Abstract
This paper discusses the current state of Swedish implementation of the Basel Core Principles for Effective Banking Supervision (BCP). The banking supervisory framework and its implementation in Sweden are in line with many of Basel Core Principles’ essential criteria. However, the assessors found evidence of impairment in Finansinspektionen (FI)’s operational independence. Assessors suggest that staffing levels at FI are an urgent concern to be remedied and also that a revised legal structure ensuring greater independence of FI be considered.
I. Summary, Key Findings, and Recommendations
1. The banking supervisory framework and its implementation in Sweden are in line with many of the Basel Core Principles’ essential criteria. Since the advent of the global financial crisis, Finansinspektionen (FI) has instituted a more robust supervisory approach, which has made important advances on the previous regime and initiated a number of fruitful projects but which needs continued technical development. Nonetheless, FI’s overall capacity to supervise banks, despite a consistent risk-based approach, is chiefly impacted by an acute staffing shortage. FI is established as a government authority responsible to the Ministry of Finance (MoF). In practice, the assessors found evidence of impairment of FI’s operational independence, through the mechanism of the annual appropriations letter process. FI’s ability to discharge its supervisory and oversight functions adequately and effectively is significantly impaired by the coupling of inadequacy of independence and resource. It is suggested that staffing levels at FI are an urgent concern to be remedied as soon as possible and also that a revised legal structure ensuring greater independence of FI be considered.
A. Introduction
2. This assessment of the current state of the Swedish implementation of the Basel Core Principles for Effective Banking Supervision (BCP) has been completed as part of a Financial Sector Assessment Program (FSAP) Update undertaken by the International Monetary Fund (IMF) in March 2011, and reflects the regulatory and supervisory framework in place as of the date of the completion of the assessment. An assessment of the effectiveness of banking supervision requires a review of the legal framework, both generally and as specifically related to the financial sector, and detailed examination of the policies and practices of the institutions responsible for banking supervision.
B. Information and Methodology Used for Assessment
3. The Swedish authorities agreed to be assessed according to the Core Principles (CP) Methodology issued by the Basel Committee on Banking Supervision (Basel Committee) in October 2006. The current assessment was thus performed according to a revised content and methodological basis as compared with the previous BCP assessment carried out in 2002. The assessment of compliance with each CP is made on a qualitative basis to allow a judgment on whether the criteria are fulfilled in practice. Effective application of relevant laws and regulations is essential to provide indication that the criteria are met.
4. To assess compliance, the BCP Methodology proposes a set of essential and additional assessment criteria for each principle. The essential criteria (EC) are the only elements on which to gauge full compliance with a core principle. The additional criteria (AC) are suggested best practices against which the Swedish authorities have agreed to be assessed. Additional criteria are commented on but are not reflected in the grading. The assessment of compliance with each principle is made on a qualitative basis. A four-part grading system is used: compliant; largely compliant; materially noncompliant; and noncompliant. This is explained below in the detailed assessment section.
5. The assessment team reviewed the framework of laws, rules, and guidance and held extensive meetings with officials of FI, and additional meetings with the Riksbank (RB), the MoF and banking sector participants. The team met the industry association representing banks in addition to a number of domestic and non-domestic institutions.
6. The team appreciated the very high quality of cooperation received from the authorities. The team extends its thanks to staff of the authorities who provided excellent cooperation, including extensive provision of documentation, at a time when many other initiatives related to domestic, European and global regulatory initiatives are in progress.
7. The standards were evaluated in the context of the Swedish financial system’s sophistication and complexity. It is important to note that Sweden has been assessed against the BCP as revised in 2006. This is significant for two reasons: (i) the revised BCP have a heightened focus on risk management and its practice by supervised institutions and its assessment by the supervisory authority; and (ii) the standards are evaluated in the context of a financial system’s sophistication and complexity.
8. An assessment of compliance with the BCPs is not, and is not intended to be, an exact science. Reaching conclusions required judgments by the assessment team.1 Banking systems differ from one country to another, as do their domestic circumstances. Furthermore, banking activities are undergoing rapid change after the crisis, prompting the evolution of thinking on and practices for supervision. Nevertheless, by adhering to a common, agreed methodology, the assessment should provide the Swedish authorities with an internationally consistent measure of the quality of its banking supervision in relation to the revised Core Principles, which are internationally acknowledged as minimum standards.
9. To determine the observation of each principle, the assessment has made use of five categories: compliant; largely compliant, materially noncompliant, noncompliant, and non-applicable. An assessment of “compliant” is given when all essential criteria are met without any significant deficiencies, including instances where the principle has been achieved by other means. A “largely compliant” assessment is given when there are only minor shortcomings, which do not raise serious concerns about the authority’s ability to achieve the objective of the principle and there is clear intent to achieve full compliance with the principle within a prescribed period of time. A principle is considered to be “materially noncompliant” in case of severe shortcomings, despite the existence of formal rules and procedures and there is evidence that supervision has clearly not been effective, the practical implementation is weak or that the shortcomings are sufficient to raise doubts about the authority’s ability to achieve compliance. A principle is assessed “noncompliant” if it is not substantially implemented, several essential criteria are not complied with, or supervision is manifestly ineffective. Finally, a category of “non applicable” is reserved (though not used) for those cases that the criteria would not relate to the Swedish authorities.
10. For completeness’ sake, it should be noted that the ratings assigned during this assessment are not necessarily directly comparable to the ones assigned in terms of an FSAP performed using the pre-2006 BCP Methodology. Differences may stem from the fact that the bar to measure the effectiveness of a supervisory framework was raised by the 2006 update of the BCP Methodology, as well as by lessons drawn from the financial crisis that may have a bearing on supervisory practices.
C. Institutional and Macroeconomic Setting and Market Structure—Overview2
11. The Swedish financial sector is large relative to GDP and the banking sector is highly concentrated. The financial system’s assets account for 550 percent of GDP, of which 65 percent belong to four systemic banking groups. There are over a hundred regulated banking entities in the non-systemic sector, but taken in aggregate the secondary banking sector represents at least 25 percent of the domestic system (FI estimate).
12. The structure of household savings in Sweden has implications for banks’ ability to meet the forthcoming Basel standards on liquidity. Trust savings and pension savings have developed into significant vehicles for household savings, reflecting a relatively lower level of domestic deposits in the Swedish banking system. This feature of the banking market, coupled with a sovereign with a low level of debt issuance, means that the banks may face higher challenges than in other jurisdictions to meet the requirements of the recently agreed Basel III liquidity framework which places emphasis on the presence of a stable retail deposit base and on stocks of high quality liquid assets, ideally government debt instruments. FI is monitoring the situation closely. It has intensified supervision of liquidity risk management, revised liquidity risk management standards (based on Basel and European Union (EU) available guidelines), is in the process of trialing revised liquidity reporting requirements and undertaking a major review of liquidity practices across a broad segment of the banking market. Basel has now signaled that it recognizes that changes may be needed to its liquidity framework, but FI needs to remain alert to potential need to encourage structural changes to banks’ balance sheets.
13. The capitalization of the Swedish banking sector is strong following the crisis. The four major banks are well capitalized with a capital adequacy ratio (CAR) of 12.2 percent in part due to major rights issues in 2008 and 2009. Banks’ profits rebounded from 2009 lows and retained earnings continue to support banks’ capitalization. Profits declined in banks with Baltics exposures due to substantial increases in loan loss provisions. Most provisions were booked in 2009 and further reversals are expected owing to improved macro conditions in the Baltics.
14. All the large banks have operations within the life insurance sector, whilst many of the large insurance companies have banks of their own. Some of the banking and insurance groups exhibit a complex structure. As an integrated regulator FI is responsible for both banking and insurance supervision. These supervisory functions are organized into sector specific divisions. Choices made on organizational structure bring benefits and risks. The advantage of FI’s chosen option is the capacity to ensure a focus on the banking and insurance risks in the respective divisions. The challenge that FI must manage is to ensure that there is sufficient management resource available to assess how banking and insurance risks interact when housed in the same financial conglomerate and to avoid silo thinking.
15. Sweden is a regional banking hub. Its significance rests more in its role as a home than as a host jurisdiction but as fewer than half of the consolidated assets of the systemic groups are located in Sweden it has a critical role to play in ensuring the financial stability of the region. Sweden has responded actively to the challenges of its position. FI was one of the earliest jurisdictions to start putting colleges of supervisors into place, well ahead of the requirements set out in EU law and guidelines. Sweden has also been a path breaker in agreeing a multilateral memorandum of understanding (MoU) on cross border financial stability, crisis management and resolution with its peers in the Nordic/Baltic region. Work is at early stages of making concrete proposals across a range of issues, from identification of systemically important groups to resolution, monitoring and burden sharing. In the narrower field of supervisory colleges, FI’s relative depth of experience in college matters makes it well placed to harness the college structure to develop a broader and deeper understanding of the banking groups’ risk profile. FI, notably, does not see the objective of college gatherings to be information exchange in order to satisfy each supervisor’s local supervisory needs but an active participatory process in order to achieve a shared risk assessment of a group. The success of college arrangements is work in progress for all supervisory authorities who are home or host to internationally active groups, but Sweden is particularly well placed in this respect.
16. Initiatives both at the Basel Committee and European level have influenced and contributed to the enhancement of the way FI conducts its supervision. Basel II, including Pillar 2, has been implemented in Sweden through the Capital Requirements Directive (CRD) and FI has used this framework as a basis, in a proportionate and differentiated manner, to critically assess both the systemic banking groups and the non-systemic institutions.
17. Historically the Swedish model has been to rely on a collegiate, consensual approach to many of its supervisory interactions. There has been a high degree of trust that institutions will rectify matters as and when deficiencies are pointed out to them, which has not always been the outcome in practice. FI is currently tackling the transition challenge of moving to a more assertive approach, more disciplined and formal in follow up, while retaining a mature and constructive dialogue with the supervised entities.
II. Preconditions for Effective Banking Supervision
A. Sound and Sustainable Macroeconomic Policies
18. The Swedish economy enjoyed an extended period of strong growth between 2002–2008, before being affected by the global financial crisis. The economy exited from recession in mid-2009. The financial and industrial sectors were severely affected by the crisis but have recovered. Unlike in other countries, housing prices were resilient in the downturn. Macroeconomic developments have been favorable, but macro financial risks remain, including the degree of reliance on wholesale funding within the banking sector. GDP growth rebounded strongly and is projected to grow 2.5-3 percent in 2011-2012. Public finances are among the strongest in advanced economies, with the fiscal balance projected to return to a surplus by 2012. The financial system has been stabilized, showing increases in banks’ capital positions and lower loan losses. Improved market conditions have enabled the authorities to begin to exit from crisis response measures since April 2010.
B. A Well-Developed Public Infrastructure
19. Overall, the public infrastructure supporting effective banking supervision is well developed in Sweden. In the area of financial stability there are relatively new cooperation arrangements in place between the domestic authorities—MoF, RB, FI, and the Swedish National Debt Office (SNDO)—that were established during in the financial crisis. The experience of cooperation and information exchange in the crisis was positive although some gateways for exchange of information (e.g., with the SNDO) are yet to be fully opened and greater formalization of concrete cooperation practices outside of crisis periods.
20. The Swedish legal system is based on civil law. The Swedish constitution establishes the independence of the courts. The general courts deal with criminal and civil actions while the general administrative courts are responsible for cases concerning public administration, including proceedings concerning financial regulation and regulation. State Aid to financial institutions is taken before a special Appeals Board specifically established for that purpose. As a member of the EU, much domestic legislation, including banking regulation, derives from EU regulations, directives and decisions which are frequently updated to keep pace with international standards.
21. The principle of transparency is fundamental to Sweden. In principle all information that is collected by or communicated from a public Swedish authority is open for everyone to see. If, for some reason, the information shall not be disclosed, an explicit decision has to be made, stating on what legal ground the “default option,” (i.e., openness, should not prevail in that specific case. The Public Access to Information and Secrecy Act of 2009, to which FI is subject, governs disclosure and confidentiality provisions.
22. Sweden has implemented International Financial Reporting Standards (IFRS). There is a full range of high-quality accountancy, audit, legal, and ancillary financial services available in the jurisdiction.
C. Effective Market Discipline
23. The principle of disclosure and transparency is well established in the Swedish context. In addition, with respect to the banking and financial sector, transparency is supported by the application of the “Pillar 3” disclosure framework of the Basel Capital Accord, which has been implemented in Sweden through the relevant EU legislation (CRD). The public statement on FI’s website states that it discloses as much information as possible in order to give the public insight into what is happening on the financial market, but that it does not, however, disclose sensitive information that can affect a firm’s competitive positioning on the market. FI also issues, on a regular basis, reports assessing and describing the risk environment. The RB publishes a bi-annual financial stability report.
D. Financial Sector Safety Net
24. Deposit insurance was introduced in Sweden in 1996 in conformity with the EU directive on deposit guarantee schemes. Since the end of 2010, deposits placed in credit institutions are protected to the maximum limit of € 100, 000. Since the introduction of the scheme there have been few failures in Swedish institutions leading to a payout, two in 2006 when the scheme was administered by the now disbanded Deposit Guarantee Board and one in 2010. The scheme has been managed by the NDO since 2008. Under the current law, payout under the deposit insurance scheme is triggered only when the institution is placed into bankruptcy. Although the FI can revoke a license, it cannot place an insolvent institution into bankruptcy. The deposit protection scheme plays no role in bank restructuring and is funded ex ante according to a fee structure that is sensitive to the relative capital adequacy strength of the individual institution making the contribution. Deposits made to deposit companies pursuant to the Deposits Business Act are not covered by the deposit protection scheme. The deposits that can be made to such companies are limited to SEK 50, 000 per individual.
25. Crisis measures to protect the stability of the banking system were largely based on the 2008 Government Support to Credit Institutions Act. Specific measures included debt guarantee, recapitalization, and bank takeover. As a state-aid measure the Act and the programs based on it were subject to scrutiny by the European Commission. Reflecting improved market conditions, the authorities began, in April 2010 to exit from crisis-response measures. Banks participating in the support schemes were subject to restrictions on remuneration to senior management. Additionally, the RB implemented a sweep of new liquidity measures through expanding its balance sheet, and took a number of measures to support banks’ capital and assure markets. At the same time, the NDO borrowed externally to boost international reserves, and the RB established swap facilities with the U.S. Federal Reserve and European Central Bank (ECB).
E. Main Findings
Objectives, independence, powers, transparency, and cooperation (CP 1)
26. FI needs operational independence in being able to set its priorities, make day to day decisions, allocate resources, and to establish a supervisory strategy with a long term horizon. The annual appropriations letter can be amended with updated requests during the year contains tasks and priorities for FI, thus introducing a degree of uncertainty or even directly impeding FI’s ability to plan and execute a supervisory program. The Minister of Finance can also (albeit indirectly) influence FI through the rather cumbersome budgetary process. Therefore, alternatives might be considered, for example, a more straightforward process, where FI levies fees and uses these to finance its own budget directly. In this example, the government ministry could subsequently oversee the efficiency and budgetary performance of FI.
27. Legislation creates the possibility for government involvement in or control of supervisory decisions, even though such powers have rarely been used. If the matter involves a matter of principle or particular importance the government and not FI must make the licensing decision. The Government is also empowered to make a wide range of decisions, regarding matters such as intervention, sanctions or revocation, when FI refers the matter to it because there is a matter of principle. Legislative changes to ensure that FI is the sole responsible authority for supervisory decisions are recommended.
28. Resources have increased at FI over the course of the last five years but there are material concerns that FI is still too resource constrained to deliver effective minimum levels of supervision and owing to the appropriations process lacks independent means to redress this deficiency. Many areas of FI’s supervisory operations, ranging from depth and intensity of supervisory actions (e.g., on-site inspections), ability to launch proactive investigations, enhance timeliness of follow up on remedial action and ability to ensure a sufficiently high level of supervision for the secondary banking market, which represents nearly one third of the banking sector in terms of domestic loans to the public, shows signs of severe resource strain. The forthcoming international regulatory agenda will only add to FI’s burdens.
29. In general, the Swedish approach is highly transparent and lines of accountability are clearly set out. FI’s mandate, with the twin objectives of financial stability and consumer protection, is expressed at a very high level. Prudential objectives are not stated explicitly, however, and notwithstanding the issuance of the annual appropriations letter which states specific tasks and objectives for the year, it is not clear how FI is expected to balance between the priorities and demands of these objectives.
30. Regulatory decisions made by FI, for example its use of remedial powers, its sanctions, and its power of revocation are subject to challenge and reversal in court. The right of appeal is an important component of any legal framework and the grounds for appeal are set at a high level. However, the element of legal and regulatory uncertainty can impede the effectiveness of FI’s intervention efforts and potentially exacerbate the management of a crisis situation given that that decisions cannot be applied until a court has provided its ruling, allowing claimants to delay and thus frustrate the purpose of FI’s interventions and potentially reduce FI’s incentives to employ its powers. An alternative method of satisfying the right to appeal by an institution or individual needs to be found in order to remove such uncertainties.
31. There is no direct or explicit protection afforded to FI or its staff against liability for actions and omissions in discharging their duties and this should be remedied. The assessors recognize that the thresholds for successful legal action are set at a high level and that the cultural environment of Sweden is not strongly litigious, unlike that in some other jurisdictions, but business culture can change over time, and an international market such as Sweden is exposed to this risk.
32. Sweden has extensive gateways for information sharing, domestic and non-domestic, that are complemented by a network of arrangements, MoUs and colleges. There are gateway provisions for the exchange of information between the principal domestic authorities with any responsibilities with respect to financial stability. When Sweden implements the revision to the EU CRD (CRD2) it will at that time widen and reinforce its gateways for information exchange both between supervisors (domestic and non domestic) and other relevant domestic authorities, particularly in respect of crisis management situations. During the financial crisis Sweden enhanced its domestic cooperation practices and the challenge is to ensure that open and effective communication and information exchange remains in place now that the peak of the crisis is passed.
Licensing and structure (CPs 2-5)
33. In the main, licensing and structure are given appropriate treatment under Sweden’s regulatory regime. There remain, however, areas where adjustments are recommended.
34. Overwhelmingly, deposit taking is located in entities licensed by, and subject to, the supervision of FI. However, deposits can also be taken by “deposit companies” operating under the Deposits Business Act and while deposits per customer are limited to SEK 50,000 they are not covered by the deposit guarantee scheme. This presents an unnecessary reputational risk to FI and also a risk to customers’ own interests as such “deposit companies” are registered by FI but not supervised by it although there are limited reporting requirements and the companies are subject to AML requirements also.
35. While FI’s close relationship with market participants reportedly enables it to obtain its objectives either via pressure or the desire of participants to keep it informed, basic statutory underpinnings are to be preferred. In these regards, granting FI the power to assess the fitness and propriety of all members of senior management, rather than only the Chief Executive Officer (CEO) and his/her deputy would be constructive (CP 2). In similar vein, FI should have the statutory power to revoke a license obtained through deception or other irregularity and credit institutions should be obliged by statute to notify FI forthwith upon learning of any material information that may negatively affect the suitability of a major shareholder.
36. Potentially, there is ample room for acquisitions/investments by credit institutions to occur without FI having the opportunity to comment. While again licensees’ desire to keep FI informed may work in its favor, the quantum limit above which FI’s approval for an investment/acquisition is required is in excess of 25 percent of the investors’ capital base. Investments below the threshold may be made without informing FI either before or after the fact. Consideration should be given to requiring FI’s prior approval for investments in subsidiaries, over to be determined threshold, and after the fact notification.
Prudential regulation and requirements (CPs 6-18)
37. There are a range of issues that need to be addressed, some with urgency, with respect to a number of individual risk areas. In addition it may be noted that FI’s capacity to determine the quality of institutions’ own oversight and management of their key risk areas is significantly constrained by limits on its own resources. This factor needs to be borne in mind when assessing the degree of compliance with this group of principles, but it is important also to recognize that resource constraint is not the sole and is not the determining factor driving these assessments. Aside from that, FI has prioritized between major risk factors for the Swedish banking system and it has launched a number of initiatives to improve its understanding and industry practice in some key areas, notably liquidity, trading book valuations and operational risk.
Methods of ongoing banking supervision (CPs 19-21)
38. The overall supervisory approach is based on a risk based process that acts as an effective method of resource allocation but needs further analytical development. FI does not have a formalized, analytical risk framework that might be used to assess the risk profile of an institution. At present supervisory effort focuses on the use of a technique designed to assess capital adequacy, that of the supervisory review evaluation process. The assessors are satisfied that in daily practice supervisors do not take a narrow approach to their risk analysis or supervisory practice, but the Supervisory Review and Evaluation Process (SREP) needs to be developed and supplemented to ensure that other risks (e.g., environmental—such as economic and competitive environments; business model risks and controls; oversight and governance risks) are fully and systematically built into the assessment, including forward looking elements. FI is in the course of developing some further analytical tools with respect to monitoring smaller firms and with respect to credit risk (internal ratings). These developments are welcome and can be built into a more formal overarching analytical framework.
39. Lack of resource is a severe and damaging constraint upon FI. As FI recognizes itself, needs to be able to spend more time on site with institutions, both systemic and non-systemic, deepening its understanding and challenging firms as appropriate. The supervisors’ capacity to assess the dimensions of risk facing the supervised institutions is, at present, undermined by limitations on the frequency, duration and intensity of supervisory interactions that are possible.
40. FI must strike the right balance in allocation of time and attention between systemic banks and the secondary banking sector. The challenge is to ensure that there is an effective minimum level of supervision for the secondary banking sector which in aggregate represents a significant proportion of the banking system. FI should carefully reconsider whether it has achieved the right balance at this time.
Accounting and disclosure (CP 22)
41. FI does not have the power to reject and rescind the appointment of an external auditor. While FI can often achieve this objective through putting pressure on an institution’s Board, it would be preferable to have an unfettered power to rescind appointment of an external auditor.
Corrective and remedial powers of supervisors (CP 23)
42. At a broad level FI has a range of corrective and remedial powers. However, there are gaps and limitations in FI powers. With respect to sanctions and penalties on individuals, FI has only the power to remove or bar an individual from the Board or position of managing director. FI cannot remove senior management, only the Board or managing director. This creates strong opportunities for influence, but more direct intervention powers would be more efficient and lead to more timely outcomes.
43. FI’s powers of sanction and decision making can be affected by legal certainty. The legal uncertainty affects intervention but also has wider consequences for bank resolution although resolution issues fall outside of the scope of the BCP assessment. Under the Swedish system, liquidation of a non-systemic bank is triggered by a revocation decision, but the revocation decision itself can be overturned, as can any FI sanction. The liquidation may be suspended pending outcome of appeal. The legal uncertainties inhibit a clear and predictable outcome for a firm as well as FI’s ability to plan a course of supervisory action involving sanction. A robust and flexible early-intervention framework that would provide the supervisory and resolution authorities with the tools and mandate to intervene and resolve ailing institution at an earlier stage, and resolving the legal concerns identified, is needed.
Consolidated and cross-border banking supervision (CPs 24-25)
44. FI practices consolidated supervision according to the EU legislative framework. FI applies its prudential standards on a consolidated basis and makes determinations on the oversight of the group through a mix of regular college meetings and periodic on-site visits to firms. However, FI does not have direct powers to impose its prudential standards on non-financial (and non mixed activity) parent companies of credit institutions. Although the major banking groups have regulated banking entities as the parent company, it would be advisable for Swedish authorities to consider if they need to go beyond the requirements set out in the banking directives governing scope of application of FI powers to parent entities. From a forward looking point of view it is always possible that new corporate structures can be adopted or new groups emerge.
45. FI has an extensive network of MoUs and arrangements with other home or host supervisors supported by a gateways for information exchange and confidentiality provisions. Sweden is the home jurisdiction to four systemically significant banking groups for the Nordic region, one of which is considered to be globally systemic. At the same time Sweden is host to 45 foreign branches. On balance, however, Sweden’s role as a home supervisory authority is more significant than as a host authority but the potential for spill over of risks could be both inward and outward. Home-host arrangements are therefore critical and FI has a clear ambition to ensure that information exchange serves as the first step towards a deeper and broader understanding of a banking group’s activities and risk profile by all relevant supervisors. In other words information exchange is not seen as an end in itself but as it serves the purpose of more meaningful and effective supervision. Progress would benefit from increased time spent on-site visits to host/home jurisdictions, although this option is limited by current resource constraints.
Table 1.
Sweden: Summary Compliance with the BCP—Detailed Assessments
Table 1.
Sweden: Summary Compliance with the BCP—Detailed Assessments
| Core Principle | Grading | Comments | |
|---|---|---|---|
| 1. Objectives, independence, powers, transparency, and cooperation | lc | ||
| 1.1 Responsibilities and objectives | lc | Statutory regulatory and supervisory mandates are open to interpretation and lack clarity with respect to how prudential objectives should be balanced with consumer protection objectives. FI has been able to move into a more proactive and where possible intrusive approach to supervision without change to its overarching mandate. | |
| 1.2 Independence, accountability and transparency | mnc | FI’s effectiveness may be compromised by the annual appropriation letters from the government. Resources are constrained to the extent that they are compromising FI’s ability to deliver effective minimum standards of supervision. Both FI and the government have powers to issue or withdraw a banking license or decide upon revocation thus creating the possibility for the government to be involved in institution-specific supervisory issues such as licensing. | |
| 1.3 Legal framework | c | FI is compliant with this criterion; please note comments under CP 1(2) however. | |
| 1.4 Legal powers | lc | Regulatory decisions made by FI, for example its use of remedial powers, its sanctions, and its power of revocation are subject to challenge and reversal in court. The grounds for appeal are set at a high level but the element of legal uncertainty is an impediment to effective supervision. | |
| 1.5 Legal protection | lc | There is no direct or explicit protection afforded to FI or its staff against liability for actions and omissions in discharging their duties. | |
| 1.6 Cooperation | c | No comments | |
| 2. Permissible activities | lc | Deposit taking is not reserved for entities licensed and subject to supervision as banks. | |
| 3. Licensing criteria | lc | The FI does not have power to assess fitness and propriety of all members of senior management (EC8). Obtainment of a license through false information or other irregularity is not in itself sufficient grounds for FI to revoke the CI’s license. This is a weakness in the statutory provisions. | |
| 4. Transfer of significant ownership | c | It would be constructive for CIs to be obliged to notify FI forthwith upon learning of any material information that may negatively affect suitability of a major shareholder. | |
| 5. Major acquisitions | mnc | Notification limit is set at more than 25 percent of the CI’s capital base, which gives broad latitude for acquisitions/investments to escape FI’s review. Except for the obligation to notify FI about an acquisition made to secure a claim, there are no requirements to notify FI even after an acquisition/investment. Moreover, there are no precise legal criteria or supervisory guidelines by which to judge even individual proposals that must first be referred to FI for prior approval. | |
| 6. Capital adequacy | c | No comments | |
| 7. Risk management process | lc | Too great an emphasis is placed on the existence of policies and processes and insufficient weight placed on corroborating actual risk management practice in institutions. | |
| 8. Credit risk | c | No comments | |
| 9. Problem assets, provisions, and reserves | lc | The extent of information obtained by FI is questionable. The FI is not in a position to robustly determine the quality of process, policies, classification and controls within even its major institutions. | |
| 10. Large exposure limits | c | More granular reporting of exposures from the major institutions in particular (applied in the crisis but subsequently withdrawn) would be advisable. | |
| 11. Exposure to related parties | lc | FI is relying on general requirements to address related party exposures. Although supervisory review has identified breaches in banks on this issue, more specific requirements are needed. | |
| 12. Country and transfer risks | c | Country and transfer risk is increasingly important for Sweden given the cross border activities of the systemic players. Close monitoring of exposures is warranted. | |
| 13. Market risks | LC | Although market risk is not considered to be a major risk in the overall banking sector, the failure of at least one bank has been attributable to trading book weaknesses. The FI is not in a position to robustly determine the quality of process, policies, limits and controls within even its major institutions. Timeliness in following up on identified concerns has been weak although recently launched initiatives ought to deliver significant strengthening in this risk area. | |
| 14. Liquidity risk | LC | Liquidity risk supervision has been very weak and is in the course of major revision. FI has been devoting effort into revising liquidity risk management standards, liquidity reporting as well as launching a major project to assess the quality and implementation of liquidity risk policies across institutions and an additional review targeted at systemic institutions on liquidity pricing risk. Continued progress, as planned, is required at a minimum. | |
| 15. Operational risk | LC | Emphasis placed on operational risk is not strong as for some other risk areas. This is exemplified by the lack of guidance to firms with respect to operational risk. | |
| 16. Interest rate risk in the banking book | c | No Comments | |
| 17. Internal control and audit | lc | Regulations are deficient with respect to setting clear obligations for an institution to inform FI of material information that may negatively affect the fitness and propriety of a Board member or a member of senior management. Note that are also deficiencies with respect to regulations concerning internal control regarding FI’s lack of power to require changes in the senior management of an institution other than the CEO/Deputy CEO (assessed under CP 23). It is noted that there have been nine (9) on-site examinations with a focus purely on Internal Control in the three years to December 31, 2010. Where Internal Audit is addressed as part of a themed inspection with another focus, it is not clear from inspection reports that this was done. | |
| 18. Abuse of financial services | LC | CIs are not obliged to implement screening procedures to ensure high ethical and professional standards when hiring staff and nor are they required to report to FI suspicious activities and incidents of fraud material to their safety, soundness or repute. | |
| 19. Supervisory approach | LC | The existing risk based framework needs to be enhanced and supplemented by a formalization of a risk-based methodology. | |
| 20. Supervisory techniques | MNC | Balance of on-and-off site supervision has not been achieved. Severe weakness in this area has exacerbated deficiencies in compliance in seven risk and risk control aspects of the CP and the individual and cumulative force of these weaknesses are assessed here. More resource needs to be available to on-site inspection across systemic and non-systemic institutions. | |
| 21. Supervisory reporting | LC | FI resources are wasted by frequent incidents of misreporting. FI’s on-site inspection program is modest and rarely includes validation of the accuracy of supervisory reporting. The Standard Report would benefit from addition to “C. Specifications: Balance Sheet” of a breakdown of exposures to related parties. | |
| 22. Accounting and disclosure | LC | The FI does not have power to reject or rescind the appointment of an external auditor (EC6). | |
| 23. Corrective and remedial powers of supervisors | LC | FI has only the power to remove or bar an individual from the Board or position of managing director. FI cannot remove senior management, only the Board or managing director. There is legal uncertainty created surrounding the sanctions and revocations process due to the manner in which the appeals process is designed. Possibility of appeal and redress without overturning a decision of revocation should be achieved. | |
| 24. Consolidated supervision | c | Widening the legal framework to ensure FI powers are applicable to bank holding companies should be considered. | |
| 25. Home-host relationships | c | No comments. | |
| Aggregate: Compliant (C)-8, Largely compliant (LC)-15, Materially noncompliant (MNC)-2, Noncompliant (NC)-0, Not applicable (N/A)-0 | |||
Table 1.
Sweden: Summary Compliance with the BCP—Detailed Assessments
| Core Principle | Grading | Comments | |
|---|---|---|---|
| 1. Objectives, independence, powers, transparency, and cooperation | lc | ||
| 1.1 Responsibilities and objectives | lc | Statutory regulatory and supervisory mandates are open to interpretation and lack clarity with respect to how prudential objectives should be balanced with consumer protection objectives. FI has been able to move into a more proactive and where possible intrusive approach to supervision without change to its overarching mandate. | |
| 1.2 Independence, accountability and transparency | mnc | FI’s effectiveness may be compromised by the annual appropriation letters from the government. Resources are constrained to the extent that they are compromising FI’s ability to deliver effective minimum standards of supervision. Both FI and the government have powers to issue or withdraw a banking license or decide upon revocation thus creating the possibility for the government to be involved in institution-specific supervisory issues such as licensing. | |
| 1.3 Legal framework | c | FI is compliant with this criterion; please note comments under CP 1(2) however. | |
| 1.4 Legal powers | lc | Regulatory decisions made by FI, for example its use of remedial powers, its sanctions, and its power of revocation are subject to challenge and reversal in court. The grounds for appeal are set at a high level but the element of legal uncertainty is an impediment to effective supervision. | |
| 1.5 Legal protection | lc | There is no direct or explicit protection afforded to FI or its staff against liability for actions and omissions in discharging their duties. | |
| 1.6 Cooperation | c | No comments | |
| 2. Permissible activities | lc | Deposit taking is not reserved for entities licensed and subject to supervision as banks. | |
| 3. Licensing criteria | lc | The FI does not have power to assess fitness and propriety of all members of senior management (EC8). Obtainment of a license through false information or other irregularity is not in itself sufficient grounds for FI to revoke the CI’s license. This is a weakness in the statutory provisions. | |
| 4. Transfer of significant ownership | c | It would be constructive for CIs to be obliged to notify FI forthwith upon learning of any material information that may negatively affect suitability of a major shareholder. | |
| 5. Major acquisitions | mnc | Notification limit is set at more than 25 percent of the CI’s capital base, which gives broad latitude for acquisitions/investments to escape FI’s review. Except for the obligation to notify FI about an acquisition made to secure a claim, there are no requirements to notify FI even after an acquisition/investment. Moreover, there are no precise legal criteria or supervisory guidelines by which to judge even individual proposals that must first be referred to FI for prior approval. | |
| 6. Capital adequacy | c | No comments | |
| 7. Risk management process | lc | Too great an emphasis is placed on the existence of policies and processes and insufficient weight placed on corroborating actual risk management practice in institutions. | |
| 8. Credit risk | c | No comments | |
| 9. Problem assets, provisions, and reserves | lc | The extent of information obtained by FI is questionable. The FI is not in a position to robustly determine the quality of process, policies, classification and controls within even its major institutions. | |
| 10. Large exposure limits | c | More granular reporting of exposures from the major institutions in particular (applied in the crisis but subsequently withdrawn) would be advisable. | |
| 11. Exposure to related parties | lc | FI is relying on general requirements to address related party exposures. Although supervisory review has identified breaches in banks on this issue, more specific requirements are needed. | |
| 12. Country and transfer risks | c | Country and transfer risk is increasingly important for Sweden given the cross border activities of the systemic players. Close monitoring of exposures is warranted. | |
| 13. Market risks | LC | Although market risk is not considered to be a major risk in the overall banking sector, the failure of at least one bank has been attributable to trading book weaknesses. The FI is not in a position to robustly determine the quality of process, policies, limits and controls within even its major institutions. Timeliness in following up on identified concerns has been weak although recently launched initiatives ought to deliver significant strengthening in this risk area. | |
| 14. Liquidity risk | LC | Liquidity risk supervision has been very weak and is in the course of major revision. FI has been devoting effort into revising liquidity risk management standards, liquidity reporting as well as launching a major project to assess the quality and implementation of liquidity risk policies across institutions and an additional review targeted at systemic institutions on liquidity pricing risk. Continued progress, as planned, is required at a minimum. | |
| 15. Operational risk | LC | Emphasis placed on operational risk is not strong as for some other risk areas. This is exemplified by the lack of guidance to firms with respect to operational risk. | |
| 16. Interest rate risk in the banking book | c | No Comments | |
| 17. Internal control and audit | lc | Regulations are deficient with respect to setting clear obligations for an institution to inform FI of material information that may negatively affect the fitness and propriety of a Board member or a member of senior management. Note that are also deficiencies with respect to regulations concerning internal control regarding FI’s lack of power to require changes in the senior management of an institution other than the CEO/Deputy CEO (assessed under CP 23). It is noted that there have been nine (9) on-site examinations with a focus purely on Internal Control in the three years to December 31, 2010. Where Internal Audit is addressed as part of a themed inspection with another focus, it is not clear from inspection reports that this was done. | |
| 18. Abuse of financial services | LC | CIs are not obliged to implement screening procedures to ensure high ethical and professional standards when hiring staff and nor are they required to report to FI suspicious activities and incidents of fraud material to their safety, soundness or repute. | |
| 19. Supervisory approach | LC | The existing risk based framework needs to be enhanced and supplemented by a formalization of a risk-based methodology. | |
| 20. Supervisory techniques | MNC | Balance of on-and-off site supervision has not been achieved. Severe weakness in this area has exacerbated deficiencies in compliance in seven risk and risk control aspects of the CP and the individual and cumulative force of these weaknesses are assessed here. More resource needs to be available to on-site inspection across systemic and non-systemic institutions. | |
| 21. Supervisory reporting | LC | FI resources are wasted by frequent incidents of misreporting. FI’s on-site inspection program is modest and rarely includes validation of the accuracy of supervisory reporting. The Standard Report would benefit from addition to “C. Specifications: Balance Sheet” of a breakdown of exposures to related parties. | |
| 22. Accounting and disclosure | LC | The FI does not have power to reject or rescind the appointment of an external auditor (EC6). | |
| 23. Corrective and remedial powers of supervisors | LC | FI has only the power to remove or bar an individual from the Board or position of managing director. FI cannot remove senior management, only the Board or managing director. There is legal uncertainty created surrounding the sanctions and revocations process due to the manner in which the appeals process is designed. Possibility of appeal and redress without overturning a decision of revocation should be achieved. | |
| 24. Consolidated supervision | c | Widening the legal framework to ensure FI powers are applicable to bank holding companies should be considered. | |
| 25. Home-host relationships | c | No comments. | |
| Aggregate: Compliant (C)-8, Largely compliant (LC)-15, Materially noncompliant (MNC)-2, Noncompliant (NC)-0, Not applicable (N/A)-0 | |||
III. Recommended Action Plan and Authorities’ Response
A. Recommended Action Plan
46. Table 2 lists the suggested steps for improving compliance.
Table 2.
Sweden: Recommended Action Plan to Improve Compliance with the BCP
Table 2.
Sweden: Recommended Action Plan to Improve Compliance with the BCP
| Reference Principle | Recommended Action |
|---|---|
| 1.1 Responsibilities and objectives | FI should articulate how it interprets its mandate including how it would respond in the event that a conflict should arise between acting on the basis of consumer protection or financial stability. |
| 1.2 Independence accountability and transparency | Ensure operational and legal independence of FI. Remove duality of powers of FI and Government to determine licensing and revocation. Increase scale of funding and consider whether there are alternative funding models for FI. |
| 1.4 Legal powers | Identify and implement alternative legal options that are compatible with the right of appeal and redress to ensure that FI is able to deliver a regulatory decision or sanction, such as revocation, without the risk of the decision being overturned by the courts. |
| 1.5 Legal protection | Establish direct or explicit protection to FI and its staff against liability for actions and omissions in discharging their duties when acting in good faith. |
| 2. Permissible activities | Deposit taking should be permitted only to those entities licensed and subject to supervision as banks. |
| 3. Licensing criteria | The FI should have power to assess fitness and propriety of all members of senior management. Revise the statute to provide power to revoke a license determined to have been obtained by deception. |
| 4. Transfer of significant ownership | Amend regulations to create the obligation for firms to notify FI forthwith upon becoming aware of any material information that may negatively affect the suitability of a major shareholder. |
| 5. Major acquisitions | Laws or regulations should provide precise criteria by which to judge individual proposals. Prior notification requirement should be expanded, including establishing specific thresholds, and after-the-fact notification introduced. |
| 7. Risk management process | Ensure focus is placed on corroborating firms’ risk management practices rather than whether policies and processes are formally in place. |
| 9. Problem assets, provisions and reserves | Ensure adequacy of information on quality of assets from firms. |
| 11. Related parties | Consider developing more explicit rules. Ensure adequate supervisory focus in the context of reviews. |
| 13. Market risk | Continue with current initiative on trading book valuation. Ensure that findings inform future supervisory practice in on site reviews, and ensure that there is feedback to internal and external auditors to enhance understanding of supervisory expectations. |
| 14. Liquidity risk | Continue with planned implementation of liquidity initiatives and ensure that findings from the reviews are incorporated in guidance and supervisory practice going forward. |
| 16. Operational risk | Continue with development of guidance for firms and establish, to the extent possible a systematic approach to the on-site assessment of firms’ practices. Ensure firms are placing sufficient emphasis on business continuity and contingency plans. |
| 17. Internal control and audit | Remedy deficiencies in regulations with respect to obligations on institutions to inform FI of material information that may negatively affect the fitness and propriety of a Board member or a member of senior management Where Internal Audit is included in a themed inspection with a different focus, the report should indicate the findings. |
| 18. Abuse of financial services | CIs should be formally required to implement screening procedures to ensure high ethical and professional standards when hiring staff. The text of FFFS 2005:12 should be revised to provide for reporting of incidents of suspicious activity and high impact fraud to FI. |
| 19. Supervisory approach 20. Supervisory techniques | Establish a formalized analytical framework for the risk assessment of firms, building on existing practices. Determine resource requirements to ensure minimum level of effective oversight in particular in respect of: risk management, credit risk, problem assets, market risk, liquidity risk, operational risk, internal control and audit. (CPs 7, 8, 9, 13, 14, 15, and 17). |
| 21. Supervisory reporting | FI should consider demanding certification of filings by a CI’s CEO or CFO and obtaining statutory authority to levy significant fines for misreporting. FI should consider requiring external auditors opining whether filings have been accurately made, with the fee being for the CI’s account. The Standard Report should include a breakdown of exposures to related parties. |
| 22. Accounting and disclosure | The FI should be granted power to reject or rescind the appointment of an external auditor. |
| 23. Remedial action | Ensure that sanctions can be applied to senior management (in addition to Managing Director). Consider early intervention framework. Identify appropriate revisions in order to remove legal uncertainties that are created by the possibility that a revocation decision can be overturned. The ambiguity of status of a revoked institution (including liquidation issues) may lead to significant supervisory hesitation in using powers of revocation. Review levels of fines that can be applied to supervised institutions, including the removal of the existing cap of SEK 50,000, 000. |
| 24. Consolidated supervision | Ensure that consolidated supervision powers can be applied to and enforced on a bank holding company. |
Table 2.
