Abstract
The Bank Supervision Department (BSD) of the Central Bank of the Bahamas (CBoB) has a generally effective supervisory program in place for the size and complexity of the Bahamian banking system. Since the prior FSAP in 2012, clear progress has been made enhancing the framework in a number of areas as well as in the execution of its supervision program. CBoB supervision continues to evolve in a number of positive directions, with most of the areas viewed by assessors as warranting enhancements included in the execution of the program.
Introduction1
1. The Bank Supervision Department (BSD) of the Central Bank of the Bahamas (CBoB) has a generally effective supervisory program in place for the size and complexity of the Bahamian banking system. Since the prior FSAP in 2012, clear progress has been made enhancing the framework in a number of areas as well as in the execution of its supervision program. CBoB supervision continues to evolve in a number of positive directions, with most of the areas viewed by assessors as warranting enhancements included in the execution of the program.
2. Several initiatives undertaken by CBoB have strengthened the overall regulatory and supervisory framework for the banking and trust company sector. CBoB, together with the Ministry of Finance (MoF), has either introduced or updated several key pieces of legislation and regulations pertaining to AML/CTF as well as issued guidance (Applications Manual, Administrative Money Penalty regime) and consultation proposals for Basel II/III regulatory reforms (capital, DSIB designation, and liquidity). In addition, CBoB has broadly enhanced its risk-based supervision regime, including as it pertains to AML/CTF, which is evidenced by enhanced off-site surveillance (review of all AML/CTF policies and procedures of all SFIs) and on-site targeted examinations conducted at SFIs to assess compliance with requirements.
3. CBoB has enhanced its engagement with the largest SFIs with respect to addressing the lingering non-performing loan (NPL) problems in the banking sector. CBoB has communicated to the SFIs its expectations that banks take action to significantly lower overall NPL levels. CBoB now regularly monitors the actions SFIs are taking in this regard and has periodic meetings to discuss strategy and progress.
Methodology
4. This assessment of the current state of the implementation of the Basel Core Principles for Effective Banking Supervision (BCP) in The Bahamas has been completed as part of the 2019 FSAP. The Financial Sector Assessment Program (FSAP) was undertaken by the International Monetary Fund (IMF) and the BCP assessment mission took place January 8 to 28, 2019.
5. The ratings assigned during this assessment are not directly comparable to those from the previous assessment. The methodology issued by the Basel Committee on Banking Supervision (BCBS) in September 2012 was used for the current assessment and the authorities have opted to be assessed and graded on the essential criteria (EC) only. The 2013 BCP assessment, prepared in the context of the 2012 FSAP, was based on the 2006 methodology. Since then, the methodology has been revised leading to some substantive changes.
6. The 2012 methodology reflects lessons from the global financial crisis (GFC) and emerging supervisory best practices. New principles have been added to the methodology along with new EC for each principle that provide more detail. Altogether, the revised CPs now contain 247 separate essential and additional criteria against which a supervisory agency may be assessed. In particular, the revised BCPs strengthen the requirements for supervisors, the approaches to supervision and supervisors’ expectations of banks. While the BCPs set out the powers that supervisors should have to address safety and soundness concerns, there is a heightened focus on the actual use of the powers, in a forward-looking approach through early intervention.
7. The 2019 FSAP assessment team reviewed the framework of laws, rules, and guidance and held extensive meetings with authorities and market participants. The assessment team met officials of the CBoB, the MoF, auditing firms, and banking sector participants. The authorities provided a comprehensive self-assessment of the CPs, as well as detailed responses to additional questionnaires, and facilitated access to staff and to supervisory documents and files on a confidential basis.
8. The team appreciated the very high quality of cooperation received from the authorities. The team extends its warm thanks to staff of the authorities, who provided excellent cooperation, including provision of documentation and technical support.
9. The standards were evaluated in the context of the sophistication and complexity of the financial system of The Bahamas. The CPs must be capable of application to a wide range of jurisdictions whose banking sectors will inevitably include a broad spectrum of banks. To accommodate this breadth of application, a proportionate approach is adopted within the CP, both in terms of the expectations on supervisors for the discharge of their own functions and in terms of the standards that supervisors impose on banks. An assessment of a country against the CPs must, therefore, recognize that its supervisory practices should be commensurate with the complexity, interconnectedness, size, and risk profile and cross-border operation of the banks being supervised. In other words, the assessment must consider the context in which the supervisory practices are applied. The concept of proportionality underpins all assessment criteria. For these reasons, an assessment of one jurisdiction will not be directly comparable to that of another.
10. An assessment of compliance with the BCPs is not, and is not intended to be, an exact science. Reaching conclusions required judgments by the assessment team. Banking systems differ from one country to another, as do their domestic circumstances. Furthermore, banking activities are undergoing rapid change after the GFC, prompting the evolution of thinking on, and practices for, supervision. Nevertheless, by adhering to a common, agreed methodology, the assessment should provide The Bahamian authorities with an internationally consistent measure of the quality of their banking supervision in relation to the revised CPs, which are internationally acknowledged as minimum standards.
Institutional and Market Structure—Overview
A. Institutional Framework for Regulation and Supervision
11. CBoB is responsible for the prudential regulation and supervision of banks, trust companies and credit unions that operate both from and within The Bahamas. Besides this responsibility, CBoB in its capacity as central bank, also acts as the lender of last resort for financial institutions. If and when necessary, it also oversees the operations of the Deposit Insurance Corporation (DIC).
12. The Bahamas regulatory framework include other financial sector authorities responsible for financial regulation. These are as follows:
The Securities Commission of The Bahamas oversees the registration, supervision and regulation of broker-dealers, mutual fund administration, securities investment advisors, and public companies.
The Registrar of Insurance Companies is responsible for the licensing, registration, supervision and regulation of registered re-insurers, insurers, and insurance intermediaries.
The Inspector of Financial and Corporate Service Providers oversees the licensing and regulation of financial and corporate service providers.
The Compliance Commission of The Bahamas is responsible for enforcing compliance with AML requirements of designated financial institutions (e.g. co-operative societies, friendly societies, trustees, administrative managers or investment managers of superannuation schemes, trustee, counsel, attorney or accountants receiving money in the course of business).
13. These regulators, known as the Group of Financial Service Regulators (GFSR), meet to discuss domestic issues of importance primarily focused on greater harmonization of the regulatory system. The GFSR, chaired by CBoB, meets at least quarterly in an effort to achieve supervisory coordination across the financial system in addressing common domestic themes. A memorandum of understanding (MoU), signed in 2002, outlines the ability to share information amongst the regulators as well as conduct joint on-site examinations and develop joint guidance and procedures where applicable.
B. Overview of the Banking Sector
14. The off-shore component of The Bahamas banking system is large compared to the operations of the domestic financial institutions. As at June 30, 20182, seven commercial domestic banks with total assets of B$12.3 billion3 include three indigenous domestic banks (B$3.3 billion) and four foreign bank subsidiaries (B$9 billion). In addition, one development bank and ten credit unions, which represent only B$0.5 billion of total domestic assets, have a considerable number of small retail depositors. The Bahamas international (offshore) financial sector, made up of many firms,4 had total off-shore balance sheet assets of B$255.6 billion. Of this total, 208 banks and trust companies, including 121 nominee trust companies, represented B$168.2 billion of total assets.
15. The domestic banks primarily deal in residential mortgage lending and consumer financing (with some commercial lending) while the off-shore banks focus on either private banking and trust services or conduct treasury operations on behalf of affiliated institutions. Offshore banks hold substantial off-balance sheet fiduciary assets on behalf of international clients (about B$120 billion), with a relatively smaller amount of primarily liquid on-balance sheet assets. As of June 2018, domestic banks’ loan books consisted of residential mortgages (43 percent); consumer credit (38 percent), business credit (17 percent) and commercial mortgages (2 percent).
16. Overall, the banking sector has strong capital and liquidity levels. As of September 2018, the system-wide capital adequacy ratio stood at 32 percent, well above the regulatory requirement of 17 percent. The ratio of liquid assets to total assets was 30 percent as at June 30, 2018.
17. Although the growth in consumer credit is very low, the banking sector remained profitable mainly due to fee income, stable lending rates, and lower deposit rates. System-wide return on assets has remained stable in the 2.2–2.5 percent range over the last three years. Asset growth was minimal and mainly driven by credit to the central government.
18. NPL’s remain high at 9 percent, after peaking at 17.2 percent in 2014, with three institutions representing 61 percent of aggregate NPLs. NPLs are made up of residential mortgages at B$323.6M (or 61.7 percent), consumer loans at B$143.7M (or 27.4 percent) and commercial loans at B$57.1 million (or 10.9 percent). The real estate market in The Bahamas has been relatively soft for the past several years, as evidenced by the significant stock of distressed properties listed for sale.
19. The Bahamas has been listed by the Financial Action Task Force as a country with strategic AML/CFT deficiencies and is taking steps to address this. Several laws and regulations have been revised in The Bahamas in 2018 to address AML/CFT requirements of both banking and non-banking institutions. CBoB, in its capacity as the regulatory and supervisory authority of financial institutions has strengthened its risk-based supervisory framework to include the testing of bank’s compliance with AML/CFT requirements.
Preconditions for Effective Banking Supervision5
20. The Bahamian economy has returned to moderate growth after a period of stagnation. After a decline in real GDP from 2013–2015, growth in this tourism-driven economy is projected at 2.3 percent in 2018. Growth is vulnerable to downturns in the U.S., the largest source market for tourism, which accounts for 45 percent of GDP. Real estate investment and construction are also important economic drivers, representing about 22 percent of GDP.
21. Debt-to-GDP has risen to 55 percent in FY2017, from 38 percent in FY2012. In response, the government has increased VAT from 7.5 to 12 percent and announced austerity measures.
22. The Bahamas has a fixed exchange rate and capital controls. The Bahamian dollar is pegged to the U.S. dollar at parity. Capital controls afford some scope for monetary policy independence, for example through reserve requirements, changes in the discount rate and selective rate controls.
23. CBoB has the mandate to promote financial system stability. CBoB’s mission is to foster an environment of monetary stability conducive to economic development, and to ensure a stable and sound financial system. On matters of systemic importance, CBOB it works closely with the MoF, including on the drafting or formulation of any legislation pertaining to financial stability measures. Further, the MoF has primary responsibility for all fiscal matters, including the funding of any resolution-related interventions pertaining to financial institutions.
24. Although the GFSR seeks to coordinate certain regulatory and supervisory matters pertaining to financial institutions, it does not act in a capacity to contribute to financial stability policy measures. Although the GFSR contributes to the consistency in the regulation and supervision of financial and non-financial institutions in The Bahamas, it does not have representation of the MoF nor does it examine in-depth macroprudential issues at this time.
25. The Bahamas legal system is well developed for the regulation and supervision of financial institutions. The CBoB can operate independently and has the authority to impose sanctions, take preventive corrective action and resolve weak banks, including revocation of the license.
26. CBoB has the primary regulatory responsibility for The Bahamas payments system, including the systemically important payment systems. Since 2004, the CBB has been operating a Real Time Gross Settlement (RTGS) system, the Bahamas Interbank Settlement System, which constitute a systemically important payment system and provides RTGS (with finality and irrevocability) for payments of B$150,000 or larger. CBoB also governs the payments systems through the Payments Policy and Oversight Unit as well as through its participation in the National Payments Council.
27. The framework for crisis management, recovery and resolution is currently under development in The Bahamas. Proposed legal reforms will bring the CBoB’s resolution framework more in line with international best practice and if passed, will give the central bank the authority to require banks to have recovery plans, resolution plans for DSIBs, and the ability to appoint a statutory administrator.
