Financial Sector Assessment Program Update: Technical Note: Factual Update on Basel Core Principles for Effective Banking Supervision (Central Bank of Cyprus)

This technical note examines Cyprus’s factual update on the Basel Core Principles for Effective Banking Supervision for Cyprus. The 2006 directive on corporate governance provides that each commercial credit institution should have a robust internal governance framework. Although the level of activities of banks in Cyprus that can generate market risk remains low, the Central Bank of Cyprus issued bank guidelines on the management of market risk that include provisions on scenario analysis, stress testing, and contingency planning, as appropriate.


This technical note examines Cyprus’s factual update on the Basel Core Principles for Effective Banking Supervision for Cyprus. The 2006 directive on corporate governance provides that each commercial credit institution should have a robust internal governance framework. Although the level of activities of banks in Cyprus that can generate market risk remains low, the Central Bank of Cyprus issued bank guidelines on the management of market risk that include provisions on scenario analysis, stress testing, and contingency planning, as appropriate.

I. Introduction

1. This note presents a factual update of the 2005 assessment of Cyprus compliance with the 1997 Basel Core Principles for Effective Banking Supervision (BCP), including a follow up on implementation of the 2005 BCP assessment, undertaken in the context of the original Offshore Financial Center (OFC) assessment in 2005. The note was based on a factual update prepared by the Central Bank of Cyprus (CBC); interviews with staff of the CBC, external auditors, industry, and professional associations; and legal and other background documents. The update follows the 1997 BCP and took into account the revised Principles which came into effect October 2006.

2. This update is based solely on the laws (a translation of the latest amendment of the Banking Law is pending), supervisory requirements, and practices that were in place at the time of the assessment. However, the mission made note of regulatory initiatives which have yet to be fully implemented or which are not final, such as the proposed amendments to mergers and acquisitions with respect to banks, which, as per the relevant EU Directive 2007/44/EC, should be enacted by March 20, 2009.

3. The mission is grateful to the CBC for its full cooperation and assistance with the logistical arrangements and coordination of various meetings with industry bodies and companies. Discussions with CBC staff during a series of technical meetings facilitated a meaningful update of Cyprus’s approach for the supervision regime.

II. Overview: Supervisory Scope

4. The CBC is—via its Banking Supervision and Regulation Division—responsible for licensing, winding up and supervising all commercial domestic and foreign credit institutions and foreign bank branches in Cyprus. In this context, the CBC Law defines the safeguarding of the financial stability of the financial system as one of the main tasks of the CBC.

5. The management body of the CBC is the board of directors consisting of the governor, the deputy governor, and five directors. The CBC Law provides that the governor and the deputy governor are appointed by the president and the vice president of the Republic, respectively. The independence of the CBC is secured by the Cyprus Constitution. The Banking Supervision and Regulation Division consist of two departments. The total number of staff in each department is as follows:

  • Bank Supervision and Regulation Department: 44 staff members.

  • Licensing Department: 3 staff members.

6. The CBC has made substantial progress in its supervisory practices to strengthen Cyprus’s supervisory framework for commercial banks. The mission commends the CBC for the many important measures adopted since the 2005 Offshore Financial Center Assessment (OFCA). Going forward, the CBC will conduct joint inspections with the Authority for the Supervision and Development of Cooperative Societies (ASDCS), and implement amendments to the CRD and to the regime on mergers and acquisitions with respect to banks and foreign currency liquidity.

7. The CBC’s organization reflects the nature of the commercial bank sector.

Currently there are 19 domestic commercial banks and 24 branches of foreign incorporated banks operating in Cyprus.

8. The authority has worked to enhance the quality of supervision, inter alia in the organizational area, upgrading the number of staff and staff expertise, and planning to intensify on-site supervision. The CBC should continue to develop its staff expertise and skills particularly as it is expected that the business activities through the cross-border activities of Cypriot banks became more complex in the future. The CBC should continually ensure that it has the necessary resources, expertise and advanced skills.