Sweden: Recommended Action Plan to Improve Compliance with the BCP
| Reference Principle | Recommended Action |
|---|---|
| 1.1 Responsibilities and objectives | FI should articulate how it interprets its mandate including how it would respond in the event that a conflict should arise between acting on the basis of consumer protection or financial stability. |
| 1.2 Independence accountability and transparency | Ensure operational and legal independence of FI. Remove duality of powers of FI and Government to determine licensing and revocation. Increase scale of funding and consider whether there are alternative funding models for FI. |
| 1.4 Legal powers | Identify and implement alternative legal options that are compatible with the right of appeal and redress to ensure that FI is able to deliver a regulatory decision or sanction, such as revocation, without the risk of the decision being overturned by the courts. |
| 1.5 Legal protection | Establish direct or explicit protection to FI and its staff against liability for actions and omissions in discharging their duties when acting in good faith. |
| 2. Permissible activities | Deposit taking should be permitted only to those entities licensed and subject to supervision as banks. |
| 3. Licensing criteria | The FI should have power to assess fitness and propriety of all members of senior management. Revise the statute to provide power to revoke a license determined to have been obtained by deception. |
| 4. Transfer of significant ownership | Amend regulations to create the obligation for firms to notify FI forthwith upon becoming aware of any material information that may negatively affect the suitability of a major shareholder. |
| 5. Major acquisitions | Laws or regulations should provide precise criteria by which to judge individual proposals. Prior notification requirement should be expanded, including establishing specific thresholds, and after-the-fact notification introduced. |
| 7. Risk management process | Ensure focus is placed on corroborating firms’ risk management practices rather than whether policies and processes are formally in place. |
| 9. Problem assets, provisions and reserves | Ensure adequacy of information on quality of assets from firms. |
| 11. Related parties | Consider developing more explicit rules. Ensure adequate supervisory focus in the context of reviews. |
| 13. Market risk | Continue with current initiative on trading book valuation. Ensure that findings inform future supervisory practice in on site reviews, and ensure that there is feedback to internal and external auditors to enhance understanding of supervisory expectations. |
| 14. Liquidity risk | Continue with planned implementation of liquidity initiatives and ensure that findings from the reviews are incorporated in guidance and supervisory practice going forward. |
| 16. Operational risk | Continue with development of guidance for firms and establish, to the extent possible a systematic approach to the on-site assessment of firms’ practices. Ensure firms are placing sufficient emphasis on business continuity and contingency plans. |
| 17. Internal control and audit | Remedy deficiencies in regulations with respect to obligations on institutions to inform FI of material information that may negatively affect the fitness and propriety of a Board member or a member of senior management Where Internal Audit is included in a themed inspection with a different focus, the report should indicate the findings. |
| 18. Abuse of financial services | CIs should be formally required to implement screening procedures to ensure high ethical and professional standards when hiring staff. The text of FFFS 2005:12 should be revised to provide for reporting of incidents of suspicious activity and high impact fraud to FI. |
| 19. Supervisory approach 20. Supervisory techniques | Establish a formalized analytical framework for the risk assessment of firms, building on existing practices. Determine resource requirements to ensure minimum level of effective oversight in particular in respect of: risk management, credit risk, problem assets, market risk, liquidity risk, operational risk, internal control and audit. (CPs 7, 8, 9, 13, 14, 15, and 17). |
| 21. Supervisory reporting | FI should consider demanding certification of filings by a CI’s CEO or CFO and obtaining statutory authority to levy significant fines for misreporting. FI should consider requiring external auditors opining whether filings have been accurately made, with the fee being for the CI’s account. The Standard Report should include a breakdown of exposures to related parties. |
| 22. Accounting and disclosure | The FI should be granted power to reject or rescind the appointment of an external auditor. |
| 23. Remedial action | Ensure that sanctions can be applied to senior management (in addition to Managing Director). Consider early intervention framework. Identify appropriate revisions in order to remove legal uncertainties that are created by the possibility that a revocation decision can be overturned. The ambiguity of status of a revoked institution (including liquidation issues) may lead to significant supervisory hesitation in using powers of revocation. Review levels of fines that can be applied to supervised institutions, including the removal of the existing cap of SEK 50,000, 000. |
| 24. Consolidated supervision | Ensure that consolidated supervision powers can be applied to and enforced on a bank holding company. |
IV. Authorities’ Response to the Assessment
47. The Swedish authorities welcome the assessment of the regulation and supervision of the Swedish banking sector. We look forward to using the recommendations stated in the report to improve the regulation and supervision of the banking sector in Sweden.
48. Generally, we share the views expressed in the assessment as well as the grading of most of the Basel Core Principles. However, while appreciating our earlier interaction on the evaluation on the Basel Core Principle 1.2, which has been rated materially non-compliant (MNC), we do not fully share this assessment. The main reasons for this are:
49. First, it should be noted that the possibilities for the government, after referral from FI, to decide on matters concerning, e.g., licensing of a bank or revocation of a bank’s license are circumscribed through provisions in law and interpretative statements in preparatory works to the law. Moreover, in practice, such decisions have been taken by FI rather than by the government. Although the mere possibility that the government may take such decisions may be seen as unsuitable per se, it does not appear that the legal provisions as such have created legal uncertainty among the regulated entities.
50. Further, we would like to emphasize that FI’s current fee model—where fees levied by FI are passed on to the state budget—ensures that these funds are subject to parliamentary control. The fact that these funds form part of the state budget, which is decided by the highest representatives of Swedish voters in Parliament pursuant to provisions in the Swedish Constitution, is held to be very valuable in this context. The budgetary process as laid down in the Constitution and the Budget Act has been designed to ensure sound public finances and transparent handling of public funds. Also, parliamentary control constitutes a safeguard against the risk that market actors might be perceived as having undue influence in the setting of fees.
51. Also, assessments of supervisory authorities’ independence in other FSAP’s carried out in other countries during 2007 and 2008 have resulted in higher ratings in cases where the supervisory authorities were subject to government decision-making power as regards, e.g., the allocation of funds, supervisory priorities and staffing issues.
52. Finally, we would like to draw your attention to the fact that we are about to initiate work aiming at revising our framework and welcome you back to a new assessment in a not too far distant future.
V. Detailed Assessment
Table 3.
Sweden: Detailed Assessment of Compliance with the BCP
Table 3.
Sweden: Detailed Assessment of Compliance with the BCP
| Principle 1. | Objectives, autonomy, powers, and resources. An effective system of banking supervision will have clear responsibilities and objectives for each authority involved in the supervision of banks. Each such authority should possess operational independence, transparent processes, sound governance and adequate resources, and be accountable for the discharge of its duties. A suitable legal framework for banking supervision is also necessary, including provisions relating to authorization of banking establishments and their ongoing supervision; powers to address compliance with laws as well as safety and soundness concerns; and legal protection for supervisors. Arrangements for sharing information between supervisors and protecting the confidentiality of such information should be in place. | ||||
| Description | |||||
| Assessment | Largely Compliant | ||||
| Comments | |||||
| Principle 1(1). | Responsibilities and objectives. An effective system of banking supervision will have clear responsibilities and objectives for each authority involved in the supervision of banks. | ||||
| Description | EC1. FI is the authority responsible for banking supervision in Sweden. The general responsibilities and objectives of FI are set out in Government Ordinance 2009:93. Namely
In discharging its responsibilities, FI is obliged to ensure that its practices (rules and routines) are cost effective and simple for citizens and firms to understand and comply with. In addition to Ordinance 2009:93, the government issues an annual appropriations letter to FI which may also set out specific responsibilities and tasks for the authority for the fiscal year in question. This letter may be amended and revised during the course of the year. The appropriations letters are publicly disclosed on the government and FI websites. The letter will set out specific assignments and but may also include objectives such as:
EC2. FI operates with a comprehensive framework of minimum prudential standards. Minimum prudential standards for banks are set out in the Banking and Finance Business Act (2004:297). The Act sets out the minimum requirements for obtaining banking license, including minimum initial capital (Chapter 3, Section 5), fit and proper tests, solvency, liquidity, risk management, transparency and soundness. Detailed provisions on capital adequacy requirements are contained in the Act on Capital Adequacy and Large Exposures (CALE) (2006:1371). FI has the mandate to issue binding secondary regulation and general (non-binding) guidelines concerning different aspects of banking business. Failure to conform to the guidelines is taken as a signal that the institution may not be in conformity with the underlying law either. EC3. The Banking and Finance Business Act and the Act on CALE are updated in order to keep the law abreast of changes in EU law and other developments. Further amendments are foreseen in 2011 in order to transpose new provisions in the EU Directives on Credit Institutions and Capital Adequacy (the “CRD 2” and “CRD 3” legislative packages). However, there can be a lag in the timeliness of updates, as, for example, the Acts have not been updated to take account of CRD2 which should have been implemented by the end of 2010. In this particular instance the delay was due to staff shortages at the MoF. The elements of CRD2 that could be implemented directly by FI under its own authority were implemented on time. FI has an established process to systematically survey and assess the need for changes within its regulatory mandate. EC4. FI issues regular and ad-hoc reports concerning the financial system. Regular publications include the annual Risk Report, and the Supervisory Report. The former gives an overview of the present situation and the outlook for different parts of the financial sector, including identification of main risks and problems. This report provides the basis for FI’s supervisory planning process. Supervisory Report describes FI’s recent supervisory and regulatory activities are described. Additionally, FI produces and publishes, usually on a quarterly basis, various statistics, based in regular reporting from supervised entities. This concerns, e.g., various financial data, lending, capital adequacy. Pillar 3 data is not posted directly on FI’s website although there is access to a data base of authorized institutions from which to examine Pillar 3 disclosures. FI is concerned that firms should fulfill their public disclosure responsibilities and in support of that is, for example, planning a targeted assessment of firms’ disclosure in the field of liquidity risk later in 2011. AC1. FI adopts a risk based approach to supervision. Data and analysis contained in the Risk Report and the Supervisory Report is used as one starting point for prioritizing and for planning supervisory activities. Supervisors also conduct individual assessments of the risks of the institutions in order to contribute to prioritization of supervisory activity and allocation of resources. | ||||
| Assessment | Largely Compliant | ||||
| Comments | FI has two core objectives set out in legislation: financial stability and consumer protection. FI’s responsibility for supervision and licensing of financial institutions is also clearly stated in law. There is no clarity, however, with respect to how FI should balance its financial stability and consumer objectives. Nor, given that FI is a unitary regulator, is there clarity with respect to balancing prudential and conduct of business duties. It is recommended that FI should articulate how it interprets its mandate including how it would respond in the event that a conflict should arise between acting on the basis of consumer protection or financial stability. The public annual appropriations letter from the government sets specific tasks and assignments for the supervisory authority so, from year to year and within the course of the year, FI will receive direction and revision on its tasks and priorities within the context of its mandate for financial stability and consumer protection. The timeliness of updating of relevant banking legislation is not consistently achieved. In those areas where FI has responsibility for updating regulation that it issues, timeliness has been maintained. However, there have been delays when aspects of the legislation that are dependent on the more time consuming Parliamentary process. Delays, for example to the implementation of CRD2, have occurred primarily due to staffing limitations at the MoF. | ||||
| Principle 1(2). | Independence, accountability, and transparency. Each such authority should possess operational independence, transparent processes, sound governance and adequate resources, and be accountable for the discharge of its duties. | ||||
| Description | EC1. FI is an independent government authority. As a public authority, its independent decision-making capacity is enshrined in the Instrument of Government. Thus, the government or an individual minister cannot influence or modify a decision by FI. The government issues an annual, publicly disclosed, appropriations letter which identifies objectives, assignments and reporting requirements to FI. The supervisor itself is consulted in the course of the preparation of this letter. The director general may be removed from office before the end of the six year term only if he or she commits forms of misconduct or has a disability impairing the performance of the authority, defined by law. Where the head of a government agency is removed from office, the reasons must be publicly disclosed. EC2. The Annual Report from FI, in which the authority describes and evaluates its activities, including its cost-effectiveness, subject to detailed reporting requirements from the MoF, is a public document. FI must respond to the tasks, reports and assignments set out in the annual public appropriations letter from the government. The Director General of FI makes a statement at least once a year before the Parliamentary Finance Committee. The FI’s activities are scrutinized by the Swedish National Audit Office. The budget of FI, including objectives and motivations behind the instructions and resources provided, is public. The supervisory measures that FI takes against the credit institutions are made public by the supervisor. EC3. FI has established a set of ethical standards for its employees (including the Director General and the Board members) concerning, e.g., confidentiality, loans from supervised entities, additional occupations, and dealings in financial instruments, to avoid possible conflicts of interest or imply other problems that may to affect public confidence negatively. There are also policies and routines in place for handling the situation when an employee leaves FI for work in a supervised institution (e.g., an employee would be removed from sensitive responsibilities for at least three months prior to taking up a role in a supervised institution). EC4. FI is mainly financed through appropriation (allowance) from the state budget. In turn, FI levies fees on its supervised entities and passes these funds to the state budget, In 2010, 85percent of FI’s activities were funded in this manner. The remaining financing derives from fees that are charged to firms in respect of specific services that the supervised entity has sought from FI on a voluntary basis. FI has in practice enjoyed full discretion over the use of these fees, but the level of the fees is determined by the government and could in theory be reduced should the government wish to constrain how FI disposed of its budget as pursuant to Sections 7 and 8 of the Budget Act (1996:1059), the government may impose some limitations on the use of funds allotted to an administrative authority. In discussion with supervised institutions the assessors noted that generally service based fees were not resisted but there was some discussion on whether the levels of delivery (e.g., expertise in performing certain specialist tasks) always matched the institutions’ expectations. Once the state budget has been adopted by the Parliament, the government issues an annual appropriation instruction to each administrative authority, including FI, as noted in EC1. Where the appropriations letter imposes a particularly burdensome requirement on FI, it may also allocate additional funding or resource to ensure the completion of the task, as has happened in the past. Except for the resources explicitly granted by the Government for specific projects FI has, so far, had freedom to dispose of its allocation of resources, inter alia, salaries, training of staff, equipment, travels, etc. In recent years, supervisory resources have increased, from 199 full time employees in 2005 to 228 by 2009. External experts have not been commissioned in the banking supervisory field. On-site examinations are relatively limited in number (cf CP20 in particular) but travel budgets have supported FI participation in cross border supervisory colleges throughout the Nordic and Baltic region, though the administration of college work is resource-intensive and it is unclear that resources are commensurate with the demands of ensuring that core supervisory functions maintained. Noting the high degree of turnover, particularly in the more specialist risk areas, the assessors consider that the FI salary scale is insufficient to attract qualified and experienced staff who are mid career. FI has been successful in attracting some experienced staff members who have had a successful industry career and for whom headline salary is not an urgent priority. AC1. The Director General is appointed by the Government for a minimum term of six years. FI Board members have a minimum appointment of three years. | ||||
| Assessment | Materially Noncompliant | ||||
| Comments | The Swedish approach is highly transparent and lines of accountability are clearly set out. With respect to independence there are issues that are cause for concern. The issue is discussed below under the following headings: the annual appropriations letter; supervisory decision making; and resources. The annual appropriations letter The annual appropriations letter, referred to in CP 1(1) above, which can be amended with updated requests during the year (and in 2010 was amended on multiple occasions) contains tasks and priorities which the FI must perform and to which it must respond. Although such tasks fall within the remit of FI they will not necessarily correspond with priorities FI would set for itself, notwithstanding the fact that FI is consulted as part of the process of preparing the appropriations letter. The letter, and revisions to the letter, introduce a degree of uncertainty in FI’s ability to plan the use of its own resources and also introduces the potential for further strain on FI resources when tasks and priorities set by the government are not consistent with FI’s own assessment. Discussions with staff have indicated that although some government set tasks impose only modest burdens, others have necessitated delay in other supervisory projects meaning that there is a direct impairment of FI’s ability to set its own supervisory agenda. If a supervisory authority is unable to prepare and execute its own supervisory strategy, then its independence is de facto also impaired. The assessors note that the authorities remarked in their comments of April 1, 2011, that “amendments in the appropriation letters hardly have a significant impact on the freedom of FI to allocate its staff independently.” In the view of the assessors the letters ought not to have any impact at all, nor even the capacity to have an impact. Supervisory decision making In the context of independence it is also noted that both FI and the government have powers to issue a banking license (see also CP1(3)). In practice this power has been used only rarely, nevertheless its existence can be seen as impinging on the operational independence of FI as there appear to be no safeguards to ensure, for example, that the government would step in to make a decision only at the request of FI. If the matter involves a matter of principle or particular importance the government and not FI must make the licensing decision. The assessors welcome strongly the confirmation from the MoF (letter May18, 2011) that revisions will be proposed to clarify in future that FI will have sole authority regarding licensing. It is also noted that the Government is also empowered to make a wide range of decision when FI refers the matter to it because there is a matter of principle. I.E., there are more than a dozen references in the Banking and Financing Business Act (BFBA) regarding the potential for a Government role in intervention, sanctions, mergers, revocation, etc. In these instances the law is clear that the referral to the Government depends on FI’s own determination but this arrangement can be seen as undermining the independent authority of FI. The authorities are advised to consider how best to enhance FI’s independence, preserving transparent governance and ensuring that FI is able to deliver its supervisory tasks. In addition, to welcoming the statement from the Ministers of Finance that revisions will be proposed to the law concerning licensing, it is recommended that consideration be given to establishing FI’s legal independence, and also removing the remaining instances in the BFBA where FI may refer matters of principle to government. The removal of the right to refer decisions to the government should not impede FI’s right to seek the opinion of the government when forming its opinion and in coming to its own determination. Resources A discussion on availability of resources is pertinent to very many of the Core Principles, but is presented at this part of the document partly because it is a direct assessment of EC(2) and also due to the fact that access to a sufficiency of resources depends on appropriations from the government which is a facet of the extent to which FI is, or is not, fully independent. Were FI able to set and raise its own budget autonomously and independently this discussion would be more suitably placed at CP20 where the gravest consequences of resource deficiencies are experienced. The assessors very strongly welcome the statement by the MoF (letter May 18, 2011) that there will be proposals put forward in the Budget Bill of 2012 for a substantial increase in resources for FI over a period of three years. Nonetheless, the fact that the proposal for substantially increased resources needs to be made by government underlines the weakness in the current level of resourcing and also of FI’s true independence. The commentary below elaborates on the assessors’ concerns regarding the scale of resources needed in the Swedish system. In view of the scale of the Swedish banking sector in comparison to GDP and recognizing that Sweden is the home state and global consolidated supervisor for a number of regionally and even globally systemically significant banking groups, the Assessors are concerned that there has been a significant underestimate of the level of resources which would be appropriate for FI. Although staff numbers in the banking sector have risen by over a third since 2002, staff turnover remains high (15 percent) with particular vulnerability in the specialist risk units, a factor FI itself acknowledges. There are 70 staff positions for the banking division (not all posts are currently filled) which are divided between line side, specialist risk and legal units. In this context, FI is fortunate to have a cadre including highly experienced and skilled staff but has almost no strength in depth. Meetings with the industry confirmed a consistent view that FI’s resources were stretched and particularly so in the risk areas. Several major firms expressed concern that FI had, for example, lost all or nearly all of the staff who had implemented the Basel II (CRD) regulatory package. The loss of corporate memory and experience from such a major regulatory process is a significant blow in terms of FI’s capacity to deliver effective ongoing supervision. A recent study suggested that while the financial services sector in Sweden is approximately at the median level in size and complexity in Europe, the total staff of the FI is below the median for European Economic Area (EEA) regulators. The survey (funded by FI although carried out by an independent academic) can only be used as an indicator but at the same time objective consideration needs to be given to the minimum resource that can deliver an adequate minimum level of supervision for the systemic and non-systemic sectors of the banking sector alike. At the very minimum a peer assessment between comparable jurisdictions, and also of supervision of comparable systemic institutions should be carried out. Any deficiencies in FI’s resource allocation through such an exercise should then be remedied. Looking to the future, pressures on resources will intensify due to further changes to EU legislation and global agreements on the treatment, including more intense supervision, for significant financial institutions and in particular globally significant financial institutions. Such agreements will be of particular relevance to Sweden given that it is the home jurisdiction for several systemic groups. It is further suggested that the funding model for FI also be reviewed and possible alternatives considered. For example, full autonomy for setting and collecting fees directly might be accorded to FI. Such an approach would be an important signal of FI’s institutional independence and would not undermine accountability of FI. Other alternatives may be also be worthy of consideration. The present institutional arrangements, confirmed by the powers set out in the Budget Act, permit the possibility of indirect influence upon FI through the budgetary process. Conclusion Taking the three main factors into consideration: the influence over the supervisory agenda via the appropriations letter; the lack of clarity over the potential for the government to play a role in supervisory decisions; and the constraint on resources in which FI has limited scope to influence, the assessors are of the view that a rating of MNC is warranted. However, the assessors fully recognize and strongly welcome the statements made by the MoF in its letter of May 18, 2011 and consider that at such time as the proposed changes outlined in the letter are achieved that an upgrade to the rating will be appropriate. | ||||
| Principle 1(3). | Legal framework. A suitable legal framework for banking supervision is also necessary, including provisions relating to authorization of banking establishments and their ongoing supervision. | ||||
| Description | EC1. Pursuant to Chapter 3, Section 8 of the BFBA (2004:297), FI is responsible for processing applications for a license to conduct banking business. FI may withdraw such licenses pursuant to provisions in Chapter 15 of the same Act. Firms applying for license have to pay a cost-based fee. Detailed provisions concerning the licensing process are laid down in Chapter 2 of the Banking and Financing Business Ordinance (2004:329). In addition government has the authority to directly process an application for banking license according to Chapter 3, Section 8 of the BFBA (2004:297). See also Core Principle 3, EC1. The supervisory authority confirms that in practice the government’s authority to license or revoke a license has never been used. The option exists, in practical terms, for FI to escalate a sensitive decision to government. However, the legislation is silent with respect to whether the government would only determine such matters “where they involve a matter of principle or particular importance” only in instances where FI had referred the matter to it. EC2. FI has a mandate to issue binding regulations regarding prudential rules pursuant to Chapter 16, Section 1 of the BFBA (2004:297) and Chapter 5 of The Banking and Financing Business Ordinance (2004:329). The mandates provided by law and ordinance entail that regulation may be issued and changed under devolved authority without any need for legislative changes. FI also has a mandate to issue non-binding guidelines. FI has in recent years established an explicit and transparent process for identifying the need for regulatory changes or modifications. FI consults with market participants and other authorities on proposed changes. It also often invites reference groups, consisting of representatives from the industry, to comment on proposal for new rules during the working process. All rules, (i.e., binding regulations and non-binding guidelines are published in FI’s Regulatory Code and are made public). All the rules by FI are also available on FI’s website. Since autumn 2009 FI has provided public feedback containing the reasoning behind new proposed rules and an analysis of the consequences. FI also publishes important decisions regarding licensing or sanctions on its website EC3. The BFBA (2004:297, Chapter 13, Section 3) requires that credit institutions shall provide FI with any and all information regarding their operations and related circumstances at the request of FI. Moreover, Chapter 16, Section 1 at 5 of the Act provides that either the government or an authority determined by the government may issue regulations regarding information that a credit institution shall provide to FI for its supervisory activities. Pursuant to Chapter 5, Section 2 of the Banking and Financing Business Ordinance (2004:297), regulatory authority on this matter devolves to FI. | ||||
| Assessment | Largely Compliant | ||||
| Comments | The existence of deposit taking companies which are not subject to a full authorization process or on-going supervisory process is a concern and should be remedied. Although Sweden meets the literal terms of the criteria, because the dual powers of FI and the Government in respect of granting and withdrawing banking licenses are clearly established in law there is less de facto clarity on how the powers of the two institutions might operate or interact. The Government has only rarely used its power even in the context of the recent financial crisis. Therefore it is recommended that the potential for lack of clarity in this area be resolved by deleting these powers. See also comments under CP 1(2). The statement by the MoF (letter of May 18) indicating that legislative proposals will be made to clarify FI’s sole authority in the matter of licensing is strongly welcomed. | ||||
| Principle 1(4). | Legal powers. A suitable legal framework for banking supervision is also necessary, including powers to address compliance with laws as well as safety and soundness concerns. | ||||
| Description | EC1. FI is responsible for supervision and rule making (Financial Supervisory Authority Instructions Ordinance (2009:93) and has the power to impose a range of sanctions should a credit institution fail to comply with provisions under the BFBA (2004:297). These provisions are articulated, typically, in the form of high level principles thus giving FI full scope for intervention based on possible concerns. Pursuant to Chapter 15, Section 1 of the BFBA (2004:297), FI has powers to intervene when a credit institution has violated its obligations pursuant to the Act, other legislation governing the operations of the institution, the institution’s articles of association, by-laws or regulations, or internal instructions based on legislation governing its operations. FI must first determine whether intervention is necessary and may, where appropriate, pursue informal action to resolve issues. EC2. As noted under Principle 1(3) EC3 above, Chapter 13, Section 3 of the Banking and Finance Business Act (2004:297) stipulates that credit institutions are to furnish FI with such information as the authority requests, including Board Staff records. In practice the supervisory staff use review of Board minutes as a routine component of their assessment of EC3. FI has a range of measures it may take against credit institutions or its senior management in instances where there have been violations of legal requirements. Based on Chapter 15, Section 1 of the BFBA (2004:297). FI may issue an order requiring a credit institution to take prompt remedial action, including restriction or limitation of business. Action may be taken against senior management (Section 2) and FI may also issue a warning, levy or a fine. Revocation of license is also possible in cases of serious infringements. A remark can be issued in relation to less serious violations, for example such as minor deficiencies in risk management and the internal control. A waning on the other hand is an alternative sanction that can be used when the conditions for withdrawal are fulfilled but when it is considered that a warning would be sufficient to ensure that remedial measures would be taken, that the institution is not likely to repeat the violation and if the prognosis for the institution is good. FI is not required to proceed through the sequence of remarks, warnings and revocation, but can proceed directly to revocation if circumstances warrant it. A fine can only be issued in connection with a remark or a warning. Chapter 15, Sections 2 and 3 of the Act set out specific conditions under which a license shall or may be revoked by FI. Sections 7-9 concerns fines that may be levied in conjunction with FI interventions. FI may levy fines of up to SEK 50 million (approximately US$8million) on a credit institution. | ||||
| Assessment | Largely Compliant | ||||
| Comments | Regulatory decisions made by FI, for example its use of remedial powers, its sanctions, and its power of revocation are subject to challenge and reversal in court. The grounds for appeal are set at a high level and the petition for appeal must be made within three weeks of the decision being made. Supplementary information after the mission from FI clarifies that if the CI appeals and demands that the court stay the execution and if the court decides to stay the execution, the decision cannot be applied until the court has made a determination of the appeal. However given that revocation leads to immediate liquidation, it appears probable that any appeal against revocation would be also accompanied by an appeal that the court stays the execution. It is recommended that due consideration be given to legal amendments to ensure legal certainty regarding FI’s regulatory decisions while at the same time protecting the right of redress and appeal of the party/parties subject to FI’s decisions albeit in a different manner. In Sweden the public disclosure of a remark or warning is perceived to have considerable deterrence. Nonetheless, FI is keen to ensure that it has a flexible toolkit and is examining ways in which it can make better and greater use of the full range of its tools provided for under law than it has to date. The assessors’ contacts with banks suggested that FI’s use of its sanctioning powers is becoming more frequent and assertive. The supervisory authority’s ability to apply qualitative judgment is not explicitly laid out in the legal framework, but nor is it explicitly restricted. Much relevant Swedish law in the field of banking and banking regulation is expressed at a high level and the practice of supervision by FI makes considerable and necessary use of qualitative judgment in order to interpret the demands of the law and carry out its functions. | ||||
| Principle 1(5). | Legal protection. A suitable legal framework for banking supervision is also necessary, including legal protection for supervisors. | ||||
| Description | EC1. The BFBA (2004:297) contains no specific provisions on legal protection for the supervisor or supervisory staff concerning actions taken in good faith in discharge of their duties. In the absence of specific legal provision, general Swedish tort law applies. General provisions on, e.g., the liability of public administrative authorities and their employees are set out in the Damages Act (1972:207). Under this legislation (Chapter 3, Section 2) public administrative authorities are liable for damages resulting from negligence in carrying out their duties. However, case law has set a very high threshold for what constitutes negligence in the discharge of administrative duties. The assessment must have been manifestly wrong for liability to arise. Provisions on the liability of FI’s employees for damages arising from actions that they have taken in the discharge of their duty are also covered by the Damages Act (Chapter 4, Section 1). The Damages Act protects the staff of FI against damages arising from their official duties. FI employees may be held liable for actions taken in the discharge of their duty only if extraordinary grounds for imposing liability exist. Academic commentaries on this provision have held that this entails a presumption that the employee is not liable. EC2. The Damages Act (1972:207, Chapter 4, Section 1) states that the employer normally has to bear the cost of compensation for damage caused by error or mistake by its employees although the employer may seek damages from the employee. FI state that an attempt at recovery of costs or damages would apply only in exceptional circumstances, after taking account of the nature of the action that caused damage, the position of the employee, the interests of the person who suffered damage and other relevant circumstances. FI has liability insurance that covers damage up to SEK 10 million caused by negligence. | ||||
| Assessment | Largely Compliant | ||||
| Comments | FI is of the view that FI itself and its staff are afforded protection against liability for actions and omissions in discharging their duties. However, there is no direct or explicit protection and the possibility exists that staff could be held liable for their actions in carrying out their duties. The assessors recognize that the thresholds for successful legal action are set at a high level and that the cultural environment of Sweden is not strongly litigious, unlike that in some other jurisdictions. There is no indication that FI staff feel vulnerable to liability at a personal or institutional level. The concern is not one of immediate practicality or urgency. Nonetheless, on a more forward looking basis, it should be recognized that cultures, in particular business cultures morph over time. Sweden is an open market economy significantly exposed to influences from other jurisdictions through the inward and outward expansion of cross border groups or even mergers such OMX/NASDAQ. The business climate is not isolated and may be subject to significant change over a period of years. It is recommended, that the authorities review the legal position and that FI be provided with explicit protection for its official actions as an institution, except in cases of gross negligence or willful misconduct, in line with practice in many neighboring countries. It would be helpful to provide similar protection to State and resolution trustees in the case of resolution actions. A further element of the current framework that is noteworthy which may potentially hinder or impede the exercise of powers by staff of FI is the provision granting FI permission to seek damages from the employee, if it has incurred costs in compensating a person for damage caused by error or mistake by its employees. The assessors recognize that such a situation would arise only in exceptional circumstances but the power is inappropriate and should be deleted. Finally, the liability insurance policy maintained by FI appears to be too small, covering only damages caused by negligence of up to SEK 10 million. Were there to be an action for recovery of losses arising through a failed bank, insurance company or securities firm, this coverage would be negligible. | ||||
| Principle 1(6). | Cooperation. Arrangements for sharing information between supervisors and protecting the confidentiality of such information should be in place. | ||||
| Description | EC1. The Financial Supervisory Authority Instructions Ordinance (2009:93) imposes duties of cooperation with the RB and the Swedish Civil Contingencies Agency on issues relating to the Crisis Management and Enhanced Preparedness Ordinance. FI shall also consult with the RB significant issues relating to the stability of the payment system or to the RB’s responsibility for currency and credit policy and for the payment system. FI shall also consult with such foreign authorities as have the competence to exercise the supervision of the financial markets and of financial companies. Correspondingly, the RB has obligations to consult with FI in matters of major importance concerning the payment systems or involving FI’s supervisory activities (RB Act, 1988:1385, Chapter 4, Section 3). FI has an agreement with the SNDO, which administers the deposit guarantee system clarifying what information FI will pass to the Debt Office either on demand or as a matter of course, as relevant. There is a MoU between the tripartite authorities (FI, RB, and the MoF) last updated in 2005. In 2009, on the basis of revisions to EU legislation, the MoU was enhanced and signed by FI, the MoF, and the SNDO. The 2005 MoU sets the framework for cooperation concerning financial stability, crisis resolution and information exchange. The established guidelines for consultation and the exchange of information between the parties in the areas of financial stability and crisis management. The Domestic Standing Group—a non-decision making body formed on the basis of the MoU—was broadened to include the Debt Office In practical terms the MoU establishes the seniority of attendance and frequency of meetings of the authorities. The MoU also addresses specific cooperation issues (e.g., between FI and RB) and the division of responsibilities in relation to their respective mandates for financial stability and crisis resolution. During the financial crisis the DSG authorities met with high frequency (often daily) but the periodicity of meetings has now extended. Its minimum frequency is quarterly. FI also has a MoU with the Swedish Consumer Agency. EC2. Under EU legislation gateways exist for the provision of supervisory information between EU supervisory authorities. Gateways governing the exchange of information were made at EU level in directive 2009/111/EC (“CRD2”) which Sweden will implement in the course of 2011, further widening gateways for the provision of information between authorities in the EU. CRD2 also creates a requirement for supervisory authorities to establish colleges of supervisors for EEA banks. With respect to non-EEA countries, a bilateral cooperation agreement is not a precondition to exchange information with an authority of another country given that FI may, on request, disclose information to an authority if the Public Access to Information and Secrecy Act does not hinder a disclosure. However, a bilateral agreement facilitates exchange of information between the authorities and may specify how information may be exchanged on a regular basis, as for example with the Nordic Baltic MoU. Sweden has a range of MoUs with non-EEA countries. A cooperation agreement on cross-border financial stability, crisis management and resolution was signed in August 2010 between relevant Ministries, Central Banks and Financial Supervisory Authorities of Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway, and Sweden, establishing a Nordic/Baltic Stability Group (NBSG). The NBSG held its first meeting in November 2010 where it established four working groups addressing issues ranging from identification of and data gathering on systemic institutions, resolution tools, consideration of financial stability and crisis prevention and burden sharing. As the operation of the NBSG proceeds to greater maturity it should form an important broader support for the effective operation of cross border supervision and cooperation. EC3. FI is an integrated supervisory authority and thus has no domestic supervisory authority with whom it needs to exchange information. The BFBA (2004:297) states that FI shall cooperate and exchange all information necessary as provided for in EU-legislation which is binding in Sweden. The EU directive provisions ensure that confidentiality of information must be protected and that information provision must be for supervisory purposes. Hence, for example, under the Public Access to Information and Secrecy Act (2009:400), confidential information may only be provided to a foreign authority if this is regulated in law or regulation, or, if the information could be provided to a Swedish authority. As information exchange between supervisory authorities is regulated by EU legislation, which is binding on Sweden, FI is able to effectively provide confidential information to other supervisory authorities. Information FI has received in accordance with an agreement with a foreign state and where the agreement (including EU directives) is approved by Parliament that information is governed by the confidentiality provisions of the Public Access to Information and Secrecy Act (2009:400). This means that information provided to FI by virtue of information gateways that were created under EU legislation, whether the other authority is EEA or non-EEA, are protected by Swedish law confidentiality provisions. It does not require individual MoUs to be approved by Parliament. Both confidential and non-confidential information is exchanged on an on-going basis within the colleges of supervisors. Assessors reviewed information packages that were shared and noted the regularity and frequency of college meetings at which the information was discussed. EC4. General secrecy provisions regarding financial markets are set out in the Public Access to Information and Secrecy Act (2009:400). A large proportion of the information held by FI is confidential under provisions of this act and may as such not be disclosed. On the other hand, non confidential information must be disclosed to citizens, or (under Chapter 6, Section 5) to another Swedish authority upon request. There is no corresponding provision regarding foreign authorities. Precedent under case law has established that an individual member of parliament does not have the right to obtain information subject to confidentiality (RÅ 1992 not. 188). The provisions of the Public Access to Information and Secrecy Act (2009:400) determine whether the information is confidential or not. Confidentiality provisions include, but are not limited to, information pertaining to business affairs of a supervised entity, as well as the business or personal affairs of someone who has dealings with the supervised entity (Section 4); information about an individual’s business or personal affairs in the context of fit and proper tests (Section 5); and information given to FI by other competent authorities pursuant to an agreement (Section 7); information related to deposit guarantee (Section 10); information on state support of credit institutions (Section 12). However, the act also contains gateway provisions in particular situations (Chapter 10, Section 15). Confidentiality restrictions do not therefore prevent information from being submitted to the parliament or the Government. FI cannot deny information to the Government unless there is a legal restriction governing this information. Restrictive provisions of this nature may exist in certain international agreements, and as a result FI is by law prohibited to provide such information in breach of the agreement to the Government. Information can be given to a prosecuting authority in the context of a criminal investigation pursuant. In this latter case, the secrecy provisions do not prohibit disclosure of confidential information to prosecutors or police if a penalty of imprisonment may be imposed for the crime under investigation. In relation to foreign authorities FI may use its own discretion. Confidential information received from another competent authority in an EEA country is protected by general secrecy provisions concerning confidential information received from other states, without the necessity of specific statutory provisions to this effect (see prop. 2006/07:5 s. 349 f. and prop. 2006/07:115 s. 516). | ||||
| Assessment | Compliant | ||||
| Comments | There are gateway provisions for the exchange of information between the principal domestic authorities with any responsibilities with respect to financial stability. When Sweden implements the revision to the EU CRD (CRD2) it will at that time widen and reinforce its gateways for information exchange both between supervisors (domestic and non domestic) and other relevant domestic authorities, particularly in respect of crisis management situations. Sweden intends to implement CRD2 in 2011. Information gateways have been broadening over a period of years in the EU with the more recent focus been on ensuring adequate flow of information and cooperation in the fields of financial stability, crisis management and resolution, both domestic and cross border. The 2010 CEBS peer review found Sweden to “have fully applied the requirements for information exchange.” In common with other EU jurisdictions, therefore, the Swedish authorities face the challenge of determining how financial stability objectives can be most effectively delivered and support the practice of effective banking supervision. The effectiveness of cross-border cooperation agreements is commented on in CP25. | ||||
| Principle 2. | Permissible activities. The permissible activities of institutions that are licensed and subject to supervision as banks must be clearly defined and the use of the word “bank” in names should be controlled as far as possible. | ||||
| Description | 1, 2. The term “bank” is defined in the BFBA (Chapter 1, Section 5) as comprising banking companies, savings banks and members’ banks. Further, a “banking company” is defined as “a limited liability company licensed to conduct banking business.” (NB: The term “bank,” as defined, is distinct from the term “credit institution” (CI), the latter term being broader in scope. A CI is a bank or a credit market undertaking (Sw. kreditmarknadsföretag). Banks—but not credit market undertakings—may carry out “banking business” (BFBA (Chapter1, Section 3). As explained below, the definition of a “bank” in Sweden relates to payment services and acceptance of short term deposits. Both banks and credit market undertakings may carry out “financing business” (BFBA (Chapter 1, Section 4). As Financing business (see below) corresponds to the activities that “CIs” may carry out pursuant to Article 4.1.a) of the EU Credit Institutions Directive (2006/48/EC).) Both banks and credit market undertakings are CIs for the purposes of the EU legal framework and both are also subject to the BFBA’s prudential requirements, hence both forms of institution are licensed and supervised. A credit market undertaking is therefore a form of credit institution that meets the terms of the EU directive (accepting deposits from the public and making loans) but which is not a bank as defined under Swedish law. “Banking business” includes (i) payment services via general payment systems and (ii) receipt of funds which, following notice of termination, are available to the creditor 30 days or less. Banks may engage in activities other than banking business (BFBA Chapter 7, Section 1). A CI may only conduct financing operations and operations naturally connected therewith, including, inter alia:
The term “financing business” (BFBA Chapter 1, Section 4) means (i) to accept repayable funds from the public and (ii) to grant loans and guarantees. Firms carrying out only financing business, as opposed to banking business, are referred to as “credit market undertakings.” Banks and credit market undertakings are collectively referred to as “CIs” (see above). 3. The word “bank” may only be used by banks, RBen, the General Mortgage Bank of Sweden and foreign CIs (BFBA Chapter 1, Section 9). Minor exceptions to the general rule are set out in the same provision. The BFBA (Chapter 10, Section 35) provides that banking companies shall use the word “bank” in their name. There are no corresponding provisions in law concerning use of “credit market undertaking.” 4. The substantial majority of all deposits (98.0 percent) are held by banks. However, other categories of institutions are allowed to take deposits. These primarily include credit market undertakings (BFBA Chapter 1, Section 4) and—in the context of securities business—securities firms (SMA Chapter 2, Section 2) to the extent necessary for facilitating securities trading (prop. 2006/07:115 p. 326). Deposits with all these institutions are covered by the Deposit Guarantee Scheme. Deposits (up to SEK 50,000) may be taken by deposit companies under the Deposits Business Act. Such deposits (extremely limited) are not covered by the Deposit Guarantee Scheme.) 5. The Companies Registration Office keeps records of banks, savings banks, members’ banks and foreign banks with branches in Sweden. FI’s website also lists licensees (banks and credit market undertakings as well as foreign CIs active in Sweden). | ||||
| Assessment | Largely Compliant | ||||
| Comments | Permitted activities are clearly defined and use of the word “bank” is protected. However, deposit taking is not reserved for entities licensed and subject to supervision as banks. | ||||
| Principle 3. | Licensing criteria. The licensing authority must have the power to set criteria and reject applications for establishments that do not meet the standards set. The licensing process, at a minimum, should consist of an assessment of the ownership structure and governance of the bank and its wider group, including the fitness and propriety of Board members and senior management, its strategic and operating plan, internal controls and risk management, and its projected financial condition, including its capital base. Where the proposed owner or parent organization is a foreign bank, the prior consent of its home country supervisor should be obtained. | ||||
| Description | 1. FI is responsible for processing applications for a license to conduct banking business (BFBA Chapter 3, Section 8). (NB: The government is to determine certain matters relating to licensing or approval of amendments to a CI’s articles of association if these involve a matter of principle or of particular importance. Where the Government takes a decision in respect of a license, FI shall submit its opinion (BFBO Chapter 1, Section 4). Decisions on applications for a banking license are, in practice, always taken by FI. The government has not decided on any license application since the BFBA’s enactment (2004). (Detailed provisions on the licensing process are laid down in the Banking and Finance Business Ordinance (BO Chapter 2)). FI’s guideline FFFS 2004:9 sets out required information and documents to be provided when applying for a banking license: FFFS 2005:1 lays down what has to be met on internal controls and risk management issues; FFFS 2007:1 provides criteria concerning the capital base (and supplements the CALE Act. 2, 3. The BFBA (Chapter 3, Section 2) sets out at the principle level those criteria to be met by an undertaking in order for it to receive a license to carry out banking or financing business. FI’s scope of supervision is also stated (BFBA Chapter 13, Section 12): “With respect to a credit institution, the supervision shall ensure that the business is conducted in accordance with:
In addition, FI shall also ensure that the owners and management of the credit institution fulfill the suitability requirements in this Act.” The task of supervision is thus inter alia to ensure that CIs continually fulfill all licensing criteria required in the BFBA. 4. A banking license may only be approved if the general conditions in the BFBA, the BO and the criteria in FI’s regulations and guidelines are met. If not, the application is to be rejected (e.g., an application was rejected in June 2010 on grounds that the owners and Board members did not meet “fit and proper” requirements). 5. An overarching objective when examining an application is to determine that the proposed legal, managerial, operational and ownership structure of the CI and its wider group will not hinder effective supervision, on both a solo and a consolidated basis (e.g., FI will not accept an unclear and non transparent ownership structure or the outsourcing of all core business). 6. FI identifies and determines the suitability of major shareholders (a “major shareholder” being one with a direct or indirect ownership in an entity representing 10 percent or more of the equity capital or of all voting participating interests or otherwise rendering it possible to exercise significant influence over its management). In assessing “suitability” a person’s reputation and financial strength are to be taken into consideration. FI assesses the ownership structure’s transparency and the source(s) of initial capital. Based on the intending acquirer’s economic and financial condition, the investigation’s primary focus is on the acquirer’s ability to finance the acquisition and, where applicable, to maintain or promote a financially sound structure of the business. 7. The BFBA provides that banking companies shall have an initial capital of not less than five million euros (Chapter 3, Section 5); savings banks not less than one million euros (Chapter 3, Section 6); members’ banks and credit market undertakings not less than five million euro (although those intending to pursue only small-scale operations may be allowed a lower initial capital, but not less than one million euro (Chapter 3, Section 7). 8. Under the BFBA (Chapter 3, Section 2) any person who is to serve on a CI’s Board of Directors (Board) or as Managing Director (CEO), or be an alternate in these functions, must possess sufficient insight and experience and be suitable (reputation and financial strength are also taken into consideration). The Swedish rules have been enacted to transpose relevant EU legislation on, e.g., fit and proper tests of Directors and senior management in CIs (see EU Directive 2007/44/EC). FI’s regulation FFFS 2009:3 details the fit and proper test. The assessment includes whether the person concerned has skills and experience in relevant financial operations commensurate with the CI’s intended activities, any potential for conflicts of interest, and any record of criminal activities or adverse regulatory judgments that make him/her unfit to hold important positions in a CI. FI gathers information from the Tax Authority, Police and the Companies Registration Office. Not all members of a CI’s senior management [for example senior executives at the c-level, chief financial officer (CFO), chief risk officer (CRO), chief operating officer (COO)] are subject to such fit and proper tests. While companies’ applications often include a CV of senior management at the c-level for FI’s information, FI considers that it is not entitled to deepen its analysis and believes that a legislative amendment is required for it to be able to conduct a “fit and proper” assessment of senior management beyond the CEO. 9. The entity’s application must also include the business statutes and the operating plan complemented by, inter alia, an organization chart, a description of outsourcing arrangements, information on the proposed Board and CEO and the written procedures on internal governance, information and control and the procedures against money laundering and terrorist financing (AML/CFT). In regard to internal governance and information and control, the description on monitoring and management of risk (credit, operational, interest rate, foreign exchange and liquidity) is of particular interest to FI in the licensing process. FI reviews that the information received is in accordance with the principles set out in laws, regulations and guidelines, working with a checklist to make sure that there is an accurate review of the applicant. 10. A1. Pro forma financial statements and projections for the next three years for the CI and, if applicable, the group of which it is going to be a part, must be presented for FI’s review. An analysis of capital requirements must be included and reflect the scope and nature of the planned business. FI assesses the major shareholders’ current financial strength and, as well, their capacity to support the proposed strategic plan going forward. 11. CIs from EEA countries may conduct business in Sweden under the “passporting” regime in relevant EU directives (BFBA Chapter 4, Sections 1-3). A CI from a non-EEA country may be granted a license to operate through a branch in Sweden, provided inter alia that it is subject to satisfactory supervision by a competent authority in its home state, and that this authority consents to such establishment in Sweden (BFBA Chapter 4, Section 4). A license is needed to establish a subsidiary CI in Sweden, be the parent based in an EEA state or not. A license may only be approved if the close relation to the parent company does not obstruct FI’s supervision. Further, where the parent company is a CI, then FI will consult with the competent authority within the EEA. A MoU with a foreign authority is needed for exchange of information and is integral to FI’s assessment of whether the home supervisor practices global consolidated supervision. 12. There are no grounds under the BFBA for FI to revoke a license where a CI is found to have obtained a license through false information or other irregularity. This is surprising given that the CRD (Article 17(1) (b)) determines that “the competent authorities may withdraw the authorization granted to a credit institution only where such an institution has obtained the authorization through false statements or any other irregular means.” However, FI notes that if the false information still applies—and in particular if it becomes clear that use of correct information would put the CI in breach of laws or regulations—then FI can order the CI to make corrections or, if necessary, decide on sanctions via a warning, penalty or license revocation. Furthermore, FI considers that general principles of Swedish administrative law enable it to take actions if it finds out after the fact that its original decision was based on false information. On this basis, a favorable licensing decision given by FI could be overturned if obtained through false information or deception. 13. Both during the licensing procedure and thereafter FI evaluates the competence of the Board (collectively) and the CEO. For an entity to be granted a banking license, a person who is proposed as a Board member or CEO, must have sufficient knowledge and experience of participation in the governance of a CI and also be suitable for such task. If during on-going business those criteria are no longer met, FI may appoint a new person as a Board member or CEO or, in the extreme revoke the CI’s license. Information for the fit-and proper test has to be provided to FI in the application for a license and whenever a change takes part during on-going business. During on-going supervision FI reviews the work done by the Board and CEO. A2. FI monitors new entrants’ performance against projections by on site investigations within a year from the start up. FI mainly collects information and financial data from companies’ periodic reporting but there is no specific process for new entrants. | ||||
| Assessment | Largely Compliant | ||||
| Comments | FI has power to set criteria and reject applications from entities that do not meet the standards set. The licensing process consist of an assessment of the ownership structure and governance of the CI and its wider group, including the fitness and propriety of Board members and CEO (but not other members of senior management (EC8)) its strategic and operating plan, internal controls and risk management, and its projected financial condition, including its capital base. It is a significant weakness that FI does not have powers to assess the individual senior management (EC8) and should be remedied. Where the proposed owner or parent organization is a foreign bank, FI contacts the home country supervisor for its comments on the licensing application. The fact that a CI is found to have obtained a license through false information or other irregularity is not in itself sufficient grounds for FI to revoke the CI’s license. This is a weakness in the statutory provisions notwithstanding the general administrative law principles that FI considers apply in this case. | ||||
| Principle 4. | Transfer of significant ownership. The supervisor has the power to review and reject any proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties. | ||||
| Description | 1. The BFBA (Chapter 1, Sections 5, and 14) defines a “qualifying holding” as a “direct or indirect ownership in an undertaking, where the holding calculated in the manner set forth in Section 5a represents 10 percent or more of the equity capital or of all voting participation interests or otherwise renders it possible to exercise a significant influence over the management of the undertaking.” (NB: the BFBA’s unofficial translation uses different terms (“qualified holding”: Chapter Sections 5 and 5a; “qualifying holding”: Chapter 14, Section 1) for the same Swedish term (“kvalificerat innehav”). 2, 3. With minor specified exceptions, the intending acquirer must file an application for FI’s prior consent to obtain a qualifying holding (and to increase any qualifying holding to above 20, 30, and 50 percent of the share capital or voting rights) in a CI. The BFBA (Chapter 14, Section 1, 2, and 6) provides FI power to reject any proposal for a change in a qualifying holding or prevent exercise of voting rights in connection therewith if it does not meet criteria comparable to those used in approving new CIs. 4. When a CI learns that its shares or participation interests have been acquired/ divested in such amount as to make the buyer’s or seller’s holdings go above or below the numerical limits referred to in the previous two paragraphs (qualified holdings director/ indirect) it must forthwith notify FI. A CI must also file an annual report on those with qualified holdings; FI is entitled to request such information from a CI at any time. 5. FI may decide that “unapproved” owners of qualified holdings may not represent the shares at the shareholders’ meeting and instead apply to a district court to appoint a trustee to represent such holdings (BFBA Chapter 14, Sections 6, 7, and 9). Moreover, FI may order divestiture of shares sufficient to render a holding as no longer ldquo;qualifying.” A1. There is no requirement in law or regulation—and nor does FI ensure—that CIs must notify FI upon becoming aware of any material information that may negatively affect the suitability of a major shareholder. | ||||
| Assessment | Compliant | ||||
| Comments | It would be constructive for CIs to have an obligation to notify FI forthwith upon becoming aware of any material information that may negatively affect the suitability of a major shareholder. | ||||
| Principle 5. | Major acquisitions. The supervisor has the power to review major acquisitions or investments by a bank, against prescribed criteria, including the establishment of cross-border operations, and confirming that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision. | ||||
| Description | 1-6. FI’s prior authorization is only required when the consideration for an acquisition exceeds 25 percent of a CI’s capital base (BFBA Chapter 7, Section 12). Neither laws nor regulations provide explicit, detailed criteria by which to judge individual proposals presented for approval. There is the general statement: “Authorization shall be granted unless it can be assumed that the acquisition will result in the violation of this Act or other statutes.” (BFBA Chapter 7, Section 12) and it may be inferred that this is a reference, inter alia, to BFBA Chapter 6 “General provisions regarding the business of a credit institution” (e.g., Chapter 6, Section 1: “A credit institution’s operations shall be conducted in such a manner that the institution’s ability to perform its obligations is not jeopardized. In such context, the institution shall ensure that it possesses satisfactory internal controls:” and Chapter 6, Section 2: “A credit institution shall identify, measure, manage, internally report and have control over the risks associated with its operations”). Besides these largely generic statements, a CI may only possess such property as it needs for its own business operations and there are statutory limits and prohibitions governing various types of acquisition/investment that appear designed to prevent exposure to undue risks (BFBA Chapter 7, Section 2). In particular:
Moreover, a CI (subject to the limitations on non-financial acquisitions/investments cited immediately above) may only engage in “financing operations and operations naturally connected therewith” thereby limiting the risks that nonbanking activities may pose. The risks of non-financial activities are to be dealt with in a CI’s internal capital adequacy assessment process (ICAAP). FI seeks to evaluate every CI’s ICAAP annually (this target has on occasion been missed due to pressure of other work) and if FI considers that due to non-financial activities a CI does not meet statutory requirements regarding risk management, transparency and soundness, it may impose a higher capital requirement or an order to reduce the risks (BFBA Chapter 15, Section 1) (CALE Chapter 2, Section 2). | ||||
| Assessment | Materially Non-Compliant | ||||
| Comments | It is recognized that FI’s relationship with licensees is likely to result in consultation before many of the incidents contemplated by CP 5 occur. However, the notification limit is set at “more than 25 percent” of the CI’s capital base as stated in Chapter 7, Section 12 of the BFBA, which gives broad latitude for acquisitions/investments to escape FI’s review. (Moreover, there are no precise criteria by which to judge even those individual proposals that must first be referred to FI for prior approval.) There is no requirement, for example, that a CI either establishing a “financing operations” subsidiary or making a strategic investment in such an entity in a non-EEA country is obliged to notify FI, either before or after the event, so long as the capital base quantum limit is not breached. (In contrast, there is the requirement that for a Swedish bank either opening a branch or establishing a subsidiary in an EEA country prior notification to FI must occur; establishment of a branch in a non-EEA country requires that FI first grant a license. It is, however, in any case inappropriate for FI to be in a position where it is dependent on another competent authority to inform it of an acquisition that is planned by one of its own supervised institutions.) FI cannot formally prohibit banks from making fairly major acquisitions/investments (including establishment of subsidiaries) in countries with secrecy laws or other regulations prohibiting information flows deemed necessary for adequate consolidated supervision. This also means that FI cannot, from the outset—determine whether an investee bank has adequate financial and organizational resources to handle the acquisition/investment. Certainly, FI has corrective means available for use “after the fact”—but that is not the thrust of CP5. In practice, corrective action after the fact will often be problematic. Obliging institutions to divest recent acquisitions, for example, may result in substantial reputational damage and possible book losses (eroding the institution’s capital base). Moreover divestiture will only be successful if any interested buyers are available. | ||||
| Principle 6. | Capital adequacy. Supervisors must set prudent and appropriate minimum capital adequacy requirements for banks that reflect the risks that the bank undertakes, and must define the components of capital, bearing in mind its ability to absorb losses. At least for internationally active banks, these requirements must not be less than those established in the applicable Basel requirement. | ||||
| Description | 1, 2. A1 A2. Sweden has implemented the EU directives concerning CALE (2006/48/EG and 2006/49/ EG). The EU directives (and thus Sweden’s regulations) closely track the Basel II framework both as regards calculation of capital requirements for the various risk exposures and for composition of the capital base. The Swedish definition of capital base requires deduction of both goodwill and deferred tax assets. The capital base is to be at all times more than or equal to the sum of the capital required for each of the Pillar 1 risk types (credit, market and operational). The capital adequacy regulations apply to all CIs (and additionally to investments firms) on a standalone basis and also at the level of financial group. For application at group level there are rules to determine which individual firm in the group is responsible for calculation of the capital base, the capital requirements and supervisory reporting. 3, 4. FI has power to order a CI or financial group to limit its operations in any respect, which includes requiring the CI to exit a business line. On capital charges, if there is a material risk not adequately covered by the normal rules for Pillar 1, FI can demand and has demanded more capital by a decision to raise the CI’s level or by an understanding under the SREP. Formally, this remains a general charge on the entity, not on a specific risk position. FI would inform the CI that the reason for the higher charge is a particular material risk exposure and that the overall charge would be lower if that risk exposure was reduced. While the minimum Pillar 1 capital ratio (8 percent) is the same for all, the risk weighted exposure amount (i.e., the denominator in the calculation) reflects the risk profile of each CI. Rules for calculation of risk weighted exposure amounts are, as mentioned above, determined on Basel II specifications. Rules for calculation of risk weighted exposure amounts are specified in FI’s Regulations and General Guidelines governing CALE (FFFS 2007:1 Chapter 11, -61). Both on and off-balance-sheet items are included in the calculation of risk weighted exposure amounts (see e.g., FFFS 2007:1 Chapter 15, Section 3, and Chapter 22 using the standardized method for credit risk; Chapter 40. using the internal rating-based approach (IRB) method for credit risk and Chapter 13, Section 66 for off balance sheet items in the trading book). 5. As noted above, Sweden applies the general Basel II capital adequacy requirements on a financial group level and on a solo level for Swedish CIs. The Basel II capital requirements are applied on a solo level in most entities within the Swedish financial groups, but where a non Swedish entity belonging to a Swedish financial group is located in a country which does not apply Basel II, different capital adequacy requirements are applied for this entity, on a solo basis. Some of the largest Swedish CIs operate in geographic areas of higher perceived risk and have FI’s permits to apply internal models in the calculation of Pillar 1 capital, the implication being that the capital adequacy models take the conditions in those areas into account. Where a CI does not have a permit to use an internal model and FI assesses that the standardized Pillar 1 rules do not sufficiently reflect the risk in a particular jurisdiction, then those risks are deal with in Pillar 2. 6. Where a CI or financial group fails to fulfill the requirements of the law or regulations (CALE Chapter 12, Section 1-3) FI must order the CI or the undertaking in the financial group which is to prepare the consolidated accounts (CALE Chapter 10, Section 12) to limit its operation s in some respect within a certain time, to reduce the risks therein or to take any other measures to rectify the situation (provisions regarding intervention also apply; BFBA Chapter 15). Breaches of capital requirements are reportedly rare and there is no recent case where an order has been made. There have, however, been instances where CIs have fallen below the minimum capital requirement but corrected the infraction immediately. To prevent such situations arising, FI requires CIs to have a margin between their actual capital base and their absolute minimum level. FI tracks quarterly prudential reporting and contacts those CIs (approximately 15 annually) approaching the minimum requirement to ensure that an updated capital adequacy plan is in place. 7. FI permits CIs to use internal models to compute regulatory capital (see CALE Chapter 4, Section 7 IRB for credit risk; Chapter 5, Section 3 for own risk calculation models for position, forex and commodity risks included in market risk (VaR models) and Chapter 6, Section 6 for the advanced measurement approach (AMA) to operational risk. CIs must adhere to qualifying standards to receive permits to se internal models (see CALE Chapter 4 Section8; Chapter 5, Section 3; Chapter 6, Section 7). Failure to meet the qualifying standard likely results in revocation of the permit. To make significant changes in an internal model, CIs must first apply for a method change to FI and receive a permit before implementing any change. Besides reasonableness checks of the size of the regulatory capital requirement per risk type, which is performed as part of the annually SREP:
To date, FI has never had to revoke an internal model as any observed deficiencies have received prompt attention. Seven CIs have permits to apply the IRB Foundation approach for credit risk and one the advanced approach Chapter One CI has a permit to apply the AMA. Three CIs have permits to apply their own market value-at-risk (VaR) model for position, forex and /or commodity risks. A3. As respects supervisory power to require CIs to adopt a forward looking approach to capital management and set capital levels in advance of possible events, reference is made to BFBA Chapter 6, Section 3: “A credit institution ....shall at a minimum, have methods which enable it to regularly value and maintain a capital, which in terms of amount, class and allocation is sufficient to cover the type and level of the risks to which it is, or may become exposed.” This approach includes Pillar 1 risks but additionally covers an open ended span of risks which may or may not be important to the individual CI (Pillar 2 risks). Pillar 2 capital requirements are assessed by FI as part of the SREP. CIs do their corresponding assessment under the ICAAP. How the SREP operates and what kind of results it leads to is described in FI’s memorandum “Method for Supervisory Review and Evaluation Process (SREP)” March 1, 2008. Inter alia, it explains that both scenario analyses and stress tests are used to simulate possible events or market changes that could have an adverse effect, which should be reflected in the overall capital assessment. FI does not permit the recognition of diversification effects in the stress tests that the institutions carry out and it will assess and comment on the severity of the stress testing and assumptions employed by the institutions. A4. As Pillar 1 capital requirements apply to both individual firms on a standalone basis and at the level of financial groups, the requirement on adequate distribution of Pillar 1 capital within the group is satisfied. An adequate distribution of non-Pillar 1 capital, including capital buffer is also made across foreign subsidiaries and assessed annually by FI and the host supervisory authorities of the subsidiaries. FI makes no regular assessment of the distribution of non-Pillar 1 capital across Swedish CIs’ subsidiaries located in Sweden. A5. CALE (Chapter 2, Section 2) provides that if a CI breaches any of the general requirements laid down in BFBA (Chapter 6, Sections 1-3, 4a, 4b, and 5) and if it is unlikely that any other measure would be sufficient to make the CI rectify the situation, then FI must determine a minimum for the capital base that is higher than that which would result from the general rules. FI has never used this formal power. Breaches of important legislative requirements are discussed with management to obtain a reasoned agreement on remedies. These likely include improvements to governance and risk management and also capital strengthening, either via additional capital or by reduction of the level of risk. Increased reporting requirements are also included. Depending on when the problems are identified, the discussions are included in the SREP and the determination of Pillar 2 requirements. FI supplemented its original self assessment to state that it maintains a dialogue with the systemic institutions as well as those that are close to the formal Pillar 1 minimum capital requirements and that discussion with management is not the only measure that may be taken. All recent cases of breach of minimum capital level have been investment firms rather than banks but FI responded within two weeks by prescribing, by letter, that the institution should take action to restore capital adequacy levels. | ||||
| Assessment | Compliant | ||||
| Comments | It is noted that the overall level of capitalization of the Swedish banking system is high. Within the context of a system that is highly concentrated in a handful of firms, the robustness of the supervisory processes assessing the internal models of approved firms (nine firms have IRB approvals) is at a high premium. It is welcome that FI will monitor IRB permissions that have been granted on an annual basis from 2011, but it should be noted that such assessments should already have been routine practice. FI are encouraged to maintain momentum on documenting their internal guidance to ensure consistency in models assessment. SREP is the main supervisory process undertaken by FI (see also CPs 19 and 20). It is FI’s objective to perform a SREP annually for all CIs. Although compliance with this target has been high, it has not been complete. For the systemic institutions the SREP is a more intensive process than for the smaller firms. In all cases firms the annual SREP is concluded with a sign off letter from FI detailing findings, for example including FI assessment of the rigor of the firm’s stress testing, and expected remedies. For the systemic firms and some of the smaller firms there will also be meetings to discuss these findings. Capital add-on techniques are used but uncommon. For a number of Pillar 2 risks capital is not the first best remedy, but FI should be ready to apply differentiated capital requirements as necessary, and promptly should the context require it. FI needs to be mindful of the fact that a Pillar 1 approach, while risk weighted and therefore to an extent risk sensitive, will not necessarily capture the severity even of the Pillar 1 risks to which an institution is exposed. | ||||
| Principle 7. | Risk management process. Supervisors must be satisfied that banks and banking groups have in place a comprehensive risk management process (including Board and senior management oversight) to identify, evaluate, monitor and control or mitigate all material risks and to assess their overall capital adequacy in relation to their risk profile. These processes should be commensurate with the size and complexity of the institution. | ||||
| Description | EC1. BFBA (Chapter 6, Section 2) requires that a CI must identify, measure, manage, internally report and have control over the risks associated with its operations. In this respect, it shall ensure that it possesses satisfactory internal controls and that credit risks, market risks, operational risks and other risks taken together do not entail that its ability to fulfill its obligations is jeopardized. Such requirements are to apply in proportion to the type and scope of the CI’s operations and to their degree of complexity (BFBA Chapter 6, Section 4a). During the licensing process, FI collects and carefully reviews extensive information about the proposed CI’s risk management process. In particular, the business plan should contain a description of the manner in which the CI will handle the risks (credit, market, liquidity, operational) associated with its business. The CI shall, at a minimum, have methods which enable it to regularly evaluate and maintain a capital which, in terms of amount, class and allocation is sufficient to cover the type and level of risks to which it is, or may become, exposed. CIs must evaluate these methods to ensure that they are comprehensive (BFBA Chapter 6, Section 2). In the on-going supervisory process, risk management policies and processes are reviewed at least annually in the SREP. This is based primarily on the CI’s ICAAP which should include information about:
(FI memorandum “Method for Supervisory Review and Evaluation Process (SREP)” March 1, 2008). The CI’s risk management processes are also reviewed through FI’s on-site examinations of different risk or business areas… Normally, when FI receives a signal about weaknesses in the risk management process of a CI, these results in an on-site examination to follow up if any corrective action is needed. If deemed necessary FI has the power to require a CI to strengthen the risk management processes or to raise more capital or to force it to scale down or exit some activities in order to reduce its risk profile (BFBA Chapter 15, Section 15 1-3; CALE Chapter 2, Section 2). EC2, 4. FI’s General Guidelines governing CALE (FFFS 2007:1) require all CIs to have a risk management process which covers all risk areas. Moreover, the Guidelines make the Board responsible for approving policies and instructions, for setting overall limits and for defining the risk appetite. The Board is also responsible for monitoring senior management, the latter being responsible for implementation of policies and instructions in the organization. Senior management has the responsibility for setting in place an organizational structure which contains a function for risk control with capacity and resources to implement tools to identify and evaluate the risk. In addition, senior management should ensure that reporting lines are implemented and that the reports provide the necessary and timely information for managing (and mitigating) the risks. In its supervisory process, FI assesses the involvement and role of the Board in deciding the risk appetite and strategy of the CI. Reading of Board minutes and risk reporting to the Board as well as reviewing the Board-established risk policies, mandates and limits are part of FI’s ongoing supervision through the annual SREP. In its supervision of the four systemic institutions, FI has regular biannual meetings with Internal Audit and Compliance functions to discuss their findings regarding compliance with regulations and internal policies and instructions. For smaller institutions, these functions are interviewed in the course of on-site examinations or the annual SREP. EC3. In on-site examinations, FI checks the level and appropriateness of risk management documentation as well as whether the responsibility for its updating and reviewing is satisfactorily stated in policies approved by the Board. For each risk area, FI has defined the requirement regarding documentation of policies, processes and distribution of responsibilities. As regards exceptions to established policies, processes and limits receiving the prompt attention of—and authorization by—the appropriate level of management, an illustrative example is found in the regulation for CIs permitted to IRB for credit risk: “The institution shall have documented principles for when it is permitted to override a mechanically calculated rating as well as for the approval procedures for such departures. Institutions shall individually document all overrides from the mechanically calculated risk grade. The institution shall in particular analyze and document the outcome of these overrides in accordance with the same principles as prescribed in section in Section 28. With respect to exposures to governments, institutions and corporations, the credit officer shall at all times make a qualitative assessment of the suitability of the grade indicated by the mechanical method (FI: Regulations and General Guidelines governing CALE (FFFS 2007:1 Chapter 44, Section 17).” FI’s most common method to verify that such exceptions are handled in a correct manner, is by reading the annual internal audit report. EC5. A CI is required to have in place sound, effective and complete strategies and processes to assess and maintain on an ongoing basis the amounts, types and distribution of internal capital that it considers adequate to cover the nature and level of the risks to which it is or might be exposed. These strategies and processes must be subject to regular internal review to ensure that they remain comprehensive and proportionate to the nature, scale and complexity of the activities of the CI credit institution concerned (BFBA Chapter 9, Section1: CALE Chapter 2, Section 1). FI conducts an annual SREP to evaluate whether a CI’s target level of capital is adequate and whether it has adequate methods to identify, measure, govern internally, report and have control over the risks that its business is associated with (FI’s memorandum “Method for Supervisory Review and Evaluation Process (SREP)” March 1, 2008). A CI itself must evaluate its methods and assessments in order to ensure that they are comprehensive. At least annually it must prepare an ICAAP which becomes one—of several—sources that underpin FI’s work with a SREP. FI’s general guidelines for ICAAP submission, outline in which way a CI can inform FI regarding its ICAAP and its calculations. EC6. For any CI permitted to use models to measure components of risk there is the requirement that it must regularly conduct internal validation of the risk measurement system, taking account of both quantitative and qualitative factors. This validation shall be documented. It is also required that internal audit verifies that the validation is done by independent functions in the CI. FI in its on-site examination of these models assesses the validation processes and routines. There must be an annual independent validation performed internally and an annual verification performed by internal audit (FI Regulations and General Guidelines governing CALE (FFFS 2007:1) (Chapter 60, Sections 9-10). EC7. FI determines whether CIs (and their groups) have adequate information systems for measuring, assessing and reporting on the size, composition and quality of exposures as part of on-site examinations. CIs also have to deliver to FI for review all policies and instructions which internally regulate reporting and also examples of such reporting. These policies, instructions and reports are reviewed with regard to size, composition and quality of exposures. This assessment is also an integral part of the SREP. For CIs that are allowed to use more advanced models when measuring risk and exposure, there are defined requirements that information systems must fulfill. Degree of conformity with those requirements is established in the context of the annual SREP (FI Regulations and General Guidelines governing CALE (FFFS 2007:1) (Chapter 44, Sections 22-23)). EC8. In FI’s supervision and approval processes for operational risk, it is assessed whether a CI’s Board and senior management are aware of its operational risk exposure and whether the Board and senior management understands if the risk area is under control. As part of the assessment, FI verifies whether the CI has an instruction and an organization for new product approval. FI Regulations and General Guidelines governing CALE (FFFS 2007:1) (Chapter 30, Section 2 and Chapter 60, Sections 3 and 6) requires that: “The institution shall have processes for handling its exposure to operational risks. The institution shall have policy documents approved by the Board… for management and assessment of its exposure to operational risks. Policy documents shall also cover tail risk events with severe impact on the activities of the institution. In addition to stating the institution’s applied definition of operational risk, the policy documents shall state which forms of operational risk are relevant in the operation. The institution shall have an internal reporting structure up to and including the Board.... and management. This structure shall be designed such that the involved functions in the institution receive regular and pertinent information about exposures to operational risks and about losses related to operational risks. The institution shall have procedures in place to take appropriate corrective actions based on this information.” FI does not have any regulation governing a new product process for CIs. EC9. FI Regulations and General Guidelines governing CALE (FFFS 2007:1) (Chapter 30, Section 2, and Chapter 60 Sections 4-6) provides that, for CIs as a general rule, a risk control function must be established which is not involved in risk taking. The responsibility for establishing this function lies with Board The function should possess the resources necessary for its duties. The duties should not be carried out by employees who are engaged in the day-to-day business operations. It may structure the work in different ways depending on the undertaking’s operations. It may, for example, engage other functions in the undertaking to compile data for its reports and analyses. The function shall, however, at all times be responsible for the coordinated reporting and analyses of the credit institution’s risks, and for ensuring that the underlying data is correct. For the three main risk areas credit, market and operational risk, there are explicit requirements for independent risk evaluation and reporting to the Board and senior management if a CI uses an advanced methodology for calculation of capital adequacy. CIs that do not use such a methodology are to apply principles set out in FI General Guidelines regarding Governance and Control of Financial Undertakings (FFFS 2005:1) (Chapter 5, Sections 1-4). FI in its on-site examinations determines whether CIs have risk evaluation, monitoring and control or mitigation functions with duties clearly segregated from risk taking functions and which report directly to senior management and the Board. EC10. FI has issued specific standards for credit risk, market risk, liquidity risk and interest rate risk in the banking book. Operational risk is only covered in the Regulations and General Guidelines regarding CALE (FFFS 2007:1). FI plans to issue a standard in the current year based on the BCBS document “Sound Practices for the Management and Supervision of Operational Risk.” AC1. BFBA presents requirements for more complex CIs to have independent and specialized units for risk control. Larger and more complex CIs also use more advanced models for their risk assessment and capital adequacy and for these models it is a requirement to have dedicated units for risk control. The Board should ensure that a function is in place which monitors and evaluates the internal control (including the risk control and the compliance function). In CIs with an internal audit function (e.g., the four systemic institutions) such duties are performed by that function. The function should possess sufficient resources for its duties. It should also have personnel who possess:
The function should report directly to the Board and organizationally, it should be entirely separated from the operations that are being audited. (FI has confirmed this to be the case for the four systemic institutions) At FI there is a specialized unit for the largest and most complex credit institutions. For each of the four major groups there is a Group supervisor who is responsible for coordinating the supervision of that group. This coordination effort includes risk experts, legal experts, accounting experts as well as supervisors of insurance, mutual funds and market conduct. AC2. As regards a requirement for CIs to conduct rigorous, forward-looking stress testing that identifies possible events or changes in market conditions that could adversely impact the CI, the CEBS CP 32 concerning stress tests and FI’s SREP guidance set out the conditions for stress testing, which FI evaluates in the annual SREP. AC3. While rules are not set out in detail, FI does have requirements on CIs to have in place policies and processes for assessing other risks. The stipulations about risk management and capital in BFBA (Chapter 6, Section 2) are not restricted to a fixed set of risks. Some risks—notably credit risk, market risks and operational risk are singled out in the process of determining minimum capital requirements—but the other risks are to be treated in a corresponding way, if they are material for a particular CI. The capital need and processes are assessed in the annual SREP. | ||||
| Assessment | Largely Compliant | ||||
| Comments | Overall, while all elements of the criteria are touched on in FI’s processes, the supervisory risks too great a focus on procedures and documentation rather than meaningful corroboration of quality of implementation. On-site inspections are discussed specifically in the context of CP20, but FI notes that there will be an on-site visit for all major risk areas of a systemic institution on an annual basis. For systemic institutions, however, the quarterly risk meetings, even supplemented by on-site inspections focusing on individual risk areas, may be an insufficient basis to determine and confirm compliance with the criteria as the program of on-site inspection is not equivalent to an intrusive examination cycle which ought to be combined with a frequent review of internal management reporting and a close and continuous dialogue with relevant control functions and external auditors. In the supervision of the four systemic institutions, FI fields the relationship manager plus a team of experts in quarterly risk review meetings with each bank, wherein the bank provides an update of developments in credit, market and liquidity risk. Any changes in the risk management process/organization are also addressed. The corresponding review of operational risk is performed in a separate meeting, normally twice a year. There is an important clarity and discipline in this process but there are also weaknesses. For example, while reading the Board minutes and risk reporting to the Board is useful it may not be sufficient to determine whether the institutions’ senior management understands the “nature and level of risk being taken by the bank and how this risk relates to adequate capital levels”; examinations and frequent dialogue will be necessary to do this. Also, while the dialogue with Audit, and Compliance is regular it is insufficiently frequent (the supervisory contact schedule for one of the systemic firms indicated an annual meeting). Dialogue with Audit, Compliance and Risk Management should be continuous, at least for the four systemic institutions. Further, although FI puts an important and valuable emphasis on quality of documentation, it is essential that a corresponding emphasis is placed by FI on ensuring that policies are adhered to in practice, for example through a rigorous process of spot checks and file reviews, or by ensuring that the check on exceptions is based on monthly and quarterly management information rather than an annual internal audit report, at least for the systemic firms. Ensuring compliance with the essential criteria iterated in this principle falls within the SREP process conducted for the non-systemic institutions. For such institutions the depth and breadth of approach applied to the systemic firms is not available in large part due to the resources available for on-site inspections of CIs. For a developed country such as Sweden, the level of compliance in particular in respect of systemic institutions needs to be enhanced. | ||||
| Principle 8. | Credit risk. Supervisors must be satisfied that banks have a credit risk management process that takes into account the risk profile of the institution, with prudent policies and processes to identify, measure, monitor and control credit risk (including counterparty risk). This would include the granting of loans and making of investments, the evaluation of the quality of such loans and investments, and the ongoing management of the loan and investment portfolios. | ||||
| Description | EC1. FI’s General Guidelines regarding Credit Risk Management in Credit Institutions and Investment Firms (FFFS 2004:6) make a CI’s Board ultimately responsible for a CI’s credit risk management (Section 7) and stresses the importance of having a clear credit strategy, consistent with the CI’s overall strategy as well as with other internal strategies and goals (Section 9). Minimum requirements regarding what the CI’s credit policies and instructions should cover is also provided (Section 15). The General Guidelines regarding Governance and Control of Financial Undertakings (FFFS 2005:1) stipulate that the CEO shall handle a CI’s day-to-day management in accordance with the Board’s guidelines and instructions (Chapter 2, Section 4). In light of its available resources, FI’s approach to supervision is risk-based. CIs are required to report risks, including credit risk, on a regular basis. Inspections are then carried out in the areas where CIs are deemed to carry increased risk. FI has indicated that it plans on the basis of two examinations a year for each of the systemic banks (each of these banks has had an on-site examination for credit risk in the last six months) and fifteen examinations for non systemic banks within the course of a year. Over the period of 2008-2010 FI performed 74 on-site examinations focused on credit risk. At on-site inspections adherence to inter alia FFFS 2004:6 is assessed. FI does, for example, verify the presence of policies and instructions and how these are implemented and monitored within the CI. In addition, there is dialogue between FI and CIs. In the annual SREP each CI’s risk profile is assessed with credit risk as one of the main focus areas. The risk profile is then compared to the capital strength of the institution. In connection with SREPs and on-site inspections (irrespective of the focus area of the inspection), all major policies and instructions (including credit-related) are checked and minutes from Board meetings are studied. EC2. BFBA (Chapter 8, Sections 1-3) stipulates that a CI’s credit assessment must be based on the applicant’s repayment capacity, that all credit decisions must be based on appropriate information and that all credit decisions must be documented. FFFS 2004:6 (Section 6) requires that all credit risks within a credit institution shall be handled with sound judgment, the CI having a good knowledge of the kind of credit risk associated with its business and that it must identify this risk on an ongoing basis (Section 6). The CI is required (Section 12) to monitor and control its aggregate credit exposure on an ongoing basis and subject all exposures to risk classification. A management information system must also be in place (Section 14) to provide accurate reporting on credit exposures. Among the credit policies/instructions mentioned (Section 15) are those concerning approval authorities as well as the setting and monitoring of limits. Credit proposals (Section 16) must be based on a true picture of the applicant’s economic conditions and ability to repay, with credit decisions only made (Section 17) on the basis of credit proposals and well documented. The CI must have a well functioning process in place for the early detection and accurate handling of problem loans (Section 18). The credit institution (Section 20) should aim for a good and sound credit culture (Section 20 also provides guidance for how a well-functioning credit administration should be set up). For those on-site inspections that it conducts, FI uses a template modeled on the requirements of FFFS 2004:6 itemized above. (For 9 of the CIs which have applied to use an IRB including the four systemic institutions- a review of the credit process was performed as part of the on site assessment of the IRB approach.) EC3. BFBA (Chapter 8, Section 5) provides a list of persons considered as potentially having a conflict of interest and permits some discretion to FI to discern whether an individual qualifies under the categories stated. These include (i) Board members, (ii) a person in senior management who alone or together with a third party is authorized to determine lending matters otherwise determined by the Board, (iii) an employee who holds a senior position, (iv) shareholders or holders of participating interests with holdings equal to at least three percent of the CI’s outstanding capital, (v) a spouse or cohabiter of a person in the categories above, or (vi) a legal person in which any of the persons above holds a significant financial interest as owner or member. (The same section further stipulates that a CI may not enter into a services agreement on unusual or commercially unjustified terms with any of the foregoing types of persons.) FFFS 2004:6 (Section 17) requires that anyone taking part in a credit decision must make sure that the credit proposal is of sufficient quality, that the proposed credit is in line with the CI’s credit policy and must be able to fend off pressures to bend the credit decision in one direction or the other. FFFS 2005:1 (Chapter 3, Section 4) mentions separation of duties as a way to ensure that the risk of conflicts of interest is avoided. During on-site inspections, FI actively looks for potential conflicts of interest when assessing a CI’s internal governance and control against the requirements of FFFS 2005:1. From time to time, FI conducts special investigations into how CI’s handle conflicts of interest. EC4. BFBA (Chapter 13, Sections 3-4) sets out a CI’s obligation to provide such information that FI may require from time to time and also stipulates FI’s right to conduct such on-site inspections as it deems necessary. FI’s experience is that there is no problem in obtaining the necessary information, on site or off site. During the financial crisis FI demanded a major step-up in both coverage and frequency of information reporting and CIs co-operated. AC1. FFFS 2004:6 (Section 15 a) and b) stipulates that, as a minimum, a CI’s governance documents should include information about: a) the units within the CI that may make credit decisions and the conditions for being allowed to make decisions in those units, and b) the units’ authorizations to make credit decisions, e.g., with regard to monetary limits. In practice, all CIs apply segregated levels of decision depending on the risks involved. At the highest level, a credit policy will be adopted that constitutes the framework for the credit instructions, which contain procedures and delegations of authority in connection with the granting of credits. Each CI is free to determine its own levels of delegated credit authority; there are no hard limits set in the regulation, neither in absolute nor relative terms. However, if FI considers that credit decisions are not made at a suitable level in the organization, it can obtain correction (BFBA Chapter 6, Section 2). When reviewing a CI’s policies and procedures, as well as Board (and other relevant bodies’) minutes, FI checks that a delegation of authorities exists and that credit decisions of a certain size are referred to the Board. The threshold for having a credit decision referred to the Board should be indicated in the CI’s credit instructions (reference is made to the general guidelines in 1, above). AC2. All CIs must calculate counterparty credit risk for their derivatives exposures. Irrespective of whether the credit institution uses the standardized approach or the IRB for its credit risk exposures, the regulation provides for different methods for calculating the exposure values of these derivatives transactions. The most advanced method (internal model) requires an approval from FI. CIs institutions are free to choose between the other methods set out in the regulation. The details of these methods are described in FI Regulations and General Guidelines governing CALE (Chapters 18, 40, and 61) While the methods vary in complexity, they all cover the potential future exposure. FFFS 2004:6 applies to all forms of credit risk, including counterparty credit risk. Thus all sections referred to above apply also to the identification, measurement, monitoring and control of counterparty credit risk. (The guidelines have to be adapted to the size and complexity of the individual CI (FFFS 2004:6 Section 1).) The annual SREP captures all forms of outstanding credit risk in a CI, including counterparty credit risk. As respects a CI’s policies and processes to monitor an obligor’s total reference is made to 1 and 2, above. The credit policies and instructions of CIs are checked against FFFS 2004:6 (Section 16) which requires that a CI’s credit assessment shall be based on information providing a good overall view of the applicant’s economic status. FI expects CIs to follow best practice by use of the database/register UC >(Sw. Upplysningscentralen) for private individuals and small/medium companies and annual reports for listed companies. For any clients falling outside these sources of information, it is expected that the CI forms an opinion based on the best available information about the applicant’s economic status before granting a credit and also performs a follow-up at relevant intervals. | ||||
| Assessment | Compliant | ||||
| Comments | It is noted that FI has succeeded in increasing the frequency of on-site activity over the course of the past three years, and this testifies to FI’s desire to move to a higher standard of performance. It should also be noted that the impact of restrictions on ability to achieve an appropriate balance of on and offsite supervision is addressed in CP 20. Three of the four Essential Criteria (ECs 1, 2, and 3) for this Core Principle use the wording “The supervisor determines/requires and periodically confirms that…” in addressing matters described. A Comment in FI’s Self Assessment indicates that the number of on-site inspections in the past several years which would have provided the determinations and confirmations has fallen short of the desired standard. This deficiency is a reflection of the resources available for on-site inspections of CIs. | ||||
| Principle 9. | Problem assets, provisions and reserves. Supervisors must be satisfied that banks establish and adhere to adequate policies and processes for managing problem assets and evaluating the adequacy of provisions and reserves. | ||||
| Description | EC1. FI’s General guidelines regarding credit risk management in credit institutions and investment firms (FFFS 2004:6) require a CI to have policies and procedures in place to identify and manage problem assets and assets with deteriorating credit quality (FFFS 2004:6 Sections 12, 15, and 18). FI’s Regulations governing the reporting of interim and annual report data (FFFS 2008:14) contain the template for CIs’ mandatory quarterly reporting to FI (the “Standard Report”). FI has issued guidance (Standard Report - guidelines for credit institutions and investment firms, December 2009), which provides a definition for what should be considered a problem asset for the purposes of such reporting. FI’s Regulations and General Guidelines governing CALE (FFFS 2007:1) requires that all exposures be subject to some form of asset classification. For those using the IRB, it is required that when a CI receives new information which substantially influences assessment of the counterparty’s credit risk, the CI must perform a risk classification review (FFFS 2007:1 Chapter 44, Section 16). For those using the standardized approach, FFFS 2007:1 implicitly requires that changes that would lead to a different risk weight for exposures are to be captured on a daily basis unless otherwise provided (e.g., less strict requirements for the revaluation of residential property collateral Chapter 16, Section 28. para 2). In regard to determining the amount of provisions and write-offs, all CIs must use International Financial Reporting Standards (IFRS) for their external financial reporting. However, FI assesses whether CIs are making realistic assumptions in the valuation of important portfolios or individual large exposures (see below). EC2, 4, 10, 12. CIs’ risk classification is assessed and discussed in the annual SREP. Risk classifications may also be reviewed in the course of on-site examinations. For each of the four systemic institutions, FI reviews the provisioning at quarterly meetings where it requires presentation of a list of the 20 largest problem assets. A sample of the problem asset files are usually selected for more thorough examination. This includes inter alia a check of the handling of the individual credit against the CI’s policies and procedures, including the risk classification procedure (see CP 8 above for references to credit risk inspections). Further, each CI must apply accounting regulation International Accounting Standards (IAS) 39 Financial instruments: Recognition and Measurement which requires its management to assess whether there is objective evidence that a financial asset or group of financial assets measured at amortized cost is impaired. If such evidence does exist, then the CI must apply IAS 39 p. 63 to determine the amount of any impairment loss. FI’s experience from the Baltic crises is that -contrary to the common perception of IFRS application in this area—the CIs involved (primarily the four systemic institutions) did make both early and sufficient provisions regarding their Baltic exposures, in line with IFRS. FI has made special investigations of problem assets and provisioning during the financial crisis and its aftermath:
As indicated, the investigations were extraordinary: FI does not routinely confirm the adequacy of CIs classification and provisioning polices and processes, or their implementation. EC3. In addition to prescribed requirements under IFRS, FI’s Regulations and General Guidelines governing CALE (FFFS 2007:1) lay down rules about the treatment of off-balance sheet items for CIs that have approved IRB-models for credit risk. FFFS 2007:1 (Chapter 40, Section 31) requires all off-balance sheet exposures to be converted using a Credit Conversion Factor (CCF) with the CCF taking into account the risk for further drawings by a counterparty after an event of default has occurred (2007:1. Section 39). There are CCF for different off-balance sheet items to be used by CIs not having an IRB permit (2007:1 Chapter 17). The amounts of the off-balance sheet exposures after the application of the conversion factors are added to any other exposures on the same counterparty and thus subject to the same risk classification and provisioning in the CI’s processes and systems. The foregoing elements (IFRS; FFFS 2007:1) are prescriptive. FI has not performed any supervisory activity in recent years directed to the specific area of how CIs handle off-balance sheet exposures in their risk measurement. EC5. FFFS 2004:6 (Section18) prescribes that a CI be properly organized for the early detection of deteriorating credit risk and well prepared for the handling thereof. It further notes that past due credits and credits with increased risk should be handled rapidly so as to avoid a worsened outcome in efforts to secure repayment and to reduce the credit risk. FI’s self assessment stated that FI regularly receives and reviews information regarding supervised CIs’ credit portfolios and management of problem assets, and has full access to all relevant information. In meetings, FI indicated that problem assets are reported at an aggregate level, but not by portfolio or by class of asset. Only assets that are over ninety days past due are reported. FI would require a CI to change its procedures/policies and organizational resources if it had serious concerns about their fitness for purpose. EC6. Under FFFS 2008: 14, FI receives a quarterly Standard Report from each CIs based on IFRS. Lending to CIs and lending to the “general public” (which includes Swedish non-financial corporations, insurance companies and investment funds) are separately disclosed in the Standard Report. Further, such lending to CIs and the “general public” are distributed among different subcategories (see FFFS 2008:14 rows C1-C16). The CI’s total provisions are specified for a number of different subcategories and for a number of different kinds of loans (e.g., specific provisions for individually appraised loan receivables) (see Standard Report, rows C 68-C91). EC7, 8. If, in light of the level of problem assets, FI deems a CI’s level of provisions and/or overall financial strength to be insufficient, then FI has power to intervene and demand that the CI rectify the situation through setting higher capital requirements BFBA (Chapter 15, Section 1). This also follows from the provisions of CALE (Chapter 12, Section 1). Reference is made to FI’s special investigations of problem assets and provisioning during the financial crisis and its aftermath, in 2, above. EC9. As noted in 2, above, a CI’s policy regarding asset/risk classification and provisioning must reflect current accounting practices as provided in IFRS, including IAS 39. As currently applicable, the latter (IAS 39.63) requires that the amount of a loss is measured as the difference between the asset’s carrying amount and the present value of estimated future cash flows (including the net realizable value of collateral). Further, IAS 39 AG 84 states that the calculation of the present value of the estimated cash flows of collateralized financial assets reflects the cash flows that may result from foreclosure less costs for obtaining and selling the collateral, whether or not foreclosure is probable. The requirements of IFRS are augmented by FI’s General Guidelines regarding Credit Risk Management in Credit Institutions and Investment Firms (2004: 6) where it is required (Chapters 12, 15c, and 20) that a CI shall:
EC11. BFBA (Chapter 6, Section 2) prescribes that a CI shall identify, assess, monitor, control and report the risks inherent in its operations and that the Board shall ensure fulfillment of these requirements (BFBA Chapter 6, Section 4b). FFFS 2004:6 further underlines that ultimate responsibility for a CI’s credit risk management rests with the Board (Section 7) and moreover requires that the CI, on a continuing basis, assess and follow up on the aggregate credit risk to which it is exposed (Section 12) and that the assessment process shall, inter alia, enable a) an analysis of the credit portfolio’s composition from a risk perspective b) a continuous monitoring of the credit risk development both for an individual credit and for the whole credit portfolio (Section 13). FI’s determination as to whether the foregoing prescriptions translate into the Board receiving timely and relevant information on the condition of a CI’s asset portfolio is made (excluding the four systemic institutions) in the course of on-site inspections, where Board minutes and Directors’ packages are available for review. In the case of the four systemic institutions, FI is able to make the determination at the quarterly presentations which it receives as, in several respects, these closely resemble those made by senior management to the Board. AC1. FFFS 2007:1 defines the term “Past due items” (Chapter 16, Section 31) and contains a list of criteria and indicators of when an exposure shall be classified as being in default for IRB purposes (Chapter 41, Section 7). In both cases, a 90-day overdue limit is mentioned as a strong criterion. According to IAS 39 p. 59, objective evidence that a financial asset or group of assets is impaired includes observable data on “loss events,” including:
Although IAS 39 no longer defines the term “doubtful exposure,” which used to be defined, among other criteria, as an exposure past due for 60 days or more, this definition is still used in FI’s Standard Report and in several CIs’ external reports as well as in their internal credit instructions. | ||||
| Assessment | Largely Compliant | ||||
| Comments | Five of the twelve Essential Criteria (ECs 2,4,5, 8 and 11) for this Core Principle use the wording “The supervisor determines/confirms/assesses that…” in addressing the matters of (i) adequacy of classification and provisioning policies and their implementations; (ii) provisions and write-offs reflecting realistic repayment/recovery expectations; (iii) appropriateness of policies and processes and organizational resources to identify and manage problem assets; (v) adequacy of Board reporting. Although meetings with FI confirmed that this area is one which FI increasingly seek to target, comments in FI’s Self Assessment stated that “confirmation of the adequacy of classification and provisioning policies and processes and processes as well as their implementation is not carried out on a routine basis.” In comments supplied after the assessment, the authorities indicated that, contrary to the statement in the self assessment, “reading provisioning policies and going through reserves, name by name, is performed in all FI’s credit risk inspections.” It is therefore not possible for the assessors to ascertain independently which account of FI’s practices should be relied upon. However, concerns regarding frequency or adequacy of checking may be offset in the case of the four systemic institutions by the quarterly meetings, but not in the case of the smaller institutions where contact is less frequent. This is a reflection of the resources available for on-site inspections of CIs. Critically, however, the adequacy of the information that FI is receiving has to be questioned. Aggregate data indicating claims that are more than 90 days past due is insufficient for FI to monitor or analyze the quality of the portfolio or assess the potential for deterioration of asset quality across firms. | ||||
| Principle 10. | Large exposure limits. Supervisors must be satisfied that banks have policies and processes that enable management to identify and manage concentrations within the portfolio, and supervisors must set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties. | ||||
| Description | EC1. The CALE Act (Chapter 7, Section 4) explicitly defines that a “group of connected clients” means two or more natural or legal persons who, unless otherwise shown, constitute a single risk because one of them, directly or indirectly, has control over the other or others in the group, or without such a relationship, they are so interconnected that if one of them were to experience financial problems, the other or all of the others would be likely to encounter repayment difficulties. “Client” means with respect to investments in financial instruments the issuer or, where the instrument has other financial instruments as underlying assets, the issuer of such assets and, with respect to other claims or commitments the party which is liable for the claim or commitment. EC2. The requirements regarding limits on large exposures, (Chapter 7, Section 3 of the CALE Act) are consistent with the EU directive requirements, including: a limit of 25 percent of the institution’s capital base for the value of a credit institution’s exposures to a single client or group of connected client; a limit of 20 percent in cases where the client or a group of connected clients is a parent undertaking or subsidiary of the institution or subsidiary of the parent institution; an aggregate limit of 800 percent of capital base for total value of the institution’s large exposures may not exceed 800 percent of the institution’s capital base. A large exposure is defined as an exposure which a credit institution has to a client or group of connected clients where the value of the exposure is 10 percent or more of the institution’s capital base (Chapter 7, Section 5). FI has the power, although has never excised this power, to permit value of a credit institution’s exposures in the trading book to a client or a group of connected clients may exceed the limits mentioned above. Such exemptions would be subject to additional requirements and conditions set out in the regulation on CALE (Chapter 35, Section 15). The term “exposures” as defined in the Act (Chapter 1, Section 3 at 4) covers all items reported as assets in the balance sheet, derivative contracts reported as liabilities or off balance sheet obligations. However, not all exposures must be included for the purposes of determining the large exposures limits. Exemptions are listed in Chapter 7, Sections 6 and 7. EC2 and EC3. FI looks into management policies in the context of the SREP process every year (Pillar 2). Internal policies shall include senior management’s duty to monitor large exposure limits and instructions for the adequate design of management information systems. FI’s ability to determine the performance of a bank’s management systems therefore depends heavily on information submitted to it in the context of the ICAAP/SREP process and on its own ability to process this information, which appears to be adequate although could be enhanced. FI has not conducted any recent specific investigations on this issue. EC4. In the context of the SREP review FI assesses that management policies shall include thresholds for acceptable concentrations of credit and confirmation that all material concentrations are reviewed and reported periodically to the board. Concentrations of credit risk have high priority in the SREP process. During 2010 FI introduced mandatory measurement of the “Herfindahl index” for all credit institutions analysis of which, although rudimentary, leads to additional capital requirements for large exposures to what are deemed to be higher risk areas. A lot of the data from the ICAAP is sent to FI and evaluated in the SREP process. EC5. FI obtains quarterly reports of large exposures in accordance with the Capital Adequacy report (Appendix 2 to FI’s Regulations on CALE). Sectoral and geographical data is not included in these reports, but is obtained, in respect of the four major banking groups in a separate report, and for non systemic firms standard reporting includes is a breakdown of lending across public sector, financial/non-financial companies, credit institutions and households as well as Swedish and non-Swedish counterparties. Institutions have to report the number and total amount of exposures exceeding 10 percent of the capital base. More detailed information is required in respect of any breaches to the large exposure limits. However, reporting of an institution’s 20 largest exposures and 15 largest corporate exposures, irrespective of whether these exposures exceed 10 percent of capital base or are formally exempt from limits under the EU directive, will be instituted from the second quarter 2011. Immediate notification to FI is required in the event of a breach of large exposure limits and FI has the power to specify the time period within which the institution must reduce the exposure. (Chapter 10, Section 15 CALE Act). FI has power to proceed to sanctions in the event of failure to remedy the breach and has acted on this power. FI required enhanced reporting from the four major banking groups during the period November 2008 to December 2009. The temporary reporting included the 15 largest exposures to credit institutions and the 25 largest exposures to corporations. Information was required on the name, country, management credit limit, external rating, internal risk classification and probability of default (PD) value, total amount and balancing day, exposures split into kind of transactions and amounts for each transaction, and existence finally guarantees. Also name, total amount and balancing day, exposures split into kind of transactions and amounts for each transaction, guarantees, and provisions regarding the 25 largest and weakest counterparties were required. Finally information was required regarding expected loss during 2008 and 2009, split into sector and geographical exposures. Although enhanced reporting for the systemic firms has now ceased, valuable information is received through the quarterly risk reviews when FI obtains a breakdown on the credit portfolio including concentrations, asset quality and granular information on the twenty-five largest exposures. FI has no specific regulation to require credit institutions to take preventive actions in cases where concentrations appear to present significant risk of breach of large exposure limits. However FI can require additional reporting at any time in order to judge whether additional capital should be required under Pillar 2. AC1. A large exposure is defined as an exposure which a credit institution has to a client or group of connected clients where the value of the exposure is 10 percent or more of the institution’s capital base, according to Chapter 7, Section 5 of the CALE. The value of a credit institution’s exposures to a single client or group of connected clients may not exceed 25 percent of the institution’s capital base, according to (Chapter 7, Section 3 of the Act). | ||||
| Assessment | Compliant | ||||
| Comments | FI has implemented the recent changes to the EU CRD that removed some potential exemptions to the large exposures regime. The enhancements to regular LE reporting are also welcome. Future changes to large exposure regimes can be expected in the light of reviews being undertaken on concentration risk by the Basel Committee. FI’s compliance with this principle rests essentially on its ability to carry out an adequate review of policy and practice of management’s controls on large exposures through the SREP process. The use of the Herfindahl index points to a heightened awareness of the issues posed by concentration risk and large exposures in general. In this context FI may wish to consider if it wants to re-institute more granular reporting for its systemic institutions (for example based on the approach adopted during the financial crisis) and whether tighter large exposure limits would be appropriate in the Swedish market. It should, however, be borne in mind that new EU standards of reporting will shortly be in force. | ||||
| Principle 11. | Exposures to related parties. In order to prevent abuses arising from exposures (both on balance sheet and off balance sheet) to related parties and to address conflict of interest, supervisors must have in place requirements that banks extend exposures to related companies and individuals on an arm’s length basis; these exposures are effectively monitored; appropriate steps are taken to control or mitigate the risks; and write-offs of such exposures are made according to standard policies and processes. | ||||
| Description | EC1. Chapter 1, Section 6 of the BFBA defines when a related party relationship is considered to exist between a credit institution and external and/or affiliated parties. FI has issued general guidelines on credit risk management that provides more detailed rules. Pursuant to Section 8 of these general guidelines, no one is to participate in a matter or a decision concerning the granting of credit to a related party, a related party’s firm or in other cases when there is a risk of a conflict of interest. Furthermore, requirements governing issues of conflict of interest are set out in Chapter 8, Sections 5 and 6 of the BFBA (“the Act”) and address the related parties definitions, including FI’s powers to itself determine whether certain individuals may be considered as potentially having a conflict of interest. The Act provides a list of persons considered as potentially having a conflict of interest, including (i) board members, (ii) delegates—a person in senior management who alone or together with a third party is authorized to determine lending matters otherwise determined by the board, (iii) an employee who holds a senior position, (iv) shareholders or holders of participating interest, with holdings equal to at least three percent of the credit institution’s outstanding capital, (v) a spouse or cohabiter of a person in the categories above, or (vi) a legal person in which any of the persons above holds a significant financial interest as owner or member. EC2. Chapter 8, Section 5 of the BFBA states that a credit institution may not enter into a services agreement (including the granting of credits) on unusual or commercially not justified terms with any of the persons mentioned under EC 1 above. Chapter 8, Section 5 further stipulates that a credit institution may not enter into a services agreement (including the granting of credits) with related parties (excluding subsidiaries and affiliates) on more favorable terms than the terms granted to non-related counterparties Transactions with subsidiaries/affiliates are regulated by the Companies Act. Chapter 17, Sections 1 and 2 contains a definition of “transfers of value” and stipulates which transfers are allowed. All other transfers of value from a registered company are prohibited, also within a group. This includes transfers in the form of business transactions that decrease the net value of the company and that are not justified for purely commercial reasons. EC3. Chapter 8, Section 6 of the BFBA requires that all exposures with related parties defined in Section 5 shall be subject to prior approval of the credit institution’s Board. FI noted in its self assessment that in most cases this referral is made. Chapter 8, Section 23 of the Companies Act stipulates that a board member shall not be involved in matters where a conflict of interest may arise. EC4. Requirements are set out in the of the BFBA (Chapter 6, Section 5) for a credit institution to have the necessary policies and processes in place for the orderly fulfillment of the Board’s responsibility regarding transparency and internal control. Additionally there are regulations (Section 2 and 4 of FFFS 1998:22) stipulating that each credit institution shall have ethical guidelines, established by the Board in respect of its lending practices. These guidelines shall include instructions regarding the granting of credits and the providing of products in order to comply at all times with existing laws and regulations. EC5. The CALE Act does not contain any specific provisions regarding the treatment of, e.g., credits to related parties in the context of capital adequacy measures. Neither does the BFBA explicitly address limits for exposures to related parties or collateralization requirements. However, FI is mandated to supervise, e.g., credit institutions’ compliance with the soundness criteria in Chapter 6 of the BFBA and may, in this context, take measures against credit institutions that extend credit to related parties in a manner not consistent with sound business practices. Furthermore, Chapter 7, Section 3 of the CALE Act stipulates that exposures to a client or a group of interrelated clients may not exceed 25 percent of the credit institution’s capital base. The same Section stipulates that if the client or clients are members of the same group as the credit institution, the aggregate exposure may not exceed 20 percent of the capital base. Chapter 10, Section 17 of the BFBA stipulates that a credit institution may grant a loan or security to an outside party acquiring a stake in the credit institution or a company in the same group as the credit institution. However, after deduction of the lent/secured amount(s) the restricted capital of the credit institution must remain fully covered. FI has not issued any regulations regarding limits for exposures to related parties (except the abovementioned regulation regarding parties related to the credit institution itself). EC6. Chapter 8, Section 6 of the Banking and Financing Act requires that the Board of the credit institution keeps a written record of all agreements entered into with related parties. Chapter 2, Section 1 of FFFS 2005:1, stipulates that an undertaking’s Board bears the ultimate responsibility for the undertaking’s organization and management of its affairs. Chapter 2, Section 4 stipulates that the managing director shall handle the day-to-day management in accordance with the Board’s guidelines and instructions. Chapter 3, Section 1 stipulates that it is the responsibility of the Board and the managing director jointly to ensure that there is a sound internal control in place. Thus the general responsibilities of Board and senior management are used to ensure risk management processes. Requirements are not set out for an independent credit review process. An inspection involving seventeen selected credit institutions, focusing solely on related-party issues, was carried out by FI in the autumn of 2010. It has confirmed that the institutions have policies and processes in place to identify individual exposures to related parties as well as the total amount of such exposures, and to monitor and report on them. Monitoring and reporting is made as part of the normal credit review process but decisions are made separately. The inspected credit instructions stipulate that exceptions to policies, processes and limits should be reported to the Board. Related Party transactions are reviewed by senior management, the Board and in some cases by the Internal and External Audit functions. EC7. The assessors saw working papers relating to the review of exposures to related parties detailing the initial stages of planning for follow up action. | ||||
| Assessment | Largely Compliant | ||||
| Comments | Requirements are in place obliging institutions to identify related parties and manage conflicts of interest. In respect of the credit granting and review process, however, FI is relying on what are general requirements for sound and ethical processes. FI maintains a regular review of Board information of the most significant institutions and has undertaken a recent review of practice more broadly. Within the limits of its supervisory capacity, FI has been diligent in this area and there is active follow up work in progress with at least one institution at present in respect of this issue. It is recommended that FI draft more specific regulations to ensure that there is clarity of requirements that institutions must meet. FI has indicated that it intends to review the credit risk guidelines in 2012 and plans to use this opportunity to impose more specific guidelines regarding exposures made to related counterparties. | ||||
| Principle 12. | Country and transfer risks. Supervisors must be satisfied that banks have adequate policies and processes for identifying, measuring, monitoring and controlling country risk and transfer risk in their international lending and investment activities, and for maintaining adequate provisions and reserves against such risks. | ||||
| Description | EC1. As a major regional banking hub, Sweden’s banks are exposed to country risk, although to varying degrees, largely concentrated in the major four systemic groups. Credit institutions, other than the four major banks, do not have exposures towards high risk countries, but almost only to European countries and primarily to Nordic countries. Therefore even though a few credit institutions, other than the four major banks, have a large part of their lending outside Sweden, the transfer risk and specifically the country risk for credit institutions, other than the four major banks, is low even on an individual basis. However, Country risk is not explicitly defined in regulations or guidelines but is considered to be a component of credit risk, which is subject to the requirements set out in FFFS 2004:6 and FFFS 2007:1. Liquidity regulations (Chapter 1, Section 2, Chapter 4, Sections 4 and 5 of the FFFS 2010:7) address transfer risk through requiring institutions to minimize the transfer risk by maintaining reliable liquidity reserves. It is thus considered that regulations and guidelines relevant for country risk are in place, albeit indirectly. FI’s practice is to use its process of “ongoing supervision” (see CP19) to determine that the institutions have policies and processes for identifying, measuring, monitoring and controlling country risk and transfer risk, amongst other risks. Although regular frequent contact is limited to the major firms, it is these institutions which have the most significant exposure to country risk. In its supervision FI considers country risk in the context of cross border activity (e.g., subsidiary holdings and branches, investments, portfolio composition). FI contacts firms directly when a high profile country event needs to be taken into consideration, to identify exposures, assess possible mitigation by the firm or even (e.g., in case of EU imposed sanctions) to ensure firms have frozen assets as necessary. EC2. All credit institutions are required to have systems in place to monitor and manage all credit risk, no matter where they arise. Within the work with the ICAAP/SREP the institutions’ methods for identifying, monitoring and quantifying all risks are assessed. Also, FI performs risk reviews with the larger banks on a regular basis, four times a year, apart from the SREP which is performed on a yearly basis. FI will conduct targeted investigations regarding exposures towards different countries when needed, e.g., investigations into exposures towards Baltic countries were conducted 2007 and 2009. EC3. Provisioning is not required, instead FI will apply supplementary capital requirements in respect of country risk. Country risk is viewed as any credit risk and is part of the risk classification of each exposure/counterpart. Each risk classification will result in a capital requirement where country risk is included. Thus credit institutions are requested to report exposures towards different countries and will be requested to hold Pillar 2 capital as a result of the concentration of risk to a specific or a few countries and the specific risk for a certain predefined country. For example, if the credit institution has high exposure towards one country only, that will generate high concentration towards one specific country and will therefore result in Pillar 2 capital requirement. If the credit institution has large exposures towards a predefined country with higher country risk (at present five countries have been classified as high risk) an extra capital need under Pillar 2 is added. EC4. The four major banks report on a quarterly basis their exposures where exposure per country is defined. FI analyses these reports. (Chapter 4, Sections 1 and 3, FFFS 2007:1, Regulations and General guidelines governing CALE). The four major banks reports on a quarterly basis their exposures where exposure per country is one of the reporting requirements. There is, in addition, ad hoc reporting required from credit institutions more broadly, of specific country exposure, for example vulnerable European countries exposures. In conjunction with the SREP/ICAAP the credit institutions are requested to report exposures towards different countries and will be requested to hold Pillar 2 capital as a result of the concentration of risk to a specific or a few countries and the specific risk for a certain predefined country. And this refers both concentration risk and specific country risk. FI conducts annual stress tests, more frequently when needed, where exposures in different countries are stress tested. The results are published at least yearly in the report “Risks in the financial system.” In addition, the major institutions (which are considered to account for all cross-border exposures of Swedish institutions) report their country exposures to the RB on a quarterly basis using the BIS standards. FI can obtain this data from the RB, and has done so recently, for example in connection to the vulnerable European countries. | ||||
| Assessment | Compliant | ||||
| Comments | Sweden is a regional banking hub, acting in particular as the parent jurisdiction for the majority of the systemic entities of the Nordic region. Cross border banking activity and country exposure is therefore a significant feature of the banking system, even if it is concentrated in only a few institutions. Therefore the lack of explicit regulations and absence of relevant guidelines in this risk category needs to be reconsidered. FI is mindful of these risks and has an active (non documented) policy to keep such risks under review in its supervisory activity with the most relevant institutions. At the very least, however, a more direct treatment of country risk, including the articulation of supervisory expectations from institutions is recommended, to give greater assurance that all relevant risk can be identified and assessed on a sufficiently regular basis and to a sufficiently penetrating degree. | ||||
| Principle 13. | Market risk. Supervisors must be satisfied that banks have in place policies and processes that accurately identify, measure, monitor and control market risks; supervisors should have powers to impose specific limits and/or a specific capital charge on market risk exposures, if warranted. | ||||
| Description | Introduction Approximately a dozen institutions, including the four major banks, are engaged in trading activities to a significant extent. FI has implemented the EU directives and issued regulations which embody the Basel Market Risk Amendment and subsequent revisions to the market risk framework (the July 2009 revisions to the Basel framework are contained in “CRD3,” the latest revision to the CRD and will be implemented in 2011). In 2000 FI issued a guideline concerning the management of market risks. Supervisory contact is largely although not exclusively focused on the four major banks (., e., quarterly risk reviews and the SREP process). Altogether FI has a regular quarterly meets cycle with ten institutions. FI recorded 5 on-site examinations focused on market risk between the period 2008-2010. The quarterly risk review incorporates review of Board minutes as well as packages of information submitted to the Board and includes meetings with senior management. Two of the quarterly reviews each year have a particular focus on market risk activities. The supervisory personnel are supported by specialist market risk personnel (two persons) and the specialist staff participate in the quarterly risk reviews. It should be noted that the market risk specialists are located in a joint market and liquidity risk unit comprising five experts in total, although this unit has responsibilities for investment firms as well as for credit institutions. There are other market risk staff resources within FI, but as they are located in their own specialist units (e.g., Chief Economist) or are in other supervisory units or divisions (e.g., line side supervision or markets and insurance department) they cannot be considered as fully available resources for the purpose of market risk supervisory activity. FI also analyses its quarterly reports from firms to identify particular changes in market risk related balance sheet items such as interest bearing securities, equities, derivatives as well as market risk P/L items. This analysis provides the basis for more information gathering or inspections (i.e., not limited to the most significant firms for market risk). Unusual indications of activity or discrepancies between different sources of information are targeted as priorities for follow up investigation, although discussion with staff showed that delays to this follow up activity could occur due to conflicting pressures on resources. Since 2008, the regular meetings for major firms and the analysis of risk returns from all firms with market risk activity have been supplemented by a program of targeted onsite inspections in the four big banks and three other credit institutions regarding trading in complex instruments. In the wake of significant losses, due to incorrect valuations in one smaller institution, FI is launching a major investigation into valuation practices in trading books, covering all firms with significant trading activity. The project team comprises eight to nine persons and is cross disciplinary, including market risk, supervisory, legal, economic, insurance and accounting specialists and represents a significant allocation of resources within FI. EC1. The 2008 inspections into complex products were the most recent occasion for on-site determination that the firms in question had in place suitable policies and processes for identification, measuring, monitoring and control of market risk. The inspections addressed the boards’ oversight of market risk management and FI checked policies and instructions issued by the boards’ in addition to evaluating reports to the boards on trading results and market risks. EC2. The 2008 on-site inspections also investigated risk limits (appropriateness and approval by Board/senior management). FI monitors the internal risk limits against the regular reporting of exposures for the four major firms. For banks with an approval to use a VaR-model to calculate the capital requirement for market risks, FI requires that the model is used as the basis for the limit structure. Inconsistency between reported internally assessed capital requirements and reported exposures notified FI of deficiencies in one of its banks, leading to investigation and significant supervisory intervention. EC3. The most recent systematic review that captured the control and valuation functions was the 2008 investigation into complex products but the planned 2011 investigations which will have a broader scope of firms as well as particular focus on valuations and control environment. EC4. Stress tests and scenario analysis is a central feature of the quarterly risk reviews with the four big banks and is basis for discussion on any potential need for adjustments in business strategies. Banks with approval to use VaR-models for calculation of capital requirements are subject to additional specific requirements for stress tests. All firms, for which it is relevant, must include stress testing of market risks in the ICAAP/SREP process. AC1. FI requires that data used to value trading book positions is verified by an independent unit and also imposes a general requirement for the independent testing and validation of models. Discussion with staff indicated that the assessment of independent risk control functions is seen as a central element in nearly all of FI’s direct on-site market risk supervision. | ||||
| Assessment | Largely Compliant | ||||
| Comments | There have been failures in the area of market risk, an area where guidelines have not been updated since 2000, even though there have been changes to the Basel standards in this area dating from 2005. Although it may be argued that market risk is not the key risk for the Swedish banking system the management of the trading book was, for example, at the heart of a prominent recent banking failure. FI had already been aware of some concerns and specifically identified weaknesses in respect of this specific institution but follow up was not as fast as it should have been. Delay appears to have been primarily a result of limited resources that were subject to competing urgent priorities given the on-going financial crisis but the case illustrates the importance of supervisory follow up in a timely manner. The 2011 investigation into trading book valuation practices in the aftermath of the bank failure is an appropriate regulatory response. The initiative is consistent with FI’s approach in seeking to pursue signals of weakness or bad practice whenever such signals emerge and taking a thoughtful, though prioritized approach in assessing the scope of the follow up action (i.e., in this case how many institutions should be covered). The investigation will be a valuable source of information for benchmarking, peer reviews and potentially more proactive monitoring in future, but proactive monitoring and follow up itself will require more abundant resources. Market risk experience and expertise within FI appears to be high quality but it is scarce in comparison to the demands made on it. At present, however, FI necessarily adopts a reactive approach and reaction times to adverse indicators are not wholly within FI’s control given that many valuable projects compete for the same resources. The FI is not in a position to robustly determine the quality of process, policies, limits and controls within even its major institutions although its greater familiarity with the largest institutions give FI enhanced possibility to organize a swift response if routine contact identifies any negative feature. Attention is drawn to the fact that in addition to the eight targeted inspections regarding complex products in 2008, FI conducted 5 on-site examinations focused on Market Risk between 2008 and 2010. It notable in this context that the weaknesses in the bank failure may have been spotted sooner had FI not been significantly reliant on the veracity of ICAAP statements and annual reports. Closer interaction with the failed firm might have led to a very different outcome. | ||||
| Principle 14. | Liquidity risk. Supervisors must be satisfied that banks have a liquidity management strategy that takes into account the risk profile of the institution, with prudent policies and processes to identify, measure, monitor and control liquidity risk, and to manage liquidity on a day-to-day basis. Supervisors require banks to have contingency plans for handling liquidity problems. | ||||
| Description | EC1. FI issued revised liquidity regulations in 2010 (FFFS 2010:7, replacing guidelines and instructions from 2000) that came into force January 1, 2011. They closely reflect the Basel committee’s Principles for Sound Liquidity Risk Management from 2008 as well as European Union directives and various recommendations from Committee of European Banking Supervisors, including coverage of all types of off-balance sheet items. Work is in progress to improve FI’s Regulations on liquidity risk reporting and to include coming international standards on liquidity reporting. EC2. FI’s regulations regarding management of liquidity risks in credit institutions and investment firms require the credit institutions to establish a risk tolerance that is documented, Board approved, and based on an expressed quantitative and qualitative view of what constitutes appropriate liquidity risk in relation to the credit institution’s operational objective, strategy and general risk preference. Furthermore the regulations (Chapter 4) stipulate that a credit institution shall have both a liquidity strategy and a funding strategy. Chapter 4 also contains several sections on Guidelines and instructions as well as Liquidity risk control and Independent review. The regulations in these sections also point to a clear responsibility of the Board of Directors in these issues. Liquidity strategies as well as polices and processes for management of liquidity risk are discussed regularly with the four big banks, e.g., in the quarterly risk reviews and in the SREP work. Liquidity strategy issues including policies and processes were examined in 2009 in five mainly bond market financed credit institutions (companies second in size after the four big banks). In 2008 the nine largest savings banks were examined regarding liquidity risk reporting. In those examinations liquidity strategy and internal policies and processes were also briefly inspected. In all these cases FI checks that the Board is the decision making body for liquidity management strategies and policies and in other aspects has a proper oversight role. During the first half of 2011 FI will undertake a broad survey on the implementation of the new regulation on management of liquidity risk. Inter alia FI plans to check that the companies have a written risk tolerance, a liquidity strategy and a funding strategy in place. EC3. The new regulations stipulate (Chapter 2, Sections 2-6 amongst others) that the board of directors and the managing director are responsible for having appropriate policies and processes in place to control and limit liquidity risk. It is also the managing director’s responsibility to implement such policies and processes. The senior management is responsible for managing liquidity risks in accordance with the firm’s written risk tolerance. Polices and processes for management of liquidity risk are discussed regularly with the four big banks, e.g., in the quarterly risk reviews and in the SREP work. Policies and processes were examined in 2009 in five mainly bond market financed credit institutions (companies second in size after the four big banks). In 2008 the nine largest savings banks were examined regarding liquidity risk reporting. In those examinations policies and processes for liquidity management were also briefly reviewed. During the first half of 2011 FI plans a broad survey on the implementation of the new regulation on management of liquidity risk. Inter alia FI plans to check that the firms have necessary policies and instructions in place. EC4. The new regulations (FFFS 2010:7, Chapter 3) address identification and measurement of liquidity risks. A credit institution is required to use several customized risk measures and key ratios to calculate its comprehensive liquidity risk. Emphasis is put on cash flow projections. Several sections (7-10) are devoted to stress tests and scenario analysis. In Chapter 4, Section 2 there are rules on funding strategy including diversification of funding sources. Section 7 of the same chapter covers the area of limits in liquidity management. Funding needs under both normal and stressed conditions are discussed regularly with the four big banks, e.g., in the quarterly risk reviews and in the SREP work. Detailed discussions were held in 2008 on processes and methods measuring cash flows and defining the components of the liquidity reserve. Policies and processes for measuring net funding requirements were examined in 2009 in five mainly bond market financed credit institutions (companies second in size after the four big banks). In 2008 the nine largest savings banks were examined regarding liquidity risk reporting including methods for liquidity risk measurement. In those examinations policies, processes and forecasts for funding needs were also briefly reviewed. FI is in the process of revising its liquidity reporting arrangements in preparation for new international standards in liquidity risk reporting (Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio (NSFR), etc.) FI has instituted test-reporting from the 45 biggest credit institutions. New monthly reporting requirements will apply from July 2011. The reporting requirements will apply to 45 credit institutions. Small banks and local savings banks are not included in the reporting coverage. In order to enhance reporting requirements FI has consulted with industry and the RB and has experienced difficulties encountered by other jurisdictions in terms of tensions between whether firms should report on the basis of their own management information and definitions or a standardized information requirement imposed by the regulator but which might not reflect meaningful information on how the firm monitors or manages its own liquidity risk. The new reporting regulations will include reporting on liquidity reserves, intraday reserves, cash flow forecasts, redemption schedules for issued securities, outstanding debt to credit institutions and of outstanding covered bonds. The regulations will also include requirements covering the LCR and NSFR as agreed in the Basel liquidity framework. EC5. Swedish credit institutions are engaged in two types of “foreign currency liquidity transformations.” Major banks and credit market companies issue covered bonds and other interest bearing securities in foreign currencies in order to finance mortgage lending in Swedish kronor. The general rule is to fully hedge the currency exposure in this business. The other type of “foreign currency liquidity transformation” is when Swedish firms lend in Euro to clients in primarily Lithuania and Latvia. The borrowers, in many cases, do not have income denominated in Euro, so although the direct foreign exchange risk lies with the borrower, there is an increased credit risk to the lending institutions due to the currency component. Reviews of larger institutions have not uncovered systematic levels of currency risk. Currency risks arise in trading and as a result of investing in foreign subsidiaries (strategic investments), however. FI I analyses the risks including the effects of possible devaluations in countries with fixed currency regimes in its SREP for relevant institutions. FI has not found that medium sized or smaller credit institutions are engaged in “foreign currency liquidity transformation.” In preparation for new international standards in liquidity risk reporting LCR and NSFR, etc.) we have organized a test-reporting from the 45 biggest credit institutions. In this reporting we require the credit institutions to specify a number of items in foreign currencies, dividing them at least in euro, USD and other currencies. FI requires the companies to show cash flow forecasts, funding and redemptions of securities in each currency. This is also the case for the composition of the liquidity reserve. EC6. Requirements are in place (FFFS 2010:7) for credit institutions to have contingency plans in place for handling liquidity problems. There is however no specific requirement to inform FI of upcoming liquidity problems. In practice, FI’s experience is that they would be informed of such issues. Moreover FI point to a general requirement under FFFS 2005:12 which obliges firms to report to FI when they are aware of an event which may result in significant financial damage to a large number of customers or events which may result in significant badwill for the undertaking. However, given that the examples cited in the general guidelines relate to technical failures in the institution it is very possible that firms will consider operational risk events rather than failures in liquidity management which may not be due to technical failures. It would be advisable for more specific guidance to be put in place. Liquidity risk can damage an institution irretrievably in a very short period of time so it is unacceptable that a firm could be in any possible doubt of its obligations to inform FI as soon as possible. FI has launched a broad survey on the implementation of the new regulation on management of liquidity risk. The first element of this survey is for firms to provide the policies and processes on liquidity risk management including contingency planning. All policies have now been received and the process of analysis to assess the adequacy of the policies and instructions has begun. AC1. FFFS 2010:7 has requirements on a liquidity strategy and a funding strategy in Chapter 4, Sections 1-2. These strategies shall consider interalia. Currencies, countries and geographic markets. Chapter 3, Section 8 says that when constructing a stress test this shall be based on the credit institution’s own and its customers’ risk exposure and the focus and complexity of its business. This means that the credit institution separately has to stress test a foreign currency liquidity strategy if this is a material issue. In accordance with Section 9 the credit institution is required to use the stress test results to adjust its strategies. For major institutions, FI has regular discussions of the exposure to refinancing risk in various foreign currency funding markets. FI also discusses the banks’ stress tests regarding the effects of possible devaluations of currencies with fixed exchange rates. AC2. The new liquidity regulation (FFFS 2010:7 Chapter 4, Section 2) requires credit institutions to maintain a presence in their chosen funding markets and to have strong relationship with funds providers to promote effective diversification of funding sources. Requirements governing the liquidity reserve (Chapter 4, Section 5) state that the liquidity reserve shall enable the rapid creation of liquidity at foreseeable values. With respect to maintaining relationships with liability holders, FI has confirmed that the institutions that are active borrowers in domestic and international capital markets have extensive programs for “road shows” and other presentations for bond investors. FI is aware that some firms’ liquidity portfolio did not perform as expected during the recent financial crisis. The new reporting (currently taking place on a trial basis on a more restricted sample of institutions) in respect of the LCR, and NSFR will provide enhanced information about the composition of the liquidity reserve and based on that we can judge the credit institutions’ capacity to realize assets for predictable values. | ||||
| Assessment | Largely Compliant | ||||
| Comments | Supervisory jurisdictions around the globe were required to take remedial action with respect to domestic frameworks for liquidity risk management and supervision as a result of the crisis. Appropriately, the management of liquidity risk is a major priority for FI’s senior management. FI is still in the process of deepening its understanding of institutions’ practices and setting more rigorous requirements. To this end a major survey has been launched, addressing the 45 most significant institutions. There are three stages to the project. First, to assess the liquidity risk management policies and instructions of the firms (all policies have been submitted to FI and the assessment process has just begun). The second phase is to assess the size and composition of firm’s liquidity reserve. Some issues arose in 2010, including the interruption to business of one institution on which a number of smaller institutions had been dependent for liquidity. FI regards this episode as having the benefit of useful market discipline, but it has emphasized the need for caution in identification of liquid assets (e.g., undrawn inter-bank commitments are not eligible under FI’s standards) and diversification of liquidity sources. The third phase of the investigation is to determine what Pillar 3 information firms are publishing on liquidity positions, risk management and strategy. FI will ensure feedback to firms, on bilateral and industry wide basis as appropriate. In addition to the broadly based liquidity risk project, a more in-depth investigation is targeted at the main banking groups, focusing on internal liquidity risk pricing. Overall, liquidity risk practices at FI are in the course of evolution and considerable effort is being devoted to the greater understanding of firms’ practices and to position FI to insist on enhancements where necessary. This is work in progress for FI. By the time that FI’s currently active projects on liquidity are completed it will have a considerably enhanced understanding of the state of firms’ practices and be able to assign follow up and remedial action. While there is no evidence that FI takes liquidity risk lightly or fails to interact or intervene with significant firms, one challenge for FI is to ensure that the coverage of its enhanced requirements, reporting and investigation is sufficiently broad. As part of this FI should ensure that there is enhanced clarity with respect to institutions obligation to inform FI in the event that they believe they may be subject to upcoming liquidity problems. Moreover, despite the significant commitment of resource, it is questionable whether FI is able to spend sufficient time with the major institutions (including but not limited to the major cross border banking groups) to determine the quality of internal management and data regarding liquidity risk. FI needs and lacks a liquidity regime. It is likely that the Basel/EU changes will deliver a consistent international framework, but should there be delay, FI must consider taking action on its own initiative. This regime needs to have qualitative and quantitative aspects, including at a minimum a liquidity reporting regime applying to all institutions and delivering high quality data. To this end it is important to ensure that there is a sufficiently granular break down of currency reporting (reflecting the international profile of the banking sector) to permit appropriate stress testing on aggregate and currency basis. FI intends to introduce new reporting requirements from July 2011 as well as adopting EU standards from January 2012. FI needs to ensure that the sequential introduction of reporting requirements is efficient and does not require duplication or repetition of tasks. | ||||
| Principle 15. | Operational risk. Supervisors must be satisfied that banks have in place risk management policies and processes to identify, assess, monitor and control/mitigate operational risk. These policies and processes should be commensurate with the size and complexity of the bank. | ||||