28. With the passage of the proposed legislation, CBoB, together with other relevant authorities, will need to build the critical crisis management infrastructure needed to manage a major bank failure. The CBoB would like to make use of an expanded GFSR as the informal financial crisis management committee (FCMC). This committee would require representation from the MoF on the GFSR, and would be tasked with the responsibility of not only ensuring that the pending legal reforms contain all the necessary powers to minimize legal risk but also to become fully operational including developing a national crisis management plan once promulgated.
29. The DIC continues to build toward its target funding level of B$88.5 million. The DIC, a public corporation established under the Protection of Depositors Act, 1999, insures eligible Bahamian dollar deposits of licensed banks. The current DIC fund stands at B$56M as of December 31, 2018, which represents approximately 0.8 percent of insurable deposits and 2.9 percent of insured deposits.
30. Although the DIC has a Board of Directors in place, the infrastructure needed to manage the failure of a member financial institution would fall to CBoB. At this time, the DIC has the power to take control of the assets of an insolvent financial institution. However, under the proposed legislative resolution reforms, CBoB will have the power to appoint a statutory administrator that would, among other things, ensure prompt payouts of the deposits of a bank in liquidation.
31. The proposed legislation will formalize CBoB’s authority to provide emergency liquidity assistance. Amendments to emergency liquidity assistance provisions clarify the purpose of such lending and address solvency tests, collateral mandates, penalty rates, and maturity limits.
32. Transparent information is provided by SFIs to the public. Given The Bahamas’ requirement to adhere to International Accounting Standards (IAS) and the expectation that IFRS 9 implementation by the supervised institutions will be complete effective January 1, 2018, SFIs are required to disclose their financial statements to enable users to evaluate the nature and extent of risks arising from financial instruments to which the entity is exposed and its management of those risks. In addition, the publicly-traded domestic banks are also subject to disclosure requirements imposed by the Securities Commission of The Bahamas.
Main Findings
A. Responsibilities, Objectives, Powers, Independence (CP 1–2)
33. CBoB has broad powers and clear responsibilities underpinned mainly in the CBBA, BTCRA and CUA. CBoB’s primary objective is to promote financial system stability in The Bahamas. CBoB has broad corrective action and sanction powers. Laws and regulations provide CBoB with the power to set and enforce prudential regulations to support delivery of its statutory mandate.
34. The sufficiency of BSD’s supervisory resources should be re-examined in light of CBoB’s current legislative initiatives and to further strengthen the effectiveness and efficiency of its’ risk-based supervision framework. BSD would benefit from additional staff to: i) carry out periodic in-depth on-site examinations of key practices (which may entail additional risk specialists to be hired); ii) support further enhancements to the off-site surveillance program; iii) assist in the implementation of regulatory reforms (Basel II/III, IFRS 9 implementation); iv) address the ongoing need for enhanced supervision of SFI’s compliance with AML/CTF standards and v) specialize in dealing with intervention staged SFIs.
35. The reasons for the removal of a CBoB board member or the Governor should be required to be publicly disclosed.
B. Licensing, Changes in Control, and Acquisitions (CP 4–7)
36. CBoB has a very thorough licensing framework in assessing licensing applications which follows criteria that are consistent with ongoing supervision requirements. The BTCRA defines the “banking business” and restricts deposit taking activities to banks and credit unions only. CBoB’s framework for assessing licensing applications follows criteria pertaining to the financial strength of investors, fit and proper guidance for the appointment of senior management and Board members, analysis of proposed business strategy, and determines minimum capital adequacy requirements.
37. CBoB has the power to review, reject, and impose prudential conditions on proposals to transfer significant ownership or controlling interests in SFIs. The BTCRA empowers CBoB to establish clear provisions on acquisitions and investments that require prior supervisory approval or prior notification to CBoB.
C. Supervisory Cooperation and Cross Border Supervision (CP 3, 12, 13)
38. CBoB has MoUs in place to support information sharing as well as co-operation and co-ordination between both domestic and foreign regulatory authorities in dealing with a crisis.
39. The introduction of a resolution regime will help bolster CBoB’s power to undertake recovery and resolution actions in a coordinated manner with other regulatory authorities.
D. Supervisory Approach (CP 8–11)
40. Certain aspects of CBoB’s risk-based supervision framework should be reassessed for efficiency and effectiveness, with the goal of providing CBoB with greater confidence in assessments of key corporate governance, risk management and control practices. CBoB’s off-site supervision surveillance program uses a number of methods for assessing an SFI’s financial condition and compliance with prudential requirements and standards, including those related to corporate governance and risk management. Both domestic and international (including offshore) SFIs are subject to the same risk-based supervisory framework with more emphasis being placed on the largest SFIs in both categories. The program should be re-calibrated to include more frequent on-site examinations that can support more comprehensive assessments of DSIB’s key corporate governance, risk management and internal controls practices, as well as in-depth reviews of material risks (e.g. credit risk, AML, etc.) depending on the business model of the SFI.
41. A careful balancing of the risk-based supervisory framework between onsite and offsite work may allow for enhanced efficiency in the program while promoting CBoB’s ability to gain greater confidence in assessments of the effectiveness of SFI’s governance and risk management practices. In practice, and as noted above, what is likely needed is an increase in resources which could support further development of strong offsite analytic capabilities and increased use of onsite examinations in key areas. A strong supervisory framework for the DSIBs would help ensure CBoB is better equipped to take early intervention measures to address weaknesses in key practices in need of timely and effective remediation.
42. CBoB utilizes a principles-based approach to supervision and maintains wide discretionary powers to select the appropriate measures through which to require firms to address identified weaknesses. The Central Bank’s Guide to the Ladder of Supervisory Intervention provides an overview of the intervention measures CBoB may take depending on the severity of the situation. Over the past years, CBoB has been heavily engaged in the recovery efforts of one of its largest domestic banks. Although CBoB has successfully made use of several corrective measures over the past 10 years pertaining to this SFI, CBoB’s powers to require swift actions will be strengthened with the introduction of the proposed resolution regime.
E. Corporate Governance and Interval Audit (CP 14, 26)
43. Supervision of corporate governance has become a more direct area of emphasis for CBoB, as it has with supervisors in many jurisdictions and in line with the updated Basel Core Principles. However, the current practice of assessing governance largely in the context of individual specific risk areas may attenuate the ability to clearly and directly hold accountable those with key responsibilities on a firm-wide basis before identified weaknesses lead to significant observable events. The Guidelines for Corporate Governance (amended and expanded in 2013) appropriately detail the extensive duties of boards of directors and senior management. CBoB’s principles-based approach to supervision places primary responsibility for ensuring the establishment of an effective framework for risk management and controls with boards of directors and clearly articulates the appropriate split between the oversight role of the board and the active role of management. CBoB has recently notified the industry of plans to step up the level of direct engagement with boards of directors as a part of this enhanced governance focus.
44. In addition to placing significant emphasis on the roles of the board and senior management, the program relies on internal and external auditors and periodic attestations required to be made by boards regarding compliance with laws, rules and standards. It combines substantial offsite analyses and assessments with relatively infrequent onsite examinations where those are deemed warranted by the risk assessment process in its risk-based supervision framework. This balance can be hard to strike effectively. Assessors note that CBoB supervision would benefit from greater interaction with the firms and more use of comprehensive thematic onsite examinations. These exams could cover all aspects of a particular area or practice to increase their level of confidence in assessments of risk management, internal controls and corporate governance. For example, regular periodic reviews of credit risk or ICAAP covering all elements articulated in credit risk, ICAAP, corporate governance and internal audit guidelines.
45. CBoB’s significant reliance on the required board of directors’ annual certifications of compliance—or notice of noncompliance, as applicable—with laws, rules and expectations would benefit from a formal process for the escalation of requirements when there is a discovery that a certification was materially inaccurate. To increase the accountability of the board when signing off on the certification, CBoB should make it clear that if there are material errors it will require a third party or supervisory review of all aspects of the certification and supporting processes. If using external auditors/consultants for this work, CBoB should require the SFI’s board to get an opinion supported by a ‘reasonable assurance’ opinion.
46. The role of internal audit is particularly and increasingly important in the CBoB supervision program and as such internal audit effectiveness warrants even greater attention. CBoB has recently increased the importance of the role of internal audit with respect to supervision of SFIs and heightened associated accountability by requiring the chief internal auditor to attest in writing when signing off on remediation of an area of weakness that requires attention. CBoB’s supervision would benefit from more comprehensive assessments of internal audit, including a periodic review that can shed light on internal audit effectiveness across many elements of its role, as detailed in BCP 26 in this report. When it is discovered that internal audit has missed key issues that are later found by CBoB supervisors, CBoB should consistently articulate these findings to the Board in writing and hold the board accountable for its duty to ensure an effective audit function.
F. Capital (CP 16)
47. CBoB has updated its capital regime and it is now largely in line with the key aspects of Basel standards, though further work is to be done with respect to implementing Basel III. Current required regulatory capital ratios are super-equivalent to Basel, with DSIBs being required to meet a 17 percent target for capital and at a 14 percent trigger supervisors escalate coverage of the SFIs. Credit, Operational and Market risks are now all captured in capital requirements and CBoB issued Guidelines on ICAAP in 2016 to address those risks not well captured in the regulatory regime.
48. More emphasis should be placed on in-depth reviews of the largest SFIs’ ICAAPs. While CBoB published Guidelines requiring periodic ICAAPs at SFIs in late 2016, assessors noted the supervisory reviews of SFIs’ ICAAP reports to date have been done at a fairly high level and focused primarily on ensuring the SFIs’ ICAAP reports contained all required elements, rather than the effectiveness of the overall process. Given the importance of ICAAP with respect to both risk management and SFIs’ internal capital planning processes, more attention should be given during ICAAP reviews to the various inputs into and practices driving the process, as well as the controls around those.
G. Credit Risk and Problem Assets, Provisions and Reserves (CP 17–18)
49. CBoB should undertake deeper and more frequent reviews of credit risk management practices at its largest SFIs, including a review of the current treatment of non-performing loans and impaired assets. CBoB’s credit risk and impaired asset guidelines allow SFIs a variety of credit risk reporting methodology for non-performing loans and provisioning levels. Inconsistent asset classification, collateral valuation and loan loss provisioning practices for asset backed loans (particularly residential mortgages) may lead to an overestimation of the accuracy and comparability of SFI’s reported financial data and underestimation of the overall level of credit risk within and across the SFIs. CBoB has conducted only five in-depth credit reviews on the DSIBs since 2015 (not including the on-site credit reviews undertaken on the problem DSIB), it is imperative that CBoB assure itself that bank’s credit risk management internal controls are in place and effective as well as gaining a view on the extent of the differences in practices across firms. With the implementation of IFRS 9 (beginning January 1, 2018), the banking sector requires further guidance on CBoB’s expectations and discretion as it pertains to the validation of credit risk models used to assess and measure expected credit losses.
H. Risk Management (CP 19–25)
50. Monitoring compliance with quantitative requirements and a focus on financial strength metrics are key areas of focus and resource expenditure. CBoB requires frequent reporting across a wide spectrum of regulatory requirements and positions in order to assess the financial condition of the SFIs and to assess compliance with quantitative elements of the regime—e.g., country and transfer risks; large exposure management and reporting; etc. CBoB’s qualitative expectations and standards are generally in line with international practices and are articulated to the SFIs through clear written Guidelines, examination reports (when examinations are carried out), discussions during semi-annual meetings with the firms and other less formal communications.