9. The CBC has broadly implemented the recommendations of the 2005 OFCA, as noted in Section VI.

III. BCP Factual Update

10. The CBC has addressed all of the areas in the “Recommended Action PlanBasel Core Principles” from the 2005 OFCA and the mission commends the CBC for its efforts. The earlier BCP assessment gave CBC a high level of compliance with the BCP but also made some recommendations. The narrative below summarized measures that have been adopted and addresses each of the recommendations from the 2005 BCP assessment. The discussion below is divided into the seven broad categories of the 1997 BCPs. Additional recommendations for consideration are also noted.

A. Objectives, Independence, Powers, Transparency and Cooperation (Principle 1)

11. Since the earlier BCP assessment, the CBC has issued several directives, circulars and guidelines, and regulatory decisions addressing:

  • Calculation of the capital requirements and large exposures of banks;

  • Framework of principles for the operation and criteria of assessment of banks' organizational structure, internal governance and internal control systems;

  • Supplementary supervision of banks which belong in a financial conglomerate;

  • Suspension of interest and other income on nonperforming credit facilities;

  • The fitness and probity (assessment criteria) of directors and managers of banks directive;

  • Management of credit risk;

  • Management of country risk;

  • Management of market risk;

  • Management of operational risk;

  • Conditions of offering of investment or ancillary services and the performance of investment activities by banks;

  • Professional conduct of banks during the provision of investment or ancillary services and during the performance of investment activities;

  • Transactions effected by electronic payment instruments;

  • Covering expenses in relation to the supervision and on-site examinations of banks;

  • Immovable property of banks;

  • Investments of banks in the capital of other companies; and

  • Interest rate risk in the banking book.

The above mentioned directives, circulars and guidelines issued by the CBC are based on respective European Union (EU) Directives and the recommendations of the Committee of European Banking Supervisors (CEBS) and of the Basel Committee on Banking Supervision (BCBS)

12. The CBC has transposed EU directives and supporting regulations in a timely and comprehensive fashion. In particular, implementation of the CRD and its complementary regulations has proceeded on schedule, thereby establishing an advanced legal framework in key areas of banking supervision.

13. The disclosures under Pillar III are provided either in the financial statements of the banks or on their websites. In accordance with section 26A of the BL, which transposed article 144 of the EU Directive 2006/48/EC, concerning supervisory disclosure, the CBC discloses on its website and updates regularly the following information e.g. the texts of laws, regulations, administrative rules and general guidance or aggregated statistical data on key aspects of the implementation of the prudential framework in Cyprus. The cooperative banking sector aggregate statistical data are included via the Cooperative Central Bank (CCB).

14. An effective system of banking supervision will have clear responsibilities and objectives for each authority involved in the supervision of banks. In the overall framework of supervision of credit institutions, two parties have responsibility to execute specific duties. There exist a duplication of work as the CBC and the ASDCS both have responsibilities in the supervision of the CCB and the affiliated Cooperative Credit Institutions (CCIs), although the CBC’s responsibilities are confined to the consolidated supervision of the CCB together with its affiliated CCIs. A single supervisor for all credit institutions operating in Cyprus could enhance the effectiveness and efficiency of supervision and could support the creation of a level playing for all credit institutions. Such an entity should have the responsibility for or contribute to safeguarding the stability of the financial sector but should not be mandated to play a role in the development of entities outside the financial sector.

15. The mission could not identify any doubts on the operational or financial independence of the CBC. The Banking Supervision and Regulation Division receive the necessary funds to guarantee an adequate supervision of commercial banks.

16. Within the framework set out by the EU Capital Requirements Directive (CRD) and the guidelines published by CEBS, the CBC has taken various initiatives to enhance its cooperation with other EU banking supervisors. The same guidelines have been taken as a basis for elaborating cooperation arrangements with non-EU supervisors in countries where there is a home-host relationship. Additional Memoranda of Understanding (MoUs) have been signed, largely on the initiative of the CBC, with the following overseas banking supervisory authorities:

  • Banque du Liban

  • Central Bank of the Republic of Armenia

  • De Nederlansche Bank

  • Jersey Financial Services Commission

  • Austrian Financial Market Authority

  • Estonian Financial Supervision Authority

  • National Bank of Kyrgyz Republic

  • Malta Financial Services Authority

In addition, the CBC is a party to a multilateral MoU signed between the banking supervisors of South Eastern Europe.