| Description | EC1. Requirements with respect to policies and processes regarding operational risk are set out in FI’s Regulations and General guidelines governing CALE (FFFS 2007:1). Credit institutions using or wishing to apply to use the standardized approach or the advanced measurement approach to calculate regulatory capital for operational risk, must fulfill the specific requirements set out in FI’s published instructions on these two approaches. As part of the application for a license, FI reviews compliance with requirements to describe their organization, policies and processes for identifying, assessing, monitoring and controlling/mitigating operational risk which are described under FI’s General Guidelines regarding Applications for a License to Conduct Banking or Financing Business or to Issue Electronic Money (FFFS 2004:9) and FI’s General guidelines regarding governance and control of financial undertakings (FFFS 2005:1). EC2. The BFBA (Chapter 6, Sections 2 and 5) imposes the obligation on the board of directors to approve the strategies, policies and processes for the management of operational risk. This requirement is reinforced in FI’s guidelines regarding governance and control of financial undertakings (Chapter 4). Further requirements applicable to institutions with permission to use the more advanced methods are also set out in the guidelines regarding CALE (FFFS 2007:1 Chapter 30 and 60). EC3. In addition to initial assessment approaches, FI’s ongoing assessment of firms’ practices is though on-site examinations, of which there were seven focused on operational risk in the period 2008-2010. The annual SREP includes an assessment of policies and processes (see FI guideline, “Method for Supervisory Review and Evaluation Process (SREP)” March 1, 2008.”). The assessment is based on the size, the complexity and the nature of the credit institution’s business. For the four major groups, there are biannual meetings with the head of operational risk management. The agenda for these meetings cover such areas as reporting to the board, incidence of major losses (causes, and remedial action taken), changes to policies, organization or reporting lies are also covered, as is the bank’s annual risk assessment of the exposure to operational risk and changes in the exposure. FI follows up noteworthy items through on-site examinations, which primarily are focused on units with inherently high levels of operational risk, such as the trading unit and the Information Technology (IT) Department. For the IT-area, FI uses an internationally accepted supervisory methodology based on CoBit, IIL and ISO 17799. Onsite inspection, which was joint with other Nordic supervisors, and enhanced risk analysis for operational risk was limited to the four major banking groups in the 2009/10 period. A further check on institutions’ practices is carried out through a review of internal audit to ascertain whether the internal audit function has itself reviewed that the management has implemented strategies, policies and processes and periodically reports to the board. FI’s review takes place in the context of meetings with the internal audit function to discuss their reporting to the board and their annual audit plans based on their risk assessment. EC4. The requirement for institutions to have business resumption and contingency plans are set out in the BFBA (2004:297, Chapter 6, Section 4) and FI Regulations on CALE (FFFS 2007:1 Chapter 30 and 60). FI verifies the existence of these plans in the course of model approval, including ascertaining that the plans are implemented and tested. FI reviews contingency and resilience through on-site IT-examinations, though an IT focus is by definition a subset of broad business contingency. Failure to provide business resumption and contingency plans by an institution could be seen as grounds for a determination of unsound business, leading to intervention by FI and, in worst case scenario, revocation. EC5. FI uses a methodology for IT-examination built on the international standards CoBit, Information Technology Infrastructure Library (ITIL) & ISO 17799: 2009. These standards will be used until FI has drafted regulations with respect to IT. At point of application for a license according to FFFS 2004:9, an institution also has to present processes and policies on information security that it is commensurate with the size and complexity of their operations. FI plans to issue a specific regulation concerning operational risk in 2011 which will be based on the Basel document “Sound Practice for the Management and Supervision of Operational Risk.” The Basel guideline contains requirements on institutions’ use of IT. EC6. Reporting requirements in relation to operational risk are imposed through the CALE Act (Chapter 10, Section 16). FI’s guidelines regarding reporting of events of material significance (FFFS 2005:12), further requires credit institutions to report major incidents that could affect their operational risk exposure. EC7. FI’s guidelines and instructions stipulate that legal risks are part of operational risks. FI checks that the credit institution’s own definition of operational risk includes legal risk and also that the legal or compliance department/functions informs the operational risk management function about legal risk and legal risk events. FI checks that loss events stemming from legal risk have been incorporated in the loss data base. FI also checks to determine whether legal risk is included in all types of self assessments and scenarios used by the credit institution in the operational risk management process. EC8. FI assesses outsourcing policies and practices in relation to outsourcing and relies on the major banking groups to inform it when they plan to undertake outsourcing of activities. There are regulations requiring institutions to notify FI in advance when intending to outsource a significant part of its licensed operations (FFFS 2005:1, Chapter 7, Section 4) and to date the voluntary approach for notifications that would not be captured by this regulation (i.e., non significant changes) has also worked well in FI’s assessment. FI assesses if credit institutions fulfill the requirements set out in the regulation (FFFS 2005:1, section 1) which correspond to and are more extensive than EC8. All criteria under EC no 8 are included in FI’s examinations and FI uses the international IT-standards (see EC5) when assessing compliance in the outsourcing field. To date, in practice, FI has undertaken close monitoring and on-site completion assessment of outsourcing projects. AC1. Through the on-site processes (and also bi-annual meetings, and SREP), FI checks that risk management policies and processes address the major aspects of operational risk on a group-wide basis, which is a requirement for using an advanced measurement approach. Relevant regulations are contained in the BFBA (2004:297) and in FI’s General guidelines regarding governance and control of financial undertakings ((FFFS 2005:1). Credit institutions permitted to use the more advanced methodologies to calculate capital for operational risk must assess the risk exposure of the different business areas and assess if the risk is higher than in other areas. In the SREPs, the capital need and exposure is also assessed by FI taking into consideration if there are operations or business activities where the operational risk could increase due to the business environment, or other factors. | ||||
| Assessment | Largely Compliant | ||||
| Comments | Operational risk is differentiated from market, credit and liquidity risk in FI in that, following a recent restructuring, the operational risk specialists (four in total at present) are not located in a specialist unit but are embedded in the two line side supervisory units. This does not indicate a lack of focus on this risk, but it is important that the specialist maintain a fully coordinated and consistent approach (proportionate to the firms they are working with). There are two concerns that the embedded specialists must address and in a fully coordinated manner. First, FI needs to issue operational risk guidance. It plans to do so in 2011, based on existing Basel and EU sources, and this risk area stands out as lacking regulatory guidelines. It is unclear why FI has delayed this task for such a long period as Basel sound practices guidance has been available since 2003 (Sweden is a Basel Committee member). Secondly, FI needs to place greater efforts into emphasizing the importance of business continuity and contingency. The former task may be more challenging outside of a dedicated unit, but the latter task may be easier to deliver in the new structure. As with other aspects of the risk assessment process (RAP), FI’s resources are targeted to the four major institutions. Operational risk contacts are bi-annual rather than quarterly and the program of on-site operational risk contact in recent years has been less extensive than for other risk areas, for example there being seven on site examinations focused on operational risk in the period 2008-2010. By the end of 2011 all the systemic firms will have had an onsite examination in this area, some of which are already well underway. Nonetheless, this is not commensurate with an intensive or intrusive cycle of supervision (please see also comments re CP 7). By way of illustration, although FI is conscious of the significance of internal audit (for example, the SREP report for one of the systemic firms shows that FI paid close attention to the internal audit findings) FI’s formal meetings with internal audit according to the meeting schedule were only annual for this systemic firm. As noted above this strategy to issue guidance in this risk area is welcome but FI are urged to consider the potential for risks emerging in the secondary banking sector where, typically, despite the relative lower complexity there are fewer resources and skills available to manage operational risks. In this regard it is welcome that FI has already pressed small and mid size firms to re-assess their capacity in this area. FI is concerned also that the smaller firms should exercise caution when choosing consultants to ensure suitable skills can be employed and FI is further concerned that smaller firms are relying unduly on FI to act as a control function in this area and needs to continue to press this message in its continuing interaction with firms. | ||||
| Principle 16. | Interest rate risk in the banking book. Supervisors must be satisfied that banks have effective systems in place to identify, measure, monitor and control interest rate risk in the banking book, including a well defined strategy that has been approved by the Board and implemented by senior management; these should be appropriate to the size and complexity of such risk. | ||||
| Description | EC1. FI’s guidelines governing management of market risks in credit institutions and investment firms cover all types of market risks including interest rate risk in both the trading and the banking book. The guidelines address risk measurement and valuation (Sections 8 and 9) as well as evaluation of risk models and the use of limits (Section 12). The guidelines cover strategies, policies and processes for identification, measurement, management and control of market risks including interest rate risk in the banking book. Although interest rate risk is discussed in detail in the context of the quarterly risk reviews with the four major institutions, on-site examinations to assess the quality and appropriateness of interest rate risk strategy, policies and processes were in place have not taken place within the last five years. EC2. Firms with permission to use internal VaR model for calculation of capital requirements for market risks also use their VaR-models for their internal calculations of interest rate risk in the banking book. FI has checked that these models and underlying assumptions are validated on a regular basis through risk reviews, on site checks and specific reporting; that the models reflect the risk strategy, constitute the basis for the internal limit system in addition to checking process for informing senior management about exceptions and breaches of limits and ensuring that senior management takes prompt action. For non-VaR approved institutions investigations have not focused on determining that comprehensive interest rate risk measurement systems are in place, except to the extent that such issues have been covered by quarterly meetings or in the context of assessment of market risk (EC1). EC3. Under FI Regulations regarding reporting of interest rate risks in non-trading activities (FFFS 2007:4 Chapter 2) credit institutions have to perform a stress test where an interest rate shock corresponding to a sudden and sustained parallel shift by 200 basis points applies to all positions. If the effect of such shock results in a decline in the firm’s economic value by more than 20percent in relation to its own funds the firm shall submit a statement to FI describing the measures required to reduce the potential decline in economic value. The results of the stress tests are reported quarterly to FI. To date there has been no reporting of a potential decline in economic value above the 20 percent limit. All credit institutions reporting a change in value (loss or gain) due to interest rate risk higher than 10 percent are required to submit a written description of the business features driving the result. The results of the stress tests are discussed in detail at the quarterly risk reviews with the major institutions. AC1. Based on the regulations 2007:4 FI has the power to obtain from credit institutions the results of their internal interest rate risk measurement systems, expressed in terms of the threat to economic value using a 200 basis points interest rate shock on the banking book. FI (as noted in EC3) uses a 10 percent change in value as a threshold alert to prompt further review and investigation. AC2. The FI regulation (FFFS 2000:10, Section 8, re risk measurement) governing management of market risks in credit institutions and investment firms stipulates that VaR models shall be evaluated and in Section 12 (re risk control) that risk models and price model shall be validated. Firms with permission to use internal VaR models to calculate Pillar 1 capital requirements for market risks also use the VaR-models internally also for Pillar 2 calculations of interest rate risk in the banking book. FI has undertaken inspections to determine that the major institutions have processes in place to regularly validate their VaR-models. Other credit institutions have not been priority assessments. FI considers that regulations are weak in respect of internal capital measurement systems of firms in regarding interest rate risk in the banking book. Even with the major institutions this aspect of interest rate risk has not been a priority and there has been no prioritized supervision in this area for other institutions. AC3. FI’s regulation on management of market risks in credit institutions and investment firms (FFFS 2000:10, Section 12) briefly covers the use of stress tests. FI does not explicitly require stress tests to be based on a reasonable worst case scenario including a breakdown of critical assumptions. However the prescribed stress test in (FFFS 2007:4) of a sudden parallel shift of yield curves by 200 basis points arguably represents a reasonable worst case considering the general low interest rate level in Sweden. Stress test results and impact on policies, processes and limits for interest rate risks are discussed in the quarterly risk reviews with the major institutions. AC4. FI’s regulation (FFFS 2005:1, Chapter 4) on governance and control of financial undertakings addresses, inter alia, independence of risk management of interest rate risk and reporting lines. However, there is no specific reference to or guidance provided with respect to mitigants available absent independent risk management function where the potential for conflict of interest exists. | ||||
| Assessment | Compliant | ||||
| Comments | Interest rate risk in the non-trading portfolio is an important risk facing the Swedish banking system. Formally, FI is compliant with this principle, but on a risk assessed basis, this risk has a claim to a higher priority than FI has, to date, placed upon it. An assessment of the adequacy of the risk control in this area by FI depends essentially on the effective integration of interest rate risk control into the market rate risk regime, which is intuitive but is not relevant for all institutions and needs to be handled with care for institutions with market risk capacity to ensure that the risk is explicitly identified and managed to appropriate standards. The extent to which firms are pressed on the credit risks is not clear and needs to be given higher priority. Given that FI itself considers that regulations are weak in respect of internal capital measurement systems of firms regarding interest rate risk in the banking book, remedy should be made to enhance such regulations. | ||||
| Principle 17. | Internal control and audit. Supervisors must be satisfied that banks have in place internal controls that are adequate for the size and complexity of their business. These should include clear arrangements for delegating authority and responsibility; separation of the functions that involve committing the bank, paying away its funds, and accounting for its assets and liabilities; reconciliation of these processes; safeguarding the bank’s assets; and appropriate independent internal audit and compliance functions to test adherence to these controls as well as applicable laws and regulations. | ||||
| Description | EC1. AC1. Under Sweden’s Companies Act (Chapter 8, Section 4) the Board is responsible for the company’s organization, management of its affairs and assessing its financial position on a regular basis. It is also responsible for ensuring that the company’s organization is structured so that accounting, management of funds and the company’s finances in general are monitored in a satisfactory manner. The CEO attends to the day-to-day management of the company pursuant to guidelines and instructions issued by the Board (Chapter 29). More details of the respective responsibilities of the Board and CEO are found in FI’s General Guidelines Regarding Governance and Control of Financial Undertakings (FFFS 2005:1) which, inter alia, addresses in separate short chapters “Governance: The Board’s responsibilities and duties; The Managing Director’s responsibilities and duties” (Chapter 2); “Internal governance and control” (Chapter 3); “Management and Control of Risks” (Chapter 4); “Compliance” (Chapter 5); “Independent Monitoring Function” (Chapter 6). (A CI’s Board consists of not less than three members, the majority of whom must be persons who are not employed by the institution and all must have “sufficient insight and experience to participate in the management of a credit institution” (BFBA Chapter 3, Section 2)). EC2. As respects internal controls dealing with: (I) organizational structure; (ii) accounting policies and processes; (iii) checks and balances: and (iv) safeguarding assets and investments, the FI largely relies on the work of a CI’s external auditor in formulating its determination on the existence and adequacy of performance of (ii) and (iv)—although it is not yet standard procedure for FI to receive a copy of the external auditor’s “management letter/internal control memorandum”—and targets (I) and (iii) itself in the course of on-site examinations (of which there were 9 focused exclusively on internal control during the period 2008-2010) using checklists drawn up for the purpose. In particular, FI determines if the organization is well defined and that all responsibilities are covered and in special areas such as Credit Risk covers, inter alia, credit granting levels and independence for credit control. Similar procedures are followed for market risk and operational risk. Principles of segregation of duties are also included in the assessment. EC3. The BFBA (Chapter 3,. Section2) sets out requirements that a Board (and CEO) must meet (i.e., the fit and proper standards). It is for FI to assess whether the Board (and CEO) meets these standards or not. This it does by assessing the Board and (CEO) against prescriptions in the BFBA, notably as under: “Chapter 6 General provisions regarding the business of credit institutions 1. A credit institution’s operations shall be conducted in such a manner that the institution’s ability to perform its obligations is not jeopardized. 2. A credit institution shall identify, measure, manage, internally report and have control over the risks associated with its operations. In such context the institution shall ensure that it possesses satisfactory internal controls. A credit institution shall specifically ensure that its credit risks, market risks, operational risks and other risks taken together do not entail that the institution’s ability to fulfill its obligations is jeopardized.” In its supervision, FI relies extensively on the quality of the ICAAP to assess a Board’s understanding of the CI’s risk profile as a deficient ICAAP has often signaled more substantial problems in risk management. EC4. AC4. Where Board members or the CEO are found to be lacking in having “sufficient insight and experience to participate in the management of a credit institution” (BFBA Chapter 3, Section 2) FI may order that that person no longer may serve as a Board member or CEO. However, FI has no power to require changes in the senior management, except the CEO and Deputy CEO. (NB: There is no requirement by law or regulation that a CI inform FI as soon as it becomes aware of any material information which may negatively affect the fitness and propriety of a Board member or a member of senior management. Nor does the FI require that it be so informed.) As with liquidity risk, FI notes that there is a general requirement under FFFS 2005:12 which obliges firms to report to FI when they are aware of an “event which may result in significant financial damage to a large number of customers or events which may result in significant badwill for the undertaking.” The examples cited in the general guidelines relate to technical failures in the institution and it is unlikely that firms would interpret this general guidance as being relevant in respect of assessing the performance of the Board or senior management. EC5. Determination of whether or not there is appropriate balance in the skills and resources of the back office/control functions vs. front office/business origination is assessed during FI on-site examinations when the risk management process is under scrutiny and the assessment is based on the CI’s size, nature and complexity of its activities. EC6, 7. 8. As noted in the second paragraph of this Description, FFFS 2005:1(Chapter 5) addresses “Compliance.” Generally, CIs are expected to have an independent compliance function (subject to type, scope and complexity of operations) or explain how they are addressing compliance risks in an alternative way. Existence of a permanent, independent and competent compliance function is assessed by on-site examination. Moreover, FFFS (2005:1) (Chapter 6) addresses the internal risk function (“internal audit”) makes the Board responsible to ensure that a function is in place which monitors and evaluates internal control (including the risk control and compliance function) and whose work is documented. This Independent Monitoring Function should possess sufficient resources for its duties. It should also have personnel who possess, inter alia:
The regulations contained in FFFS 2005:1 Chapter 6 thus require firms to ensure there is skill, resource and independence in place. The regulations are not explicit with respect to access and communication to all records and data for the internal audit function, its methodology, preparation of audit plan or authority to assess outsourced functions. AC2. AC3. FFFS (2005:1) has the function directly answerable to the Board, which determines its responsibilities, work duties and reporting routines. (Major Swedish CIs follow international best practice and have the function report to an audit committee, as a Board sub-committee. The audit committee includes experienced non-executive directors.) Regular meetings with internal audit are an essential part of FI’s on-going supervision of the largest banks and practiced in cases of smaller banks on an ad-hoc basis. FI judges the quality and competence of internal audit by examining its reports and the work done to follow-up implementation of recommendations. FI can also see if the audit has an established methodology to identify the CI’s material risks and that the audit plan is based on this risk assessment. The sufficiency of internal audit resources is assessed by reference to the size and complexity of banks’ operations. All on-site examinations concerning internal control contain an assessment of internal audit, including review of the annual audit plan and the underlying risk assessments. The audit report to the Board is also reviewed for frequency and content. | ||||
| Assessment | Largely Compliant | ||||
| Comments | As noted above (EC4), FI has no power to require changes in the senior management except the CEO and Deputy CEO. Moreover there is no clear requirement under law or regulation that a CI informs FI as soon as it becomes aware of any material information which may negatively affect the fitness and propriety of a Board member or a member of senior management other than a general requirement that could easily be misinterpreted by institutions. These are deficiencies, and in the case of power to require changes in senior management, that need to be remedied. It is not sufficient and is in any case directly inefficient for the supervisory authority to have to rely on indirect powers of suasion (i.e., pressure on the CEO and Deputy CEO) in order to effect the removal of other members of senior management. It is also recommended that FI routinely obtain a copy of the external auditor’s “management letter/internal control memorandum” and review this as part of their overall assessment of the supervised institutions. This is a straightforward and basic routine that would enhance the supervisor’s understanding of the control environment of the institution. The current dialogue with the auditing profession referred to elsewhere would be a good platform to raise this issue. Five of the eight Essential Criteria (ECs 2, 5, 6,7, and 8) for this Core Principle use the wording “The supervisor determines that…” in addressing the matters of (i) effective internal controls; (ii) a balanced front office/back office organization; (iii) effective compliance function; (iv) and (v) internal audit function. Comments in FI’s Self Assessment on those five Essential Criteria describe on-site examinations as being integral to supervisory processes in assessing CIs’ performance against the prescriptions of laws and General Guidelines (particularly FFFS 2005:1). Of 141 on-site examinations performed in the three calendar years ended December 31, 2010, there were 9 focused on Internal Control. However, FI management note that Internal Audit’s performance is frequently addressed in themed inspections that focus on, for example, credit risk or market risk, and that this is clear from the pre-inspection note to the CI. While accepting this point, the assessors would recommend that inspection reports include findings on all areas addressed (those areas found performing adequately would not require extensive text) rather than only those where issues are raised. As noted elsewhere (and as assessed under CP 20), the assessors believe that resources for on-site supervision are inadequate, particularly as regards those necessary for the assessment of institutions outside of the four systemic institutions. | ||||
| Principle 18. | Abuse of financial services. Supervisors must be satisfied that banks have adequate policies and processes in place, including strict “know-your-customer” rules, that promote high ethical and professional standards in the financial sector and prevent the bank from being used, intentionally or unintentionally, for criminal activities. | ||||
| Description | EC1. While the BFBA (Chapter 13) makes FI responsible for supervision in general of CI’s, the Money Laundering and Terrorist Financing (Prevention) Act (“AML/CFT Act”) (Chapter 6, Sections 1 and 2) makes FI specifically responsible for supervision of their compliance with legislation on the prevention of money laundering and terrorist financing. (Note, however, that FI is not active in criminal proceedings involving money laundering or terrorist financing. This responsibility rests with the Swedish Economic Crime Authority, the Swedish Prosecution Authority and the Police.) The AML/CFT Act (adopted March 15, 2009) implements EU Directive 2005/60/EC and the accompanying Commission Directive 2006/70/EC. FI issued its Regulations and Guidelines governing Measures against Money Laundering and Terrorist Financing (FFFS 2009:1) (“AML/CFT Regs/Guides”) May 15, 2009. The AML/CFT ACT and the AML/CFT Regulations/Guidelines contain, inter alia, requirements on internal governance and control, management and control of risks, customer identification procedures and customer due diligence (CDD) requirements, risk management, monitoring and reporting of suspicious transactions, record keeping and staff training, as well as protection against threats towards staff. EC2. CIs must designate a Money Laundering Reporting Officer (MLRO) and establish risk based internal procedures and policies to prevent money laundering and terrorist financing (see AML/CFT Act (Chapter 5, Section 1) and AML/CFT Regs/Guides (Chapter 2, Section 1 and 2 and Chapter 6, Sections 1 and 2)). These internal procedures include risk management, CDD routines (normal; simplified and enhanced); record retention; detection of unusual and suspicious transactions; the reporting obligation for suspicious transactions; staff training and protection against threats towards staff (AML/CFT Regs/Guides Chapter 3, Sections 1 and 2). The CI’s Board or CEO must appoint a MLRO who is responsible to provide information and monitor transactions pursuant to the AML/CFT Act (Chapter 3, Section 1, paras 13 and 5) and the AML/CFT Regs/Guides (Chapter 5 and Chapter 6. Section1.). The MLRO is also responsible for reporting to the Board or CEO. CIs shall thus monitor transactions and report suspicious transactions to the Police, the Financial Intelligence Unit (AML/CFT Act Chapter 3. Section1). At the Police’s request, all information needed in a money laundering/terrorist financing investigation must be provided promptly. EC3. FI’s General Guidelines regarding Reporting of Events of Material Significance (FFFS 2005:12) requires that CIs report to FI (a) events which may result in significant financial damage to a large number of customers and (b) events which may result in significant “bad will” for the CI (Section 5). Such events include those where; information provided in conjunction with customer transactions is erroneous or deficient; customer transactions are handled in an erroneous or deficient manner; errors arise in technical systems; or internal or external regulations are violated. FFFS 2005:12 also requires (Section 8) that “upon suspicion of any crime, the undertaking should file a report with the police authority or prosecutor.” Legislation and prudential regulations, however, do not require that CIs report to FI suspicious activities and incidents of fraud when they are material to the safety, soundness or reputation of the CI and indeed it is unusual for FI to receive reports of incidents of fraud and at its own admission has not investigated why there have been such infrequent reports. EC4. Under FFFS 2009:1 (Chapter 3, Section 1) it is the responsibility of a CI’s Board or its CEO to establish internal rules for measures against money laundering and terrorist financing, designating decision points regarding procedures, systems, training programs and guidelines (for internal control, compliance and internal information) made pursuant to FFFS 2009:1 (Chapter 3, Section 2) and including maintenance of CDD and record keeping procedures (FFFS2009:1 Chapter 3, Section 2 paras 1-3). AML/CFT policies must be established group-wide (FFFS 2009:1Chapter 3, Section 4). Each CI is required to make a risk assessment containing an analysis of its customers, products, services and other relevant factors for its operations such as distribution channels and geographical areas (FFFS 2009:1 Chapter 2, Section 3)). Risk mitigating CDD procedures and routines should be implemented. (Certain risk mitigating measures are already required by law, such as prohibition of anonymous accounts (AML/CFT Act; Chapter 2, Section 14) and conduct of businesses with shell banks (AML/CFT Act Chapter 5, Section 3)). The AML/CFT Act (Chapter 2) and FFFS 2009:1 (Chapter 4) requires a customer identification, verification and due diligence process (“normal,” “simplified” and “enhanced”), identification of beneficial ownership and appropriate record keeping. It also requires an on-going CDD program. The identity of the beneficial owner is to be checked both when the customer is a natural and a legal person (Chapter 2, Section 3, para 2 of the AML/CFT Act Chapter 2, Section 3 para 2). FFFS 2009:1 further states that a CI has to obtain reliable and sufficient information on a beneficial owner’s identity by means of public registers, relevant information from the customer or other information that it has received (Chapter 4, Section 9. para 10f). In addition, for legal persons the CI has to investigate the ownership and control structure (AML/CFT Act Chapter 2, Section 3, para 2). This is supplemented by FFFS 2009:1, which states that CIs must verify direct and indirect natural owners if the holding in the customer exceeds 25 percent and, as well, any natural persons exercising a determining influence over the customer (Chapter 4, Section 9, para 2). FFFS 2009:1 (Chapter 3, Section 2, para 4) also requires that a system or procedure shall be maintained so that the CI fully discharges its monitoring obligations (AML/CFT Act Chapter 3, Section 1 and FFFS 2009:1 Chapter 5, Section 1). In particular, the CI shall pay special attention to transactions considered to involve special risk for money laundering and terrorist financing (e.g., complex or unusually large transactions with no apparent economic or visible lawful purpose. The AML/CFT Act (Chapter 2, Sections 6-7) requires a CI to escalate to the next higher level decisions for entering into business relationships with high-risk accounts, such as those for politically exposed persons (PEPs), or maintaining such relationships when an existing relationship becomes high-risk, and to maintain procedures for enhanced CDD, including for PEPs (FFFS 2009:1 Chapter 3, Section 1). It is also required (AML/CFT Act Chapter 2, Section 13) that systems be in place enabling rapid access to information and that there be a records retention period of at least 5 years after the transaction, or for business relationships, five years after termination of the relationship. EC5. Unless circumstances dictate otherwise, a high risk of money laundering or terrorist financing is deemed to prevail for relationships between a CI and one located outside the EEA. (AML/CFT Act Chapter 2, Section 6). CIs must then use enhanced measures, including: a. obtaining sufficient information about the other party to be able to understand its activities as well as assessing the other party’s reputation and the quality of its supervision, b. assessing the other party’s controls to prevent money laundering and terrorist financing, c. documenting the respective institution’s responsibility for taking control measures and the measures that they each take. The AML/CFT Act (Chapter 5, Section 3) bars CIs from relationships with shell banks. EC6, 7. CIs are assessed in the course of prudential supervision against their compliance with FI’s General Guidelines Regarding Governance and Control of Financial Undertakings” (FFFS 2005:1) and FI’s General Guidelines regarding Reporting of Events of Material Significance (FFFS 2005:12). Events of abuse of financial services found by such supervision (or through reports of events of material significance) could lead to sanctions for breach against FFFS 2005:1 and/or FFFS 2005:12. In 2006, FI conducted a large survey of 133 financial companies which had to respond to approximately 80 questions concerning their AML/CFT policies and procedures. Through this exercise FI could assess the level of compliance and hence the risk of money laundering and financing of terrorism. Moreover, FI’s AML experts have performed focused AML/CFT inspections and closely worked with prudential supervision units on joint inspections (FI has three prudential supervision departments, Insurance and Investment Funds, Banking and Securities and Markets. At Markets there is a special unit with AML/CFT experts who support the other departments on AML/CFT issues. The unit also conducts thematic and specialized AML/CFT inspections). Results are as under:
FI may do off or on-site inspections and has power to compel production of—and obtain access to—all records, documents or information (BFBA Chapter 13, Section 3). There is a range of sanctions, including fines (see above), the power to remove a Board member or the CEO and, at the extreme, to remove a CI’s license. There are adequate powers of enforcement and sanction for failure to comply with or properly implement AML /CFT requirements (BFBA Chapter 15). EC8. (a) As noted in the second paragraph of CP 17’s Description, FFFS (2005:1) (Chapter 6,) makes a CI’s Board responsible to ensure that an Independent Monitoring Function (i.e., internal audit) is in place to monitor and evaluate internal control (including the risk control and compliance function) and whose work is documented. Risk management policies, processes and controls for AML/CFT would be a target for such an Independent Monitoring Function and its reports would be available to FI (BFBA Chapter 13, Section 3). 8. (b) FFFS 2005:1 (Chapter 5) also addresses “Compliance.” Generally, CIs are expected to have an independent compliance function (subject to type, scope and complexity of operations) or explain how they are addressing compliance risks in an alternative way. As noted in 2, above, a CI’s Board or CEO must appoint a MLRO responsible for providing information and monitoring transactions pursuant to the AML/CFT Act and the AML/CFT Regs/Guides. 8. (c) Neither laws nor regulations impose formal obligations on CIs regarding screening procedures to ensure high ethical and professional standards when hiring employees. 8. (d) CIs must have effective internal information and communication systems and they have to offer an employee-training program regarding AML/CFT matters (FFFS 2009:1 Chapter 7, Section 1). The training must give all employees dealing with relevant areas of concern a sound AML/CFT education and be adapted to the specifics of operations. Employees must be kept informed of changes and developments in AML/CFT regulations and on new methods for money laundering and financing of terrorism. EC9. Through the licensing process and later through off and on-site inspections, FI determines that a CI’s Board or CEO has established internal rules for measures against money laundering and terrorist financing (FFFS 2009:1 Chapter 3, Sections 1 and 2). Inter alia. a CI must maintain a system or procedure for its monitoring obligations (AML/CFT Chapter 3, Section 1 and FFFS 2009:1 Chapter 5, Section 1) and have efficient communication systems or procedures for transmission of internal information so that relevant knowledge obtained from the monitoring and reporting of suspect transactions is reported continuously to the relevant business areas (FFFS 2009:1 Chapter 8, Section 2). On-site inspections are at a low frequency, although plans for off-site reviews are increasing. Including banks, investment banks and credit market companies, FI has carried out 6 on-site inspections in 2007, 2 in 2008, 3 in 2009 and 7 in 2010. No on-site inspections were planned for 2011 in the banking field at the time of the assessors visit. EC10. A natural or legal person providing information in accordance with reporting requirements in the AML/CFT Act may not be held liable for having neglected professional secrecy if the natural or legal person had cause to anticipate that the information ought to be provided. The same also applies to a director or employee who provides information on behalf of the natural or legal person (AML/CFT Act Chapter 3, Section 5). EC11, 12. If FI has, via its inspection procedures or otherwise, discovered a circumstance that may be assumed to be related to or constitute money laundering or terrorist financing, it must immediately notify the National Police Board (AML/CFT Act Chapter 3, Section 6). FI has regular information exchange with other national authorities such as the Financial Intelligence Unit (FIU), the National Economic Crime Bureau, the Tax Authority, Security Police and others. These other national authorities maintain international cooperation within their responsibilities. A special coordinating body has been established for supervision relating to the AML/CFT Act and comprises representatives from; FI, the Swedish Board of Supervision of Estate Agents, the National Gaming Board, the Supervisory Board of Public Accountants, the Swedish Bar Association and three county administrative boards. The coordinating body is to work to promote efficient collaboration between the supervisory authorities and the National Police Board as regards the obligation of parties engaged in activities to provide information and, as well, the supervisory authorities’ notification obligation. (Ordinance on Measures against Money Laundering and Terrorist Financing Sections 13-15). FI shall provide any and all information that a competent authority in an EEA state requires for its supervision (BFBA Chapter 13, Sections 6a and 8). The Public Access to Information and Secrecy Act (Chapter 8, Section 3) governs information sharing with competent authorities both inside and outside the EEA. For states inside the EEA, FI is obliged to share information. For states outside the EEA, Sweden must—in each case—assess (i) whether the information in a corresponding case would be disclosed to a Swedish authority and (ii) whether it is clear that a disclosure, according to FI’s review, to the foreign authority or international organisation is in Sweden’s interest. | ||||
| Assessment | Largely Compliant | ||||
| Comments | Laws and regulations are in place requiring that CIs have in place adequate policies and processes (including strict “know-your-customer” rules) to promote high ethical and professional standards in the financial sector and prevent CIs from being used, intentionally or unintentionally, for criminal activities. Notably, however, there is no formal obligation imposed on CIs that they implement screening procedures to ensure high ethical and professional standards when hiring staff. Legal and regulatory requirements have been reinforced by use of seminars sponsored by either FI alone or in conjunction with the FIU. FI satisfies itself—and periodically confirms—that CIs have installed adequate policies and processes sufficient for their scale of operations by use of its AML/CFT Markets unit. CIs are not required to report to FI suspicious activities and incidents of fraud whenever they are material to the CI’s safety, soundness or reputation and indeed the text of FFFS 2005:12 (Section 8) directs the CI that “upon suspicion of any crime, the undertaking should file a report with the police authority or prosecutor.” Again, as with CP14 and CP17, greater specificity is needed in terms of regulations so that it is clear to institutions that they should report incidents of fraud or suspicious activities when they are material to the safety and soundness of the institution. FI itself notes that it is unusual to receive notifications and has yet to investigate the cause of this low incidence. Finally it is recommended that FI requires institutions to differentiate their approach on the basis of dedicated risk assessments that go beyond a geographic criterion. Such differentiation is justified in terms of risk discrimination and would also be consistent with the Financial Action Task Force (FATF) preference that there should be no automaticity in treating all relationships within the EEA as equivalent (EC5). | ||||
| Principle 19. | Supervisory approach. An effective banking supervisory system requires that supervisors develop and maintain a thorough understanding of the operations of individual banks and banking groups, and also of the banking system as a whole, focusing on safety and soundness, and the stability of the banking system. | ||||
| Description | FI has adopted a risk based approach to supervision. In practice there are two stages to the risk approach. The first stage differentiates between firms in order to identify which firms will be subject to a closer and more intensive form of day to day supervision (“ongoing supervision”). For other firms, supervisory contact and processes are more limited, and focuses on the annual Pillar 2 process (submission of ICAAP and supervisory evaluation—SREP) as well as monitoring of returns. The major four banking groups are subject to ongoing supervision as are some of the smaller institutions. Ongoing supervision includes, at a minimum, a more intensive approach to the SREP and also a program of quarterly risk review, and regular contact with internal audit. Also as a part of its risk based approach, FI carries out a RAP in order to generate a risk profile for each supervision department and a combined risk profile for FI. The risk assessment is a method of prioritizing risk in each area and acts as a basis for discussion of planned supervisory activities and resources that are in addition to the baseline of normal supervisory activity that is conducted by FI. The purpose is to focus on specific risks that have been identified and that are not covered in the context of continuous supervision. The RAP is used explicitly as a tool for prioritization, not an estimate of the impact should the risk materialize. The risk profile that each department creates is divided into risks relating to consumers, financial stability and risks more generally relating to confidence or efficiency. The risk assessment meeting—i.e., the internal FI meeting—takes place twice a year. Once in September prior to the Risk Report and again in April. The risks assessment meeting takes place with the Chief Economist Unit (CEU) (see EC2), which then summarizes the complete risk picture and proposes a prioritization for FI as a whole which is discussed, together with resource allocation, by the management group, headed by the Director General. The most important risks are publicly disclosed in the “risk matrix” published in the Risk Report. EC1. The risk profiles for all supervised firms are monitored and the supervisory approach is tailored depending on the risk profile of the institution. The methodology is predominantly based on the SREP to which all firms are subject and which is the annual supervisory assessment of a credit institution’s Pillar 1 and Pillar 2 capital needs. Firms subject to “ongoing supervision” will have a more developed program of supervisory contact and analysis (noted above and also in CP20), but risks in and to firms that are not subject to “ongoing supervision” will be evaluated predominantly through the SREP. FI’s internal method for the SREP is described and published on the website of FI. Guidance is also available for firms in preparing their ICAAP document which must be produced annually and forms a major component of FI’s assessment. The recent financial crisis has caused FI to place enhanced focus on capital adequacy and capital planning using stress testing. FI conducts its own scenario analyses or stress tests in order to assess the institutions’ analyses and assessed target level of capital needs. There is also increased focus on liquidity risks and the interaction between liquidity and capital. The SREP is designed to assess whether an institution has taken measures to ensure a sound management of its risks and the adequacy of its capital resources to meet these risks. In its review, therefore, FI seeks to determine whether the arrangements, strategies, processes and mechanisms that the institution has implemented are adequate to its needs. An additional component of the risk evaluation for the banking groups that active on a cross border basis is the joint assessment of the banking group’s profile through the supervisory colleges which FI chairs in the case of the four major Swedish banks. College activity in respect of risk evaluation is performed through exchange of information, national ICAAPs, meetings within the college and meetings with the bank in question. In 2010, the Committee for European Banking Supervisors (CEBS), which was the forerunner of the European Banking Authority (EBA) carried out a review of the functioning of a number of EU colleges including two of the colleges chaired by FI. Each college was assessed as fully compliant with essential standards which included whether college members shared, coordinated and discussed their risk assessments and whether there was a balanced, two-way and cooperative process involving all college members. FI participated in pilot study in 2010 to perform a bottom up joint risk assessment in a supervisory college and has adopted guidelines issued by CEBS on how to proceed with joint risk assessment. The Assessors were able to review some of the joint assessment reports which appeared to be well structured and although high level, to have considered all material aspects. EC2. The (CEU) at FI has the main responsibility of monitoring and analyzing the overall risks to the financial system and macro prudential risks. The CEU has been expanded in the past years and comprise currently ten analysts. The CEU participates in the (bi-annual) risk assessment meetings with all three FI departments (Bank, Insurance and Markets) to make sure that macro prudential perspectives are considered, and also authors the macroeconomic chapter in the annual Risk Report, which like similar publications in many other EU jurisdictions, highlights the risks that FI considers to be the most serious in the financial sector. To enhance this function, and to ensure the overall quality of its risk analysis, FI has hired three professors on part time as academic advisors. Furthermore, in each Risk Report a panel of 4-6 internationally distinguished professors gives their view on macroeconomic risks and the regulatory developments. Externally, the CEU participates on behalf of FI in the BCBS main committee, the Advisory and Technical Committee under the European Systemic Risk Board, and the Nordic Baltic Stability Group. The CEU normally participates in the “4-part” stability meetings with the other authorities, and exchanges continuously views and reports with the RB. EC3. The new RAP, described in the introduction, replaces an older classification of firms and products into risk categories and is intended as a continuous bottom-up process, where each supervisory department assesses—both in terms of probability and potential impact on both the stability and consumer protection dimension—the risks within its industry. As such, the RAP is not of itself an assessment of the risk profile of individual institutions or banking groups, but it is used as an input in establishing individual risk profiles for credit institutions and the SREP. The RAP is the primary vehicle for prioritizing supervisory work within FI. The methodology for conducting the underlying risk analysis that feeds into the RAP is not documented but is carried out by skilled and experienced staff. EC4. In order to determine compliance with prudential regulations and other legal requirements, FI conducts offsite review of a range of data sources. In addition to regulatory returns, and ad hoc data requests (e.g., regarding sovereign exposures or liquidity positions), for the systemic and larger firms subject to the process of “ongoing supervision” there is review of board minutes, risk management policies and processes are assessed and reviewed annually as part of the SREP for all institutions. Both on-site examination, where this takes place, and SREP processes review minutes from management committees, reports from internal audit, onsite checks will include interviews with management and staff in risk management functions and will address, inter alia reporting lines. The on-site and SREP examinations also review policies and instructions which internally regulate reporting and examples of reporting. Size, composition and quality of exposures are reviewed. On-site examinations will include meetings with internal audit. Input to the annual assessment or review is both the ICAAP from the institutions and their annual reports in which they have to publicly release information about:
EC5. Credit institutions are expected, according to the General Guidelines regarding Reporting Events of Material Significance (2005:12), to report events that may jeopardize the stability of an undertaking or the protection of customers’ assets (“events which may result in significant financial damage to a large number of customers or events which may result in significant badwill for the undertaking”). This guideline is also referred to above (CPs 14, 17, and 18) and does not impose an obligation on a firm to report a material change that does not have an expected adverse impact or outcome. Hence this criterion is not fully met. FI has the mandate to issue binding regulation on this matter but as yet has not done so. For the major firms, ongoing supervision is based on frequent contact—which includes but is not limited to the major quarterly risk review meetings (e.g., 30 supervisory contacts took place in 2010 for one of the systemic firms) ensuring that the supervisor is aware of significant developments in a timely manner and promoting a dialogue in which the institution can raise any concern at an early stage. However, there are no obligations on firms to notify FI of substantive changes in their activities, structure or overall condition. EC6. Data submitted to FI comprises standard prudential information and ad hoc reporting. For the systemic sector in addition to prudential returns, there is a strong reliance on individual bank management information data, ad hoc reporting and non-standard reports that the banks agree to submit. The major institutions also submit packages of risk focused information in relation to the quarterly risk meetings and present and discuss this information (including stressed assumptions) at the meetings. Internally within FI there is ongoing development of IRB reporting models to promote stronger in depth and peer analysis although some technical difficulties are being experienced. FI is currently assessing its data needs and internal data manipulation in respect of smaller financial institutions in particular in order to generate a key set of indicators for this sub sector. The Assessors saw packages of new reports which are still in trial phase but which will assist the monitoring of trends, permit the identification of outliers, peer group analysis and the possibility of interrogating the soundness and strategy of smaller firms’ business models. The material is not intended as a comprehensive company analysis but to perform an analysis that permits FI to identify the need for further investigations. Thematic reviews and focused investigations (e.g., trading book evaluation and liquidity risk) demonstrate one aspect of how FI organizes its follow up activity. AC1. An FI management priority is to deliver proactive supervision. To support this objective the CEU, together with analysts at the banking department, undertakes continuous analysis and stress testing of credit institutions. The RAP and the supervisory process are intended to deliver early identification of risks and to ensure a proactive stance towards supervision. Various information and indicators, such as on household indebtedness, credit growth, and sector exposures, are used to assess long-term risks for individual banks and the system as a whole. The new templates for liquidity reports from the credit institutions are being finalized and are considered to be an important component of forward-looking risk assessment in the near future. | ||||
| Assessment | Largely Compliant | ||||