I. Abuse of Financial Services (CP 29)
51. Given the importance of this risk area, as well as release of several new or updated pieces of associated legislation, regulations and guidelines, CBOB should continue its enhanced supervisory oversight of SFI’s compliance with AML/CFT requirements. CBoB has made a concerted effort to review most of the SFI’s board policies and procedures pertaining to AML/CTF requirements as well as undertaking a targeted on-site review program aimed at approximately twenty percent of all SFIs, which were identified as warranting reviews. It will be essential for CBoB to take timely corrective measures when discovering gaps in SFI’s compliance with AML/CTF requirements to ensure remediation efforts are carried out on a timely basis. CBoB should undertake a review of the compliance of Credit Unions with the AML/CTF requirements.
Detailed Assessment
A. Supervisory Powers, Responsibilities, and Functions
| Principle 1 | Responsibilities, objectives and powers. An effective system of banking supervision has clear responsibilities and objectives for each authority involved in the supervision of banks and banking groups.6 A suitable legal framework for banking supervision is in place to provide each responsible authority with the necessary legal powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address safety and soundness concerns.7 |
| Essential criteria | |
| EC1 | The responsibilities and objectives of each of the authorities involved in banking supervision8 are clearly defined in legislation and publicly disclosed. Where more than one authority is responsible for supervising the banking system, a credible and publicly available framework is in place to avoid regulatory and supervisory gaps. |
| Description and findings re EC1 | The Central Bank of the Bahamas Act, 2015 (CBBA), the Banks and Trust Companies Regulation Act, 2015 (BTCRA) and the Bahamas Co-operative Credit Unions Act and the Bahamas Cooperative Credit Unions Regulations, 2015 (CUA) set out the powers, responsibilities, and objectives of the Central Bank of The Bahamas (CBoB) as the supervisor of banks (including branches of foreign banks), trust companies, credit unions and money transfer businesses (referred to as supervised financial institutions or SFIs) operating within and from within The Bahamas. The Acts and Regulations are complemented by a series of Guidelines that supplement but do not replace any requirements under the relevant legislation or accounting standards. S. 13 of the BTCRA designates the CBoB (in the person of the Inspector) as the banking supervisor and gives it such powers as are reasonably necessary to perform its supervisory function. S. 17 (First Schedule) of the BTCRA sets out the rules of inspection and supervision of banks. All legislation, regulations and guidelines are published and are available on the CBoB Website. |
| EC2 | The primary objective of banking supervision is to promote the safety and soundness of banks and the banking system. If the banking supervisor is assigned broader responsibilities, these are subordinate to the primary objective and do not conflict with it. |
| Description and findings re EC2 | S. 17 (First Schedule) of BTCRA states that the Inspector of Banks and Trust Companies of the CBoB (Inspector) is responsible to regularly evaluate the condition of solvency and liquidity of all licensees and to establish appropriate and prudent standards for the conduction safe and sound banking and trust business. CBoB’s risk-based supervision framework includes an off-site examination together with an off-site supervision surveillance program designed to make judgments about the financial soundness of banks. |
| EC3 | Laws and regulations provide a framework for the supervisor to set and enforce minimum prudential standards for banks and banking groups. The supervisor has the power to increase the prudential requirements for individual banks and banking groups based on their risk profile9 and systemic importance.10 |
| Description and findings re EC3 | S. 17 (First Schedule) of the BTCRA specifies that CBoB (the Inspector) shall establish appropriate and prudent standards for conducting safe and sound banking (and trust business). The Schedule also states that CBoB shall set prudent and appropriate capital adequacy requirements for banks not less than those in the Basel Capital Accord and Amendments. Detailed prudential standards are set out in Regulations. Further S. 6 of the BTCRA, states that the CBOB may impose new conditions or limitations on the license of an SFI or amend or revoke any authorization, condition or limitation contained in the license. In addition, S. 18(1)(h), the CBOB may issue directions requiring a licensee to cease or refrain from committing an act or pursuing a course of conduct that is an unsafe or unsound practice, or that is in contravention of any law, or to perform a remedial act, or to do anything required to be done; and require such action to be taken by the licensee as CBoB considers necessary. The Guideline entitled “A Guide to the Central Bank’s Ladder of Supervisory Intervention”, revised May 2017 (Ladder of Intervention Guideline) outlines a wide range of discretionary intervention actions that CBoB may take if it determines that the cause of concern is not being addressed. |
| EC4 | Banking laws, regulations and prudential standards are updated as necessary to ensure that they remain effective and relevant to changing industry and regulatory practices. These are subject to public consultation, as appropriate. |
| Description and findings re EC4 | The BTCRA and the CBBA, updated in 2015, together with several Guidelines pertaining to various risks (Market, Operational, Interest Rate Risk, etc) together with several guidelines and legislation pertaining to Anti-Money Laundering and Terrorist Financing (AML, CFT) have been introduced in the past several years. All amendments to laws, regulations and material changes to guidelines are issued for public consultation as a normal practice. |
| EC5 | The supervisor has the power to:
|
| Description and findings re EC5 | S. 35 of CBBA and S.13(3) of BTCRA authorize CBoB to have access to such information and records of each bank as it requires to enable it to perform its duties and to require banks to provide such information in the form and frequency deemed necessary. S. 13(3) of BTCRA specifies that CBoB (the Inspector) shall be entitled at all reasonable times to have access to such books, records, vouchers, documents, cash, and securities of a bank and to call upon the manager or any officer designated by the manager of any bank for such information or explanation as is reasonably required to enable the CBoB to carry out its functions under the Act. |
| EC6 | When, in a supervisor’s judgment, a bank is not complying with laws or regulations, or it is or is likely to be engaging in unsafe or unsound practices or actions that have the potential to jeopardize the bank or the banking system, the supervisor has the power to:
|
| Description and findings re EC6 | S. 18 (1)(h) of BTCRA, states that the CBoB may issues directions requiring a licensee to cease or refrain from committing an act or pursuing a course of conduct that is an unsafe or unsound practice, or that is in contravention of any law, or to perform a remedial act, or to do anything required to be done and require such action to be taken by the licensee as the central bank considers necessary. S. 18 of the BTCRA also states that the CBOB may impose a range of sanctions from issuing a warning, suspension or the revocation of the license. The Ladder of Intervention Guideline outline the various steps CBoB’s may take to intervene in the case of supervisory/regulatory breaches, or where the bank poses a risk to depositors. These discretionary intervention measures range from the issuance of warnings, more intensive supervision, increase in capital, liquidity and provisioning levels, imposition of fines, conditions/directions (e.g., restricting further lending/deposit-taking), removal of directors/senior management, appointment of special advisors, increased reporting from the external auditor, suspension of license, revocation of license. These measures are not explicitly stated in the BTCRA at this time (the proposed 2018 Amendment to the BTCRA proposes the insertion these intervention measures). CBoB has successfully been able to utilize s. 18(1)(h) of the BTCRA in the past to take the necessary intervention measures required to deal with problem entities. The proposed 2018 Amendment to the BTCRA will enhance CBoB’s powers by explicitly listing the intervention measurers CBoB has typically utilized in the past. In a situation where CBoB has issued a direction which is not being honored, CBoB may apply to the Supreme Court for an order to compel the bank to comply with the direction. Draft amendments have been proposed to the BTCRA to establish an enhanced bank resolution framework. CBoB has signed MOUs with all relevant domestic and foreign supervisory authorities to share information during a time of crisis. The CBoB does not have a formal legislative resolution regime in place at this time. |
| EC7 | The supervisor has the power to review the activities of parent companies and of companies affiliated with parent companies to determine their impact on the safety and soundness of the bank and the banking group. |
| Description and findings re EC7 | CBoB requires banks to prepare financial reports on a consolidated basis. CBoB also receives the financial statements of the bank’s parent company and significant financial subsidiaries. |
| Assessment of Principle 1 | Compliant |
| Comments | CBoB has broad powers and clear responsibilities underpinned mainly in the CBBA, BTCRA and CUA. CBoB’s primary objective is to promote financial system stability in The Bahamas. CBoB has broad corrective action and sanction powers. Laws and regulations provide CBoB with broad power to set and enforce prudential regulations to support delivery of its statutory mandate. Draft amendments have been proposed to the BTCRA to establish an enhanced bank resolution framework. |
| Principle 2 | Independence, accountability, resourcing and legal protection for supervisors. The supervisor possesses operational independence, transparent processes, sound governance, budgetary processes that do not undermine autonomy and adequate resources, and is accountable for the discharge of its duties and use of its resources. The legal framework for banking supervision includes legal protection for the supervisor. |
| Essential criteria | |
| EC1 | The operational independence, accountability and governance of the supervisor are prescribed in legislation and publicly disclosed. There is no government or industry interference that compromises the operational independence of the supervisor. The supervisor has full discretion to take any supervisory actions or decisions on banks and banking groups under its supervision. |
| Description and findings re EC1 | S. 5(3) of the CBBA states that CBoB shall have power to do anything, whether in The Bahamas or elsewhere, which is calculated to facilitate, or is incidental or conducive to the discharge of its duty under this section. For significant actions or activities, the CBoB is required to make notification to the Minister of Finance (MoF), for example when an SFI is a category stage 3 in accordance with the Ladder of Intervention Guideline. After the fact notifications to the MoF would include the granting of, or refusal to grant a license (see BTCRA s.4(2)(c)) and the revocation of a license (see BTCRA s. 18(1)(a)). In practice, CBoB’s ability to act with complete independence may not be the case for state-owned banks. Although CBoB is only required to notify (post decision) the MoF of intervention measures taken with respect to problem entities staged rated 3 and above, with respect to the state-owned bank, CBoB should strengthen its ability to undertake regulatory and supervisory processes on a timely basis without undue influence from the government or the MoF. |
| EC2 | The process for the appointment and removal of the head(s) of the supervisory authority and members of its governing body is transparent. The head(s) of the supervisory authority is (are) appointed for a minimum term and is removed from office during his/her term only for reasons specified in law or if (s)he is not physically or mentally capable of carrying out the role or has been found guilty of misconduct. The reason(s) for removal is publicly disclosed. |
| Description and findings re EC2 | The Schedule to CBBA sets out the terms under which the Governor (or any other director) may be removed. These include where the director: is absent from meetings longer than three consecutive months without the permission of the board of directors; declared bankrupted; is incapacitated by physical or mental health; has a court conviction involving dishonesty; becomes a member of Parliament; becomes a director, officer or employee of, or is a shareholder of with an interest of one percent or more in the ordinary paid up share capital of, or has a controlling interest in, any financial institution regulated by CBoB. The head(s) of the supervisory authority is (are) appointed for a minimum term. At this time, CBoB is not required to publicly disclose the reasons for the removal of the Governor. |
| EC3 | The supervisor publishes its objectives and is accountable through a transparent framework for the discharge of its duties in relation to those objectives.11 |
| Description and findings re EC3 | CBoB’s objectives are set out in the CBBA and the BTCRA. S. 32 of the CBBA requires CBoB, within four months after the end of each financial year, cause to be made and transmit to the MoF, a report of the operations of the Bank during the year and a statement of the accounts of CBoB in respect of that year certified by auditors. The MoF lays a copy of the report before both Houses of Parliament and causes a copy to be published in the Official Gazette. The Governor also holds regular meetings with the MoF. |
| EC4 | The supervisor has effective internal governance and communication processes that enable supervisory decisions to be taken at a level appropriate to the significance of the issue and timely decisions to be taken in the case of an emergency. The governing body is structured to avoid any real or perceived conflicts of interest. |
| Description and findings re EC4 | The Inspector oversees the Bank Supervision Division (BSD) which has internal mechanisms for raising significant issues. Further, the Inspector reports to the Governor any issues of significance on a regular basis. The Governor meets with the MoF on a weekly basis and is able to raise any issues of significance when required on an emergency basis. SFIs rated stage 1 and above are subjected to enhanced supervision and reporting requirements (Stage 1: early warning; Stage 2: heightened risk to financial viability or solvency; Stage 3: severe risk to financial viability or solvency; Stage 4: imminent insolvency or non-viability; Stage 5: insolvency or non-viability). The decision to stage or change the stage rating of an SFI is discussed with BSD senior management and senior representatives within CBOB. Further, the status of stage rated SFIs are discussed regularly with CBoB senior management. |