B. Progress on Recommended Actions from 2005 Assessment

17. The 2005 mission recommended an increase in the total number of staff of the supervision division to address the increasing demands resulting from the accession of Cyprus to the EU, as well as other developments in the financial supervisory and regulatory sector in particular to meet the increasing needs for the on-site examinations and the implementation of the CRD. Since the 2005 FSAP the number of staff of the Banking Supervision and Regulation Division (which now excludes financial stability) increased by two employees. The Division’s staff participates actively in training seminars and has extensive experience in all of the CBC’s supervisory tasks.

C. Licensing and Structure (Principles 2–5)

18. There have been no major changes to the CBC’s licensing regime. However, section 4A of the BL clarifies the powers of the CBC with respect to the withdrawal of authorizations. Such withdrawals will occur when the bank:

  • does not make use of the authorization within 12 months, expressly renounces the authorization or has ceased to engage in business for more than six months;

  • has obtained the authorization through false statements or any other irregular means;

  • no longer fulfills the conditions under which authorization was granted;

  • no longer possesses sufficient own funds or can no longer be relied on to fulfill its obligations towards its creditors, and in particular no longer provides security for the assets entrusted to it; or

  • falls within one of the other cases where Cyprus law provides for withdrawal of authorization.

In addition, a new comprehensive “fit-and-proper” directive was introduced for boards of directors and senior management supplementing the existing criteria.

19. Concerning ownership any intention to increase the control in a bank or its holding company above the level that has initially been approved by the CBC or to reach 20 percent, 33 percent or 50 percent of the voting rights or of the shares requires notification and the prior approval of the CBC and vice versa. Concerning the identification of the beneficial owners of banks the CBC, in deciding whether to grant its approval to a person to obtain a controlling interest in a bank, it ensures that the person concerned is a ‘fit and proper’ person, and does not pose a threat to the interest of depositors and integrity of the bank concerned. The CBC vets all controlling shareholders (over 10 percent) and obtains also the names and holdings of all significant shareholders (below 10 percent).

20. In addition, the CBC Directive for the calculation of the capital requirements and large exposures requires that investments in excess of the prescribed limits are deducted from the bank’s own funds. The BL is in the process of being amended to adopt the maximum limits on investments outside the financial sector of Article 120 of the EU Directive 2006/48/EC, on individual participation to 15 percent of capital and aggregate participation to 60 percent—current rules on the investment outside the financial sector are stricter than those in Article 120.

D. Prudential Regulation and Requirements (CPs 6–15)

21. The CBC has fully transposed the CRD into legislation. This implies that capital requirements are now imposed on the basis of the new approaches laid down therein. The requirement to calculate capital needs also covers operational risk; and the introduction (under the so-called Pillar II of the CRD) of powers for the CBC to require additional capital coverage for other risks (such as interest rate risk in the banking book and concentration risk, etc.) constitutes a fundamental change compared to the more rigid and “mechanical” regime in place until recently.

22. The implementation date was January 1, 2007, but most banks exercised the option under Article 152(8) of the CRD to defer the implementation to January 1, 2008. In general, all commercial banks apply the simpler approaches to measuring risk under the CRD. However, some banks consider applying for more advanced approaches in the future when more data for the calibration of the models are available. All banks comply with the ratio and the average ratio for the sector as at 31 December 2007 exceeded 12 percent. It should be noted, however, that the said possibility to require capital add-ons under Pillar II,” as laid down in the respective rules and regulations, is subject to very precise criteria for progressively more severe measures. The prudential filters agreed at CEBS have been adopted.

