A. Independence, Accountability and Transparency (BCP 1.2)

9. In instituting an internal audit function, the FMA has responded to one of the main recommendations in this field. The charter of the internal audit function provides for it to be answerable to the management board, having at the same time a direct reporting line to the supervisory board. The internal audit is conducted according to an approved annual audit. However, this plan has not yet been framed in the context of longer-term planning.³ This implies that, even if there are no statutory limitations to its remit, there are no guarantees that internal audits cover all activities, services and systems of the FMA. The Rechnungshof review assessed, in this respect, that the scope and coverage of internal audit’s actions should be enhanced.

B. Legal Framework (BCP 1.3)

10. Austria has transposed EU directives and supporting regulations in a timely and comprehensive fashion. In particular, implementation of the CRD and its complementary regulations has proceeded on schedule, thereby establishing an advanced legal framework in key areas of banking supervision.

11. Compared with the situation in existence at the time of the 2003 FSAP, the FMA has been entrusted with adequate regulatory powers. The framework encompasses,inter alia, close consultation with OeNB prior to the issuance of regulations, with the effect of involving both institutions and of committing them to monitor and supervise the observance thereof.

C. Legal Protection (BCP 1.5)

12. The main legal change since the 2003 assessment has been the clarification that individual staff members cannot be held personally liable for actions taken in the execution of their duties, and that suits for improper supervisory action should be directed against the Republic of Austria, not government institutions such as the FMA. In 2005, legislation was amended to clarify that the government is liable for the actions of a statutory external auditor only insofar as they were performed by that auditor in fulfillment of an order of the authorities. However, it is worth noting that, since then, several suits have been brought against the federal government claiming negligence in the execution of financial sector regulation and supervision. Cases have been brought that seem to have involved at most slight negligence. Furthermore, charges have been filed against staff of the FMA (although they have not been brought to court). These cases have involved the possible award of large sums in compensation, and have occupied significant supervisory resources. Thus, legal protection with respect to institutional liability (“Amtshaftung”) is weak.

D. Cooperation (BCP 1.6)

13. The FMA was actively involved in the elaboration by CEBS of a guidance paper on the principles and sound practices of home/host cooperation. It has committed itself to integrate these principles and practices into its own operational cooperation with foreign supervisors. Memoranda of Understanding (MoU) on supervisory cooperation have been signed or cooperation arrangements under the EU Directive are in place with EU supervisors for all countries where Austrian banks are operating or whose banks operate (directly or through the acquisition of Austrian institutions) in the country.⁴ With non-EU supervisors, the same has been effected, except where legal issues (notably with regard to bank secrecy provisions) impede the conclusion of an MoU. In the latter case, practical arrangements have been worked out to provide for modalities of cooperation as equivalent as feasible to the intra-EU approach.

14. The FMA has already coordinated to a very large extent the work on model approval (internal ratings-based (IRB) and advanced modeling approach (AMA) for operational risk) processes under the CRD in cooperation with host supervisors of Central Eastern, and Southern European (CESE) countries. Moreover, for large Austrian institutions having subsidiaries in these areas, the FMA and OeNB have set up and successfully tested a regime of simultaneous on-site inspections, covering the same topic or subject throughout a whole banking group, with a view on making one integrated and global assessment thereof.

15. Nonetheless, banks and the authorities (both the FMA and the OeNB) confirm that efforts to enhance cross-border cooperation need to be pursued further, especially in the light of the potential impact of CESE subsidiaries on Austrian banks and the role of foreign-owned banks in Austria. The authorities recognize that further progress in this area must remain a priority, for example, through the undertaking of group-wide risk assessments, coordinating stress testing, and the alignment of supervisory planning, and the conduct of joint crisis-preparedness exercises.

E. Permissible Activities (BCP 2)

16. FMA has established a database of licenses granted and made this publicly accessible, thus giving the general public a means for verifying the licit or illicit character of all offerings or solicitations made with regard to regulated financial services.