| EC5 | The supervisor and its staff have credibility based on their professionalism and integrity. There are rules on how to avoid conflicts of interest and on the appropriate use of information obtained through work, with sanctions in place if these are not followed. |
| Description and findings re EC5 | CBoB’s supervision has a staff complement of over 70 persons. Technical staff with direct supervisory and examination responsibilities are well qualified with university degrees, with some risk specialist expertise in AML, credit, Operational and IT risk. With respect to confidentiality and conflict of interest, upon joining CBoB, staff sign a confidentiality agreement on the appropriate use of information obtained through work. In addition, staff are subject to Code of Conduct requirements. |
| EC6 | The supervisor has adequate resources for the conduct of effective supervision and oversight. It is financed in a manner that does not undermine its autonomy or operational independence. This includes:
|
| Description and findings re EC6 | CBoB uses its own resources (fees paid by SFIs) to carry out its statutory objectives and responsibilities, including the supervision and regulation of SFIs. CBoB’s BSD has a current complement of 70 staff with only a few vacancies at this time. Salary scales are acceptable as CBoB has been able to retain or attract staff as needed. There is a training budget and a technology budget to sufficiently equip staff. CBoB is able to commission external experts when needed (as demonstrated in the past). |
| EC7 | As part of their annual resource planning exercise, supervisors regularly take stock of existing skills and projected requirements over the short- and medium-term, taking into account relevant emerging supervisory practices. Supervisors review and implement measures to bridge any gaps in numbers and/or skill-sets identified. |
| Description and findings re EC7 | CBoB provides learning opportunities to ensure that all members of staff have the requisite technical competencies and soft skills to perform all of their functions effectively. They are expected to be very knowledgeable and aware of financial services sector trends and best practices, and have the ability to adjust to the evolving needs of the Bank. A series of in-house, local, and overseas training opportunities were facilitated by the Department over the year. Supervision staff specifically, benefit from a vocational training arrangement designed to balance depth and breadth in their knowledge and experience. The framework defines specialties that are vocationally valuable to Supervision and the CBoB and matches training to staff career progression. The Assessors observed that the BSD could use additional staff to ensure that the Domestic Systemically Important Banks (DSIBs) are subject to regular full scope on-site examinations (which may entail additional risk specialists to be hired) and added staff to oversee the off-site supervision surveillance program as well as the implementation of regulatory reforms (Basel II/III) and address the need for enhanced supervision pertaining to SFI’s compliance with AML/ATF standards. |
| EC8 | In determining supervisory programs and allocating resources, supervisors take into account the risk profile and systemic importance of individual banks and banking groups, and the different mitigation approaches available. |
| Description and findings re EC8 | CBoB assesses banks on a risk-based approach. This assessment is used to better allocate supervisory resources with high risk banks being assessed more frequently. In addition, the DSIB SFIs are grouped together under the Domestic Financial Institution Unit. |
| EC9 | Laws provide protection to the supervisor and its staff against lawsuits for actions taken and/or omissions made while discharging their duties in good faith. The supervisor and its staff are adequately protected against the costs of defending their actions and/or omissions made while discharging their duties in good faith. |
| Description and findings re EC9 | S. 13A of the BTCRA provides that no civil or criminal liability shall attach to the Inspector or a staff member for anything done or omitted in the good faith discharge or purported discharge of such person’s functions under the Act. S. 13A of the BTCRA also provides that the CBoB’s Board of Directors may indemnify the Governor and the Governor may indemnify the Inspector or staff member against the cost of defending their actions while discharging their functions in good faith. |
| Assessment of Principle 2 | Largely Compliant |
| Comments | CBoB needs to reassess the adequacy of its supervision complement given the wide range of emerging risks impacting SFIs, including the AML/CFT enhanced monitoring, the needed continued focus on credit risk in-depth on-site reviews required for all DSIBs and the need to conduct more in-depth and frequent corporate governance/internal controls reviews). Further, additional resources may be required to deal with proposed regulatory reforms (Basel II/III, IFRS, AML). The reasons for the removal of a CBoB board member or the Governor should be required to be publicly disclosed. The Schedule to the draft Central Bank of The Bahamas Bill, 2018 provides for public disclosure of the reasons for the removal of the Governor. The proposed amendments to the BTCRA 2018 will introduce added legal protection for any proceedings brought against CBBA, the Inspector, a director, officer, employee of the CBoB in relation to any action taken relating to intervening in or resolving banks. CBoB should contemplate the creation of regulations or guidelines that would help strengthen its ability to regulate and supervise state-owned banks. |
| Principle 3 | Cooperation and collaboration. Laws, regulations or other arrangements provide a framework for cooperation and collaboration with relevant domestic authorities and foreign supervisors. These arrangements reflect the need to protect confidential information.12 |
| Essential criteria | |
| EC1 | Arrangements, formal or informal, are in place for cooperation, including analysis and sharing of information, and undertaking collaborative work, with all domestic authorities with responsibility for the safety and soundness of banks, other financial institutions and/or the stability of the financial system. There is evidence that these arrangements work in practice, where necessary. |
| Description and findings re EC1 | S. 38 (9) of the CBBA allows CBoB to cooperate and exchange information with any other regulatory authority in The Bahamas where it is considered by the Governor that such cooperation or information may be relevant to the functions of such other regulatory authority or as a necessary part of a framework for consolidated supervision, oversight or regulation of the financial services sector. The Group of Financial Service Regulators (GFSR), represented by: CBoB, Securities Commission, Insurance Commission, Compliance Commission, and the Inspector of Financial and Corporate Services have signed a Memorandum of Understanding (MoU) specifying the terms of co-operation and collaboration and has been in force since 2002. Information sharing amongst the domestic regulatory agencies, as well as between these agencies and foreign regulatory authorities, is governed by the Information Sharing Arrangements in the Bahamas, July 2008 (referred to as the Information Sharing Handbook). The GFSR meets periodically to coordinate regulation/examination of financial institutions and to coordinate their activities within the financial sector. The CBoB is the lead regulator for bank and trust companies. The MoF is not a member of the GFSR. |
| EC2 | Arrangements, formal or informal, are in place for cooperation, including analysis and sharing of information, and undertaking collaborative work, with relevant foreign supervisors of banks and banking groups. There is evidence that these arrangements work in practice, where necessary. |
| Description and findings re EC2 | S. 38 (3) of the CBBA provides that CBoB may disclose to an overseas regulatory authority information necessary to enable that authority to exercise regulatory functions including the conduct of civil or administrative investigations and proceedings to enforce laws, regulations and rules administered by that authority. S. 19 (5) of the BTCRA permits the CBoB to share information on the beneficial owners, director, officers and operations of a bank with the supervisory authority responsible for regulating the head office of the bank for the purpose of consolidated supervision. The Information Sharing Handbook also provides guidance of the manner in which all domestic regulatory authorities, including CBoB, will share with foreign supervisory authorities. CBoB has signed MoUs with a number of jurisdictions including Argentina, Canada, Costa Rica, Brazil, Guatemala, Panama, Peru, and an MoU with regional supervisory authorities (CARICOM). CBoB has responded to requests to share information with foreign supervisory authorities on a timely basis. |
| EC3 | The supervisor may provide confidential information to another domestic authority or foreign supervisor but must take reasonable steps to determine that any confidential information so released will be used only for bank-specific or system-wide supervisory purposes and will be treated as confidential by the receiving party. |
| Description and findings re EC3 | S. 38 (7) of the CBBA authorizes CBoB to disclosure information only where CBoB has satisfied itself that the assistance requested by the overseas regulator is required for the purposes of the overseas authority’s regulatory functions. Any confidential information acquired by others, including a Supervisory Authority, is covered by the confidentiality provisions (S. 19) of BTCRA. CBoB is required to share information as necessary as it pertains to AML/CFT disclosure reporting requirements. |
| EC4 | The supervisor receiving confidential information from other supervisors uses the confidential information for bank-specific or system-wide supervisory purposes only. The supervisor does not disclose confidential information received to third parties without the permission of the supervisor providing the information and is able to deny any demand (other than a court order or mandate from a legislative body) for confidential information in its possession. In the event that the supervisor is legally compelled to disclose confidential information it has received from another supervisor, the supervisor promptly notifies the originating supervisor, indicating what information it is compelled to release and the circumstances surrounding the release. Where consent to passing on confidential information is not given, the supervisor uses all reasonable means to resist such a demand or protect the confidentiality of the information. |
| Description and findings re EC4 | S. 7 of the CBBA authorized the CBoB to deny any demand for confidential information when it is not satisfied that it will be treated confidentially or used for supervisory purposes and that it must be given an undertaking by the recipient authority not to disclose the information provided without the consent of the CBoB. |
| EC5 | Processes are in place for the supervisor to support resolution authorities (e.g. central banks and finance ministries as appropriate) to undertake recovery and resolution planning and actions. |
| Description and findings re EC5 | Certain provisions of the CBBA, the BTCRA and the Protection of Depositors Act and Regulations describe current processes CBoB will undertake with respect to recovery and resolution planning and actions. No formal recovering planning or resolution planning is in place at this time. |
| Assessment of Principle 3 | Largely Compliant |
| Comments | CBoB has MoUs in place to support information sharing as well as co-operation and coordination between both domestic and foreign regulatory authorities in dealing with a crisis. Proposed amendments to the CBBA and the BTCRA and Regulations to provide for the establishment of CBoB as the sole resolution authority for banks and to expand the regulatory toolkit available to CBoB to address issues relating to failing banks (e.g. the ability to appoint a statutory administrator), including the requirement for SFIs to have recovery plans and CBoB to have resolution plans in place for DSIBs. |
| Principle 4 | Permissible activities. The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined and the use of the word “bank” in names is controlled. |
| Essential criteria | |
| EC1 | The term “bank” is clearly defined in laws or regulations. |
| Description and findings re EC1 | The term “bank” is defined in S. 2 of the BTCRA as any person lawfully carrying on banking business including the acceptance of deposits of money withdrawable by cheque. |
| EC2 | The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined either by supervisors, or in laws or regulations. |
| Description and findings re EC2 | S. 3 of the BTCRA specifies that only banks authorized by the CBoB may carry out the business of banking and S. 2 defines “banking business” as the business of accepting deposits of money which may be withdrawn or repaid on demand or after a fixed period or after notice and employing those deposits in whole or in part by lending or otherwise investing them for the account and at the risk of the person accepting them. It also includes the provision of money transmission services. |
| EC3 | The use of the word “bank” and any derivations such as “banking” in a name, including domain names, is limited to licensed and supervised institutions in all circumstances where the general public might otherwise be misled. |
| Description and findings re EC3 | S. 7 of BTCRA as well as the Banks and Trust Companies (Restriction on the Use of Banking Names and Descriptions) Regulations, 2001 (as revised in 2002) specifies that no person other than a bank license holder can use the term “bank” or any derivative thereof without the permission of the CBoB. CBoB’s general policy is not to give consent for the use of a prohibited word where its use could mislead the public into believing that the company in question is, or may be a bank license holder or that it is under the direct supervision of CBoB. The Registrar of Companies will refer any company whose name contains a restricted word to CBoB for its review. |
| EC4 | The taking of deposits from the public is reserved for institutions that are licensed and subject to supervision as banks.13 |
| Description and findings re EC4 | Other than banks, credit unions are the only entities permitted to accept deposits from the public. |
| EC5 | The supervisor or licensing authority publishes or otherwise makes available a current list of licensed banks, including branches of foreign banks, operating within its jurisdiction in a way that is easily accessible to the public. |