23. Under the CBC Directive on the calculation of capital requirements and large exposures of banks, banks are required to have an Internal Capital Adequacy Assessment Process (ICAAP) for assessing their overall capital adequacy in relation to their risk profile. Banks are required to provide the CBC with all the information necessary for the assessment of their compliance with the CRD requirements. The banks’ internal control mechanisms and administrative and accounting procedures should be such as to permit the CBC to verify the banks’ compliance with these requirements at all times. The adequacy of the internal process of banks for assessing their overall capital adequacy in relation to their risk profile is evaluated in the course of the Supervisory Review and Evaluation Process (SREP).

24. Large exposure limits have been amended by implementation of the CRD (Directives 2006/49/EC and 2006/49/EC). The CBC Directive for the calculation of the capital requirements and large exposures of banks sets the prudential limits to restrict large exposures to single borrowers or group of related borrowers and connected parties. In exceptional cases where exposures exceed limits, they shall be reported without delay to the CBC which may allow the bank a limited period of time in which to comply with the limits, as required by the CRD. Although the reporting requirements are in line with the CRD, it is recommended to change the frequency of reporting from 6 to 3 months.

25. The CBC Guidelines to banks on the management of credit risk, issued in 2008 set requirements that banks should have in place established and well-documented credit and investment policies, practices, and procedures, approved by their Board of Directors and implemented by bank management. The CBC guidelines provide for the setting of internal limits with regard to concentration risk. However, these explicit limits cannot supersede or negate the obligation, as laid down in the CRD, to provide for a comprehensive and adequate assessment of all types of risk concentration features with each bank or group.

26. The CBC may wish to consider establishing a centralized registry of information on credits of one million or more Euro (as would be defined by them) to be regularly collected from banks and other credit providers in Cyprus, aggregated by the CBC for each borrower and then made available to the banks and other credit providers for their use in evaluating their credit risk exposures.

27. The CBC policies where the provisioning is deemed inadequate may require—in context with the respective CRD pillar II requirements—a bank to hold own funds in excess of the minimum level of 8 percent and / or to apply specific provisioning policies. An amendment to the respective Directive (on income recognition) will avoid inconsistencies with IAS 39.

28. The BL allows granting loans to “connected persons.” Pursuant to the Law, the total unsecured exposure of the facilities granted to all member of the Committee or Supervision Board and to the Secretary/Director and their connected persons should not exceed 5 percent of the bank’s own funds and the total exposures of all facilities granted to the above persons should not exceed 40 percent of the banks own funds. These limits should be halved to reduce risk. The granting of loans up to 40 percent of banks own funds to connected persons could be characterized as being too high.1

29. For country and transfer risk, especially relevant for banks with exposure on non-EU countries, the CBC issued guidelines to banks on the management of country and transfer risks. Under these guidelines, the CBC requires all licensed commercial banks to apply adequate systems and procedures for the identification, measurement, monitoring and effective control of the country risk inherent in their international operations and, in particular, their cross-border credit exposures. As regards branches of banks incorporated outside Cyprus, the CBC expects that these operate in the context of relevant policies and procedures prescribed by their banks and comply with sub-limits assigned to them. The CBC has not prescribed specific, formal country risk limits for banks; however, the above CBC guidelines require the Board of Directors of each bank to approve, review and, where appropriate, revise country limits and ensure that the senior management of each bank implements the defined policies and limits and is actively involved in the monitoring and effective control of the country risk.

30. The CBC issued in January 2008 Guidelines to banks on the management of market risk. These Guidelines aim at stressing the importance the CBC places on the sound management of market risk by banks and at ensuring that banks engaged in activities that give rise to market risk adopt sound management practices and processes for the identification, measurement, monitoring and control of market risk, which are commensurate with the risks undertaken. The focus of the CBC is on the review of limits and less on setting limits. However, maximum intraday and overnight foreign exchange limits are set by the CBC. These Guidelines are mainly based on the Basel Core Principle on Market Risk and on the Guideline on Technical aspects of stress testing under the SREP published by CEBS.