F. Licensing Criteria (BCP 3)

17. A modification has been made to the BWG, requiring that, for the establishment of branches or subsidiaries by credit institutions incorporated in non EU-countries, the country of origin must have in place a regime of consolidated supervision equivalent to that organized under EU-regulation. In case the credit institution concerned has pre-existing establishment(s) within the EU, FMA requires the institution of sub-consolidated supervision at least on an EU-level.

18. By application of the transposed CRD, an additional licensing requirement has been introduced in that any credit institution applying for a license shall have integrated within its organization and systems an Internal Capital Adequacy Assessment Process (ICAAP). Implicit reference is made to the requirements for such ICAAP as are laid down in CEBS’s guidance in this matter.

G. Major Acquisitions (BCP 5)

19. Changes to legislation will be made in the near future to implement relevant EU directives. Notwithstanding the absence of a formal legal requirement, FMA firmly encourages pre-notification of significant acquisitions and investments by credit institutions. This recommendation is observed in practice.

20. Nonetheless, it is strongly recommended that pre-notification be a legal obligation. Furthermore, the FMA needs to be fully empowered, on the basis of clear criteria (e.g., with regard to financial or risk impact, institutions capacity to manage and control the acquired entity, and transparency of group structures) to review and possibly object to large investments. In particular, the FMA must be able to intervene when a financial institution plans to acquire (or be acquired by) financial or nonfinancial affiliates, whereby the effectiveness of supervision is impaired. The FMA should also have enhanced powers to force financial institutions to unwind structures that impair effective supervision. Structures that obscure connections of ownership, ultimate beneficiaries, and large exposures (for example, through the use of complex holding companies and trusts) are of special concern.

H. Capital Adequacy (BCP 6)

21. Austria has fully transposed the CRD into national legislation. This implies that capital requirements are now imposed on the basis of the new approaches laid down therein. The opening for the use of IRB- and AMA-models; the requirement to calculate capital needs also for operational risk; and the introduction (under the so-called Pillar II of the CRD) of powers for the FMA to require additional capital coverage for other risks (such as interest rate in the banking book, concentration risk, country risk, etc.) constitutes a fundamental change compared to the more rigid and “mechanical” regime in place until recently.

22. It should be noted, however, that the said possibility to require capital add-ons under “Pillar II,” as laid down in the amendments to the BWG, is subject to very precise criteria for progressively more severe measures. Rather, the FMA could be enabled to have recourse to capital requirements on a more flexible basis, as a signal for credit institutions or as an incentive for improvement in system and risk management.

I. Risk Management Processes (BCP 7)

23. Under the transposed CRD, qualitative requirements with regard to risk management have been extended, deepened and, above all, made more explicit. This is reflected,inter alia, in more precise requirements on the build-up and the systems for risk management overall; in precise requirements and strong recommendations for the ICAAP within the institutions; and in clearer and more comprehensive dispositions with regard to the due diligence obligations for institutions.

24. The FMA has, in the light of CRD-implementation, issued minimum standards and (jointly with the OeNB) guidelines for risk management processes within credit institutions. These are built on the guidance CEBS has set out in its standards and guidance papers in this respect. The new guidance not only enhances existing requirements, but also promotes convergence throughout the EU, facilitating the implementation of group-wide requirements.

25. The FMA and the OeNB appear to have adequate capacity to assess banks’ risk management processes. They are in the process of certifying major commercial banks’ IRB models, and staff at commercial banks report that FMA and OeNB counterparts are knowledgeable, thorough, and insightful. A complication of risk management for any bank with extensive operations in CESE countries is the limited sample of data which can be used to parameterize models; available data cover only a period of unusually strong macroeconomic performance, financial sector expansion, and structural change.