| Description and findings re EC5 | The CBoB publishes a list of all licensed banks, including branches of foreign banks, on a quarterly basis on its website. Up-to-date lists are available from CBoB on request. |
| Assessment of Principle 4 | Compliant |
| Comments | The BTCRA clearly defines the “banking business” and restricts deposit taking activities to banks and credit unions only. |
| Principle 5 | Licensing criteria. The licensing authority has the power to set criteria and reject applications for establishments that do not meet the criteria. At a minimum, the licensing process consists of an assessment of the ownership structure and governance (including the fitness and propriety of Board members and senior management)14 of the bank and its wider group, and its strategic and operating plan, internal controls, risk management and projected financial condition (including capital base). Where the proposed owner or parent organization is a foreign bank, the prior consent of its home supervisor is obtained. |
| Essential criteria | |
| EC1 | The law identifies the authority responsible for granting and withdrawing a banking license. The licensing authority could be the banking supervisor or another competent authority. If the licensing authority and the supervisor are not the same, the supervisor has the right to have its views on each application considered, and its concerns addressed. In addition, the licensing authority provides the supervisor with any information that may be material to the supervision of the licensed bank. The supervisor imposes prudential conditions or limitations on the newly licensed bank, where appropriate. |
| Description and findings re EC1 | S. 3 (1) of the BTCRA provides that the CBoB is the only authority responsible for the granting of a bank license. S. 4(6) of the BTCRA states that the CBOB may impose conditions or limitations on a new or existing license. S. 8 of the CUA stipulates the criteria for the registration of a credit union. |
| EC2 | Laws or regulations give the licensing authority the power to set criteria for licensing banks. If the criteria are not fulfilled or if the information provided is inadequate, the licensing authority has the power to reject an application. If the licensing authority or supervisor determines that the license was based on false information, the license can be revoked. |
| Description and findings re EC2 | S. 4 of the BTCRA sets the criteria for the licensing of banks (and trust companies). It also provides that the CBoB may reject an application if the applicant does not meet the necessary authorization criteria, including: the fitness and probity of the applicant to carry out banking business; the fitness and probity of the directors and senior management; the sufficiency of financial resources to provide continuing financial support; the soundness and feasibility of the business plan; the business record and experience of the applicant; the best interests of the financial system of the Bahamas. The CBoB may also refuse to grant a license if it considers it to be in the public interest. The Bank and Trust Companies (License Application) Regulations, 2008 (License Regulations) which detail the requirements for new license applications, are augmented by the Guidelines for Licence Applications for Banks and/or Trust Companies, May 2015 (Licence Guideline) and the Applications Manual, December 6, 2018. Section 18(1)(a)(vi) of the BTCRA provides that the CBoB may revoke a license, the granting of which was based on false or misleading information. |
| EC3 | The criteria for issuing licenses are consistent with those applied in ongoing supervision. |
| Description and findings re EC3 | Banks are required to provide at the authorization stage details of their proposed internal organization structures including internal audit and compliance arrangements and the outline of their internal policies on risk management requirements as they relate, for instance, to such issues as credit, liquidity, provisioning, large exposure, country risk. CBoB does not review policies in detail at the time of issuing a license. It generally performs an onsite visit to the newly licensed SFI within 18 months of operation. |
| EC4 | The licensing authority determines that the proposed legal, managerial, operational and ownership structures of the bank and its wider group will not hinder effective supervision on both a solo and a consolidated basis.15 The licensing authority also determines, where appropriate, that these structures will not hinder effective implementation of corrective measures in the future. |
| Description and findings re EC4 | CBoB carries out a review of the proposed legal, managerial, operational and ownership structures during the licensing application process. CBoB will only authorize banks where it is satisfied that it can carry out effective supervision on both a solo and consolidated basis (see S. 4(4)(b) of the BTCRA). |
| EC5 | The licensing authority identifies and determines the suitability of the bank’s major shareholders, including the ultimate beneficial owners, and others that may exert significant influence. It also assesses the transparency of the ownership structure, the sources of initial capital and the ability of shareholders to provide additional financial support, where needed. |
| Description and findings re EC5 | S. 4 (2) of the BTCRA states that the CBoB must be satisfied about the nature and sufficiency of the financial resources of the applicant (body corporate, annual statements plus most recent unaudited financial statements, for each applicant current statement of assets and liabilities certified by a public accountant) to provide continuing financial support to carry on banking business, before the granting of a license. Additionally, the Licence Regulations permit CBoB to vet the suitability of all shareholders proposing to hold 5 per cent or more of the shares, directly or indirectly, in the bank. |
| EC6 | A minimum initial capital amount is stipulated for all banks. |
| Description and findings re EC6 | Page 19 of the Licence Guidelines indicate that the CBoB has established the minimum paid up capital requirements at $5 million for commercial and public banks as reflected in the Licence Guideline. CBoB can stipulate a higher minimum figure based on a review of the proposed business activities of the applicant. |
| EC7 | The licensing authority, at authorization, evaluates the bank’s proposed Board members and senior management as to expertise and integrity (fit and proper test), and any potential for conflicts of interest. The fit and proper criteria include: (i) skills and experience in relevant financial operations commensurate with the intended activities of the bank; and (ii) no record of criminal activities or adverse regulatory judgments that make a person unfit to uphold important positions in a bank.16 The licensing authority determines whether the bank’s Board has collective sound knowledge of the material activities the bank intends to pursue, and the associated risks. |
| Description and findings re EC7 | S. 4 (2) of the BTCRA stipulates that the CBoB must be satisfied that those who will operate the bank (or trust company) will do so responsibly and that such persons have the character, competence and experience for operating a bank. This requirement is supplemented by the Licence Regulations which allow CBoB to analyze the proposed ownership and managerial structure and the background, integrity and suitability of proposed directors and managers using traditional fit and proper criteria. Tools such as World Check and regulatory contacts are used during the due diligence process in assessing the fitness and probity of the promoters, shareholders, directors, and senior management of applicants. Senior management are required to submit police certificates from their respective home jurisdictions and to declare, inter alia, information related to criminal records, or adverse regulatory judgments in a confidential statement. S. 3E and 4(2) of the BTCRA, states that the Board (and senior) management must satisfy the CBoB that they will manage the bank responsibly and that they have the proper character, competence and experience to operate a bank. CBoB also assesses the collective sound knowledge of material activities of the proposed licensee. |
| EC8 | The licensing authority reviews the proposed strategic and operating plans of the bank. This includes determining that an appropriate system of corporate governance, risk management and internal controls, including those related to the detection and prevention of criminal activities, as well as the oversight of proposed outsourced functions, will be in place. The operational structure is required to reflect the scope and degree of sophistication of the proposed activities of the bank.17 |
| Description and findings re EC8 | S. 4(2) of the BTCRA states that each applicant must submit for consideration by the CBoB such information as the CBoB deems necessary to undertake a full assessment of the application. CBoB relies upon a number of Regulations and Guidelines including Licence Regulations, Guidelines for Assessing the Fitness and Propriety of Applicants for Regulated Functions and General Information Guidelines for Licence Applications. The Licence Guidelines require the applicant to submit a strategic and operating plan and feasibility study, pro-forma financial statements covering a three to five-year timeframe, information on its internal organization, details on internal audit and compliance functions. These are supplemented by the CBoB’s Guidelines on corporate governance, internal controls, outsourcing, AML/CFT and risk management requirements. The submitted data is required to take into account the nature and complexity of the proposed activities of the applicant. CBoB’s authorization division is responsible for the processing of authorizations. Once an application has been approved a supervisor/analysist is assigned to the supervisory oversight of the new SFI. The SFI is monitored by the off-site supervision surveillance team and in general an on-site examination is conducted within 18 months of operation. At the time of licensing, CBoB’s authorization division examines the general outline of risk management policies and has discussions with the applicants regarding the corporate governance and internal control framework for the proposed SFI. |
| EC9 | The licensing authority reviews pro forma financial statements and projections of the proposed bank. This includes an assessment of the adequacy of the financial strength to support the proposed strategic plan as well as financial information on the principal shareholders of the bank. |
| Description and findings re EC9 | The Licence Regulations require applicants to provide pro forma financial statements covering a three year to five-year timeframe. Applicants must also submit a strategic and operating plan and feasibility study. Shareholders are required to submit net worth statements to enable CBoB to assess their financial strength. Where an application is made by a corporate entity or a bank, audited financial statements for the three years immediately preceding the application are required to assess the financial strength of the parent. S. 4 (2) of the BTCRA states that the CBoB must be satisfied about the nature and sufficiency of the financial resources of the applicant to provide continuing financial support for the bank. |
| EC10 | In the case of foreign banks establishing a branch or subsidiary, before issuing a license, the host supervisor establishes that no objection (or a statement of no objection) from the home supervisor has been received. For cross-border banking operations in its country, the host supervisor determines whether the home supervisor practices global consolidated supervision. |
| Description and findings re EC10 | S. 4(4) of the BTCRA stipulates that a license shall not be granted unless the CBoB is satisfied that the bank will be subject to adequate consolidated supervision by the home supervisor; that the latter makes no objection to the establishment of the branch or subsidiary in the Bahamas; and that there are no constraints on internal or external audits imposed by the home regulator. |
| EC11 | The licensing authority or supervisor has policies and processes to monitor the progress of new entrants in meeting their business and strategic goals, and to determine that supervisory requirements outlined in the license approval are being met. |
| Description and findings re EC11 | The CBoB’s off-site supervision surveillance monitor the progress of its new licensees in meeting their business and strategic goals through a quarterly review of financial statements (as well as audited statements when they become available), prudential discussions are held with banks on an annual basis or more frequently if the need arises. All banks are subject to periodic on-site inspection. |
| Assessment of Principle 5 | Compliant |
| Comments | CBoB has a thorough licensing framework and processes in place to assess licensing applications, CBoB follows criteria explicit criteria pertaining to financial strengthen of investors, fit and proper guidance for the appointment of senior management and Board members, analysis of proposed business strategy, and minimum capital adequacy requirements. To avoid problems at a later date, for new licensees who do not have a strong parent company to oversee the startup of operations, CBoB should conduct a more in-depth review of applicant’s risk management policies and conduct an on-site view prior to the 18 months of operation of the SFI. |
| Principle 6 | Transfer of significant ownership. The supervisor18 has the power to review, reject and impose prudential conditions on any proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties. |
| Essential criteria | |
| EC1 | Laws or regulations contain clear definitions of “significant ownership” and “controlling interest”. |
| Description and findings re EC1 | S. 2 of the BTCRA outlines the definition of “controller” which means a person who is able to exercise a significant influence over the management of a licensee by virtue of (i) a holding of shares or other securities in the licenses or such other company; (ii) an entitlement to exercise, or control the exercise of, the voting power at any general meeting of the licensee, or such other company. S. 6A of the BTCRA states that the CBoB may grant/refuse approval of an application by a person to become a controller of a licensee or to increase a controller’s shareholding in a licensee. S. 6 of the BTCRA states that in the case of publicly traded banks approval is required at the 5 percent level and notification at the 3 percent level (as stated in the Acquisition of Shares Regulations (ASR)). |
| EC2 | There are requirements to obtain supervisory approval or provide immediate notification of proposed changes that would result in a change in ownership, including beneficial ownership, or the exercise of voting rights over a particular threshold or change in controlling interest. |
