banks under Section 5. The arrangement of the Company with its member banks, specifying the terms and conditions that apply to all the transactions entered into between them, is governed by a Master Agreement. Monitoring of number of transactions is performed by the Company and is regularly reported to the member banks. 22 Communication Procedures and Standards An FMI should use, or at a minimum accommodate, relevant internationally accepted communication procedures and standards The Company uses the following internationally accepted messaging standards: ISO 8583 Single Payment Local Switching 16
in order to facilitate efficient payment, clearing, settlement, and recording. 23 Disclosure of Rules, Key Procedures, and Market Data An FMI should have clear and comprehensive rules and procedures and should provide sufficient information to enable participants to have an accurate understanding of the risks, fees, and other material costs they incur by participating in the FMI. All relevant rules and key procedures should be publicly disclosed. ISO 8583 (Member Banks) / ISO 20022 (Internal within the switch) Prompt Pay As of February 2018, there is an ongoing feasibility study of ISO 20022 messaging standards to replace ISO 8583. The Company has documented rules and regulations per service being rendered, roles and responsibilities of member banks and the Company, and the daily end to end process how each system works. These are disclosed at the Company s website, which can be accessed by its member banks using their own user IDs and passwords. https://www.itmx.co.th/member/document/index 17