26. Practical experience of the effectiveness of the new regime for the different types of institution present in the Austrian market(large banks, small banks in groups, independent banks, etc.) is as yet limited. However, a prima facie assessment points to an adequate observation of proportionality principles under the new regime, i.e., allowing a bank to institute a system of a complexity that matches that of its operations.

27. Recent changes in the law also encompass an extension of the supervisory responsibility: the FMA shall assess (based on OeNB supervisory reports) not only the adequacy of internal risk measurement and risk management systems and practices, but the overall compliance with the “Pillar II” and “Pillar III” (disclosure) requirements laid down in the CRD. As for requirements on internal risk management systems, CEBS guidance on the overall Pillar II approach sets out clear standards, principles and guidance on the supervisory review process; the FMA and OeNB are building hereon in their endeavor to enhance their overall supervisory effectiveness and to provide for a consistent group-wide assessment process. Moreover, the possibility of imposing capital add-ons implicitly enhances FMA’s powers, even if such measure has to be duly justified toward the credit institution or group. The new provisions enhance the role of banks’ internal audit and the scope of the review by external auditors with regard to the entire risk management processes within each institution.

28. It is too early to assess to what extent the new provisions and their implementation by the authorities will effectively enhance the quality of supervision and the stability of the banking sector. It appears, however, that all elements are in place to reach the objectives set out by the Basel Committee, CEBS, and the Austrian authorities.

J. Types of Risks (BCP 8 to 16)

29. In the process of implementing CRD, the FMA, and OeNB have performed a comprehensive overhaul of the existing regulations, standards and guidance with regard to the assessment and management of the major risk categories for banks. A key instrument therein is the above-mentioned guidelines on bank-wide risk management and the ICAAP.

30. With regard to credit risk, complementary requirements are set out in FMA’s“Minimum standards for the credit business and other transactions entailing counterparty risk” and in FMA/OeNB guidelines on credit risk.

31. On impaired assets and provisioning, a definition of default, making explicit reference to a 90 days payment arrears standard, has been introduced, thus clarifying the concept of impairment and setting a uniform benchmark.

32. Large exposure limits have been amended by implementation of the CRD and of the Directive 2006/49/EC. It is to be understood, however, that these explicit limits cannot supersede or negate the obligation, as laid down in the CRD, to provide for a comprehensive and adequate assessment of all types of risk concentration features with each bank or group.

33. For country and transfer risk, especially relevant for banks with exposure on non-EU countries, the measurement process is based on the Bank for International Settlements Risk Statistics.

34. The transposition of the CRD and of Directive 2006/49/EC established adequate measures regarding operational risk, and enhanced provisions on interest rate risk in the banking book (IRBB). For operational risk, this implies not only opening the way for the use of advanced approaches for the assessment of capital requirements, but above all a formal requirement to adequately include operational risk in the overall risk profile of each institution and to cover operational risk with adequate capital. For liquidity risk, the FMA and OeNB are acting in line with the recent evolution of international practices: the principles-based approach herein is complemented by reporting on a “broad brush” basis of mismatches in the balance sheet. Banks are required to have in place liquidity management systems, and to conduct related stress tests to assess the effects of certain shocks over 30, 60, and 90 days. In addition, the authorities conduct “top down” tests of aggregate and bank specific liquidity. Nonetheless, it is recommended that reporting of liquidity be reviewed in due time in the light of the recent experiences with market tensions. Overall, for risks other than credit and operational risk, the OeNB and the FMA are closely following up on the guidance papers and recommendations on good practice issued by CEBS in its efforts to promote a convergent and state of the art approach to “Basel pillar II.” Together with the enhanced reporting requirements pursuant to the implementation of EU/CEBS common reporting (COREP) and financial reporting requirements (FINREP, respectively), OeNB and FMA are well advanced in developing a common proprietary risk assessment system, which will ensure full coverage of the risk profile of each institution as well as of each banking group.