| Description and findings re EC2 | S. 6 of BTCRA specifies that no shares in a bank or any other securities shall be issued and no issued shares shall be transferred or disposed of in any manner without the prior approval of the CBoB. S. 6A of the BTCRA also empowers the CBoB to approve the application of a person who wishes to become a controller of a licensee. This is also reflected in the ASR which requires that any person wishing to acquire shares in a bank (5 percent in the case of a publicly traded bank) must receive the prior approval of CBoB. Paragraph 2(a)(i) of the Schedule to the ASR—requires banks to provide a list of, and background information on, all direct or indirect shareholders who represent, either individually or as a group acting together, 10 percent or more of the voting rights, shares and/or other controlling interest of each applicant at the time of the application. Paragraph 2 (a)(iii) of the Schedule also requires the applicant to provide CBoB with an organization chart showing the structure of the direct and indirect shareholding of each applicant analyzed according to holdings of voting rights, shares and/or other controlling interests. The Registrar of Beneficial Ownership Bill, 2018, effective January 1, 2019 will provide the CBoB with an additional source of information to check prior to granting any approvals related to a controller pertaining to the prevention of criminals or associates from holding any interest, significant or otherwise in the any SFI. |
| EC3 | The supervisor has the power to reject any proposal for a change in significant ownership, including beneficial ownership, or controlling interest, or prevent the exercise of voting rights in respect of such investments to ensure that any change in significant ownership meets criteria comparable to those used for licensing banks. If the supervisor determines that the change in significant ownership was based on false information, the supervisor has the power to reject, modify or reverse the change in significant ownership. |
| Description and findings re EC3 | S. 6 of the BTCRA indicates that no shares can change hands without the consent of CBoB. The same criteria that apply upon authorization apply also, where relevant, upon change of ownership. Accordingly, the proposed new owners and controllers must meet the fitness and propriety criteria and the acquisition must not hinder effective supervision and must be in the best interests of the financial system of The Bahamas. |
| EC4 | The supervisor obtains from banks, through periodic reporting or on-site examinations, the names and holdings of all significant shareholders or those that exert controlling influence, including the identities of beneficial owners of shares being held by nominees, custodians and through vehicles that might be used to disguise ownership. |
| Description and findings re EC4 | Banks are required to submit an annual statement of shareholders, directors and senior officers to CBoB (as well as to the Registrar of Companies). As stipulated in the Licensing Guidelines and the Applications Manual, the Confidential Statement (which is completed by all shareholders, directors and senior officers seeking CBoB’s approval of their appointment) requires that each SFI should inform CBoB, within 21 days, if it becomes aware of any material information that may affect the completeness or accuracy of the information contained in the statement (as per s. 13B of the BTCRA). |
| EC5 | The supervisor has the power to take appropriate action to modify, reverse or otherwise address a change of control that has taken place without the necessary notification to or approval from the supervisor. |
| Description and findings re EC5 | S. 6 of BTCRA states that no acquisition is valid without the consent of CBoB and specifically 6B states that CBoB may object to an existing controller and may take steps to ensure that such a person ceases to be a controller. |
| EC6 | Laws or regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest. |
| Description and findings re EC6 | The Confidential Statement (which is completed by all shareholders, directors and senior officers seeking CBoB’s approval of their appointment) requires that each bank should inform the Inspector, within 21 days, if it becomes aware of any material information that may affect the completeness or accuracy of the information contained in the statement. |
| Assessment of principle 6 | Compliant |
| Comments | CBoB has the power to review, reject, and impose prudential conditions on proposals to transfer significant ownership or controlling interests in SFIs. |
| Principle 7 | Major acquisitions. The supervisor has the power to approve or reject (or recommend to the responsible authority the approval or rejection of), and impose prudential conditions on, major acquisitions or investments by a bank, against prescribed criteria, including the establishment of cross-border operations, and to determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision. |
| Essential criteria | |
| EC1 | Laws or regulations clearly define:
|
| Description and findings re EC1 | The Banks and Trust Companies (Equity Investments) Regulations 2005 (Equity Regulations) stipulates that no bank, without the prior written approval of CBoB can acquire, either directly or indirectly, more than 5 percent of the shares, securities and/or any other interest in any other person (e.g., companies, partnerships, trusts, etc.) S. 5 of the BTCRA requires that written approval of CBoB be obtained for the establishment of foreign subsidiaries (as well as foreign branches and representative offices) by banks. Regulation 3 of the Equity Regulations specifies that no bank shall, without the prior written approval of the CBoB, acquire or hold the shares, securities or other interests in or of any person that is a related party to the bank. |
| EC2 | Laws or regulations provide criteria by which to judge individual proposals. |
| Description and findings re EC2 | In general, the CBoB seeks to ensure that any acquisition proposal made by a bank is sound and feasible and is in the best interests of depositors and the financial system in The Bahamas. If the proposed investment is in a bank (or trust company), the proposal is judged by the criteria outlined in S. 4(2) of the BTCRA. (i.e., authorization criteria). |
| EC3 | Consistent with the licensing requirements, among the objective criteria that the supervisor uses is that any new acquisitions and investments do not expose the bank to undue risks or hinder effective supervision. The supervisor also determines, where appropriate, that these new acquisitions and investments will not hinder effective implementation of corrective measures in the future.19 The supervisor can prohibit banks from making major acquisitions/investments (including the establishment of cross-border banking operations) in countries with laws or regulations prohibiting information flows deemed necessary for adequate consolidated supervision. The supervisor takes into consideration the effectiveness of supervision in the host country and its own ability to exercise supervision on a consolidated basis. |
| Description and findings re EC3 | In general, the CBoB seeks to ensure that any acquisition proposal made by a bank is sound and feasible and is in the best interests of depositors and the financial system in the Bahamas. S. 5 of the BTCRA states that a licensee incorporated or registered in The Bahamas shall not without the prior written approval of the Bank establish outside of The Bahamas, a subsidiary, branch, or representative office. S. 4 of the Guidelines for the Establishment or Acquisition of Overseas Branches, Subsidiaries and Representative Offices address the requirement for consolidated supervision and provides that for CBoB’s ability to successfully supervise entire banking groups on a consolidated basis, it must have an ability to review banking and nonbanking activities conducted by its licensees, either directly or indirectly (through branches, subsidiaries or representative offices) and activities conducted at both domestic and foreign offices. To facilitate CBoB’s ability to supervise on a consolidated basis, it has entered into several MoUs with host regulators. The Guidelines states this as a condition of final approval to the establishment of a branch or subsidiary. CBoB will only allow a bank to make significant investments in other countries where it is satisfied that the supervisors in those other countries implements adequate consolidated supervision and there are no constraints on internal and external audits imposed by those supervisory authorities. The CBoB will only allow an acquisition where it can effectively supervise the bank on a consolidated basis (S. 7 of the Licence Guidelines). |
| EC4 | The supervisor determines that the bank has, from the outset, adequate financial, managerial and organizational resources to handle the acquisition/investment. |
| Description and findings re EC4 | Section 4 (2) of BTCRA provides that CBoB must be satisfied about the nature and sufficiency of the financial resources of the acquiring bank to provide continuing financial support in respect of the proposed acquisition. It must also satisfy itself regarding the soundness and feasibility of the proposal. The Guidelines for the Establishment or Acquisition of Overseas Branches, Subsidiaries and Representative Offices set out the factors which the Bank will consider when determining whether or not to approve an application to establish a foreign subsidiary. Paragraph V(1)(b) and (e) of these Guidelines includes the amongst the various criteria to be considered by the Bank: “(b) the fitness, propriety and managerial capacity of the applicant to expand its banking and/or trust business overseas in a prudent and reputable manner; and (e) the nature and sufficiency of the financial resources of the applicant to provide continuing financial support to the branch, subsidiary or representative office overseas, should it be necessary. The financial condition and likely future requirements of the entity in terms of possible injections of capital and liquidity will also be considered to ensure that there will not be undue hardship on the financial resources of the licensee;” The Equity Regulations 2005 stipulates that no bank, may without the prior written approval of CBoB acquire, either directly or indirectly, more than 5 percent of the shares, securities and/or any other interest in any other person (e.g., companies, partnerships, trusts, etc.). The off-site supervision surveillance team, together with the authorization unit, engages in discussions with SFIs of potential major acquisitions to determine if the SFI has the organizational resources to handle the acquisition or investment. |
| EC5 | The supervisor is aware of the risks that non-banking activities can pose to a banking group and has the means to take action to mitigate those risks. The supervisor considers the ability of the bank to manage these risks prior to permitting investment in non-banking activities. |
| Description and findings re EC5 | CBoB will only permit an investment in a non-banking entity where it is sound and feasible and in the best interest of depositors and the financial system in The Bahamas. |
| AC1 | The supervisor reviews major acquisitions or investments by other entities in the banking group to determine that these do not expose the bank to any undue risks or hinder effective supervision. The supervisor also determines, where appropriate, that these new acquisitions and investments will not hinder effective implementation of corrective measures in the future.20 Where necessary, the supervisor is able to effectively address the risks to the bank arising from such acquisitions or investments. |
| Description and findings re AC1 | |
| Assessment of Principle 7 | Compliant |
| Comments | The BTCRA empowers CBoB to establishes clear provisions on acquisitions and investments that require prior supervisory approval or prior notification to CBoB. |
| Principle 8 | Supervisory approach. An effective system of banking supervision requires the supervisor to develop and maintain a forward-looking assessment of the risk profile of individual banks and banking groups, proportionate to their systemic importance; identify, assess and address risks emanating from banks and the banking system as a whole; have a framework in place for early intervention; and have plans in place, in partnership with other relevant authorities, to take action to resolve banks in an orderly manner if they become non-viable. |
| Essential criteria | |
| EC1 | The supervisor uses a methodology for determining and assessing on an ongoing basis the nature, impact and scope of the risks:
The methodology addresses, among other things, the business focus, group structure, risk profile, internal control environment and the resolvability of banks, and permits relevant comparisons between banks. The frequency and intensity of supervision of banks and banking groups reflect the outcome of this analysis. |
| Description and findings re EC1 | CBoB has identified six Domestic Systemically Important Banks (DSIB) which based on their nature, impact and scope of risks were determined to have the potential impact on the safety and soundness of The Bahamas banking system. These DSIBs are subject to more enhanced off-site supervision surveillance focus requiring a three-year cycle for a risk assessment versus the other SFI’s being subject to a 5-year risk assessment cycle. The off-site supervision surveillance teams meet more frequently (semi-annually) with the DSIB’s senior management to discuss prudential issues, and progress in addressing supervisory requirements. At times, the DSIBs are also subject to more regular on-site examinations than other SFIs, however the on-site examinations do not include a deep effectiveness review of corporate governance, internal audit function nor an examination of some of the material risks (e.g. credit) on a regular basis. The international SFIs (including branch operations) are subject to similar risk assessment processes, but less frequently (e.g. annually). |
| EC2 | The supervisor has processes to understand the risk profile of banks and banking groups and employs a well-defined methodology to establish a forward-looking view of the profile. The nature of the supervisory work on each bank is based on the results of this analysis. |
| Description and findings re EC2 | CBoB’s off-site supervision surveillance includes:
When an on-site examination takes place, CBoB evaluates banks’ policies, practices, and procedures relating to their loan and investment portfolios, and ensures that banks have in place internal controls adequate to the nature and scale of their operations. The off-site supervisors prepare risk assessments (on a cycle of 3 (DSIBs) and 5 years (all other SFIs), annual/semi-annual analysis as well as reports on examinations provide for a good understanding of the overall risk profile of the SFI. The ever-greening tool which has been developed and implemented (although a few remaining adjustments are required to make it fully operational) provides the off-site supervisors the ability to update the risk assessment matrix/profile frequently, which incorporates an impact assessment of the direction of risk. |