| Comments | The purpose of CP 19 is to identify whether the supervisor adequately develops a thorough understanding of the individual banks, banking groups and the system as a whole. In this context, FI’s approach to supervision has a logical, risk sensitive foundation, focusing the majority of the supervisory effort and resource on the major systemic banking groups. The stated priority for FI is to be forward looking and proactive in all of its supervisory activities. FI is faced with a balancing act, however. The challenge with both the major and smaller institutions is to ensure that significant risks do not emerge that could undermine the Swedish banking system. In the case of the larger institutions, individual institutional weakness might be sufficient to precipitate a systemic crisis for Sweden or beyond. For the secondary tier, which represents nearly one third (30 percent) of the banking sector in terms of domestic loans to the public, there is a non-trivial tail risk that problems could emerge potentially causing loss of market confidence or creating a reputational risk for FI itself, in particular given its mandate for consumer protection. It is accepted that many of the smaller firms have very small individual market share and are not engaging, for the most part, in wholesale or market activities but experience in other jurisdictions has taught that it is unwise to underestimate the capacity for contagion risk to spread through such sectors when weaknesses in one or more small institutions becomes known. This is possible even where there are no financial or business relationships between the institutions themselves. Given the challenges thus facing the supervisory authorities, remarks fall into three main areas: resources, coverage and intensity of supervisory approach and analytical techniques. Resources In comparison to international peers the supervisory resource devoted to systemic institutions, even taking into account risk specialist staff also available, is low. Staff numbers available for the banking division is (70 positions) is low in relation to the size of the banking sector where consolidated assets of the four major groups alone represent nearly four times GDP. Although FI is able to dedicate a relationship manager to each systemic firm there is no scope to create individual teams for each of the major banks which would be in line with best international practice. The line side staff are supplemented and supported by specialist risk units, which is consistent with international good practice. In this context, FI is fortunate to have a cadre of highly experienced and skilled staff both on line side and in risk units But FI has almost no strength in depth and is highly vulnerable to losing staff, in particular in the specialist risk sections. The turnover rate for staff is at 15 percent and FI has lost the majority if not all of the staff who had implemented the Basel II (CRD) regulatory package. The loss of corporate memory and experience from such a major regulatory process is a significant blow in terms of FI’s capacity to deliver effective ongoing supervision. Any distraction from supervisory activity by staff, in the context of such limited resource, can translate into a risk to financial stability if risks are not identified in a timely manner and addressed before they become material. The Assessors note that the banking division does not have a pure focus on supervision as it has the dual objective of consumer protection. According to FI estimates, active supervision falls within the range of 45 to 65 percent of staff activity. Coverage and intensity of supervisory activity Limitation of resources manifests itself in many ways, and for FI this is acutely visible in the restricted ability for FI staff to spend time on-site with firms. (Discussed also in CP 20). Lack of ability to spend time onsite impairs FI’s ability to deliver its desired proactive approach, have adequate contact across the full range of firms and penetrate “below the skin” of the most significant institutions. At present supervisory planning processes focus on negative indicators that have been identified as potential sources of concern, but the ability to spend adequate time on site would allow for more effective ability to provide preventative rather than remedial supervision. For example, the assessors noted that in a number of recent cases weaknesses were identified due to the supervisor being alerted to an issue by the institution itself or by a third party. This is not true in all cases, but even where FI had identified clear weaknesses and agreed a remedial program FI’s ability to maintain pressure in its follow up supervisory activity was on occasion considerably delayed and impeded by the need to devote resources to competing priorities and tasks. In general therefore, FI’s supervisory responses were typically well thought through but reactive to a specific deficiency or weakness that had come to light. In addition it is noted that during 2010 FI was unable to complete its annual supervisory process for all institutions (SREP). Although the 15 percent of SREPs that were not completed were of very low risk institutions, it is indicative of pressure on resources, and represents in itself a riskindicator for FI. Analytical techniques FI does not have a formalized, analytical risk framework that might be used to assess the risk profile of an institution, e.g., a “RATE” process of some form (“Risk assessment, tools of supervision, evaluation”). For both systemic and secondary institutions, FI uses approaches built on the Basel “Pillar 2” framework, whereby the firm submits its own assessment of its capital needs (ICAAP) and the supervisor performs an evaluation (SREP) the results and conclusions of which are fed back to the firm. FI differentiates the scale and intensity of its approach proportionately to the institutions. Pillar 2/SREP is, however, a supervisory technique designed to assess capital adequacy. Other elements of risk are touched on, but the SREP was designed to assess whether a firm has adequate capital to its risk profile. FI’s own guidance on how to perform a SREP adopts a capital adequacy focus also. A SREP process can, of course, be used to examine a wider range of risks and factors (e.g., environmental—such as economic and competitive environments; business model risks and controls; oversight and governance risks), many of which are strongly relevant to assessing capital adequacy, for example risk management. But the SREP process, or the EU joint assessment process (which is a SREP process applied to firms active cross-border) will not automatically create a platform for the effective review of the wider risks a supervisor needs to assess. In reviewing work performed under the SREP process the assessors are satisfied that the actual approach taken by FI is more broad ranging than a “pure” SREP would require given that in terms of the inputs it receives and the outputs that reflect its analysis, the SREP is not limited to a narrow capital perspective for the larger or smaller firms. This reflects well on the quality of the staff. For the systemic firms there is the wider supporting framework of regular “on-going supervision” for the SREP. The assessors consider that intensity and intrusiveness in the contact with the firms needs to be enhanced so that information provided and presentations made by the firm are rigorously challenged and in particular that firms are put under direct pressure to rectify identified deficiencies according to a specified and tight timetable. For the non-systemic firms the SREP is the main focus of supervisory activity for the secondary banking sector and is frequently the only contact with the institution in a year. FI’s self assessment to the BCP made it clear that all supervisory risks for the smaller institutions are intended to be identified and assessed in the context of the SREP. It was harder to assess the degree of achievement with respect to the smaller institutions but discussions with the supervisors made it clear that they were not focused on purely capital outcomes, but had a broader assessment. FI are strongly advised to formalize and document their analytical risk assessment practices (not limited to specialist areas such as model approval). This task will create assurance, going forwards, that risk assessment is consistent between institutions and over time. It creates a baseline that FI can improve in the light of its own experience and international developments. Furthermore, it provides some protection to FI against the loss of skilled staff, which might mean that FI could become unable to maintain such standards or to replicate processes and assessments that it has undertaken in the past. This formalization of analytical technique and supervisory process can build, or “wrap around” existing use of SREP and associated standards, but a supplementary framework to the SREP is needed. | ||||
| Principle 20. | Supervisory techniques. An effective banking supervisory system should consist of on-site and off-site supervision and regular contacts with bank management. | ||||
| Description | EC1. “Ongoing supervision” (in the definition used by FI) is performed on the four large banks and on some of the smaller institutions depending on a risk-based prioritization. The greatest intensity of supervision including the most significant elements of on-site supervision is focused on the four major banking groups as noted elsewhere. The main supervisory activities for the major groups and some of the smaller institutions that generate on site activity are: 1) ongoing supervision, 2) SREP, 3) thematic investigations; and 4) ad hoc inspections. 1) Ongoing supervision for firms that FI deems to be risk priorities contains the highest levels of systematic on-site contact. For firms not deemed to be a risk priority, the majority of the ongoing supervisory activity will take place through off site analysis. An annual meeting with the institution for such low risk firms would be typical. For the major firms and firms deemed to be of higher risk, off site analysis is complemented with:
2) For the four major institutions the SREP is conducted jointly with the members of the supervisory college. Most work during the assessment will be off site but meetings are held as necessary, particularly at the outset and closing of the process. The college of supervisors, led by FI reaches a joint decision which is then jointly communicated to the firm. Time spent conducting a SREP for a large bank is approximately 3-4 months. For the smaller credit institutions, the SREP is performed either as a:
The total number of smaller institutions that will perform an ICAAP, based on which FI will perform a SREP, is approximately 300. In 2010 FI performed 85 percent of the SREP reviews. 3) Thematic investigations on a specific topics in the banking sector include and investigations driven by CEBS. The review of the valuation practices in the trading book and the planned reviews of liquidity risk are further examples. 4) Ad hoc investigations range from a quick off site investigation to a full investigation on and off site. Time spent on-site will naturally vary but rarely exceed 3-4 days. Investigations are typically triggered reactively through analysis of prudential or other market related data. EC2. The RAP, performed three times a year is the basis for planning of supervisory activities. There is a clearly articulated process for planning, executing and assessing any specific supervisory activity, ranging from initial planning through to final evaluation (including areas of assessment, data and resource needs, data verification, analysis, identification of sanction/remedial activity as necessary). Should sanctions be required there are further clearly documented processes to be followed. Onsite and offsite inspections/investigations are often performed by the same experts within FI so planning and coordination is integrated within the overall process. EC3. Despite limitations in terms of staff numbers, FI does not normally rely on external experts for on-site inspections, although it has the power to commission reports from external experts. On-site inspections are used to:
As indicated above, the majority of systematic on-site activity takes place with the major firms, so for smaller institutions, on-site examination would be more likely to be in response to a broader system wide investigation or weakness, discrepancy, or deficiency identified in the course of off-site analysis and review. It is unlikely that the degree of on-site work that is possible for FI to conduct is sufficient to determine that information provided by banks is reliable overall. FI is reliant, for the most part on the annual audit process to obtain comfort on the quality of the data it receives. EC4. FI conducts regular analysis on bank specific and system wide basis and reports are both regular and ad hoc. All reporting by banks feeds into FI’s RAP. Shifts in trends or key indicators are signals that FI uses to determine where follow up supervisory activity will be needed. FI is currently enhancing the data indicators it is using in the smaller firm sector. Regular analytical reports include (list is not exhaustive):
Areas that will be covered by ad hoc analysis are basically any areas of supervisory interest, and have recently included items such as exposures to vulnerable European countries, and impact of Basel 3. EC5. Contact with the Board and senior management is primarily within the context of ongoing supervision of the four large banks and some of the smaller credit institutions. For the systemic institutions the Director General of FI will meet at least annually with the Board. A review of regular contact and documents prepared to support the major regular meetings between FI and the major firms and some of the smaller institutions indicates that the supervisor has structured and regular contact to make an assessment and develop an understanding of a range of supervisory issues and risks. The senior management of FI also maintains a relationship with the major institutions at the most senior levels but this does not form an integrated part of the supervisory process. EC6. The most specific assessment of the Board and management takes place when the individuals take up their duties. On an ongoing basis FI relies largely on scrutiny of board minutes for the firms which are subject to “ongoing supervision.” FI will pursue follow up activity if it identifies signals of potential problems with management and internal control. The quality of banks’ ICAAP and reporting to FI are seen as significant sources of information for such signals.. FI has the legal power to replace board members, CEO and deputy CEO, in cases where they are no longer fit and proper. EC7. Meetings with internal audit are seen as an important routine aspect of supervisory contact with the firms subject to “ongoing supervision.” FI seeks to assess quality of the work, management and competence of internal audit through this regular dialogue and by examining the reports, work program and risk analysis that IA submits to the credit institution.EC8. For the firms within the “ongoing supervision” program, there is regular contact and communication in addition to the annual SREP (e.g., as noted above 30 supervisory meeting contacts with one of the systemic firms were recorded in 2010). For other institutions the SREP process will contain the major written communication from FI during the course of the year. Where a firm has been subject to a specific supervisory investigation, FI meets with the management of the credit institution to discuss the outcome of investigation and future areas for follow-up.AC1. FI meets, on a regular basis, with management. Meetings with the board of the credit institutions have so far been on ad-hoc basis. For firms subject to “ongoing supervision” FI has a regular program of meetings with senior management at which results of supervisory examinations are discussed. Meetings with the board are held from time to time, on ad-hoc basis. FI has started a new routine for more systematic meetings between the credit institutions’ boards and FI’s senior management. FI places emphasis on the initial vetting process for board members to ensure that they have an appropriate mix of skills and a good understanding of the risk profile of the credit institution on whose board they serve. FI does not meet separately with independent board members, and does not deem this to be necessary. In the Swedish system, FI notes that most board members are independent. | ||||
| Assessment | Materially Non Compliant | ||||
| Comments | CP 20 tests the balance of onsite and off-site supervision in delivering effective supervision. The assessors identified weaknesses in seven core principles (risk management, credit risk, problem assets, market risk, liquidity risk, operational risk and internal audit) on the basis that FI is unable to satisfy itself that firms are complying with minimum standards in these areas. In each of the core risk and risk control areas of that are assessed in the principles, the assessors determined that there were inadequate levels of on-site supervision and inspection. Limitations with respect to on-site activity are noted in the relevant risk areas but the impact of the limitation is reflected in the rating of this principle only. It should, also be noted however, that it is in any case difficult for a relatively small supervisory agency such as FI, always to ensure that it has sufficient expertise located in house. There are larger supervisory agencies in the EU that have admitted they have lacked specialized expertise in particular cases. In the discussion below on CP 21, it is noted that FI is now considering the potential for some use of external expertise. FI needs to ensure a proper supervisory coverage. Hence staffing budgets need to be increased or use is made of external experts. In both cases costs will accrue, directly, or indirectly to the supervised institutions. The supervisory staff at FI place a very high value on the importance of on-site supervisory work and the need to devote time to the institution in order to assess more than the superficial workings of the institution. FI has already shifted its strategy and priorities in the past two years in order to create a strengthened focus on on-site supervision to the extent possible and this is a significant development without which further progress could not be possible. Coming from a low level there has been a marked increase in on-site activity. FI is also fortunate to have in its staff a high proportion of skilled and experienced personnel. In the context of restricted resource FI has created a process to ensure that the maximum available resource is spent on the institutions representing the most significant risks. Nonetheless, it is gravely questionable whether the on-site work conducted, while valuable and of high quality, to the extent that the Assessors were able to determine from reviewing the inspection mandates and reports, is sufficient to match the scale and complexity of the demands presented by the major firms which are systemically significant not only to Sweden but to the Nordic region and in one case could be considered to be globally systemic. FI’s ability to provide a minimum consistent, much less systematic, level of coverage of the secondary banking sector (i.e., all but the four largest institutions) is even more in doubt. Challenges are different in this sector. Some institutions have complex or idiosyncratic features, and second tier banks may have fewer or less sophisticated resources of their own to employ in risk control functions when compared with the systemic firms. Lack of ability to conduct adequate levels of onsite supervision may contribute to a buildup of risk which may not become evident until an institution has failed or is at risk of failing. It would be inappropriate to address this identified risk by drawing already scarce resources away from the supervision of systemic banks. Instead this issue puts further pressure on the need for a significant increase of staffing. Irrespective of potential to increase resource, it is also important for the supervisory authority to be creative in developing “resource effective” approaches to be used vis-à-vis smaller institutions. FI is already making some progress in this respect with greater attention being paid to data analysis including peer group assessment and the initial consideration being given to use of external auditors. Additional measures that could be considered (or re-considered as appropriate), include wider use of external experts, enhanced reporting requirements, self assessments by the industry and higher financial buffers. In view of these expressed concerns, the assessors strongly welcome the statement by the Ministers of Finance (letter of May 18, 2011) that the government will propose in the Budget Bill of 2012 a substantial increase of resource for FI over a period of three years. FI has a policy of ensuring that the Director General and relationship manager have Board level meetings on an annual. The relationship manager meets with senior management of the institution on a quarterly basis to discuss outcome of the most recent results. This discipline is good and greater bilateral contact between the systemic firms and the most senior levels of FI management should be increased. In order to be effective the dialogue between FI senior management and FI staff must also be maintained so that there is sufficient input from staff, and/or proper follow up to senior level contact with firms. In particular FI should increase its levels of contact with the non-executive Board members in order to obtain their independent view on the effectiveness of senior management and the CI’s business model, strategies as well as, of course, in order to assess the quality of these Board and hence the quality of the overall Board itself (as required by EC6). FI should also consider enhancing, systematically, its contact with external auditors. Such contact provides an opportunity to challenge Board strategy and probe business direction and risks, which is an essential component of effective supervision. Furthermore, FI the effectiveness of all supervisory activity with a firm is improved when the firm recognizes that it is under scrutiny from the most senior level of the supervisory authority. In this context it is welcome that FI indicated to the assessors that it is strongly committed to giving formal recognition to the working relationship between senior management of FI and the senior management of major institutions in its description of its supervisory practices. | ||||
| Principle 21. | Supervisory reporting. Supervisors must have a means of collecting, reviewing and analyzing prudential reports and statistical returns from banks on both a solo and a consolidated basis, and a means of independent verification of these reports, through either on-site examinations or use of external experts. | ||||
| Description | EC1. The BFBA, BO, and CALE Ordinance authorize FI to require CIs to submit information on both solo and consolidated basis. FI’s regulations require CI to submit information on performance, financial condition, capital adequacy, risks, etc. at regular intervals (normally quarterly). Information collected through regular reports comprises:
These reports, with few exceptions, are submitted to FI quarterly on both solo and consolidated (group) basis. With respect to market risks, only interest rate risk is captured through quarterly regulatory reporting. For market risks such as equity, currencies, commodities, etc., FI evaluates the risks when conducting the annual SREP. This is infrequent when the volatility of such data is considered. The inputs for FI’s assessment are gathered from CIs’ own ICAAPs, and from their annual reports. However, for firms subject to “ongoing supervision” there are quarterly market risk reviews and there is also special reporting for those market risks that are captured by VaR models which FI has approved. There is no reporting of related party transactions, save for a category “Group receivables” shown on the balance sheet in the Standard Report. Although there is rudimentary geographical break-down of deposits and lending in the supervisory reporting (Swedish vs. non-Swedish counterparties) there is no FI-mandated granular reporting of CIs’ asset concentrations by geography or currency. (For the four systemic institutions, the latter information is—in most cases—included in their annual reports and is also an important input for the annual SREP assessment.) EC2, 3. According to FI’s regulations governing the reporting of interim and annual report data (FFFS 2008:14) information in the standard prudential report shall correspond to a CI’s annual and interim statements. There are no other instructions. For CIs, annual financial statements, interim financial statements and consolidated financial statements have to comply with the accounting regulations in the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559) which, together with FI regulations, implements the Bank Accounting Directive (BAD), 86/635/EEG. The Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559), refers to a great extent (mainly related to accounting issues not specific for financial institutions) to paragraphs in the Annual Accounts Act. The latter Act applies to companies in general, and is the result of the Swedish implementation of the fourth and seventh EC Company directives on annual accounts and consolidated accounts. Under the Annual Accounts Ordinance for Credit Institutions and Securities Companies (1995:1600) (Sections 4-8) FI may issue binding regulations in the accounting area and has done so to:
According to FI’s Regulation regarding annual accounts for Credit Institutions and Securities Companies (FFFS 2008:25), CIs shall in the annual financial statements for entities on a solo basis apply international accounting standards (IFRS) approved by the EU if nothing else is required by laws (the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559)), other regulations or FFFS 2008:25. The Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559) does, for example, require a specific format for the income statement and the statement of financial positions. According to FFFS 2008:25, CIs shall in their consolidated financial statements apply international accounting standards (IFRS) approved by the EU. The IASB Framework (September 2010) sets out the concepts underlying preparation and presentation of financial statements under IFRS: Relevance; Faithful Representation; Comparability; Verifiability; Timeliness and Understandability EC4. According to FI’s regulations, almost all supervisory reports are submitted quarterly and FI is comfortable in its assessment that such reports contain information sufficient for analyzing and assessing developments in large as well as small CIs. In cases where a more frequent reporting would be helpful, FI has specifically required it from a CI (e.g., daily reporting from one CI in autumn 2008). The information submitted includes standardized prudential statistics used by FI and SCB (Statistics Sweden). The Standard Report consists of a balance sheet and an income statement. Specifications in the report include details of, for instance, lending, deposits, nonperforming loans, credit losses, loan loss reserves and a breakdown of the most important lines in the income statement. EC5. According to FI’s regulations, CIs are required to submit information on solo and group level. The data relates to the same dates and periods in order to make meaningful “peer group” comparisons between different CIs or financial groups on key indicators and to track performance over time. Information that is required from branches of foreign banks is less extensive than the information required from CIs where FI is “home” supervisor EC6, 7. Besides regular supervisory reporting, there is no limit to the information that FI can request on any part of a CI’s activities (BFBA Chapter 13, Sections 3 and 5 (“where a credit institution is part of a group, the other undertakings in the group shall provideany and all information regarding operations and related circumstances as the Supervisory Authority requires for its supervision of the institution”) and CALE 2006:1371 Chapter 10, Section 7). Such information is used to get a broader and deeper knowledge of a CI’s situation on a solo or group basis. FI has the power of full access to a CI’s Board, including power to convene a meeting of the Board (BFBA Chapter 13, Section 12). Moreover, the BFBA (Chapter 16, Section1 and 5) provides that either the government or an authority determined by the government may issue regulations regarding information that a CI shall provide to FI for its supervisory activities. Pursuant to the BO (Chapter 5, Section 2) regulatory authority on this matter devolves to FI and could be used as needed. EC8, 9. To start reporting supervisory information to FI, a CI must first identify the person responsible at the operational level for such reporting and to whom FI’s questions regarding submitted information may be addressed. (However, ultimate responsibility for the CI’s compliance with all applicable legal requirements, including supervisory reporting, rests with the CI’s Board.) BFBA and CALE give FI authority to impose fines for late reporting. Fines are levied (2009: 14 fines; 2010: 2 fines) and publicized on FI’s website. Maximum fines (SEK 100,000) are rarely levied. CIs are responsible for accuracy in submitted information. FI has a documented 8-step routine for quality control which is implemented the day immediately following report “due date.” Instances where submitted information requires correction are documented and followed-up, the CI involved being responsible for making the changes and re-submitting corrected information. FI verifies that this is done within the set time. (FI reportedly makes an average of one hundred calls post “due-date” to query anomalies in reporting.) FI does not have power to levy fines for misreporting; instead, sanctions are available for what FI considers serious infractions. FI also performs selective validations where external public company information (company websites, Swedish Companies Registration Office, etc.) is compared with the information submitted to FI. As part of the annual SREPs, risk exposure processes are assessed as well as the capital situation and financial information reported through FI’s quarterly reporting or from the companies’ official sources. FI can also validate accuracy of reported information during on-site inspections. Moreover, FI can contract external experts to verify that the CI has routines to guarantee that reporting to FI is correct and is done in accordance with rules and regulations (FFFS 2004:10 Section.2: “....FI may issue instructions relating to auditing in certain areas.”) While FI has systematic and documented routines for verifying consistency of reported information, it very rarely itself validates accuracy of CIs’ reported information on-site (a reflection of its resource constraints) or engages external experts to do so (see below). Selective checks of reported information against other sources (such as external accounting) are made. EC10. As respects auditing, BFBA (Chapter 13, Section. 9) provides that the FI is entitled to appoint one or more auditors to participate in the audit of a CI “together with the other auditors” and FFFS 2004:10 Section 2 notes: “....FI may issue instructions relating to auditing in certain areas.” By law, the auditor should inform FI if he/she discovers problems of material size during the audit. EC11. Discussion at FI’s Board of the usefulness of appointing auditors to conduct supervisory tasks led to the conclusion that this is not the most effective tool of supervision, due to the substantial direct and administrative costs involved. In consequence, such appointments are very rare. Where external experts engaged to conduct supervisory work are not auditors, the assignment is defined and documented through a written agreement with FI. The latter always funds the work and monitors performance. As in the case of auditors, external experts are required to immediately report to FI any circumstances discovered when performing their mission that, inter alia, could constitute a material violation of applicable rules and regulations. | ||||
| Assessment | Largely Compliant | ||||
| Comments | While FI has a means of collecting, reviewing and analyzing CIs’ prudential returns on both a solo and consolidated basis, it faces challenges. First, anomalies in basic reporting requiring an average of 100 enquiries each quarter is wasteful of FI’s resources and indicative of a lack of attention in a significant number of CIs. FI may wish to consider: (a) requiring certification of filings by a CI’s CEO or CFO, and (b) obtaining statutory power to enable levying of significant fines for misreporting. Second, FI’s on-site inspection program is modest and rarely includes validation of the accuracy of supervisory reporting. FI may wish to consider requiring that external auditors opine whether or not filings have been accurately made, with the fee involved being for the account of the CI. Third, the standard report would benefit from addition to “C. Specifications: Balance Sheet” of a breakdown of exposures to related parties. Fourth, the granularity and frequency of the reporting should be improved (note in particular EC1). Regarding part (a) of the first challenge, the certification of filings by a senior individual in the reporting institution is common practice in other jurisdictions and has not led to loss of timeliness in submission of returns. Moreover, such practices are a useful discipline reminding institutions of their responsibilities for timeliness and accuracy, rather than having a general obligation imposed on the firm. In terms of part (b) of the first challenge, FI has already established a working group to investigate fines for misreporting. This development, if agreed, will build on existing practice of fines for late reporting which has been an effective tool in raising standards. With respect to the second challenge FI has indicated that notwithstanding its former view (noted in EC11) it is now reflecting positively on the potential to task external auditors with ensuring and auditing the quality of the reporting from the supervised institutions. Furthermore there is an ongoing dialogue with the auditing firm concerning expectations and practices with respect to the information that auditing firms need to provide to FI. With respect to the third and fourth challenges, it is accepted that the supervisory reporting regimes in the EU will be harmonized by January 2013 and existing deficiencies will be remedied in that context, if not before. | ||||
| Principle 22. | Accounting and disclosure. Supervisors must be satisfied that each bank maintains adequate records drawn up in accordance with accounting policies and practices that are widely accepted internationally, and publishes, on a regular basis, information that fairly reflects its financial condition and profitability. | ||||
| Description | EC1, 2. The Companies Act (Chapter 8, Section 4) makes it the duty of the Board and the CEO to ensure that a CI’s financial record-keeping systems and the data they produce are reliable. A CI should have at least one auditor, elected by the shareholders (Chapter 9) who should, after each financial year give an audit report to the shareholders’ meeting. That report should be given to the Board no less than three weeks before the annual general meeting. EC3. FI’s regulations and general guideline concerning the annual reports of banks (FFFS 2008:25), Chapter 2, general guideline nr 1) stipulates that a CI should in the annual financial statement apply international accounting standards approved by the EU if nothing else is required by law (e.g., the Annual Accounts Act for Credit Institutions and Securities Companies). According to FFFS 2008:25, international accounting standards are;
There are a few valuation requirements in the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559) that are in conflict with IFRS (e.g., (1995:1559) requires goodwill to be amortized in subsequent periods in the annual financial statements while IFRS tests goodwill for impairment on a regular basis). FI’s regulations and general guidelines regarding annual reports for credit institutions and securities companies (investment firms) (FFFS 2008:25), (Chapter 7, Section 2) stipulates that IFRS approved by EU shall always be applied in the consolidated financial statement. The valuation rules in IFRS are consistent, realistic and prudent, take account of current values where relevant and show profits net of appropriate provisions (i.e., see IASB Framework and IAS 1.15, 1.17 b, 1.28 and 1.45). Also the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559) (Chapter 2, Section 4, and Chapter 4, Section 14) requires that CIs use basic accounting principles, such as consistency and reasonable prudence, and take account of current values where relevant and show profits net of appropriate provisions. EC4. BFBA (Chapter 13, Section 9) provides that the FI is entitled to appoint one or more auditors to participate in the audit of a CI “together with the other auditors.” In such circumstance, the FI has power to issue instructions to those appointed auditors and with which the latter must comply “irrespective of directions issued by the general meeting.” The entitlement is sufficiently broad for FI to establish the scope of the external audit of an individual bank and the standards to be followed in its execution. (FI has issued general guidelines for auditors it appoints (FFFS 2004:10)). EC5. In Sweden, FAR SRS standards and related recommendations, such as Revisionsstandard i Sverige (RS), provide generally accepted auditing standards. While those standards do not explicitly mention or regulate in detail such areas as loan portfolio, loan loss reserves, nonperforming assets, trading and other securities activities, derivatives, and asset securitizations the standards are applicable, as under:
RS 320 is relevant as financial instruments and especially the credit portfolio in general are material items both in size and risk exposure in the financial statement and should receive thorough review within the audit. Further, RS 540 and RS 545 are relevant as judgements and revaluations are made to establish the value and size of the loan portfolio, non-performing assets and the loan loss reserves in the financial statement of a CI. Regarding the adequacy of internal controls over financial reporting, the auditing standard RS 400 specifically deals with this issue. EC6. FI does not have the legal power to reject and rescind the appointment of an external auditor (the Supervisory Board of Public Accountants has this power). However when FI is not satisfied with the auditor a dialogue is often held with the CI’s Board. So far, this has always led to the appointment of another auditor. It is though important to state that this is the decision of the credit institution. EC7. As noted above, a CI shall in its annual financial statements apply:
IFRS (International Financial Reporting Standards) are issued by IASB and are internationally accepted accounting standards. EC8, 9. The Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559) is partly an implementation of the BAD, 86/635/EEG. This Act refers to a great extent (mainly related to accounting issues not specific for financial institutions) to paragraphs in the Annual Accounts Act (1995:1554). The Annual Accounts Act (1995:1554) applies to companies in general, and is the result of the Swedish implementation of the fourth and seventh EC Company directives on annual accounts and consolidated accounts. FI has, according to Sections 4-8 in the Annual Accounts in Credit Institutions, Securities Companies and Insurance Institutions Ordinance (1995:1600) the right to issue binding regulations in the accounting area. FI has issued such regulations and general guidelines (FFFS 2008:25) that consist of:
Further, CIs are required to produce annual audited financial statements that have been audited (see above). The audit of the annual financial statement must be executed in accordance with the auditing standards, RS, which are based on internationally accepted auditing standards, ISA. FI requires credit institutions to produce annual audited financial statements based on the requirements in IFRS, (i.e., on accounting principles and rules) that are widely accepted internationally. However, there are a few requirements in the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559), Chapter 4 that are in conflict with IFRS. For example according to (1995:1559) a specific format is required for the income statement and the statement of financial position. In these rare cases (1995:1559) is applied instead of IFRS in the annual financial statement. The Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559) is based on an EU-directive. Annual financial statement and consolidated financial statement Required public disclosure and timeliness of the information disclosed According to the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559) (Chapter 8, Section 5) a bank or building society should submit certified copies of its financial statements and audit report for the past fiscal year to the registration authority (Sw. Bolagsverket) within one month after the balance sheet and income statement are determined. These requirements are also applicable to the consolidated financial statement. The annual financial statement, the audit report and the consolidated financial statement are thereafter public. Comparability, relevance, reliability and timeliness of the information disclosed FI requires CIs to produce annual audited financial statements and a consolidated financial statement based on IFRS (see above). IFRS requires a CI’s financial statements to reflect its true financial condition (IAS 1.15). The requirements imposed in IFRS promote the comparability (IAS 1.38), relevance and reliability of the information disclosed (IAS 1.17 b). Interim financial statement Required public disclosure and timeliness of the information disclosed The Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559) (Chapter 9, Section 2) requires an interim financial statement to be prepared at least once during a financial year, such statement to be delivered within two month after the end of the reporting period to the registration authority (the Swedish Companies Registration Office). Listed companies are to prepare an interim financial statement every quarter (The Securities Market Act (2007:528). Such interim financial statement shall be published as soon as possible and no later than two months after the end of the reporting period. Comparability, relevance, reliability and timeliness of the information disclosed Interim financial statements for the group are based on IFRS (IAS 34). However, the interim financial statements for the parent company are only based on the requirement in the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559)(Chapter 9, Section 2) (FFFS 2008:25 Chapter 8). Listed legal entities not included in a group shall in their interim financial statements apply IAS 34 as far as those requirements do not conflict with the law (the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559)) other regulations or FI’s regulations and general guidelines in FFFS 2008:25. According to IFRS, the information in interim financial reports shall adequately reflect the credit institution’s true financial condition (IAS 34 p 28, IAS 1 p 15). Further, the requirements imposed in IFRS promote comparability (IAS 34 p 20, 28 and 43), relevance (IAS 34 p 28, IAS 1 p.17 b) and reliability of the information disclosed (IAS 34, p 28, IAS 1, p.17, b). Also according to the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559), the information in the interim financial report shall adequately reflect the credit institution’s true financial condition (1995:1559) (Chapter 9); Annual Accounts Act (1995:1554) (Chapter 9, Section 3, and Chapter 2, Section 3) and the requirements imposed in the 1995:1559 Act promote comparability (the Annual Accounts Act (1995:1554), Chapter 9, Sections 3 and 4), relevance (the 1995:1559 Act, Chapter 9, Section 3, and Chapter 2, Sections 2 and 3), reliability of the information disclosed (the Annual Accounts Act (1995:1554) Chapter 9, Section 3, and Chapter 2, Section 4). Pillar 3 Disclosures Required public disclosure and timeliness of the information disclosed For banks and other CIs, periodic information regarding own funds and capital requirement is to be disclosed at least four times a year (regulations and general guidelines regarding public disclosure of information concerning capital adequacy and risk management (FFFS 2007:5) Chapter 2, Section 2). The information is to be disclosed as soon as possible, at the latest two months after the balance sheet date. Annual financial statement and consolidated financial statement CIs must in their annual audited financial statements and the consolidated financial statements disclose the information required under IFRS (FI’s regulations and general guidelines regarding annual reports at credit institutions and investment firms (FFFS 2008:25)). Further, additional disclosures are required under the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559). The required disclosure under IFRS and (1995:1559) include both qualitative and quantitative information on a CI’s
Disclosures of management and governance are only required for banks and credit market undertakings whose shares, warrants or debt securities trade on a regulated market in Sweden. (The Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559), Chapter 6, Section 1 which refers to the Annual Accounts Act, Chapter 6, Section 1a, 2a, and 6-9). However, in practice the disclosure regarding management and governance are applicable for about 95 percent of the CI market. Disclosures about capital adequacy and risk management are also required according to FI’s Regulations and General guidelines regarding public disclosure of information concerning capital adequacy and risk management (FFFS 2007:5). For the disclosure requirements mentioned above, except for management and governance, the scope and content provided and the level of disaggregation and detail are the same for all CIs regardless of the size and complexity of operations. 10. FI performs ad hoc supervision of CIs’ annual financial statements. If the information required by the disclosure standards is missing or in any other way not in compliance with the disclosure standards, FI requires the credit institution to correct the error in accordance with IAS 8. 11. FI has since Q4 2005 quarterly published quarterly statistics on credit institutions (Kreditmarknadsbarometern). The data presented it this publication cover all banks and credit market companies. The companies are divided into subgroups; “major banks,” “other banks,” “savings banks,” “mortgage institutions,” “smaller credit market companies,” and “securities companies.” The main areas covered are earnings, lending, credit quality, deposits and capital ratios. The major four banks lending portfolio is broken down both by sector and geography. Credit losses for the major banks are also presented by geographical area. FI also publishes an annual Risk Report. This report highlights the major risks for the banks in the coming year. It also describes the current situation and the outlook for banks’ operations. In the Risk Report FI also publishes stress tests individually for the four major banks, based on publically available data. RBen publishes a financial stability report twice a year. The area of focus is the four major banks (group level). The majority of the data used is publically available and the banks are assessed individually. In 2006 RBen first published a method for stress testing the four major banks, using publically available data and model. AC1. As needed, FI meets with a CI’s auditor to discuss a particular issue or to get the auditor’s general picture of the firm. Historically, FI also frequently used the right to appoint an auditor in order to monitor changes and to be a part of the process of auditing the CI. Since 2008 this is only done exceptionally; FI is in negotiation to reform the level of exchange of information between the auditor in charge and FI. FI arranges a seminar once a year to inform and have a dialogue with the auditors. AC2. External auditors, whether or not utilized by the supervisor for supervisory purposes, have the duty to report to the supervisor matters of material significance, for example failure to comply with the licensing criteria or breaches of banking or other laws, or other matters which they believe are likely to be of material significance to the functions of the supervisor (BFBA, Chapter 13, Section 10 and FI general guidelines for auditors appointed by FI (FFFS 2004:10)). The law ensures that auditors who make any such reports in good faith cannot be held liable for breach of a duty of confidentiality (Rev U14, The auditor’s obligation to report in financial companies). AC3. For CIs whose transferable securities trade on a regulated market, the external auditor (either the firm or individuals within the firm) must be rotated after seven years (Companies Act (2005:551) Chapter 9, Sections 21-22). Such CIs represent a large part of the Swedish CI market. AC4. There are no requirements for CIs to have a formal disclosure policy for matters presented in the financial statements. However, CIs have to disclose the information required by IFRS in their annual reports (FI regulations and general guidelines regarding annual reports at credit institutions and investment firms (FFFS 2008:25), Chapter 2, general guideline number 1). There are also requirements for CIs to have written guidelines and instructions for how they should fulfill the requirement for publication of information regarding their capital adequacy and their strategies for managing their risks and exposures (CALE, Chapter 8, Section 3). AC5. FI does not have the legal power to access external auditors’ working papers. The Supervisory Board of Public Accountants is the authority that has the power to access external auditors’ working paper (Accountants Act (2001:883) Section 28). FI can request specific cases from the Supervisory Board of Public Accountants which can comply or not, depending on its judgment. To date, FI has not felt a need to access external auditor’s working papers and has therefore not made any requests to the Supervisory Board of Public Accountants. | ||||
| Assessment | Largely Compliant | ||||
| Comments | FI does not have the power to reject and rescind the appointment of an external auditor (EC 6). While FI can often achieve the objective of EC 6 through pressuring a CI’s Board, it would be preferable to have an unfettered power to rescind appointment of an external auditor. It is noted that FI conducts ad hoc checks on firms’ annual financial statements (EC10). This would appear to be duplicative of the work of the external auditor and it is recommended that instead a stronger relationship is cultivated with the auditing profession. As mentioned in comments to CP 21 FI is already engaged in a dialogue with the auditing profession concerning expectations and practices going forward. It is recommended that frequent contact with individual institution’s auditors would be a fruitful outcome of this dialogue. | ||||
| Principle 23. | Corrective and remedial powers of supervisors. Supervisors must have at their disposal an adequate range of supervisory tools to bring about timely corrective actions. This includes the ability, where appropriate, to revoke the banking license or to recommend its revocation. | ||||
| Description | EC1. FI normally communicates its findings in the ongoing supervision to the Executive Director who represents the supervised entity. However in cases where FI has supervisory concerns, it is FI practice to communicate (in accordance with quite recently modified routines) all outcomes of the investigations to the chairman of the Board and require that these concerns are addressed in a timely manner. In terms of follow up, FI may also place an order on the credit institution to undertake certain measures to rectify the situation. Depending on the severity or character of the breach, FI requires the credit institution to submit written progress reports and checks that the remedial actions undertaken by the credit institution are completed satisfactorily. The assessors reviewed recent cases where it was clear that breaches had been pursued in a timely manner. In the case of non-material breaches or in matters where FI considers that an institution should improve, FI does not require any reports and does not set a specific timetable though discussions with firms made it clear that industry understood that remedial action would be expected to have been performed before the next SREP. FI notes in supplementary information to the self assessment that all relevant material, including outstanding matters are reviewed prior to any SREP or on-site visit and any supervisory action is followed up. In cases where FI considers intervening and requires the credit institution to take significant remedial actions, these are addressed in a written document to the Board. EC2. Sweden does not have specific rules on bank insolvency other than the Support Act to Credit Institutions (2008:814) which is invoked in the case of systemically important credit institutions. General rules on bankruptcy, liquidation and winding up which apply for all other companies, apply to non-systemic credit institutions. For non-systemic institutions, under the BFBA FI has the right, which so far it has always exercised, to petition for the liquidation and determine the manner in which a credit institution shall be wound up if its license is revoked in order to ensure the orderly winding up of the institution. When petitioning the court, FI has the power to propose a liquidator; though the court is not obliged to accept the suggestion, to date, it has done so. It should be noted that the revocation of the license is an automatic trigger to the liquidation of the company in all but a very few exceptions (BFBA 2004:297, Chapter 10, Section 31). However, Swedish law permits the possibility of the appeal against the regulatory decisions made by FI, including—in the case of credit institutions which fall into the sector of credit market undertakings—the decision to revoke. The court can therefore overturn FI’s decision to (e.g., withdraw the license and there is a three week window following FI’s decision during which an appeal can be lodged. Although (under Chapter 17, Section 1) FI may order that an injunction, order or revocation shall enter into immediate force, the institution can also apply to the court for inhibition of FI’s decision meaning that should an appeal have been lodged, including an appeal to stay the execution, the decision is not actually applicable until the court has made its determination on the decision that is being appealed. The threshold requirements to obtain an inhibition are set very high in the view of FI. In the period since 2006 to present day, 40 percent of FI’s intervention decisions (issuance of remark, warning or revocation) have been appealed against. No appeal was successful. For credit institutions defined as banking companies (Chapter 1, Section 5) a decision to terminate a liquidation may not be taken (Chapter 10, Section 34) when a decision to revoke has been taken. However, the right of appeal against the revocation decision remains. With respect to systemic credit institutions, the responsibility for “orderly resolution” of systematically important credit institutions rests with the Swedish Debt Office, as the “support authority,” with an obligation to consult with FI. The Debt Office is responsible for measures such as issuing loan guarantees and capital injections to solvent credit institutions during the crisis and providing emergency support for credit institutions experiencing problems. The Debt Office and the MoF decide, with respect to systemically important credit institutions, when and how to affect an orderly resolution, including ownership take over and the closure of such credit institutions. Government support can only be given to institutions that are considered systemically important at that point. Thus, in the case of systemic institutions, the supervisor informs the Debt Office and the MoF that decide when and how to affect the orderly resolution of a problem credit institution. In addition to the duty of the Debt Office to consult with FI, there is a MoU between the Debt Office, FI, the MoF and the central bank regarding exchange of information and consultation on financial stability and crisis management. FI discusses in its supervisory role, with the credit institutions and with other authorities on an ongoing basis how to handle problem credit institution situations. EC3. When a credit institution has violated its obligations under the Banking and Financing and Business Act, FI is required to intervene and has powers to restrict the activities and limit the operation of a credit institution, require it to reduce its risks, or undertake other measures in order to rectify the situation (e.g., capital injection—a requirement that FI has exercised recently). Where the infringement is serious, the credit institution’s license shall be revoked or, a warning shall be issued. Thus a warning indicates to an institution the gravity of the infringement without immediate steps to revocation. EC4. In addition to powers noted under EC3, FI has the power to withhold approval of new activities if the credit institution does not meet the requisite criteria. In addition FI has powers to replace a managing director/CEO or any member of the Board if they do not meet the requirements in the Banking and Financing Act. FI may in certain cases order that a party with a qualified holding of shares or participating interests in a credit institution may not represent more shares or participating interests at the general meeting than that corresponding to a non-qualified holding. FI may also order an owner with a qualified holding to divest sufficient shares so that the holding no longer constitutes a qualifying holding. There are no explicit rules on interim management, though FI has the right to replace a board member or managing director on an interim basis until the institution has elected a new board member or managing director. FI has the power to revoke the license of a credit institution. FI does not have right to replace or restrict the powers of any manager other than the managing director of a credit institution (see EC6 below). This is because Swedish law does not recognize the concept of “senior management.” FI may also need to give thought to how it would deal with a poorly performing board where, individually, the board members appear to be adequate and suitable for their role. FI cannot restrict the payout of dividends (although this power is expected to be amended with the introduction of the capital conservation requirements under Basel III). Swedish legislation does not provide for FI to facilitate a takeover by or a merger with a healthier institution. EC5. If a credit institution or a financial group does not meet the capital requirements in laws or regulations FI has the powers (referred to under EC3) to limit the institution’s operations in some respect, reduce risks therein, or take other measures, such as strengthen forms of governance and strategies or to apply specific reservation politics, in order to rectify the situation. FI may also impose a remark or warning or even revoke the license. A remark and a warning may be combined with a penalty fee of between SEK 5, 000 (€ 500) and SEK 50 million (€ 5 million). A fine can only be issued in conjunction with a remark or a warning. FI is, at present, considering how to make more extensive use of its powers to restrict the activities of institutions (BFBA, Chapter 15, Section 1). EC6. If a member of the Board or the Managing Director/CEO no longer meets the fit- and-proper criteria’s FI may revoke the credit institution’s license. However, instead of revoking the license FI may remove the Board member or the managing director—but not the other members of the management (see EC4 above)—from his/her position. FI has no other measures available to intervene against an individual. FI may only intervene and impose sanctions or penalties on the credit institution as such. Personal responsibility for individual Board members or management may only come into question and be decided by a court of justice, if a Board member or managing director is prosecuted for a criminal offence or if an indemnity claim is directed towards him or her, or if special rules on personal liability according to the Swedish Company Act (2005:551) is at hand. AC1. There is no direct prohibition against supervisory forbearance but the drafting of legislation and supporting structures mitigate against such forbearance. Moreover, FI has a duty, under the BFBA, to intervene where a credit institution has violated its obligations. In its role as an administrative authority governed by the Administrative Procedure Act (Section 7) FI is obliged to handle the intervention as simply, rapidly and economically as is possible without jeopardizing legal security. The Parliamentary Ombudsmen (PO) is assigned by the Parliament to ensure that agencies as well as the public officials they employ (and also anyone else whose work involves the exercise of public authority) comply with laws and statutes and fulfill their obligations in all other respects. It would be very rare for the ombudsman to act but it is seen as a strong deterrent. In addition to the PO, FI’s operations are also under the supervision of the chancellor of justice, a non-political civil servant appointed by the government. FI is obliged to submit a list to the chancellor of justice on a yearly basis of all matters that have been filed with FI before July 1, the previous year, but which have not been closed within the twelve month period. AC2. The range of remedial powers FI can exercise, in a time limited period, as noted under EC3 includes ring-fencing. In addition FI has a range of measures in order to prevent the shareholders, e.g., from obstructing the operations of a credit institution being conducted in a manner which is compatible with this laws and regulation. FI may, e.g., order that a shareholder with a qualified holding of shares may not represent more shares at the general meeting than what corresponds to a non-qualified holding or order a shareholder to divest such a portion of the shares that the holding thereafter no longer constitutes a qualifying holding. FI may also decide to ring-fence a credit institution’s assets from related companies, (e.g., by requiring that all transactions or transactions of a certain size or with a certain party must be approved by FI on beforehand). AC3. As a consolidated supervisory authority of all domestic financial entities, FI ensures that any remedial action is preceded by communication to those responsible at FI for nonbank related financial entities concerned and that the actions are coordinated when appropriate. FI is not directly obligated through legislation to inform supervisory (or other authorities) outside Sweden if it were to take remedial action against a Swedish parent or subsidiary of another bank/regulated firm, but has permissive powers to do so (BFBA, 2004:297, Chapter 13, Section 6 a). | ||||