K. Internal Control and Internal Audit (BCP 17)

35. Austrian corporate law has been amended to bring it more in line with internationally accepted standards of governance. Requirements for internal control and guidance on internal audit with credit institutions have been explicitly enhanced with the transposition of the CRD. The provisions and the guidance to that effect laid down in CEBS’s standards and guidance papers with regard to both advanced risk management approaches and Pillar II have been fully taken on board; they constitute a significant enhancement in line with standards and practices promoted throughout the international supervisory community.

L. Abuse of the Financial Services (BCP 18)

36. Legislation implementing the third EU Anti-Money Laundering Directive was passed by the National Assembly in the course of the mission. In 2008 a full review of all issues on AML/CFT based on the Financial Sector Action Task Force 40+9 Methodology will be conducted in collaboration with the IMF. Therefore, it has been agreed not to review this principle as part of the FSAP Update.

M. Supervisory Process (BCP 19–21)

37. As stated in the introduction, the supervisory framework is currently being overhauled. Therefore, it is of little relevance to assess the old framework, but premature to assess definitively the practical effectiveness of the framework now being established. Nonetheless, the new framework’s relative complexity and the degree of change involved require some caveats with regard to the final result, which will only become clear over time.

38. A preliminary assessment suggests that the OeNB and the FMA will need to support one another fully and coordinate very closely to make the new framework work. The most important change consists in fully entrusting OeNB with all operational aspects of banking supervision in the areas of financial analysis and onsite inspection. It appears that the legislator has opted for optimizing efficiency in the use of specialized resources, i.e., by centralizing these by type with each of the authorities, whereby the key operational functions are entrusted to the OeNB. The advantage is that overlaps and loopholes in these stages of the supervisory process can be prevented. However, the new framework entails also a risk that FMA staff could become disconnected to some extent from “hands on” supervision, while nevertheless carrying full final responsibility for the ensuing supervisory action. Furthermore, supervision is further separated from enforcement. In a stress situation, it may be difficult to communicate all necessary information as rapidly as needed to all agencies concerned, and decision making may be complicated.

39. In the overall framework of supervision of credit institutions, several parties each carry some degree of responsibility or execute specific duties. It is therefore crucial that the FMA and OeNB keep a close eye on optimizing cooperation and making the best use of synergies in planning and executing their proprietary duties. Equally, they should regularly evaluate jointly the adequacy of the overall supervisory processes from both angles: effectiveness and efficiency. Cooperation will need to be institutionalized through various mechanisms and procedures (the FMA and the OeNB already plan to maintain a joint database).

40. Moreover, in carrying the final responsibility for supervision, the FMA should retain the powers and means to effectively steer the process; given the increased involvement of OeNB, this steering process will require close consultation between both institutions. In elaborating their mutual cooperation agreement and in implementing this in practice, the FMA and OeNB should consider the following:

• Although the new framework has the advantage of defining clearly the responsibilities of both parties in legal terms, it is crucial for the credibility thereof that both institutions not only jointly express their commitment to make the regime work effectively, but that they also explicitly take joint moral responsibility in this area;

• The creation of joint teams of experts and generalists necessitates a broad and sustained effort by the management of both institutions for maintaining a truly cooperative culture. Such a culture of cooperation (gong beyond living up to minimum standards of cooperation) may become more crucial for the success than designing clear procedures, however important and necessary the latter remain;

• Adequate and sufficient staffing of both institutions is to be considered a joint and key responsibility. The changes will not only potentially entail a certain degree of switching of staff, but will also require review of the number and the profile of the required staff, in particular within the FMA. The institutions should ensure that this is done with a view to promoting commitment, inter alia by preserving career perspectives for staff within both institutions. Elements such as joining training efforts and creating an opening for cross-cutting career opportunities may be considered to this end; and

• CRD and risk-based supervision generally will require the OeNB to enhance the frequency and the scope of on-site inspections, taking into account, on the one hand, the need for adequate coverage of the full scope of credit institutions operating in the country and, on the other, the concept of proportionality. Indeed, since 2003 the authorities have increased the frequency of both general and targeted on-site inspections. Off-site monitoring and analysis will need to evolve in parallel.