| EC3 | The supervisor assesses banks’ and banking groups’ compliance with prudential regulations and other legal requirements. |
| Description and findings re EC3 | CBoB requires the Board of Directors to provide an annual certification which is relied upon to ensure that SFIs are in compliance with prudential regulations and other legal requirements. Additionally, banks are expected to notify the CBoB of any breaches of prudential norms or prudential regulations. |
| EC4 | The supervisor takes the macroeconomic environment into account in its risk assessment of banks and banking groups. The supervisor also takes into account cross-sectoral developments, for example in non-bank financial institutions, through frequent contact with their regulators. |
| Description and findings re EC4 | As part of the risk based supervisory framework, CBoB assesses the effect of economic factors of licensees including trends in national and regional gross domestic products (GDP), trends in national inflation and foreign investments in The Bahamas to name a few. CBoB also assess the impact of changes in the competitive environment of licensees including the impact of changes in international rules for disclosure (exchanges of information between tax authorities), levels of new entrants/exits from the industry/sector, trends in margins and profitability for the industry/sector as well as the industry structure. CBoB also conducts aggregate stress testing to test SFI’s abilities to withstand certain shocks in the macroeconomic environment. Although CBoB is in the preliminary stages of developing these macro stress tests, the stress testing to date has assisted the BSD with assessing the impact on the risk profile of the DSIBs. |
| EC5 | The supervisor, in conjunction with other relevant authorities, identifies, monitors and assesses the build-up of risks, trends and concentrations within and across the banking system as a whole. This includes, among other things, banks’ problem assets and sources of liquidity (such as domestic and foreign currency funding conditions, and costs). The supervisor incorporates this analysis into its assessment of banks and banking groups and addresses proactively any serious threat to the stability of the banking system. The supervisor communicates any significant trends or emerging risks identified to banks and to other relevant authorities with responsibilities for financial system stability. |
| Description and findings re EC5 | CBoB conducts reviews of trends and concentrations within and across the banking system as a whole. CBoB’s Quarterly Economic Review, produced by CBoB’s Research Department, reviews key economic and financial developments, including an analysis of the developments in the financial services sector, performance of the domestic banks, credit quality, capital adequacy, and profitability. The report also speaks to capital markets developments as well as developments in the international environment. This analysis, together with the marcro stress testing conducted by CBoB is factored into the risk assessment of the SFIs. In addition, based on the current credit environment in The Bahamas, the off-site supervision surveillance team has made an effort over the past 18 months to communicate these findings with the DSIBs, along with CBoB’s expectation that these SFI work towards lowering the overall level of NPLs in the banking sector. The overall NPL levels have been gradually decreasing since that time, with the exception of one DSIB. |
| EC6 | Drawing on information provided by the bank and other national supervisors, the supervisor, in conjunction with the resolution authority, assesses the bank’s resolvability where appropriate, having regard to the bank’s risk profile and systemic importance. When bank-specific barriers to orderly resolution are identified, the supervisor requires, where necessary, banks to adopt appropriate measures, such as changes to business strategies, managerial, operational and ownership structures, and internal procedures. Any such measures take into account their effect on the soundness and stability of ongoing business. |
| Description and findings re EC6 | CBoB reviews and assesses all relevant information received by licensees, other regulators or obtained by other means which may have an impact on the soundness and stability of licensees’ business operations. CBoB has the power under the BTCRA to impose intervention measures on licensees should there be any supervisory concerns. CBoB’s Ladder of Supervisory Intervention Guidelines provide CBoB with the ability to take the necessary intervention measures in a timely manner. At this time, proposed amendments to the BTCRA will enhance the CBoB’s resolution framework as well as when enacted would allow the CBoB to require banks to make changes to remove barriers to orderly resolution. |
| EC7 | The supervisor has a clear framework or process for handling banks in times of stress, such that any decisions to require or undertake recovery or resolution actions are made in a timely manner. |
| Description and findings re EC7 | At this time, CBoB works informally with the Group of Financial Services Regulators (domestic agencies through an MoU) as well as with the MoF to deal with the handling of banks in stress. Amendments to the BTCRA have proposed an enhanced resolution framework that would empower the BTCRA to require SFIs to undertake recovery or resolution actions in a timely manner. It is essential for the CBoB to be formally recognized as the Resolution Authority as well as having the power to take the necessary steps to ensure any actions that are required to be taken are done so in a timely manner. |
| EC8 | Where the supervisor becomes aware of bank-like activities being performed fully or partially outside the regulatory perimeter, the supervisor takes appropriate steps to draw the matter to the attention of the responsible authority. Where the supervisor becomes aware of banks restructuring their activities to avoid the regulatory perimeter, the supervisor takes appropriate steps to address this. |
| Description and findings re EC8 | SFIs are required to seek formal approval of any restructuring activities and therefore it would not approve of any activities that an SFI conducts in order to avoid regulatory requirements. |
| Assessment of Principle 8 | Largely Compliant |
| Comments | CBoB has a strong off-site surveillance program that entails direct interaction with the DSIBs on a semi-annual basis, international firms annually, that entails discussions around periodic reporting, discussion of emerging prudential risks (credit) that could impact the firm. CBoB must ensure that its DSIBs have an adequate on-site examination program that includes an in-depth review (which can be conducted on a cycle basis) of corporate governance, internal controls and a deep assessment of the most prominent risks in the business model (e.g. credit risk for the domestic retail asset backed lending books). This enhanced risk assessment process should be conducted more frequently for DSIBs to minimize the potential negative impact on the financial stability of the banking system in The Bahamas. A supervisory regime for the assessment of resolvability is still a work in progress. |
| Principle 9 | Supervisory techniques and tools. The supervisor uses an appropriate range of techniques and tools to implement the supervisory approach and deploys supervisory resources on a proportionate basis, taking into account the risk profile and systemic importance of banks. |
| Essential criteria | |
| EC1 | The supervisor employs an appropriate mix of on-site21 and off-site22 supervision to evaluate the condition of banks and banking groups, their risk profile, internal control environment and the corrective measures necessary to address supervisory concerns. The specific mix between on-site and off-site supervision may be determined by the particular conditions and circumstances of the country and the bank. The supervisor regularly assesses the quality, effectiveness and integration of its on-site and off-site functions, and amends its approach, as needed. |
| Description and findings re EC1 | CBoB’s off-site supervision surveillance program uses a number of methods for assessing an SFI’s financial condition and compliance with prudential requirements and standards, including those related to corporate governance and risk management. Both the domestic and international SFIs are subject to the same risk based supervisory framework with more emphasis being placed on the largest SFIs in both categories. The on-site examination program does not include a deep effectiveness assessment of DSIB’s key corporate governance, risk management and internal controls practices, as well as in-depth reviews of material risks (e.g. credit risk) depending on the business model on a regular basis. |
| EC2 | The supervisor has a coherent process for planning and executing on-site and off-site activities. There are policies and processes to ensure that such activities are conducted on a thorough and consistent basis with clear responsibilities, objectives and outputs, and that there is effective coordination and information sharing between the on-site and off-site functions. |
| Description and findings re EC2 | Each year the BSD formulates a strategic plan that references the continuous off-site supervision surveillance requirements (including semi-annual/annual meetings with senior management of SFIs), planned on-site examination work required to be undertaken depending on the in-depth risk assessments conducted by the off-site supervision surveillance team’s requirements together with the requirement to address all regulatory guidance needs (e.g. implementing Basel II/III reform initiatives, etc.). |
| EC3 | The supervisor uses a variety of information to regularly review and assess the safety and soundness of banks, the evaluation of material risks, and the identification of necessary corrective actions and supervisory actions. This includes information, such as prudential reports, statistical returns, information on a bank’s related entities, and publicly available information. The supervisor determines that information provided by banks is reliable23 and obtains, as necessary, additional information on the banks and their related entities. |
| Description and findings re EC3 | In addition to the documentation used in a risk assessment, CBoB reviews information obtained from statutory filings (prudential returns), financial reporting requirements for capital liquidity and earnings performance (to name a few) on a weekly, quarterly and monthly basis, external audit reports, consolidated annual reports from the parent company), correspondences, service level agreements, newspaper articles and press releases, internal audit reports, ICAAP reports and management reporting to the Board of Directors (“the Board”) (including minutes of the Board and Board committee meetings) as well as reports emanating from Discovery Review meetings. |
| EC4 | The supervisor uses a variety of tools to regularly review and assess the safety and soundness of banks and the banking system, such as:
The supervisor communicates its findings to the bank as appropriate and requires the bank to take action to mitigate any particular vulnerabilities that have the potential to affect its safety and soundness. The supervisor uses its analysis to determine follow-up work required, if any. |
| Description and findings re EC4 | CBoB uses a variety of tools to regularly review and assess the safety and soundness of SFIs, including the review and analysis of financial statements and accounts, business model analysis (part of the analysis conducted annually as well as the in-depth risk assessments conducted every 3 years for DSIBs land 5 years for all other SFIs). Horizontal peer reviews are conducted in an informal manner, but it is conducted nonetheless. The outcome of SFI produced stress tests are reviewed and discussed with the institution when relevant. CBoB on-site examiners review corporate governance, including risk management and internal control systems when a specific risk is being reviewed as part of the examination. In general, CBoB does not conduct a deep dive review of corporate governance per se. |
| EC5 | The supervisor, in conjunction with other relevant authorities, seeks to identify, assess and mitigate any emerging risks across banks and to the banking system as a whole, potentially including conducting supervisory stress tests (on individual banks or system-wide). The supervisor communicates its findings as appropriate to either banks or the industry and requires banks to take action to mitigate any particular vulnerabilities that have the potential to affect the stability of the banking system, where appropriate. The supervisor uses its analysis to determine follow-up work required, if any. |
| Description and findings re EC5 | CBoB is in its early stages of developing appropriate models and detailed guidelines for supervisory stress testing, but these have not been issued as yet. Most licensees are subsidiaries or branches of international banking groups and have advanced models that are employed subject to home country supervision standards. For the local operation, the CBoB reviews the results of the models and stress testing and is initiating work with the local operation to adapt their models. |
| EC6 | The supervisor evaluates the work of the bank’s internal audit function, and determines whether, and to what extent, it may rely on the internal auditors’ work to identify areas of potential risk. |
| Description and findings re EC6 | The off-site supervision surveillance receives all internal audit reports throughout the year on all SFIs and the team meets face to face with the internal auditors to review the findings of such reports. In addition, the on-site examiners review the scope and work papers of the auditor during onsite examination visits. As part of a licensee’s risk assessment, examiners also assess the issues identified and recommendations made in internal and group internal audit reports. |
| EC7 | The supervisor maintains sufficiently frequent contacts as appropriate with the bank’s Board, non-executive Board members and senior and middle management (including heads of individual business units and control functions) to develop an understanding of and assess matters such as strategy, group structure, corporate governance, performance, capital adequacy, liquidity, asset quality, risk management systems and internal controls. Where necessary, the supervisor challenges the bank’s Board and senior management on the assumptions made in setting strategies and business models. |