31. Under the transposed CRD, qualitative requirements with regard to risk management have been extended, deepened and, above all, made more explicit. The banks have to comply with the provisions of the Directive issued by the CBC concerning the Framework of Principles of Operation and Criteria of Assessment of Banks Organization Structure, Internal Governance and Internal Control Systems. In this context banks should have a written policy and procedures, in line with their operational strategy (monitoring and management of risks such as credit risk, market risk, liquidity risk and operational risk) and banks are required to establish a Risk Management Unit which should be administrative independent of any other units which have operational responsibilities. Further banks should submit to the CBC an annual report on the management of risks. The CBC appears to have adequate capacity to assess banks’ risk management processes.

32. In 2007, the CBC issued a revised Directive on the Computation of Prudential Liquidity. The new Directive sets out the CBC requirements for maintaining bank liquidity. Pursuant to the new directive different liquidity requirements apply to two broad groups of banks: (i) Group 1: banks primarily active in international business; and (ii) Group 2: banks primarily active in domestic business. This requires that each bank should have in place a contingency plan for the management of liquidity crises.

33. In 2007, the CBC issued a circular on the interest rate risk in the banking book. According to the CBC Circular, banks are required to monitor and measure the risk arising from potential changes in interest rates of the order of 200 basis points. Furthermore, banks are required to apply and implement the CEBS Guideline on technical aspects of the management of interest rate risk arising from non-trading activities

34. In 2008 the CBC issued guidelines on the management of operational risk. The guidelines require banks to recognize the existence and significance of operational risk in relation to their safety and viability and to develop an appropriate framework, commensurate with their size, complexity and risk profile. As regard branches in Cyprus of banks incorporated outside the country, the CBC expects that these will apply comparable operational risk management principles.

35. Practical experience of the effectiveness of the new regime for the commercial bank sector present in the Cyprus market is as yet limited. It is also too early to assess to what extent the new provisions and their implementation by the authorities will effectively enhance the quality of supervision and the stability of the banking sector. In general it appears, however, that all elements are in place or will be in place soon to reach the objectives set out by the Basel Committee, CEBS, and the CBC. This issue should be addressed further in the off-site monitoring and on-site inspection plan for the next year.

36. The 2006 directive on corporate governance provides that each commercial credit institution should have a robust internal governance framework. The Cypriot rules and regulations have been amended to bring it more in line with internationally accepted standards of governance and have been explicitly enhanced with the transposition of the CRD. The provisions and the guidance to that effect laid down in CEBS’s standards and guidance papers with regard to Pillar II have been fully taken on board. Appendix I of the Directive addresses the issue of outsourcing.

37. Legislation implementing the third EU Anti-Money Laundering (AML) Directive was passed by the House of Representatives at end of 2007. “The Prevention and Suppression of Money Laundering Activities Law” consolidated, revised and repealed the former Laws on the Prevention and Suppression of Money Laundering Activities. Under the current Law, the Cyprus legislation has been harmonized with the Third EU Directive on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing. The CBC issued a Directive to banks on 2 April 2008 supplementing the requirements of the Law on the preventive measures to be taken for the effective forestalling of money laundering and terrorist financing. The main changes focus on increased powers of the supervisor, e.g., by increasing fines and revoking licenses.

E. Progress on Recommended Actions from the 2005 Assessment

38. The mission in 2005 recommended finalizing the implementation of the more stringent criteria for interest suspension. Effective 1 January 2006 the 90 days in arrears rule applies and this will be further refined upon the alignment of the calculation of the interest to be suspended with the provisions of the International Accounting Standard 39.

39. It was also recommended that the CBC should consider establishing formal guidance on a framework for country risk and transfer risk management to formulate their own specific internal limitations, as appropriate, to the nature of their business and their ability to identify, monitor, and control such risks. The CBC issued such a formal guidance on the management of country and transfer risks in 2007.

40. Concerning market risk the assessors of the 2005 BCP assessment recommended to improve market risk expertise and supervision. Although the level of activities of banks in Cyprus which can generate market risk remains low, the CBC issued to banks Guidelines on the management of market risk which include provisions on scenario analysis, stress testing and contingency planning, as appropriate, and periodic validation or testing of the internal systems/models used to measure market risk in line with the EU CRD in January, 2008. In addition, the Banking Supervision and Regulation Division recruited an expert specializing in financial modeling. It also recognized the need for enhancing the expertise of staff through the attendance of specialized training courses.