| Assessment | Largely Compliant | ||||
| Comments | At a broad level FI has a range of corrective and remedial powers. However, there are gaps and limitations in FI powers. With respect to sanctions and penalties on individuals, FI has only the power to remove or bar an individual from the Board or position of managing director. FI cannot remove senior management, only the Board or managing director. This creates strong opportunities for influence, but more direct intervention powers would be more efficient and lead to more timely outcomes. The scale of fines that FI can levy should be reviewed, particularly with respect to the existing cap of SEK 50 million, which is nugatory in relation to the size of the larger institutions and means that the disciplinary force of the sanction would rest entirely on the public disclosure of the supervisor’s disapproval. Also, as noted under EC4, Swedish legislation does not provide for FI to facilitate a takeover by or a merger with a healthier institution. FI’s powers of sanction and decision making can be affected by legal certainty. The legal uncertainty affects intervention but also has wider consequences for bank resolution although resolution issues fall outside of the scope of the BCP assessment. Under the Swedish system, liquidation of a bank is triggered by a revocation decision, but the revocation decision itself can be overturned, as can any FI sanction. Liquidation may be suspended pending outcome of appeal should the appellate seek a stay of execution (which is likely to be the case given that immediate liquidation is not in the appellant’s interests when appealing a decision of revocation). While an appeals process is an important protection, the manner in which it is designed in Sweden interrupts the supervisory process so that the legal uncertainties inhibit a clear and predictable outcome for a firm as well as FI’s ability to plan a course of supervisory action involving sanction. The range of uncertainties that are created by use of revocation may create a significant hesitation in FI’s willingness to use such powers. A robust and flexible early-intervention framework that would provide the supervisory and resolution authorities with the tools and mandate to intervene and resolve ailing institution at an earlier stage, and resolving the legal concerns identified, while naturally preserving the rights of appeal and redress in some form though without inhibiting supervisory process, is needed. There are no formal triggers for early intervention powers and to require prompt corrective action. FI would be able to (and typically would wish to) exert supervisory pressure at an early stage and might require that an institution take remedial action. The assessors discussed cases, however, where limitation of resources delayed a more intense supervisory action, although early requirements for remedial action in the institution had been made. More formal triggers might support the authorities in their desire to roll out a more proactive supervisory approach and the authorities may wish to consider if such a development would be beneficial to them. | ||||
| Principle 24. | Consolidated supervision. An essential element of banking supervision is that supervisors supervise the banking group on a consolidated basis, adequately monitoring and, as appropriate, applying prudential norms to all aspects of the business conducted by the group worldwide. | ||||
| Description | EC1. FI applies consolidated, risk based supervision. In monitoring and risk assessment of institutions, FI drills down from the consolidated data set into the different legal entities and jurisdictions, depending on where indicators suggest there may be problems. Risk reviews, financial and risk reporting is normally performed on a consolidated level. A mapping of each group’s entities and business areas of the major four banking groups is carried out yearly. It gives an understanding of the group structure and the materiality of business lines and entities. It also provides the basis for designing the membership and structure of the supervisory college. EC2. FI has the power to require all relevant information needed to assess the capital adequacy and risks of credit institutions in Sweden and has never experienced difficulties in obtaining information pertaining to subsidiaries or branches of Swedish institutions when specific information beyond group consolidated data is required. FI has information gathering powers over financial and mixed activity financial holding companies also. Off-site supervision of the foreign activities of subsidiaries is normally carried out by collecting information through the Swedish parent bank or by contacting the host supervisor. On-site supervision of subsidiaries can only be carried out together with the host supervisory authority. FI has substantial experience of supervising the foreign activities of Swedish banks and has performed a number of joint inspections together with Nordic and Baltic supervisors. When performing on-site supervision of branches FI always informs the host supervisor before the visit. For larger cross-border groups the cooperation and coordination with other supervisors is managed in the supervisory colleges. College relationships and provision of information between authorities has been good and is improving in the experience of the staff the Assessors spoke with. There are more formal arrangements required for colleges operating in the EU context (deriving from EU legislation and guidelines) and while this has created additional administrative burdens, and has in some cases perhaps encouraged a rather legalistic response from the supervisory authorities in other jurisdictions, staff indicate that they have also seen benefits from a more reliable structure and greater discipline of approach. EC3. In its SREP/ Pillar 2 supervision, FI reviews the institution’s exposure to all material risks, irrespective of whether they emanate from banking or nonbanking activities. This assessment is documented and summarized in the yearly SREP. The SREP will incorporate an assessment of information from FI’s insurance and securities supervision in order to ensure that the assessment of the group covers all material risks. Other examples of nonbanking activities that are evaluated are special purpose vehicles that some banks have set up to manage real estate collateral that was taken over during the crisis. EC4. The CALE Act gives FI the power to establish prudential standards on a consolidated level regarding CALE and FI applies its standards on this basis. With respect to group capital adequacy, FI works towards joint decisions in the context of colleges of supervisors for the major banking groups, and working within the legal framework set up by the EU CRD. Exposures to related parties are subject to a disclosure requirement and are closely monitored by FI but FI has no power to impose limits on related party lending. EC5. For credit institution group with cross border activities supervisory colleges are established. The operation of these colleges are facilitated by MoUs which among other things regulate principles for the sharing of information and which have been drawn up using a common template created by CEBS (now the EBA). College arrangements based on MoUs are in operation for the four largest Swedish banking groups and one college has been in operation for over ten years. Three new colleges are in the process of being established. EC6. A credit institution which intends to establish a branch abroad must receive FI’s authorization before establishment. FI has the power to require an institution, on a consolidated basis, to reduce or eliminate its risks; wherever these risks are legally located although in practice it has not acted on these powers. As noted in CP5 FI does not have the power to prevent an institution from making an acquisition of up to 25 percent of the institution’s capital base and therefore FI has no ex ante powers to limit risks in this particular instance. EC7. The determination of the adequate oversight by management of a firm’s foreign activities and operations takes place in the context of the normal fabric of supervisory activity, which in the case of the major institutions includes the quarterly risk meetings, which will vary in location and will typically include representation not only from the senior management and control functions of the institution but of the main relevant overseas supervisors. A wide range of data from the institution is required to be submitted to FI ahead of the meeting. It is FI’s experience that this approach is one useful method to determine or expose lack of expertise or competency in management and control functions. For the groups where there is a supervisory college, the quality of local management and compliance with group policies is frequently discussed. FI regularly reviews group policies, instructions and business plans for foreign operations. The assessors reviewed documents from the colleges of supervisors which provided supportive evidence on this issue (EC7 and EC8). EC8. FI assesses the quality of a credit institution’s governance and internal control and oversight of its overseas operations through the ongoing supervision of the entity (see above EC7). FI has had no experience of host countries impeding the parent bank’s ability to access information. FI does not and would not hinder a parent credit institution or home supervisor from accessing information from branches or subsidiaries in Sweden. There are extensive confidentiality provisions (as discussed above in CP 1). EC9. FI has the power to require the closing of foreign offices or exiting from certain markets through its power to require that a credit institution reduce or eliminate its risks. EC10. All FI’s supervision is risk-based meaning that FI increases supervision of areas where risks are assessed to be higher and reduces supervision of areas where risks are assessed to be lower. The risk assessment is performed continuously and documented three times per year. As an example, in the past two years FI has paid much higher attention to the developments in the banks’ Baltic and Ukrainian operations than to the developments in the banks’ Nordic operations. Within the supervisory colleges, the supervisory plan is based on the yearly risk assessment conducted as part of the SREP. AC1. Sweden permits corporate ownership of credit institutions. For holdings exceeding 10, 20, 30, or 50 percent of share capital or votes in a credit institution, the owner needs FI’s approval before acquisition of the shares. If FI assesses that a financial conglomerate exists FI has the power to review the activities of the parent company. FI has the power to enforce fit and proper standards for future owners at the time of ownership change (part or full acquisition) but, on an on-going basis, FI can only enforce these standards if the owner is a financial holding company or mixed financial holding company and the management is not fit and proper. If the owner is not a financial or mixed financial holding company FI can enforce the standards only if the owner is assessed to impede the sound management of the credit institution, has committed serious crimes or increases the likelihood for money laundering. AC2. The quality of supervision conducted in other countries in which Swedish credit institutions have material operations are assessed through the ongoing college work, joint inspections and exchange of information. No formal evaluation of the quality of other supervisory authority’s supervision is conducted. AC3. FI conducts risk based supervision and regularly visits foreign operations of the Swedish credit institutions. Location and frequency of visits are decided based on FI’s risk assessment of a group. The host supervisors are informed of and typically invited to attend the meetings. | ||||
| Assessment | Compliant | ||||
| Comments | FI does not have direct powers to impose its prudential standards on non-financial (and non mixed activity) parent companies of credit institutions. Although the major banking groups have regulated banking entities as the parent company, it would be advisable for Swedish authorities to consider if they need to go beyond the requirements set out in the banking directives governing scope of application of FI powers to parent entities. From a forward looking point of view it is always possible that new corporate structures can be adopted or new groups emerge. FI practices consolidated supervision according to the EU legislative framework and makes determinations on the oversight of the group through a mix of regular college meetings and periodic on-site visits to firms. FI is also subject to EU legislation governing financial groups (conglomerates). One of its major systemic firms is a conglomerate as defined by the directive and the co-ordinating supervisor for the wider, conglomerate, group is Finland. The challenges facing FI relate to the increasing scale and complexity of its task as the consolidated supervisor of four systemic banking groups with significant levels of cross border activity. This is particularly important in instances where control functions for key risk areas are not always located in Sweden. Open and cooperative relationships with relevant host supervisors, noted in CP 25, are an important pre-condition for FI in managing risks posed by such groups. Swedish authorities benefit from a shared Nordic culture which may facilitate relationships with some of their key host and home supervisors, but increasingly the activities of the major banking groups is widening the regulatory relationships FI must maintain and the challenge is to blend the perspectives from the Nordic consensus with other views. | ||||
| Principle 25. | Home-host relationships. Cross-border consolidated supervision requires cooperation and information exchange between home supervisors and the various other supervisors involved, primarily host banking supervisors. Banking supervisors must require the local operations of foreign banks to be conducted to the same standards as those required of domestic institutions. | ||||
| Description | EC1. For the Swedish four largest banks supervisory colleges are established. All colleges are based on MoUs in line with CEBS’s standards. Within each college there is extensive ongoing information sharing. EC2. For the four largest Swedish banks’ supervisory colleges are established and additional colleges are in the process of being established. All colleges are based on MoUs in line with CEBS’ (now EBA) standards. The affected banks are informed about the existence of the colleges and the banks also meet regularly with representatives from the supervisory colleges. Information exchange, facilitated by written agreements and MoUs, also takes place with supervisory authorities other than those involved in the college arrangements. MoUs are established with supervisory authorities in nine major financial centers outside of the EEA. EC3 and EC4. The legal basis and requirement for FI to share information as a home and host supervisory jurisdiction is set out in EU legislation (CRD) and there are provisions governing the exchange of information both within the EEA and non EEA. In practice FI operates an open policy on exchange of information but its main efforts are focused on the systemic institutions. Supervisory college arrangements have been established for all the systemically significant banking groups for which FI is the home or host supervisor. Information exchange, underpinned by the MoUs is extensive and flows in both directions between home and host authorities. Either in the context of quarterly college meetings, or additionally, information exchange will include for example, (e.g., findings from completed investigations and the plans for future investigations). On a yearly basis, a joint risk assessment is carried out in each college. The group SREP is conducted jointly with relevant (based on materiality) host authorities participating in decision making. Additionally there is joint work on model approvals and specific investigations that arise in the course of supervisory activity. In the context of this work FI has only experienced friction in information exchange at the peak of the recent financial crisis. EC5. Under EU legislation which has been transposed in Sweden, FI must treat the cross border operations of foreign banks on an equivalent basis to domestic institutions. EC6. Chapter 4, Section 4 of the BFBA states that a credit institution from a non-EEA country may be granted a license to conduct business in Sweden, provided inter alia that the institution is subject to satisfactory supervision by a competent authority in the home state, and that this authority consents to the institution establishing itself in Sweden. FI does not, however, explicitly establish that in incoming credit institution is subject to global consolidated supervision. Credit institutions from EEA countries may conduct business in Sweden pursuant to the “passporting” regime in relevant EU directives (Chapter 4, Sections 1-3 of the act.) EC7. Conditional on the existence of a MoU, FI gives home country supervisors access to local offices and subsidiaries. FI has limited practical experience of this, but it has been done, (e.g., FI has given U.S. authorities permission to perform an on-site examination in a Swedish subsidiary of a U.S. bank). EC8. Shell banks are not permitted under Swedish law. EC9. Within the colleges there is a frequent exchange of supervisory information, and a well established structure for consulting with each other before taking any action. For non-college institutions, FI would anyway always consult with or inform other relevant supervisors before taking action. AC1. The communication strategy within the supervisory colleges follows CEBS guidelines. | ||||
| Assessment | Compliant | ||||
| Comments | Sweden is the home jurisdiction to four systemically significant banking groups for the Nordic region, one of which can be considered to be globally systemic. At the same time Sweden is host to 45 foreign branches. On balance, however, Sweden’s role as a home supervisory authority is more significant than as a host authority. However, as a host authority, FI may wish to institute an explicit practice of establishing that an incoming credit institution is subject to global consolidated supervision. Colleges of supervisors in the Nordic region are among the oldest in existence and Sweden also enjoys the benefit of a shared culture with many of its most material supervisory counterparts. Information exchange within the key colleges appears to be entirely unimpeded as FI has made active use of the powers provided to it through EU directives. Sweden was assessed positively in the 2010 CEBS peer review on Colleges. Furthermore the home host arrangements have, to some degree, developed beyond information sharing per se and made progress in joint efforts at supervisory activity and decision making. FI focus is not purely on identifying whether it has access to information in other host/home jurisdictions and whether it has powers or obligations to pass on information to other authorities on request. FI has a clear ambition to ensure that information exchange serves as the first step towards a deeper and broader understanding of a banking group’s activities and risk profile by all relevant supervisors. In other words information exchange is not seen as an end in itself but as it serves the purpose of more meaningful and effective supervision. To this end FI is seeking to harness the potential of college arrangements, which have been recently formally reinforced by EU legislation and CEBS/EBA guidelines and practices, to the greatest extent possible, recognizing the opportunity to mobilize a larger (cross border) team of resources and benefit from a wider range of perspectives. Progress is at an early stage and needs to continue to develop and would benefit from increased time spent on-site visits to host/home jurisdictions, although this option is limited by current resource constraints. Meetings with industry indicated that firms were conscious of differences in view and approach between the members of the supervisory college and were appreciative of FI’s efforts to achieve consistency in overall supervisory approaches. | ||||
Table 3.
Sweden: Detailed Assessment of Compliance with the BCP
| Principle 1. | Objectives, autonomy, powers, and resources. An effective system of banking supervision will have clear responsibilities and objectives for each authority involved in the supervision of banks. Each such authority should possess operational independence, transparent processes, sound governance and adequate resources, and be accountable for the discharge of its duties. A suitable legal framework for banking supervision is also necessary, including provisions relating to authorization of banking establishments and their ongoing supervision; powers to address compliance with laws as well as safety and soundness concerns; and legal protection for supervisors. Arrangements for sharing information between supervisors and protecting the confidentiality of such information should be in place. | ||||
| Description | |||||
| Assessment | Largely Compliant | ||||
| Comments | |||||
| Principle 1(1). | Responsibilities and objectives. An effective system of banking supervision will have clear responsibilities and objectives for each authority involved in the supervision of banks. | ||||
| Description | EC1. FI is the authority responsible for banking supervision in Sweden. The general responsibilities and objectives of FI are set out in Government Ordinance 2009:93. Namely
In discharging its responsibilities, FI is obliged to ensure that its practices (rules and routines) are cost effective and simple for citizens and firms to understand and comply with. In addition to Ordinance 2009:93, the government issues an annual appropriations letter to FI which may also set out specific responsibilities and tasks for the authority for the fiscal year in question. This letter may be amended and revised during the course of the year. The appropriations letters are publicly disclosed on the government and FI websites. The letter will set out specific assignments and but may also include objectives such as:
EC2. FI operates with a comprehensive framework of minimum prudential standards. Minimum prudential standards for banks are set out in the Banking and Finance Business Act (2004:297). The Act sets out the minimum requirements for obtaining banking license, including minimum initial capital (Chapter 3, Section 5), fit and proper tests, solvency, liquidity, risk management, transparency and soundness. Detailed provisions on capital adequacy requirements are contained in the Act on Capital Adequacy and Large Exposures (CALE) (2006:1371). FI has the mandate to issue binding secondary regulation and general (non-binding) guidelines concerning different aspects of banking business. Failure to conform to the guidelines is taken as a signal that the institution may not be in conformity with the underlying law either. EC3. The Banking and Finance Business Act and the Act on CALE are updated in order to keep the law abreast of changes in EU law and other developments. Further amendments are foreseen in 2011 in order to transpose new provisions in the EU Directives on Credit Institutions and Capital Adequacy (the “CRD 2” and “CRD 3” legislative packages). However, there can be a lag in the timeliness of updates, as, for example, the Acts have not been updated to take account of CRD2 which should have been implemented by the end of 2010. In this particular instance the delay was due to staff shortages at the MoF. The elements of CRD2 that could be implemented directly by FI under its own authority were implemented on time. FI has an established process to systematically survey and assess the need for changes within its regulatory mandate. EC4. FI issues regular and ad-hoc reports concerning the financial system. Regular publications include the annual Risk Report, and the Supervisory Report. The former gives an overview of the present situation and the outlook for different parts of the financial sector, including identification of main risks and problems. This report provides the basis for FI’s supervisory planning process. Supervisory Report describes FI’s recent supervisory and regulatory activities are described. Additionally, FI produces and publishes, usually on a quarterly basis, various statistics, based in regular reporting from supervised entities. This concerns, e.g., various financial data, lending, capital adequacy. Pillar 3 data is not posted directly on FI’s website although there is access to a data base of authorized institutions from which to examine Pillar 3 disclosures. FI is concerned that firms should fulfill their public disclosure responsibilities and in support of that is, for example, planning a targeted assessment of firms’ disclosure in the field of liquidity risk later in 2011. AC1. FI adopts a risk based approach to supervision. Data and analysis contained in the Risk Report and the Supervisory Report is used as one starting point for prioritizing and for planning supervisory activities. Supervisors also conduct individual assessments of the risks of the institutions in order to contribute to prioritization of supervisory activity and allocation of resources. | ||||
| Assessment | Largely Compliant | ||||
| Comments | FI has two core objectives set out in legislation: financial stability and consumer protection. FI’s responsibility for supervision and licensing of financial institutions is also clearly stated in law. There is no clarity, however, with respect to how FI should balance its financial stability and consumer objectives. Nor, given that FI is a unitary regulator, is there clarity with respect to balancing prudential and conduct of business duties. It is recommended that FI should articulate how it interprets its mandate including how it would respond in the event that a conflict should arise between acting on the basis of consumer protection or financial stability. The public annual appropriations letter from the government sets specific tasks and assignments for the supervisory authority so, from year to year and within the course of the year, FI will receive direction and revision on its tasks and priorities within the context of its mandate for financial stability and consumer protection. The timeliness of updating of relevant banking legislation is not consistently achieved. In those areas where FI has responsibility for updating regulation that it issues, timeliness has been maintained. However, there have been delays when aspects of the legislation that are dependent on the more time consuming Parliamentary process. Delays, for example to the implementation of CRD2, have occurred primarily due to staffing limitations at the MoF. | ||||
| Principle 1(2). | Independence, accountability, and transparency. Each such authority should possess operational independence, transparent processes, sound governance and adequate resources, and be accountable for the discharge of its duties. | ||||
| Description | EC1. FI is an independent government authority. As a public authority, its independent decision-making capacity is enshrined in the Instrument of Government. Thus, the government or an individual minister cannot influence or modify a decision by FI. The government issues an annual, publicly disclosed, appropriations letter which identifies objectives, assignments and reporting requirements to FI. The supervisor itself is consulted in the course of the preparation of this letter. The director general may be removed from office before the end of the six year term only if he or she commits forms of misconduct or has a disability impairing the performance of the authority, defined by law. Where the head of a government agency is removed from office, the reasons must be publicly disclosed. EC2. The Annual Report from FI, in which the authority describes and evaluates its activities, including its cost-effectiveness, subject to detailed reporting requirements from the MoF, is a public document. FI must respond to the tasks, reports and assignments set out in the annual public appropriations letter from the government. The Director General of FI makes a statement at least once a year before the Parliamentary Finance Committee. The FI’s activities are scrutinized by the Swedish National Audit Office. The budget of FI, including objectives and motivations behind the instructions and resources provided, is public. The supervisory measures that FI takes against the credit institutions are made public by the supervisor. EC3. FI has established a set of ethical standards for its employees (including the Director General and the Board members) concerning, e.g., confidentiality, loans from supervised entities, additional occupations, and dealings in financial instruments, to avoid possible conflicts of interest or imply other problems that may to affect public confidence negatively. There are also policies and routines in place for handling the situation when an employee leaves FI for work in a supervised institution (e.g., an employee would be removed from sensitive responsibilities for at least three months prior to taking up a role in a supervised institution). EC4. FI is mainly financed through appropriation (allowance) from the state budget. In turn, FI levies fees on its supervised entities and passes these funds to the state budget, In 2010, 85percent of FI’s activities were funded in this manner. The remaining financing derives from fees that are charged to firms in respect of specific services that the supervised entity has sought from FI on a voluntary basis. FI has in practice enjoyed full discretion over the use of these fees, but the level of the fees is determined by the government and could in theory be reduced should the government wish to constrain how FI disposed of its budget as pursuant to Sections 7 and 8 of the Budget Act (1996:1059), the government may impose some limitations on the use of funds allotted to an administrative authority. In discussion with supervised institutions the assessors noted that generally service based fees were not resisted but there was some discussion on whether the levels of delivery (e.g., expertise in performing certain specialist tasks) always matched the institutions’ expectations. Once the state budget has been adopted by the Parliament, the government issues an annual appropriation instruction to each administrative authority, including FI, as noted in EC1. Where the appropriations letter imposes a particularly burdensome requirement on FI, it may also allocate additional funding or resource to ensure the completion of the task, as has happened in the past. Except for the resources explicitly granted by the Government for specific projects FI has, so far, had freedom to dispose of its allocation of resources, inter alia, salaries, training of staff, equipment, travels, etc. In recent years, supervisory resources have increased, from 199 full time employees in 2005 to 228 by 2009. External experts have not been commissioned in the banking supervisory field. On-site examinations are relatively limited in number (cf CP20 in particular) but travel budgets have supported FI participation in cross border supervisory colleges throughout the Nordic and Baltic region, though the administration of college work is resource-intensive and it is unclear that resources are commensurate with the demands of ensuring that core supervisory functions maintained. Noting the high degree of turnover, particularly in the more specialist risk areas, the assessors consider that the FI salary scale is insufficient to attract qualified and experienced staff who are mid career. FI has been successful in attracting some experienced staff members who have had a successful industry career and for whom headline salary is not an urgent priority. AC1. The Director General is appointed by the Government for a minimum term of six years. FI Board members have a minimum appointment of three years. | ||||
| Assessment | Materially Noncompliant | ||||
| Comments | The Swedish approach is highly transparent and lines of accountability are clearly set out. With respect to independence there are issues that are cause for concern. The issue is discussed below under the following headings: the annual appropriations letter; supervisory decision making; and resources. The annual appropriations letter The annual appropriations letter, referred to in CP 1(1) above, which can be amended with updated requests during the year (and in 2010 was amended on multiple occasions) contains tasks and priorities which the FI must perform and to which it must respond. Although such tasks fall within the remit of FI they will not necessarily correspond with priorities FI would set for itself, notwithstanding the fact that FI is consulted as part of the process of preparing the appropriations letter. The letter, and revisions to the letter, introduce a degree of uncertainty in FI’s ability to plan the use of its own resources and also introduces the potential for further strain on FI resources when tasks and priorities set by the government are not consistent with FI’s own assessment. Discussions with staff have indicated that although some government set tasks impose only modest burdens, others have necessitated delay in other supervisory projects meaning that there is a direct impairment of FI’s ability to set its own supervisory agenda. If a supervisory authority is unable to prepare and execute its own supervisory strategy, then its independence is de facto also impaired. The assessors note that the authorities remarked in their comments of April 1, 2011, that “amendments in the appropriation letters hardly have a significant impact on the freedom of FI to allocate its staff independently.” In the view of the assessors the letters ought not to have any impact at all, nor even the capacity to have an impact. Supervisory decision making In the context of independence it is also noted that both FI and the government have powers to issue a banking license (see also CP1(3)). In practice this power has been used only rarely, nevertheless its existence can be seen as impinging on the operational independence of FI as there appear to be no safeguards to ensure, for example, that the government would step in to make a decision only at the request of FI. If the matter involves a matter of principle or particular importance the government and not FI must make the licensing decision. The assessors welcome strongly the confirmation from the MoF (letter May18, 2011) that revisions will be proposed to clarify in future that FI will have sole authority regarding licensing. It is also noted that the Government is also empowered to make a wide range of decision when FI refers the matter to it because there is a matter of principle. I.E., there are more than a dozen references in the Banking and Financing Business Act (BFBA) regarding the potential for a Government role in intervention, sanctions, mergers, revocation, etc. In these instances the law is clear that the referral to the Government depends on FI’s own determination but this arrangement can be seen as undermining the independent authority of FI. The authorities are advised to consider how best to enhance FI’s independence, preserving transparent governance and ensuring that FI is able to deliver its supervisory tasks. In addition, to welcoming the statement from the Ministers of Finance that revisions will be proposed to the law concerning licensing, it is recommended that consideration be given to establishing FI’s legal independence, and also removing the remaining instances in the BFBA where FI may refer matters of principle to government. The removal of the right to refer decisions to the government should not impede FI’s right to seek the opinion of the government when forming its opinion and in coming to its own determination. Resources A discussion on availability of resources is pertinent to very many of the Core Principles, but is presented at this part of the document partly because it is a direct assessment of EC(2) and also due to the fact that access to a sufficiency of resources depends on appropriations from the government which is a facet of the extent to which FI is, or is not, fully independent. Were FI able to set and raise its own budget autonomously and independently this discussion would be more suitably placed at CP20 where the gravest consequences of resource deficiencies are experienced. The assessors very strongly welcome the statement by the MoF (letter May 18, 2011) that there will be proposals put forward in the Budget Bill of 2012 for a substantial increase in resources for FI over a period of three years. Nonetheless, the fact that the proposal for substantially increased resources needs to be made by government underlines the weakness in the current level of resourcing and also of FI’s true independence. The commentary below elaborates on the assessors’ concerns regarding the scale of resources needed in the Swedish system. In view of the scale of the Swedish banking sector in comparison to GDP and recognizing that Sweden is the home state and global consolidated supervisor for a number of regionally and even globally systemically significant banking groups, the Assessors are concerned that there has been a significant underestimate of the level of resources which would be appropriate for FI. Although staff numbers in the banking sector have risen by over a third since 2002, staff turnover remains high (15 percent) with particular vulnerability in the specialist risk units, a factor FI itself acknowledges. There are 70 staff positions for the banking division (not all posts are currently filled) which are divided between line side, specialist risk and legal units. In this context, FI is fortunate to have a cadre including highly experienced and skilled staff but has almost no strength in depth. Meetings with the industry confirmed a consistent view that FI’s resources were stretched and particularly so in the risk areas. Several major firms expressed concern that FI had, for example, lost all or nearly all of the staff who had implemented the Basel II (CRD) regulatory package. The loss of corporate memory and experience from such a major regulatory process is a significant blow in terms of FI’s capacity to deliver effective ongoing supervision. A recent study suggested that while the financial services sector in Sweden is approximately at the median level in size and complexity in Europe, the total staff of the FI is below the median for European Economic Area (EEA) regulators. The survey (funded by FI although carried out by an independent academic) can only be used as an indicator but at the same time objective consideration needs to be given to the minimum resource that can deliver an adequate minimum level of supervision for the systemic and non-systemic sectors of the banking sector alike. At the very minimum a peer assessment between comparable jurisdictions, and also of supervision of comparable systemic institutions should be carried out. Any deficiencies in FI’s resource allocation through such an exercise should then be remedied. Looking to the future, pressures on resources will intensify due to further changes to EU legislation and global agreements on the treatment, including more intense supervision, for significant financial institutions and in particular globally significant financial institutions. Such agreements will be of particular relevance to Sweden given that it is the home jurisdiction for several systemic groups. It is further suggested that the funding model for FI also be reviewed and possible alternatives considered. For example, full autonomy for setting and collecting fees directly might be accorded to FI. Such an approach would be an important signal of FI’s institutional independence and would not undermine accountability of FI. Other alternatives may be also be worthy of consideration. The present institutional arrangements, confirmed by the powers set out in the Budget Act, permit the possibility of indirect influence upon FI through the budgetary process. Conclusion Taking the three main factors into consideration: the influence over the supervisory agenda via the appropriations letter; the lack of clarity over the potential for the government to play a role in supervisory decisions; and the constraint on resources in which FI has limited scope to influence, the assessors are of the view that a rating of MNC is warranted. However, the assessors fully recognize and strongly welcome the statements made by the MoF in its letter of May 18, 2011 and consider that at such time as the proposed changes outlined in the letter are achieved that an upgrade to the rating will be appropriate. | ||||
| Principle 1(3). | Legal framework. A suitable legal framework for banking supervision is also necessary, including provisions relating to authorization of banking establishments and their ongoing supervision. | ||||
| Description | EC1. Pursuant to Chapter 3, Section 8 of the BFBA (2004:297), FI is responsible for processing applications for a license to conduct banking business. FI may withdraw such licenses pursuant to provisions in Chapter 15 of the same Act. Firms applying for license have to pay a cost-based fee. Detailed provisions concerning the licensing process are laid down in Chapter 2 of the Banking and Financing Business Ordinance (2004:329). In addition government has the authority to directly process an application for banking license according to Chapter 3, Section 8 of the BFBA (2004:297). See also Core Principle 3, EC1. The supervisory authority confirms that in practice the government’s authority to license or revoke a license has never been used. The option exists, in practical terms, for FI to escalate a sensitive decision to government. However, the legislation is silent with respect to whether the government would only determine such matters “where they involve a matter of principle or particular importance” only in instances where FI had referred the matter to it. EC2. FI has a mandate to issue binding regulations regarding prudential rules pursuant to Chapter 16, Section 1 of the BFBA (2004:297) and Chapter 5 of The Banking and Financing Business Ordinance (2004:329). The mandates provided by law and ordinance entail that regulation may be issued and changed under devolved authority without any need for legislative changes. FI also has a mandate to issue non-binding guidelines. FI has in recent years established an explicit and transparent process for identifying the need for regulatory changes or modifications. FI consults with market participants and other authorities on proposed changes. It also often invites reference groups, consisting of representatives from the industry, to comment on proposal for new rules during the working process. All rules, (i.e., binding regulations and non-binding guidelines are published in FI’s Regulatory Code and are made public). All the rules by FI are also available on FI’s website. Since autumn 2009 FI has provided public feedback containing the reasoning behind new proposed rules and an analysis of the consequences. FI also publishes important decisions regarding licensing or sanctions on its website EC3. The BFBA (2004:297, Chapter 13, Section 3) requires that credit institutions shall provide FI with any and all information regarding their operations and related circumstances at the request of FI. Moreover, Chapter 16, Section 1 at 5 of the Act provides that either the government or an authority determined by the government may issue regulations regarding information that a credit institution shall provide to FI for its supervisory activities. Pursuant to Chapter 5, Section 2 of the Banking and Financing Business Ordinance (2004:297), regulatory authority on this matter devolves to FI. | ||||
| Assessment | Largely Compliant | ||||
| Comments | The existence of deposit taking companies which are not subject to a full authorization process or on-going supervisory process is a concern and should be remedied. Although Sweden meets the literal terms of the criteria, because the dual powers of FI and the Government in respect of granting and withdrawing banking licenses are clearly established in law there is less de facto clarity on how the powers of the two institutions might operate or interact. The Government has only rarely used its power even in the context of the recent financial crisis. Therefore it is recommended that the potential for lack of clarity in this area be resolved by deleting these powers. See also comments under CP 1(2). The statement by the MoF (letter of May 18) indicating that legislative proposals will be made to clarify FI’s sole authority in the matter of licensing is strongly welcomed. | ||||
| Principle 1(4). | Legal powers. A suitable legal framework for banking supervision is also necessary, including powers to address compliance with laws as well as safety and soundness concerns. | ||||
| Description | EC1. FI is responsible for supervision and rule making (Financial Supervisory Authority Instructions Ordinance (2009:93) and has the power to impose a range of sanctions should a credit institution fail to comply with provisions under the BFBA (2004:297). These provisions are articulated, typically, in the form of high level principles thus giving FI full scope for intervention based on possible concerns. Pursuant to Chapter 15, Section 1 of the BFBA (2004:297), FI has powers to intervene when a credit institution has violated its obligations pursuant to the Act, other legislation governing the operations of the institution, the institution’s articles of association, by-laws or regulations, or internal instructions based on legislation governing its operations. FI must first determine whether intervention is necessary and may, where appropriate, pursue informal action to resolve issues. EC2. As noted under Principle 1(3) EC3 above, Chapter 13, Section 3 of the Banking and Finance Business Act (2004:297) stipulates that credit institutions are to furnish FI with such information as the authority requests, including Board Staff records. In practice the supervisory staff use review of Board minutes as a routine component of their assessment of EC3. FI has a range of measures it may take against credit institutions or its senior management in instances where there have been violations of legal requirements. Based on Chapter 15, Section 1 of the BFBA (2004:297). FI may issue an order requiring a credit institution to take prompt remedial action, including restriction or limitation of business. Action may be taken against senior management (Section 2) and FI may also issue a warning, levy or a fine. Revocation of license is also possible in cases of serious infringements. A remark can be issued in relation to less serious violations, for example such as minor deficiencies in risk management and the internal control. A waning on the other hand is an alternative sanction that can be used when the conditions for withdrawal are fulfilled but when it is considered that a warning would be sufficient to ensure that remedial measures would be taken, that the institution is not likely to repeat the violation and if the prognosis for the institution is good. FI is not required to proceed through the sequence of remarks, warnings and revocation, but can proceed directly to revocation if circumstances warrant it. A fine can only be issued in connection with a remark or a warning. Chapter 15, Sections 2 and 3 of the Act set out specific conditions under which a license shall or may be revoked by FI. Sections 7-9 concerns fines that may be levied in conjunction with FI interventions. FI may levy fines of up to SEK 50 million (approximately US$8million) on a credit institution. | ||||
| Assessment | Largely Compliant | ||||
| Comments | Regulatory decisions made by FI, for example its use of remedial powers, its sanctions, and its power of revocation are subject to challenge and reversal in court. The grounds for appeal are set at a high level and the petition for appeal must be made within three weeks of the decision being made. Supplementary information after the mission from FI clarifies that if the CI appeals and demands that the court stay the execution and if the court decides to stay the execution, the decision cannot be applied until the court has made a determination of the appeal. However given that revocation leads to immediate liquidation, it appears probable that any appeal against revocation would be also accompanied by an appeal that the court stays the execution. It is recommended that due consideration be given to legal amendments to ensure legal certainty regarding FI’s regulatory decisions while at the same time protecting the right of redress and appeal of the party/parties subject to FI’s decisions albeit in a different manner. In Sweden the public disclosure of a remark or warning is perceived to have considerable deterrence. Nonetheless, FI is keen to ensure that it has a flexible toolkit and is examining ways in which it can make better and greater use of the full range of its tools provided for under law than it has to date. The assessors’ contacts with banks suggested that FI’s use of its sanctioning powers is becoming more frequent and assertive. The supervisory authority’s ability to apply qualitative judgment is not explicitly laid out in the legal framework, but nor is it explicitly restricted. Much relevant Swedish law in the field of banking and banking regulation is expressed at a high level and the practice of supervision by FI makes considerable and necessary use of qualitative judgment in order to interpret the demands of the law and carry out its functions. | ||||
| Principle 1(5). | Legal protection. A suitable legal framework for banking supervision is also necessary, including legal protection for supervisors. | ||||
| Description | EC1. The BFBA (2004:297) contains no specific provisions on legal protection for the supervisor or supervisory staff concerning actions taken in good faith in discharge of their duties. In the absence of specific legal provision, general Swedish tort law applies. General provisions on, e.g., the liability of public administrative authorities and their employees are set out in the Damages Act (1972:207). Under this legislation (Chapter 3, Section 2) public administrative authorities are liable for damages resulting from negligence in carrying out their duties. However, case law has set a very high threshold for what constitutes negligence in the discharge of administrative duties. The assessment must have been manifestly wrong for liability to arise. Provisions on the liability of FI’s employees for damages arising from actions that they have taken in the discharge of their duty are also covered by the Damages Act (Chapter 4, Section 1). The Damages Act protects the staff of FI against damages arising from their official duties. FI employees may be held liable for actions taken in the discharge of their duty only if extraordinary grounds for imposing liability exist. Academic commentaries on this provision have held that this entails a presumption that the employee is not liable. EC2. The Damages Act (1972:207, Chapter 4, Section 1) states that the employer normally has to bear the cost of compensation for damage caused by error or mistake by its employees although the employer may seek damages from the employee. FI state that an attempt at recovery of costs or damages would apply only in exceptional circumstances, after taking account of the nature of the action that caused damage, the position of the employee, the interests of the person who suffered damage and other relevant circumstances. FI has liability insurance that covers damage up to SEK 10 million caused by negligence. | ||||
| Assessment | Largely Compliant | ||||
| Comments | FI is of the view that FI itself and its staff are afforded protection against liability for actions and omissions in discharging their duties. However, there is no direct or explicit protection and the possibility exists that staff could be held liable for their actions in carrying out their duties. The assessors recognize that the thresholds for successful legal action are set at a high level and that the cultural environment of Sweden is not strongly litigious, unlike that in some other jurisdictions. There is no indication that FI staff feel vulnerable to liability at a personal or institutional level. The concern is not one of immediate practicality or urgency. Nonetheless, on a more forward looking basis, it should be recognized that cultures, in particular business cultures morph over time. Sweden is an open market economy significantly exposed to influences from other jurisdictions through the inward and outward expansion of cross border groups or even mergers such OMX/NASDAQ. The business climate is not isolated and may be subject to significant change over a period of years. It is recommended, that the authorities review the legal position and that FI be provided with explicit protection for its official actions as an institution, except in cases of gross negligence or willful misconduct, in line with practice in many neighboring countries. It would be helpful to provide similar protection to State and resolution trustees in the case of resolution actions. A further element of the current framework that is noteworthy which may potentially hinder or impede the exercise of powers by staff of FI is the provision granting FI permission to seek damages from the employee, if it has incurred costs in compensating a person for damage caused by error or mistake by its employees. The assessors recognize that such a situation would arise only in exceptional circumstances but the power is inappropriate and should be deleted. Finally, the liability insurance policy maintained by FI appears to be too small, covering only damages caused by negligence of up to SEK 10 million. Were there to be an action for recovery of losses arising through a failed bank, insurance company or securities firm, this coverage would be negligible. | ||||
| Principle 1(6). | Cooperation. Arrangements for sharing information between supervisors and protecting the confidentiality of such information should be in place. | ||||