41. The role and contribution of the state commissioners should be considered anew. It has been decided to retain state commissioners only in larger banks, where they are observers on the supervisory board charged with ensuring that the bank does not take any action in contravention of laws or regulations. Yet, the presence of a government official may contain a risk of hampering openness of discussions within the board. It might also create the impression that the government is responsible for any wrong-doing by a bank. The costbenefit contribution of the state commissioner to supervisory effectiveness should be assessed.

42. Heavy reliance continues to be placed on external auditors in verifying compliance with regulations, subject to review by the authorities. Audit reports must conform to certain guidelines. Increasingly, the FMA requests clarification on numerous audit reports, and regularly meets with external auditors. Auditors frequently bring issues to the attention of the FMA even before completion of an audit.

43. It is recognized that the focus of the FMA’s, OeNB’s and external auditors’ work need to be coordinated, in particular in terms of coverage and scope of the tasks executed. In doing so, the FMA and OeNB should take into account the fact that, in legal terms, the external auditor does not normally carry any responsibility in the supervisory field. Yet, it is also recognized that the authorities should not and do not bear general liability for the actions of the auditors. Thus, the incentives and constraints faced by external auditors are not the same as those faced by supervisors, and their respective activities are not perfect substitutes. In light of these considerations, it is recommended that:

• The FMA and OeNB undertake regular consultations with the audit profession with a view to maintaining a clear understanding of the nature, scope, and format of auditors’ contribution to supervision over a financial system that is evolving rapidly in structure and complexity. The guidelines on auditors’ reports may need to allow the reports to differ, for example, based on the complexity of a bank’s business and the degree of supervisory oversight to which it is subject;

• The FMA remain vigilant in ensuring the high quality of external auditors chosen by banks; and

• Auditors’ independence be enhanced by providing for a regime of mandatory or encouraged periodic rotation of audit firms, not just of individual auditors. When a bank changes its external auditors (and especially when the change is made before the end of the normal contract period), the authorities may wish to assess the auditors’ relationship with the bank and the quality of their work. These measures would serve to limit financial institutions’ influence over their external auditors.

44. Finally, by implementing the core section of the COREP framework, the FMA and OeNB have instituted a risk-oriented reporting system, well-integrated into the overall supervisory approach under CRD, adequately tailored to the needs of both institutions, and coordinated with the macro-prudential requirements set out by OeNB. The intention to establish a common database of information from all sources is commendable.

N. Accounting and Disclosure (BCP 22)

45. Austria is in the process of implementing an adequate framework. By imposing broadly IFRS-based accounting and disclosure throughout the financial sector and by transposing CEBS’s guidance on FINREP and disclosure, Austria is well on its way toward achieving this goal, at least for the banking sector. A rather complex situation, marked by significant exemptions and divergences, will thereby be replaced by a transparent, straightforward and state-of-the-art regime.

O. Corrective and Remedial Powers (BCP 23)

46. The FMA retains exclusive sanctioning powers and thus carries full responsibility thereof. In view of past experience, it is recommended that the range of sanctions available be reconsidered; the “middle section” between essentially symbolic fines and hard enforcement actions seems somewhat weak in the supervisory toolkit.

47. More importantly, for early remedial action, the authorities need to have a balanced and flexible toolkit available, and set out adequate principles for their use. The FMA is encouraged to design (with input from the OeNB) procedures to integrate early remedial action into the ongoing supervisory processes.

P. Consolidated Supervision and Home-Host Relationships (BCP 24–25)

48. As set out in the introductory remarks and under BCP 1.6, the FMA and OeNB are investing significant effort into enhancing consolidated supervision and cooperation with foreign supervisors. Given the growing involvement of Austrian banks abroad and of foreign banks in Austria, it is important that the authorities continue to take a forward looking approach to this aspect of supervision.