F. Methods of On-going Supervision (CPs 16–20)

41. Under the CRD requirements, the ICAAP assessment within the SREP, will be carried out once a year for all banks licensed by the CBC. For all Cyprus-based banks on site examinations are conducted once a year, including material overseas operations, however in the case of Cyprus based branches of EU banks the scope is limited. Some banks have already submitted their ICAAP and the CBC is in the process of conducting the SREP. The SREP conclusions form the basis for a structured dialogue between the CBC and the banks management. First reporting results do not identify material problems.

42. The CRD and risk-based supervision generally will require the CBC to enhance the frequency and the scope of on-site inspections, taking into account the need for adequate coverage of the full scope of credit institutions operating in the country.

43. An internal rating system for the commercial banks has been developed based on the “CAMEL” system. Components are strategy, credit/market/liquidity and operational risk corporate governance and internal control. A rating for each bank is derived upon the completion of the risk assessment exercise and this rating is included in the Internal Rating System template. To assist the assessment of these risks, specific audit programs are being designed for use during the on-site examination. The investigated risk profile is proved to be a very useful tool for early warning purposes and for planning on-site supervision. CBC takes into account information received directly from banks, its own reviews and from other supervisors and to a limited extent from the external auditor. The rating influences the supervisory strategy for the bank. Since the systems are new, their effectiveness will need to be evaluated over time. The classification reflects the systemic importance and each credit institution’s risk profile. The system is expected to come into force by the end of the year.

44. Recently, a formal procedure to assess the effectiveness of supervisory functions was introduced, by (i) establishing an internal quality control panel and (ii) an Examiners’ panel. The objective of the internal quality control panel is to ensure the effectiveness of the supervisory function and to address weaknesses identified in the supervisory assessment. The objective of the Examiners’ Panel is to ensure that all relevant and material risks that the supervised bank faces have been identified by the CBC. Furthermore, it ensures effectiveness and that the procedure is applied consistently between the different supervised banks.

45. End of 2008 it is planned to introduce a joint on-site inspection plan (20 inspections) between the CBC and the ASDCS concerning their responsibility for consolidated supervision of the CCB.

46. In the course of 2008 the CBC developed a more formal early warning system as proposed by the 2005 mission. The implementation took place at the micro level in the context of the application of SREP.

G. Information Requirements (CP 21)

47. The ammendment to the BL, requires the external auditor promptly to report to the CBC any fact or decision concerning his client bank of which he has become aware while carrying out his audit which is liable to constitute a material breach of the laws, regulations or administrative provisions etc.

H. Formal Powers of Supervisors (CP 22)

48. The CBC retains exclusive sanctioning powers and thus carries full responsibility thereof. In view of past experience, it is recommended that the range of sanctions available be reconsidered; the “middle section” between essentially symbolic fines and hard enforcement actions seems somewhat weak in the supervisory toolkit.

I. Cross-Border Banking (CPs 23–25)

49. As set out in the introductory remarks and under BCP 1, the CBC is investing significant effort into enhancing cooperation with foreign supervisors. Given the growing involvement of Cypriot banks abroad and of foreign banks in Cyprus, it is important that the authorities continue to take a forward looking approach to this aspect of supervision. Under the provisions of the CRD, the CBC, as a home supervisor will have to organize colleges with host supervisors for each internationally active group headed by a Cyprus based bank.

50. Since the last BCP assessment, on-site visits by home supervisors have been conducted in Cyprus by three different regulators.

IV. Key Recommendations

Table 1.

Key Recommendations

article image

V. Recommended Action Plan 2005

Table 2.

2005 OFC Recommendations Follow-Up

article image

Core Principles Methodology, BCP 11, Essential Criteria 5, states that aggregate limits on exposures to connected parties should be at least as strict as the limits for single counterparties (or groups of counterparties) that are not so connected.