| Description | EC1. The Financial Supervisory Authority Instructions Ordinance (2009:93) imposes duties of cooperation with the RB and the Swedish Civil Contingencies Agency on issues relating to the Crisis Management and Enhanced Preparedness Ordinance. FI shall also consult with the RB significant issues relating to the stability of the payment system or to the RB’s responsibility for currency and credit policy and for the payment system. FI shall also consult with such foreign authorities as have the competence to exercise the supervision of the financial markets and of financial companies. Correspondingly, the RB has obligations to consult with FI in matters of major importance concerning the payment systems or involving FI’s supervisory activities (RB Act, 1988:1385, Chapter 4, Section 3). FI has an agreement with the SNDO, which administers the deposit guarantee system clarifying what information FI will pass to the Debt Office either on demand or as a matter of course, as relevant. There is a MoU between the tripartite authorities (FI, RB, and the MoF) last updated in 2005. In 2009, on the basis of revisions to EU legislation, the MoU was enhanced and signed by FI, the MoF, and the SNDO. The 2005 MoU sets the framework for cooperation concerning financial stability, crisis resolution and information exchange. The established guidelines for consultation and the exchange of information between the parties in the areas of financial stability and crisis management. The Domestic Standing Group—a non-decision making body formed on the basis of the MoU—was broadened to include the Debt Office In practical terms the MoU establishes the seniority of attendance and frequency of meetings of the authorities. The MoU also addresses specific cooperation issues (e.g., between FI and RB) and the division of responsibilities in relation to their respective mandates for financial stability and crisis resolution. During the financial crisis the DSG authorities met with high frequency (often daily) but the periodicity of meetings has now extended. Its minimum frequency is quarterly. FI also has a MoU with the Swedish Consumer Agency. EC2. Under EU legislation gateways exist for the provision of supervisory information between EU supervisory authorities. Gateways governing the exchange of information were made at EU level in directive 2009/111/EC (“CRD2”) which Sweden will implement in the course of 2011, further widening gateways for the provision of information between authorities in the EU. CRD2 also creates a requirement for supervisory authorities to establish colleges of supervisors for EEA banks. With respect to non-EEA countries, a bilateral cooperation agreement is not a precondition to exchange information with an authority of another country given that FI may, on request, disclose information to an authority if the Public Access to Information and Secrecy Act does not hinder a disclosure. However, a bilateral agreement facilitates exchange of information between the authorities and may specify how information may be exchanged on a regular basis, as for example with the Nordic Baltic MoU. Sweden has a range of MoUs with non-EEA countries. A cooperation agreement on cross-border financial stability, crisis management and resolution was signed in August 2010 between relevant Ministries, Central Banks and Financial Supervisory Authorities of Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway, and Sweden, establishing a Nordic/Baltic Stability Group (NBSG). The NBSG held its first meeting in November 2010 where it established four working groups addressing issues ranging from identification of and data gathering on systemic institutions, resolution tools, consideration of financial stability and crisis prevention and burden sharing. As the operation of the NBSG proceeds to greater maturity it should form an important broader support for the effective operation of cross border supervision and cooperation. EC3. FI is an integrated supervisory authority and thus has no domestic supervisory authority with whom it needs to exchange information. The BFBA (2004:297) states that FI shall cooperate and exchange all information necessary as provided for in EU-legislation which is binding in Sweden. The EU directive provisions ensure that confidentiality of information must be protected and that information provision must be for supervisory purposes. Hence, for example, under the Public Access to Information and Secrecy Act (2009:400), confidential information may only be provided to a foreign authority if this is regulated in law or regulation, or, if the information could be provided to a Swedish authority. As information exchange between supervisory authorities is regulated by EU legislation, which is binding on Sweden, FI is able to effectively provide confidential information to other supervisory authorities. Information FI has received in accordance with an agreement with a foreign state and where the agreement (including EU directives) is approved by Parliament that information is governed by the confidentiality provisions of the Public Access to Information and Secrecy Act (2009:400). This means that information provided to FI by virtue of information gateways that were created under EU legislation, whether the other authority is EEA or non-EEA, are protected by Swedish law confidentiality provisions. It does not require individual MoUs to be approved by Parliament. Both confidential and non-confidential information is exchanged on an on-going basis within the colleges of supervisors. Assessors reviewed information packages that were shared and noted the regularity and frequency of college meetings at which the information was discussed. EC4. General secrecy provisions regarding financial markets are set out in the Public Access to Information and Secrecy Act (2009:400). A large proportion of the information held by FI is confidential under provisions of this act and may as such not be disclosed. On the other hand, non confidential information must be disclosed to citizens, or (under Chapter 6, Section 5) to another Swedish authority upon request. There is no corresponding provision regarding foreign authorities. Precedent under case law has established that an individual member of parliament does not have the right to obtain information subject to confidentiality (RÅ 1992 not. 188). The provisions of the Public Access to Information and Secrecy Act (2009:400) determine whether the information is confidential or not. Confidentiality provisions include, but are not limited to, information pertaining to business affairs of a supervised entity, as well as the business or personal affairs of someone who has dealings with the supervised entity (Section 4); information about an individual’s business or personal affairs in the context of fit and proper tests (Section 5); and information given to FI by other competent authorities pursuant to an agreement (Section 7); information related to deposit guarantee (Section 10); information on state support of credit institutions (Section 12). However, the act also contains gateway provisions in particular situations (Chapter 10, Section 15). Confidentiality restrictions do not therefore prevent information from being submitted to the parliament or the Government. FI cannot deny information to the Government unless there is a legal restriction governing this information. Restrictive provisions of this nature may exist in certain international agreements, and as a result FI is by law prohibited to provide such information in breach of the agreement to the Government. Information can be given to a prosecuting authority in the context of a criminal investigation pursuant. In this latter case, the secrecy provisions do not prohibit disclosure of confidential information to prosecutors or police if a penalty of imprisonment may be imposed for the crime under investigation. In relation to foreign authorities FI may use its own discretion. Confidential information received from another competent authority in an EEA country is protected by general secrecy provisions concerning confidential information received from other states, without the necessity of specific statutory provisions to this effect (see prop. 2006/07:5 s. 349 f. and prop. 2006/07:115 s. 516). | ||||
| Assessment | Compliant | ||||
| Comments | There are gateway provisions for the exchange of information between the principal domestic authorities with any responsibilities with respect to financial stability. When Sweden implements the revision to the EU CRD (CRD2) it will at that time widen and reinforce its gateways for information exchange both between supervisors (domestic and non domestic) and other relevant domestic authorities, particularly in respect of crisis management situations. Sweden intends to implement CRD2 in 2011. Information gateways have been broadening over a period of years in the EU with the more recent focus been on ensuring adequate flow of information and cooperation in the fields of financial stability, crisis management and resolution, both domestic and cross border. The 2010 CEBS peer review found Sweden to “have fully applied the requirements for information exchange.” In common with other EU jurisdictions, therefore, the Swedish authorities face the challenge of determining how financial stability objectives can be most effectively delivered and support the practice of effective banking supervision. The effectiveness of cross-border cooperation agreements is commented on in CP25. | ||||
| Principle 2. | Permissible activities. The permissible activities of institutions that are licensed and subject to supervision as banks must be clearly defined and the use of the word “bank” in names should be controlled as far as possible. | ||||
| Description | 1, 2. The term “bank” is defined in the BFBA (Chapter 1, Section 5) as comprising banking companies, savings banks and members’ banks. Further, a “banking company” is defined as “a limited liability company licensed to conduct banking business.” (NB: The term “bank,” as defined, is distinct from the term “credit institution” (CI), the latter term being broader in scope. A CI is a bank or a credit market undertaking (Sw. kreditmarknadsföretag). Banks—but not credit market undertakings—may carry out “banking business” (BFBA (Chapter1, Section 3). As explained below, the definition of a “bank” in Sweden relates to payment services and acceptance of short term deposits. Both banks and credit market undertakings may carry out “financing business” (BFBA (Chapter 1, Section 4). As Financing business (see below) corresponds to the activities that “CIs” may carry out pursuant to Article 4.1.a) of the EU Credit Institutions Directive (2006/48/EC).) Both banks and credit market undertakings are CIs for the purposes of the EU legal framework and both are also subject to the BFBA’s prudential requirements, hence both forms of institution are licensed and supervised. A credit market undertaking is therefore a form of credit institution that meets the terms of the EU directive (accepting deposits from the public and making loans) but which is not a bank as defined under Swedish law. “Banking business” includes (i) payment services via general payment systems and (ii) receipt of funds which, following notice of termination, are available to the creditor 30 days or less. Banks may engage in activities other than banking business (BFBA Chapter 7, Section 1). A CI may only conduct financing operations and operations naturally connected therewith, including, inter alia:
The term “financing business” (BFBA Chapter 1, Section 4) means (i) to accept repayable funds from the public and (ii) to grant loans and guarantees. Firms carrying out only financing business, as opposed to banking business, are referred to as “credit market undertakings.” Banks and credit market undertakings are collectively referred to as “CIs” (see above). 3. The word “bank” may only be used by banks, RBen, the General Mortgage Bank of Sweden and foreign CIs (BFBA Chapter 1, Section 9). Minor exceptions to the general rule are set out in the same provision. The BFBA (Chapter 10, Section 35) provides that banking companies shall use the word “bank” in their name. There are no corresponding provisions in law concerning use of “credit market undertaking.” 4. The substantial majority of all deposits (98.0 percent) are held by banks. However, other categories of institutions are allowed to take deposits. These primarily include credit market undertakings (BFBA Chapter 1, Section 4) and—in the context of securities business—securities firms (SMA Chapter 2, Section 2) to the extent necessary for facilitating securities trading (prop. 2006/07:115 p. 326). Deposits with all these institutions are covered by the Deposit Guarantee Scheme. Deposits (up to SEK 50,000) may be taken by deposit companies under the Deposits Business Act. Such deposits (extremely limited) are not covered by the Deposit Guarantee Scheme.) 5. The Companies Registration Office keeps records of banks, savings banks, members’ banks and foreign banks with branches in Sweden. FI’s website also lists licensees (banks and credit market undertakings as well as foreign CIs active in Sweden). | ||||
| Assessment | Largely Compliant | ||||
| Comments | Permitted activities are clearly defined and use of the word “bank” is protected. However, deposit taking is not reserved for entities licensed and subject to supervision as banks. | ||||
| Principle 3. | Licensing criteria. The licensing authority must have the power to set criteria and reject applications for establishments that do not meet the standards set. The licensing process, at a minimum, should consist of an assessment of the ownership structure and governance of the bank and its wider group, including the fitness and propriety of Board members and senior management, its strategic and operating plan, internal controls and risk management, and its projected financial condition, including its capital base. Where the proposed owner or parent organization is a foreign bank, the prior consent of its home country supervisor should be obtained. | ||||
| Description | 1. FI is responsible for processing applications for a license to conduct banking business (BFBA Chapter 3, Section 8). (NB: The government is to determine certain matters relating to licensing or approval of amendments to a CI’s articles of association if these involve a matter of principle or of particular importance. Where the Government takes a decision in respect of a license, FI shall submit its opinion (BFBO Chapter 1, Section 4). Decisions on applications for a banking license are, in practice, always taken by FI. The government has not decided on any license application since the BFBA’s enactment (2004). (Detailed provisions on the licensing process are laid down in the Banking and Finance Business Ordinance (BO Chapter 2)). FI’s guideline FFFS 2004:9 sets out required information and documents to be provided when applying for a banking license: FFFS 2005:1 lays down what has to be met on internal controls and risk management issues; FFFS 2007:1 provides criteria concerning the capital base (and supplements the CALE Act. 2, 3. The BFBA (Chapter 3, Section 2) sets out at the principle level those criteria to be met by an undertaking in order for it to receive a license to carry out banking or financing business. FI’s scope of supervision is also stated (BFBA Chapter 13, Section 12): “With respect to a credit institution, the supervision shall ensure that the business is conducted in accordance with:
In addition, FI shall also ensure that the owners and management of the credit institution fulfill the suitability requirements in this Act.” The task of supervision is thus inter alia to ensure that CIs continually fulfill all licensing criteria required in the BFBA. 4. A banking license may only be approved if the general conditions in the BFBA, the BO and the criteria in FI’s regulations and guidelines are met. If not, the application is to be rejected (e.g., an application was rejected in June 2010 on grounds that the owners and Board members did not meet “fit and proper” requirements). 5. An overarching objective when examining an application is to determine that the proposed legal, managerial, operational and ownership structure of the CI and its wider group will not hinder effective supervision, on both a solo and a consolidated basis (e.g., FI will not accept an unclear and non transparent ownership structure or the outsourcing of all core business). 6. FI identifies and determines the suitability of major shareholders (a “major shareholder” being one with a direct or indirect ownership in an entity representing 10 percent or more of the equity capital or of all voting participating interests or otherwise rendering it possible to exercise significant influence over its management). In assessing “suitability” a person’s reputation and financial strength are to be taken into consideration. FI assesses the ownership structure’s transparency and the source(s) of initial capital. Based on the intending acquirer’s economic and financial condition, the investigation’s primary focus is on the acquirer’s ability to finance the acquisition and, where applicable, to maintain or promote a financially sound structure of the business. 7. The BFBA provides that banking companies shall have an initial capital of not less than five million euros (Chapter 3, Section 5); savings banks not less than one million euros (Chapter 3, Section 6); members’ banks and credit market undertakings not less than five million euro (although those intending to pursue only small-scale operations may be allowed a lower initial capital, but not less than one million euro (Chapter 3, Section 7). 8. Under the BFBA (Chapter 3, Section 2) any person who is to serve on a CI’s Board of Directors (Board) or as Managing Director (CEO), or be an alternate in these functions, must possess sufficient insight and experience and be suitable (reputation and financial strength are also taken into consideration). The Swedish rules have been enacted to transpose relevant EU legislation on, e.g., fit and proper tests of Directors and senior management in CIs (see EU Directive 2007/44/EC). FI’s regulation FFFS 2009:3 details the fit and proper test. The assessment includes whether the person concerned has skills and experience in relevant financial operations commensurate with the CI’s intended activities, any potential for conflicts of interest, and any record of criminal activities or adverse regulatory judgments that make him/her unfit to hold important positions in a CI. FI gathers information from the Tax Authority, Police and the Companies Registration Office. Not all members of a CI’s senior management [for example senior executives at the c-level, chief financial officer (CFO), chief risk officer (CRO), chief operating officer (COO)] are subject to such fit and proper tests. While companies’ applications often include a CV of senior management at the c-level for FI’s information, FI considers that it is not entitled to deepen its analysis and believes that a legislative amendment is required for it to be able to conduct a “fit and proper” assessment of senior management beyond the CEO. 9. The entity’s application must also include the business statutes and the operating plan complemented by, inter alia, an organization chart, a description of outsourcing arrangements, information on the proposed Board and CEO and the written procedures on internal governance, information and control and the procedures against money laundering and terrorist financing (AML/CFT). In regard to internal governance and information and control, the description on monitoring and management of risk (credit, operational, interest rate, foreign exchange and liquidity) is of particular interest to FI in the licensing process. FI reviews that the information received is in accordance with the principles set out in laws, regulations and guidelines, working with a checklist to make sure that there is an accurate review of the applicant. 10. A1. Pro forma financial statements and projections for the next three years for the CI and, if applicable, the group of which it is going to be a part, must be presented for FI’s review. An analysis of capital requirements must be included and reflect the scope and nature of the planned business. FI assesses the major shareholders’ current financial strength and, as well, their capacity to support the proposed strategic plan going forward. 11. CIs from EEA countries may conduct business in Sweden under the “passporting” regime in relevant EU directives (BFBA Chapter 4, Sections 1-3). A CI from a non-EEA country may be granted a license to operate through a branch in Sweden, provided inter alia that it is subject to satisfactory supervision by a competent authority in its home state, and that this authority consents to such establishment in Sweden (BFBA Chapter 4, Section 4). A license is needed to establish a subsidiary CI in Sweden, be the parent based in an EEA state or not. A license may only be approved if the close relation to the parent company does not obstruct FI’s supervision. Further, where the parent company is a CI, then FI will consult with the competent authority within the EEA. A MoU with a foreign authority is needed for exchange of information and is integral to FI’s assessment of whether the home supervisor practices global consolidated supervision. 12. There are no grounds under the BFBA for FI to revoke a license where a CI is found to have obtained a license through false information or other irregularity. This is surprising given that the CRD (Article 17(1) (b)) determines that “the competent authorities may withdraw the authorization granted to a credit institution only where such an institution has obtained the authorization through false statements or any other irregular means.” However, FI notes that if the false information still applies—and in particular if it becomes clear that use of correct information would put the CI in breach of laws or regulations—then FI can order the CI to make corrections or, if necessary, decide on sanctions via a warning, penalty or license revocation. Furthermore, FI considers that general principles of Swedish administrative law enable it to take actions if it finds out after the fact that its original decision was based on false information. On this basis, a favorable licensing decision given by FI could be overturned if obtained through false information or deception. 13. Both during the licensing procedure and thereafter FI evaluates the competence of the Board (collectively) and the CEO. For an entity to be granted a banking license, a person who is proposed as a Board member or CEO, must have sufficient knowledge and experience of participation in the governance of a CI and also be suitable for such task. If during on-going business those criteria are no longer met, FI may appoint a new person as a Board member or CEO or, in the extreme revoke the CI’s license. Information for the fit-and proper test has to be provided to FI in the application for a license and whenever a change takes part during on-going business. During on-going supervision FI reviews the work done by the Board and CEO. A2. FI monitors new entrants’ performance against projections by on site investigations within a year from the start up. FI mainly collects information and financial data from companies’ periodic reporting but there is no specific process for new entrants. | ||||
| Assessment | Largely Compliant | ||||
| Comments | FI has power to set criteria and reject applications from entities that do not meet the standards set. The licensing process consist of an assessment of the ownership structure and governance of the CI and its wider group, including the fitness and propriety of Board members and CEO (but not other members of senior management (EC8)) its strategic and operating plan, internal controls and risk management, and its projected financial condition, including its capital base. It is a significant weakness that FI does not have powers to assess the individual senior management (EC8) and should be remedied. Where the proposed owner or parent organization is a foreign bank, FI contacts the home country supervisor for its comments on the licensing application. The fact that a CI is found to have obtained a license through false information or other irregularity is not in itself sufficient grounds for FI to revoke the CI’s license. This is a weakness in the statutory provisions notwithstanding the general administrative law principles that FI considers apply in this case. | ||||
| Principle 4. | Transfer of significant ownership. The supervisor has the power to review and reject any proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties. | ||||
| Description | 1. The BFBA (Chapter 1, Sections 5, and 14) defines a “qualifying holding” as a “direct or indirect ownership in an undertaking, where the holding calculated in the manner set forth in Section 5a represents 10 percent or more of the equity capital or of all voting participation interests or otherwise renders it possible to exercise a significant influence over the management of the undertaking.” (NB: the BFBA’s unofficial translation uses different terms (“qualified holding”: Chapter Sections 5 and 5a; “qualifying holding”: Chapter 14, Section 1) for the same Swedish term (“kvalificerat innehav”). 2, 3. With minor specified exceptions, the intending acquirer must file an application for FI’s prior consent to obtain a qualifying holding (and to increase any qualifying holding to above 20, 30, and 50 percent of the share capital or voting rights) in a CI. The BFBA (Chapter 14, Section 1, 2, and 6) provides FI power to reject any proposal for a change in a qualifying holding or prevent exercise of voting rights in connection therewith if it does not meet criteria comparable to those used in approving new CIs. 4. When a CI learns that its shares or participation interests have been acquired/ divested in such amount as to make the buyer’s or seller’s holdings go above or below the numerical limits referred to in the previous two paragraphs (qualified holdings director/ indirect) it must forthwith notify FI. A CI must also file an annual report on those with qualified holdings; FI is entitled to request such information from a CI at any time. 5. FI may decide that “unapproved” owners of qualified holdings may not represent the shares at the shareholders’ meeting and instead apply to a district court to appoint a trustee to represent such holdings (BFBA Chapter 14, Sections 6, 7, and 9). Moreover, FI may order divestiture of shares sufficient to render a holding as no longer ldquo;qualifying.” A1. There is no requirement in law or regulation—and nor does FI ensure—that CIs must notify FI upon becoming aware of any material information that may negatively affect the suitability of a major shareholder. | ||||
| Assessment | Compliant | ||||
| Comments | It would be constructive for CIs to have an obligation to notify FI forthwith upon becoming aware of any material information that may negatively affect the suitability of a major shareholder. | ||||
| Principle 5. | Major acquisitions. The supervisor has the power to review major acquisitions or investments by a bank, against prescribed criteria, including the establishment of cross-border operations, and confirming that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision. | ||||
| Description | 1-6. FI’s prior authorization is only required when the consideration for an acquisition exceeds 25 percent of a CI’s capital base (BFBA Chapter 7, Section 12). Neither laws nor regulations provide explicit, detailed criteria by which to judge individual proposals presented for approval. There is the general statement: “Authorization shall be granted unless it can be assumed that the acquisition will result in the violation of this Act or other statutes.” (BFBA Chapter 7, Section 12) and it may be inferred that this is a reference, inter alia, to BFBA Chapter 6 “General provisions regarding the business of a credit institution” (e.g., Chapter 6, Section 1: “A credit institution’s operations shall be conducted in such a manner that the institution’s ability to perform its obligations is not jeopardized. In such context, the institution shall ensure that it possesses satisfactory internal controls:” and Chapter 6, Section 2: “A credit institution shall identify, measure, manage, internally report and have control over the risks associated with its operations”). Besides these largely generic statements, a CI may only possess such property as it needs for its own business operations and there are statutory limits and prohibitions governing various types of acquisition/investment that appear designed to prevent exposure to undue risks (BFBA Chapter 7, Section 2). In particular:
Moreover, a CI (subject to the limitations on non-financial acquisitions/investments cited immediately above) may only engage in “financing operations and operations naturally connected therewith” thereby limiting the risks that nonbanking activities may pose. The risks of non-financial activities are to be dealt with in a CI’s internal capital adequacy assessment process (ICAAP). FI seeks to evaluate every CI’s ICAAP annually (this target has on occasion been missed due to pressure of other work) and if FI considers that due to non-financial activities a CI does not meet statutory requirements regarding risk management, transparency and soundness, it may impose a higher capital requirement or an order to reduce the risks (BFBA Chapter 15, Section 1) (CALE Chapter 2, Section 2). | ||||
| Assessment | Materially Non-Compliant | ||||
| Comments | It is recognized that FI’s relationship with licensees is likely to result in consultation before many of the incidents contemplated by CP 5 occur. However, the notification limit is set at “more than 25 percent” of the CI’s capital base as stated in Chapter 7, Section 12 of the BFBA, which gives broad latitude for acquisitions/investments to escape FI’s review. (Moreover, there are no precise criteria by which to judge even those individual proposals that must first be referred to FI for prior approval.) There is no requirement, for example, that a CI either establishing a “financing operations” subsidiary or making a strategic investment in such an entity in a non-EEA country is obliged to notify FI, either before or after the event, so long as the capital base quantum limit is not breached. (In contrast, there is the requirement that for a Swedish bank either opening a branch or establishing a subsidiary in an EEA country prior notification to FI must occur; establishment of a branch in a non-EEA country requires that FI first grant a license. It is, however, in any case inappropriate for FI to be in a position where it is dependent on another competent authority to inform it of an acquisition that is planned by one of its own supervised institutions.) FI cannot formally prohibit banks from making fairly major acquisitions/investments (including establishment of subsidiaries) in countries with secrecy laws or other regulations prohibiting information flows deemed necessary for adequate consolidated supervision. This also means that FI cannot, from the outset—determine whether an investee bank has adequate financial and organizational resources to handle the acquisition/investment. Certainly, FI has corrective means available for use “after the fact”—but that is not the thrust of CP5. In practice, corrective action after the fact will often be problematic. Obliging institutions to divest recent acquisitions, for example, may result in substantial reputational damage and possible book losses (eroding the institution’s capital base). Moreover divestiture will only be successful if any interested buyers are available. | ||||
| Principle 6. | Capital adequacy. Supervisors must set prudent and appropriate minimum capital adequacy requirements for banks that reflect the risks that the bank undertakes, and must define the components of capital, bearing in mind its ability to absorb losses. At least for internationally active banks, these requirements must not be less than those established in the applicable Basel requirement. | ||||
| Description | 1, 2. A1 A2. Sweden has implemented the EU directives concerning CALE (2006/48/EG and 2006/49/ EG). The EU directives (and thus Sweden’s regulations) closely track the Basel II framework both as regards calculation of capital requirements for the various risk exposures and for composition of the capital base. The Swedish definition of capital base requires deduction of both goodwill and deferred tax assets. The capital base is to be at all times more than or equal to the sum of the capital required for each of the Pillar 1 risk types (credit, market and operational). The capital adequacy regulations apply to all CIs (and additionally to investments firms) on a standalone basis and also at the level of financial group. For application at group level there are rules to determine which individual firm in the group is responsible for calculation of the capital base, the capital requirements and supervisory reporting. 3, 4. FI has power to order a CI or financial group to limit its operations in any respect, which includes requiring the CI to exit a business line. On capital charges, if there is a material risk not adequately covered by the normal rules for Pillar 1, FI can demand and has demanded more capital by a decision to raise the CI’s level or by an understanding under the SREP. Formally, this remains a general charge on the entity, not on a specific risk position. FI would inform the CI that the reason for the higher charge is a particular material risk exposure and that the overall charge would be lower if that risk exposure was reduced. While the minimum Pillar 1 capital ratio (8 percent) is the same for all, the risk weighted exposure amount (i.e., the denominator in the calculation) reflects the risk profile of each CI. Rules for calculation of risk weighted exposure amounts are, as mentioned above, determined on Basel II specifications. Rules for calculation of risk weighted exposure amounts are specified in FI’s Regulations and General Guidelines governing CALE (FFFS 2007:1 Chapter 11, -61). Both on and off-balance-sheet items are included in the calculation of risk weighted exposure amounts (see e.g., FFFS 2007:1 Chapter 15, Section 3, and Chapter 22 using the standardized method for credit risk; Chapter 40. using the internal rating-based approach (IRB) method for credit risk and Chapter 13, Section 66 for off balance sheet items in the trading book). 5. As noted above, Sweden applies the general Basel II capital adequacy requirements on a financial group level and on a solo level for Swedish CIs. The Basel II capital requirements are applied on a solo level in most entities within the Swedish financial groups, but where a non Swedish entity belonging to a Swedish financial group is located in a country which does not apply Basel II, different capital adequacy requirements are applied for this entity, on a solo basis. Some of the largest Swedish CIs operate in geographic areas of higher perceived risk and have FI’s permits to apply internal models in the calculation of Pillar 1 capital, the implication being that the capital adequacy models take the conditions in those areas into account. Where a CI does not have a permit to use an internal model and FI assesses that the standardized Pillar 1 rules do not sufficiently reflect the risk in a particular jurisdiction, then those risks are deal with in Pillar 2. 6. Where a CI or financial group fails to fulfill the requirements of the law or regulations (CALE Chapter 12, Section 1-3) FI must order the CI or the undertaking in the financial group which is to prepare the consolidated accounts (CALE Chapter 10, Section 12) to limit its operation s in some respect within a certain time, to reduce the risks therein or to take any other measures to rectify the situation (provisions regarding intervention also apply; BFBA Chapter 15). Breaches of capital requirements are reportedly rare and there is no recent case where an order has been made. There have, however, been instances where CIs have fallen below the minimum capital requirement but corrected the infraction immediately. To prevent such situations arising, FI requires CIs to have a margin between their actual capital base and their absolute minimum level. FI tracks quarterly prudential reporting and contacts those CIs (approximately 15 annually) approaching the minimum requirement to ensure that an updated capital adequacy plan is in place. 7. FI permits CIs to use internal models to compute regulatory capital (see CALE Chapter 4, Section 7 IRB for credit risk; Chapter 5, Section 3 for own risk calculation models for position, forex and commodity risks included in market risk (VaR models) and Chapter 6, Section 6 for the advanced measurement approach (AMA) to operational risk. CIs must adhere to qualifying standards to receive permits to se internal models (see CALE Chapter 4 Section8; Chapter 5, Section 3; Chapter 6, Section 7). Failure to meet the qualifying standard likely results in revocation of the permit. To make significant changes in an internal model, CIs must first apply for a method change to FI and receive a permit before implementing any change. Besides reasonableness checks of the size of the regulatory capital requirement per risk type, which is performed as part of the annually SREP:
To date, FI has never had to revoke an internal model as any observed deficiencies have received prompt attention. Seven CIs have permits to apply the IRB Foundation approach for credit risk and one the advanced approach Chapter One CI has a permit to apply the AMA. Three CIs have permits to apply their own market value-at-risk (VaR) model for position, forex and /or commodity risks. A3. As respects supervisory power to require CIs to adopt a forward looking approach to capital management and set capital levels in advance of possible events, reference is made to BFBA Chapter 6, Section 3: “A credit institution ....shall at a minimum, have methods which enable it to regularly value and maintain a capital, which in terms of amount, class and allocation is sufficient to cover the type and level of the risks to which it is, or may become exposed.” This approach includes Pillar 1 risks but additionally covers an open ended span of risks which may or may not be important to the individual CI (Pillar 2 risks). Pillar 2 capital requirements are assessed by FI as part of the SREP. CIs do their corresponding assessment under the ICAAP. How the SREP operates and what kind of results it leads to is described in FI’s memorandum “Method for Supervisory Review and Evaluation Process (SREP)” March 1, 2008. Inter alia, it explains that both scenario analyses and stress tests are used to simulate possible events or market changes that could have an adverse effect, which should be reflected in the overall capital assessment. FI does not permit the recognition of diversification effects in the stress tests that the institutions carry out and it will assess and comment on the severity of the stress testing and assumptions employed by the institutions. A4. As Pillar 1 capital requirements apply to both individual firms on a standalone basis and at the level of financial groups, the requirement on adequate distribution of Pillar 1 capital within the group is satisfied. An adequate distribution of non-Pillar 1 capital, including capital buffer is also made across foreign subsidiaries and assessed annually by FI and the host supervisory authorities of the subsidiaries. FI makes no regular assessment of the distribution of non-Pillar 1 capital across Swedish CIs’ subsidiaries located in Sweden. A5. CALE (Chapter 2, Section 2) provides that if a CI breaches any of the general requirements laid down in BFBA (Chapter 6, Sections 1-3, 4a, 4b, and 5) and if it is unlikely that any other measure would be sufficient to make the CI rectify the situation, then FI must determine a minimum for the capital base that is higher than that which would result from the general rules. FI has never used this formal power. Breaches of important legislative requirements are discussed with management to obtain a reasoned agreement on remedies. These likely include improvements to governance and risk management and also capital strengthening, either via additional capital or by reduction of the level of risk. Increased reporting requirements are also included. Depending on when the problems are identified, the discussions are included in the SREP and the determination of Pillar 2 requirements. FI supplemented its original self assessment to state that it maintains a dialogue with the systemic institutions as well as those that are close to the formal Pillar 1 minimum capital requirements and that discussion with management is not the only measure that may be taken. All recent cases of breach of minimum capital level have been investment firms rather than banks but FI responded within two weeks by prescribing, by letter, that the institution should take action to restore capital adequacy levels. | ||||
| Assessment | Compliant | ||||
| Comments | It is noted that the overall level of capitalization of the Swedish banking system is high. Within the context of a system that is highly concentrated in a handful of firms, the robustness of the supervisory processes assessing the internal models of approved firms (nine firms have IRB approvals) is at a high premium. It is welcome that FI will monitor IRB permissions that have been granted on an annual basis from 2011, but it should be noted that such assessments should already have been routine practice. FI are encouraged to maintain momentum on documenting their internal guidance to ensure consistency in models assessment. SREP is the main supervisory process undertaken by FI (see also CPs 19 and 20). It is FI’s objective to perform a SREP annually for all CIs. Although compliance with this target has been high, it has not been complete. For the systemic institutions the SREP is a more intensive process than for the smaller firms. In all cases firms the annual SREP is concluded with a sign off letter from FI detailing findings, for example including FI assessment of the rigor of the firm’s stress testing, and expected remedies. For the systemic firms and some of the smaller firms there will also be meetings to discuss these findings. Capital add-on techniques are used but uncommon. For a number of Pillar 2 risks capital is not the first best remedy, but FI should be ready to apply differentiated capital requirements as necessary, and promptly should the context require it. FI needs to be mindful of the fact that a Pillar 1 approach, while risk weighted and therefore to an extent risk sensitive, will not necessarily capture the severity even of the Pillar 1 risks to which an institution is exposed. | ||||
| Principle 7. | Risk management process. Supervisors must be satisfied that banks and banking groups have in place a comprehensive risk management process (including Board and senior management oversight) to identify, evaluate, monitor and control or mitigate all material risks and to assess their overall capital adequacy in relation to their risk profile. These processes should be commensurate with the size and complexity of the institution. | ||||
| Description | EC1. BFBA (Chapter 6, Section 2) requires that a CI must identify, measure, manage, internally report and have control over the risks associated with its operations. In this respect, it shall ensure that it possesses satisfactory internal controls and that credit risks, market risks, operational risks and other risks taken together do not entail that its ability to fulfill its obligations is jeopardized. Such requirements are to apply in proportion to the type and scope of the CI’s operations and to their degree of complexity (BFBA Chapter 6, Section 4a). During the licensing process, FI collects and carefully reviews extensive information about the proposed CI’s risk management process. In particular, the business plan should contain a description of the manner in which the CI will handle the risks (credit, market, liquidity, operational) associated with its business. The CI shall, at a minimum, have methods which enable it to regularly evaluate and maintain a capital which, in terms of amount, class and allocation is sufficient to cover the type and level of risks to which it is, or may become, exposed. CIs must evaluate these methods to ensure that they are comprehensive (BFBA Chapter 6, Section 2). In the on-going supervisory process, risk management policies and processes are reviewed at least annually in the SREP. This is based primarily on the CI’s ICAAP which should include information about:
(FI memorandum “Method for Supervisory Review and Evaluation Process (SREP)” March 1, 2008). The CI’s risk management processes are also reviewed through FI’s on-site examinations of different risk or business areas… Normally, when FI receives a signal about weaknesses in the risk management process of a CI, these results in an on-site examination to follow up if any corrective action is needed. If deemed necessary FI has the power to require a CI to strengthen the risk management processes or to raise more capital or to force it to scale down or exit some activities in order to reduce its risk profile (BFBA Chapter 15, Section 15 1-3; CALE Chapter 2, Section 2). EC2, 4. FI’s General Guidelines governing CALE (FFFS 2007:1) require all CIs to have a risk management process which covers all risk areas. Moreover, the Guidelines make the Board responsible for approving policies and instructions, for setting overall limits and for defining the risk appetite. The Board is also responsible for monitoring senior management, the latter being responsible for implementation of policies and instructions in the organization. Senior management has the responsibility for setting in place an organizational structure which contains a function for risk control with capacity and resources to implement tools to identify and evaluate the risk. In addition, senior management should ensure that reporting lines are implemented and that the reports provide the necessary and timely information for managing (and mitigating) the risks. In its supervisory process, FI assesses the involvement and role of the Board in deciding the risk appetite and strategy of the CI. Reading of Board minutes and risk reporting to the Board as well as reviewing the Board-established risk policies, mandates and limits are part of FI’s ongoing supervision through the annual SREP. In its supervision of the four systemic institutions, FI has regular biannual meetings with Internal Audit and Compliance functions to discuss their findings regarding compliance with regulations and internal policies and instructions. For smaller institutions, these functions are interviewed in the course of on-site examinations or the annual SREP. EC3. In on-site examinations, FI checks the level and appropriateness of risk management documentation as well as whether the responsibility for its updating and reviewing is satisfactorily stated in policies approved by the Board. For each risk area, FI has defined the requirement regarding documentation of policies, processes and distribution of responsibilities. As regards exceptions to established policies, processes and limits receiving the prompt attention of—and authorization by—the appropriate level of management, an illustrative example is found in the regulation for CIs permitted to IRB for credit risk: “The institution shall have documented principles for when it is permitted to override a mechanically calculated rating as well as for the approval procedures for such departures. Institutions shall individually document all overrides from the mechanically calculated risk grade. The institution shall in particular analyze and document the outcome of these overrides in accordance with the same principles as prescribed in section in Section 28. With respect to exposures to governments, institutions and corporations, the credit officer shall at all times make a qualitative assessment of the suitability of the grade indicated by the mechanical method (FI: Regulations and General Guidelines governing CALE (FFFS 2007:1 Chapter 44, Section 17).” FI’s most common method to verify that such exceptions are handled in a correct manner, is by reading the annual internal audit report. EC5. A CI is required to have in place sound, effective and complete strategies and processes to assess and maintain on an ongoing basis the amounts, types and distribution of internal capital that it considers adequate to cover the nature and level of the risks to which it is or might be exposed. These strategies and processes must be subject to regular internal review to ensure that they remain comprehensive and proportionate to the nature, scale and complexity of the activities of the CI credit institution concerned (BFBA Chapter 9, Section1: CALE Chapter 2, Section 1). FI conducts an annual SREP to evaluate whether a CI’s target level of capital is adequate and whether it has adequate methods to identify, measure, govern internally, report and have control over the risks that its business is associated with (FI’s memorandum “Method for Supervisory Review and Evaluation Process (SREP)” March 1, 2008). A CI itself must evaluate its methods and assessments in order to ensure that they are comprehensive. At least annually it must prepare an ICAAP which becomes one—of several—sources that underpin FI’s work with a SREP. FI’s general guidelines for ICAAP submission, outline in which way a CI can inform FI regarding its ICAAP and its calculations. EC6. For any CI permitted to use models to measure components of risk there is the requirement that it must regularly conduct internal validation of the risk measurement system, taking account of both quantitative and qualitative factors. This validation shall be documented. It is also required that internal audit verifies that the validation is done by independent functions in the CI. FI in its on-site examination of these models assesses the validation processes and routines. There must be an annual independent validation performed internally and an annual verification performed by internal audit (FI Regulations and General Guidelines governing CALE (FFFS 2007:1) (Chapter 60, Sections 9-10). EC7. FI determines whether CIs (and their groups) have adequate information systems for measuring, assessing and reporting on the size, composition and quality of exposures as part of on-site examinations. CIs also have to deliver to FI for review all policies and instructions which internally regulate reporting and also examples of such reporting. These policies, instructions and reports are reviewed with regard to size, composition and quality of exposures. This assessment is also an integral part of the SREP. For CIs that are allowed to use more advanced models when measuring risk and exposure, there are defined requirements that information systems must fulfill. Degree of conformity with those requirements is established in the context of the annual SREP (FI Regulations and General Guidelines governing CALE (FFFS 2007:1) (Chapter 44, Sections 22-23)). EC8. In FI’s supervision and approval processes for operational risk, it is assessed whether a CI’s Board and senior management are aware of its operational risk exposure and whether the Board and senior management understands if the risk area is under control. As part of the assessment, FI verifies whether the CI has an instruction and an organization for new product approval. FI Regulations and General Guidelines governing CALE (FFFS 2007:1) (Chapter 30, Section 2 and Chapter 60, Sections 3 and 6) requires that: “The institution shall have processes for handling its exposure to operational risks. The institution shall have policy documents approved by the Board… for management and assessment of its exposure to operational risks. Policy documents shall also cover tail risk events with severe impact on the activities of the institution. In addition to stating the institution’s applied definition of operational risk, the policy documents shall state which forms of operational risk are relevant in the operation. The institution shall have an internal reporting structure up to and including the Board.... and management. This structure shall be designed such that the involved functions in the institution receive regular and pertinent information about exposures to operational risks and about losses related to operational risks. The institution shall have procedures in place to take appropriate corrective actions based on this information.” FI does not have any regulation governing a new product process for CIs. EC9. FI Regulations and General Guidelines governing CALE (FFFS 2007:1) (Chapter 30, Section 2, and Chapter 60 Sections 4-6) provides that, for CIs as a general rule, a risk control function must be established which is not involved in risk taking. The responsibility for establishing this function lies with Board The function should possess the resources necessary for its duties. The duties should not be carried out by employees who are engaged in the day-to-day business operations. It may structure the work in different ways depending on the undertaking’s operations. It may, for example, engage other functions in the undertaking to compile data for its reports and analyses. The function shall, however, at all times be responsible for the coordinated reporting and analyses of the credit institution’s risks, and for ensuring that the underlying data is correct. For the three main risk areas credit, market and operational risk, there are explicit requirements for independent risk evaluation and reporting to the Board and senior management if a CI uses an advanced methodology for calculation of capital adequacy. CIs that do not use such a methodology are to apply principles set out in FI General Guidelines regarding Governance and Control of Financial Undertakings (FFFS 2005:1) (Chapter 5, Sections 1-4). FI in its on-site examinations determines whether CIs have risk evaluation, monitoring and control or mitigation functions with duties clearly segregated from risk taking functions and which report directly to senior management and the Board. EC10. FI has issued specific standards for credit risk, market risk, liquidity risk and interest rate risk in the banking book. Operational risk is only covered in the Regulations and General Guidelines regarding CALE (FFFS 2007:1). FI plans to issue a standard in the current year based on the BCBS document “Sound Practices for the Management and Supervision of Operational Risk.” AC1. BFBA presents requirements for more complex CIs to have independent and specialized units for risk control. Larger and more complex CIs also use more advanced models for their risk assessment and capital adequacy and for these models it is a requirement to have dedicated units for risk control. The Board should ensure that a function is in place which monitors and evaluates the internal control (including the risk control and the compliance function). In CIs with an internal audit function (e.g., the four systemic institutions) such duties are performed by that function. The function should possess sufficient resources for its duties. It should also have personnel who possess:
The function should report directly to the Board and organizationally, it should be entirely separated from the operations that are being audited. (FI has confirmed this to be the case for the four systemic institutions) At FI there is a specialized unit for the largest and most complex credit institutions. For each of the four major groups there is a Group supervisor who is responsible for coordinating the supervision of that group. This coordination effort includes risk experts, legal experts, accounting experts as well as supervisors of insurance, mutual funds and market conduct. AC2. As regards a requirement for CIs to conduct rigorous, forward-looking stress testing that identifies possible events or changes in market conditions that could adversely impact the CI, the CEBS CP 32 concerning stress tests and FI’s SREP guidance set out the conditions for stress testing, which FI evaluates in the annual SREP. AC3. While rules are not set out in detail, FI does have requirements on CIs to have in place policies and processes for assessing other risks. The stipulations about risk management and capital in BFBA (Chapter 6, Section 2) are not restricted to a fixed set of risks. Some risks—notably credit risk, market risks and operational risk are singled out in the process of determining minimum capital requirements—but the other risks are to be treated in a corresponding way, if they are material for a particular CI. The capital need and processes are assessed in the annual SREP. | ||||
| Assessment | Largely Compliant | ||||
| Comments | Overall, while all elements of the criteria are touched on in FI’s processes, the supervisory risks too great a focus on procedures and documentation rather than meaningful corroboration of quality of implementation. On-site inspections are discussed specifically in the context of CP20, but FI notes that there will be an on-site visit for all major risk areas of a systemic institution on an annual basis. For systemic institutions, however, the quarterly risk meetings, even supplemented by on-site inspections focusing on individual risk areas, may be an insufficient basis to determine and confirm compliance with the criteria as the program of on-site inspection is not equivalent to an intrusive examination cycle which ought to be combined with a frequent review of internal management reporting and a close and continuous dialogue with relevant control functions and external auditors. In the supervision of the four systemic institutions, FI fields the relationship manager plus a team of experts in quarterly risk review meetings with each bank, wherein the bank provides an update of developments in credit, market and liquidity risk. Any changes in the risk management process/organization are also addressed. The corresponding review of operational risk is performed in a separate meeting, normally twice a year. There is an important clarity and discipline in this process but there are also weaknesses. For example, while reading the Board minutes and risk reporting to the Board is useful it may not be | ||||