49. Domestically, the FMA has created a department specifically in charge of coordinated supervision over financial conglomerates.

A. Recommendations

B. Authorities’ Reactions

64. The Austrian MoF, the FMA, and the OeNB consider the recommendations as very valuable and, in general, in line with their own assessments and priorities for the forthcoming years.

65. This is particularly the case as regards the need for effective and efficient implementation of the new banking supervisory regime in a culture of close cooperation and joint moral responsibility of FMA and OeNB (nos. 37–40 and 54). We fully agree that, among others, adequate staffing throughout the whole process of analysis and prudential supervision and further intensification of on-site inspections are a prerequisite in this respect, and intend to follow a risk-based and proportionate approach in allocating the available resources.

66. Moreover, the FMA and OeNB are also fully committed to maintaining their efforts to further enhance cross-border cooperation (nos. 13–15 and 51).

67. More specifically, the Austrian authorities would like to put forward the following comments:

Para. 50, Legal Protection: We highly appreciate the recommendation to clarify that financial sector regulation and supervision is conducted in the public interest. Possible solutions for narrowing the current broad definition of public liability are currently discussed in Austria in order to bring liability in line with international practice and to avoid the undesired effects mentioned in the assessment (costly for taxpayers, moral hazard etc). Yet the issue of public liability has to be considered within the context of the Austrian legal system as a whole.

Paras. 35 and 53, Corporate Governance: We would like to underline that several provisions to further enhance corporate governance arrangements have been recently introduced in the Austrian banking law. However, we feel that the recommendation to apply fit and proper criteria for supervisory board members others than the chairpersons would have to be assessed in the light of proportionality and cost/benefits.

Paras. 41 and 57, State Commissioner: Over the last several years the state commissioners have been further integrated into the supervisory process. The FMA has undertaken various initiatives to develop its interaction with appointed state commissioners. These initiatives include inter alia regular personal contacts, regular and extensive reporting requirements, training and manuals as well as the provision of company specific information via secured internet web-sites.

Due to the state commissioner’s right to participate in the various meetings of the supervisory and management board state commissioners are in the position to add first hand and timely information for supervision. On the other hand, we feel that the concerns expressed by the IMF regarding the function of state commissioners address important issues and have to be considered seriously.

Thus, the costs and benefits of state commissioners will need to be assessed carefully before deciding on further modifying the system.

Paras. 47 and 59, Early remedial action: We agree with the IMF on the necessity of a system of early remedial action. This is why we have developed an elaborated tool kit for risk-based supervision, including on-site supervision, comprehensive and sophisticated off site analyses, regular meetings with CI’s managements and stress-testing. In addition, auditors and deposit guarantee schemes are required to provide timely information in case of any unsteadiness. Remedial measures available to the FMA encompass the widely used order to re-establish lawful conditions and, in case of continuation or repetition, a cease and desist order. This range of available measures takes into account that each case is different and that therefore some flexibility in supervisory responses is necessary.

Concluding, we are of the opinion that we are in a position to take initiatives at an early stage, which we consider early “remedial actions” under the Austrian legal framework and constitutional rights. If the IMF applies a different concept of “Early remedial action,” we would appreciate clarification of this recommendation.

Paras. 58: External Auditors: periodic rotation of firms´ mandates: We agree that the independence of external audit firms is of utmost importance. However as regards the recommendation to rotate external audit firms periodically, we would like to inform you that the relevant provisions are currently under review and will be amended in accordance with EU law (8^th EU-Directive on Auditing), which does not require an external rotation of the auditor. We understand that a legally binding external rotation of the auditing firm is rarely implemented on the EU and global levels, and we feel that any system of encouraged external rotation also requires careful analyses of its potential effects and consequences, not least since by its nature such a system is not enforceable. In the Austrian case, a system of external rotation would currently be limited to 3 to 4 companies having the expertise in auditing banks.