| Description and findings re EC7 | It is CBoB’s policy, that all licensees meet at least annually with BSD. These meetings encompass all material issues arising from both off-site monitoring of prudential indicators and the CBoB’s on-site examinations. The frequency for onsite examinations is determined by the risk-rating of the bank. For example, a bank rated as high Risk (i.e., high probability of an event occurring and high systemic or jurisdictional impact if the event crystallizes) would be subject to at least annual reviews. Lower risk banks will be subject to less frequent reviews (based on the risk rating). Licensees are required to submit, in advance of the meetings, relevant recent internal risk reports for their operations in The Bahamas, as well as internal audit reviews and the external auditor’s management letter. More frequent meetings are held with higher risk entities. Licensees are required to notify the CBoB of any significant changes in their activities, as well as discuss activities and financial performance at the annual prudential meeting. The inclusion of external auditors, non-executive directors and middle management of licensees in prudential discussions is determined on a case-by-case basis (at the discretion of the Inspector). The risk–based assessment (profile) for licensees is used for determining the frequency of examinations. Meetings are routinely held and correspondence regularly exchanged with the external auditors of banks. In general, CBoB has focused mainly on SFI senior management executives, however, CBoB recently communicated its intent to engage boards directly on a go forward basis. The intent is to engage more closely with the boards of supervised financial institutions on matters of financial and AML risk. |
| EC8 | The supervisor communicates to the bank the findings of its on- and off-site supervisory analyses in a timely manner by means of written reports or through discussions or meetings with the bank’s management. The supervisor meets with the bank’s senior management and the Board to discuss the results of supervisory examinations and the external audits, as appropriate. The supervisor also meets separately with the bank’s independent Board members, as necessary. |
| Description and findings re EC8 | CBoB traditionally meets with SFI senior management either through regular prudential meetings (annual/semi-annual) or to discuss a Report of Examination which is provided to the licensee after the examination. In the past, CBoB has taken sometimes months to release its Report of Examination. However, in 2018 CBoB has narrowed the release of final Reports of Examination within 20 business days after the onsite visit. Licensees are expected to satisfactorily address all issues/deficiencies identified in the report in a timely manner. Validation of same is conducted during the next onsite examination visits. Since 2018 CBoB has conducted quarterly/semi-annual meetings with the DSIBs to discuss, among other things, progress in addressing the overall level of NPLs (specifically focusing on the top 20 large exposures as well as the top 20 NPLs) These meetings with the DSIBs have provided a perspective of the credit profile, lending initiatives and the licensees’ perspective on the marketplace trends, as well as delinquency management practices. |
| EC9 | The supervisor undertakes appropriate and timely follow-up to check that banks have addressed supervisory concerns or implemented requirements communicated to them. This includes early escalation to the appropriate level of the supervisory authority and to the bank’s Board if action points are not addressed in an adequate or timely manner. |
| Description and findings re EC9 | CBoB monitors the progress of licensees’ ability to satisfactorily address issues or deficiencies identified in the Report of Examination by way of letter. Licensees are required to provide status updates periodically to CBoB via “Response to Report of Examination” letters until all matters are fully addressed. CBoB advises the licensee of the next reporting date in each letter until all matters are resolved. Further enhancement was made to the monitoring process this year via the development of a “Register of Supervisory Issues”, which is a compilation of all outstanding supervisory matters for each licensee. Included in the register are all outstanding directives, requirements, expectations and requests made of a licensee by the CBoB. The register is provided to licensees each year and they are advised to share the document with external auditors and other persons listed in Section 16(1) of the BTCRA. In addition, CBoB has required the Internal audit function to provide an attestation that confirms the SFI has in fact addressed any outstanding supervisory requirement. |
| EC10 | The supervisor requires banks to notify it in advance of any substantive changes in their activities, structure and overall condition, or as soon as they become aware of any material adverse developments, including breach of legal or prudential requirements. |
| Description and findings re EC10 | The BTCRA indicates that licensees are expected to inform CBoB in advance of any significant change that may impact the operation of their business. For example, via Notice, licensees were directed by the CBoB to immediately notify the Inspector of Banks and Trust Companies, if they become aware that a material event could have a significant adverse impact on its safety and soundness or reputation. The matter is to be reported whether it had already occurred, or may occur in the foreseeable future. |
| EC11 | The supervisor may make use of independent third parties, such as auditors, provided there is a clear and detailed mandate for the work. However, the supervisor cannot outsource its prudential responsibilities to third parties. When using third parties, the supervisor assesses whether the output can be relied upon to the degree intended and takes into consideration the biases that may influence third parties. |
| Description and findings re EC11 | The BTCRA enables CBoB to use independent third parties. Section 13 (3) (c), (d) (e) and 4 of the BTCRA notes the following: “In the performance of his functions under this Act and subject to the provisions of section 19, the Inspector shall be entitled at all reasonable times — (c) to call upon the auditors of any licensee for such auditor’s reports, working papers, information or explanation; (d) to require that the auditor of a bank report to the Inspector on the extent of the procedures of the auditor in the examination of the annual financial statements and may require that the auditors enlarge the scope of that examination or direct that any other particular procedure be performed in any particular case; (e) to require that the auditor make a particular examination relating to the adequacy of the procedures adopted by the bank for the safety of its creditors and shareholders, or any other examination as considered necessary by the Inspector, as the Inspector may reasonably require for the purpose of enabling him to perform his functions under this Act. (4) The Inspector with the approval of the Governor may in writing authorise any other person to assist the Inspector in the performance of his functions under this Act.” |
| EC12 | The supervisor has an adequate information system which facilitates the processing, monitoring and analysis of prudential information. The system aids the identification of areas requiring follow-up action. |
| Description and findings re EC12 | In 2015, CBoB launched its Online Reporting Information System (ORIMS), an electronic portal for licensees to upload their regulatory returns and submit same to the Bank. The ORIMS is an enhancement to CBoB’s existing infrastructure for regulatory filings, analytics and reporting. ORIMS allows licensees and other respondents to securely submit data, filings and documents via online forms submissions and file uploads. The system includes a mechanism for the downloading and subsequent uploading of returns through a secure web-based platform and built-in validation and integrity checks at the form submission level. There have been several updates since the system was launched, all in an effort to streamline the information exchange and to provide an efficient reporting system for licensees. Updates and enhancements to the system will continue as necessary. The supervisory team is then able to access the returns in the portal and conduct their own financial analysis of licensees. Areas of concern are addressed with the licensee with follow-ups if necessary. |
| Additional criteria | |
| AC1 | The supervisor has a framework for periodic independent review, for example by an internal audit function or third party assessor, of the adequacy and effectiveness of the range of its available supervisory tools and their use, and makes changes as appropriate. |
| Description and findings re AC1 | CBoB’s internal audit periodically conducts a review of all of the Bank’s processes and procedures. Findings and recommendations are provided to the Bank via an internal audit report with timelines to address any matters of concern. The last CBoB internal audit of the BSD was in the process of being finalized in January 2019. |
| Assessment of Principle 9 | Largely Compliant |
| Comments | CBoB has a good set of supervisory tools to allow for effective execution of its supervisory activities. The mix of off-site surveillance and on-site examination work needs to be reassessed by BSD to ensure the right balance and adequate coverage of the assessment of risk. Staff are knowledgeable, and assessors observed the work done by both the off-site supervisors and the on-site examiners. Written communications clearly articulate issues and through frequent engagement CBoB provides clarity to the firms on the issues raised and the general high-level expectations for addressing them. That being said, it will be important for CBoB to directly engage SFI Boards of Directors, especially DSIBs on a regular basis. Although CBoB made a public announcement that it plans to engage Boards more directly, this has not been a regular past practice. |
| Principle 10 | Supervisory reporting. The supervisor collects, reviews and analyses prudential reports and statistical returns24 from banks on both a solo and a consolidated basis, and independently verifies these reports through either on-site examinations or use of external experts. |
| Essential criteria | |
| EC1 | The supervisor has the power25 to require banks to submit information, on both a solo and a consolidated basis, on their financial condition, performance, and risks, on demand and at regular intervals. These reports provide information such as on- and off-balance sheet assets and liabilities, profit and loss, capital adequacy, liquidity, large exposures, risk concentrations (including by economic sector, geography and currency), asset quality, loan loss provisioning, related party transactions, interest rate risk, and market risk. |
| Description and findings re EC1 | S. 35 (1) of the CBBA empowers CBoB to gather any information from licensee at regular intervals, e.g., weekly, monthly, quarterly, in order for it to carry out its statutory function. Information received includes detailed profit and loss accounts and balance sheets and information on capital adequacy, liquidity, large exposures, risk concentrations, asset quality/impairment data, aggregate loan loss data, exposures to related parties, interest rate risk and market risk. S. 35 of the CBBA provides that the CBoB may require a bank to supply it in such form and within such time as it may determine such information as CBoB considers necessary to enable it to carry out its functions under the Act. Further, CBoB may require a bank, a person connected to the bank, or a person reasonably believed to have information relevant to an enquiry by CBoB to provide any information which it reasonably requires in connection with the carrying out of its functions or for the purpose of assisting an overseas regulator. S 4(4)(b), 8(3), 9 and 14 of the BTCRA supports consolidated supervision and the gathering of applicable information by obtaining key information on licensees and their parent and/or subsidiaries through regular and frequent teleconferences with other relevant regulators as well as consistently attending supervisory colleges held by foreign regulatory authorities. |
| EC2 | The supervisor provides reporting instructions that clearly describe the accounting standards to be used in preparing supervisory reports. Such standards are based on accounting principles and rules that are widely accepted internationally. |
| Description and findings re EC2 | Section 35 of the CBBA provides that CBoB can direct the form and content of financial returns. These must be prepared in accordance with IAS as adopted by the Bahamas Institute of Chartered Accountants (BICA) which is the body in The Bahamas statutorily charged with overseeing the implementation of accounting and auditing standards (See Regulation 38 of The Bahamas Institute of Chartered Accountants (General) Regulations, 2016). Further, CBoB has instructed SFI’s to be IFRS 9 compliant beginning January 1, 2018. |
| EC3 | The supervisor requires banks to have sound governance structures and control processes for methodologies that produce valuations. The measurement of fair values maximizes the use of relevant and reliable inputs and is consistently applied for risk management and reporting purposes. The valuation framework and control procedures are subject to adequate independent validation and verification, either internally or by an external expert. The supervisor assesses whether the valuation used for regulatory purposes is reliable and prudent. Where the supervisor determines that valuations are not sufficiently prudent, the supervisor requires the bank to make adjustments to its reporting for capital adequacy or regulatory reporting purposes. |
| Description and findings re EC3 | SFIs must abide by the valuation rules consistent with IAS and IFRS 9 CBoB relies on views of the external auditors to attest to the valuation practices of SFI’s and where necessary, SFI’s have had to make adjustments to prudential reporting requirements. |
| EC4 | The supervisor collects and analyses information from banks at a frequency commensurate with the nature of the information requested, and the risk profile and systemic importance of the bank. |
| Description and findings re EC4 | S. 9 of BTCRA requires banks to furnish to CBoB a special return and any such information as it reasonably sees fit to call for. It is on this basis that CBoB has requested that it receive weekly, monthly, quarterly and annual returns, and any other returns it requires from the SFIs. The type of information received will depend on the nature and complexity of the business of the bank. For instance, the domestic banks are subject to a more demanding regime regarding information requirements than the international banks. |
| EC5 | In order to make meaningful comparisons between banks and banking groups, the supervisor collects data from all banks and all relevant entities covered by consolidated supervision on a comparable basis and related to the same dates (stock data) and periods (flow data). |
| Description and findings re EC5 | In general, supervisory returns are received on a weekly, monthly, quarterly and annual basis. The layout and content of these returns are the same and banks are required to submit them at the same dates. While the different categories of banks (i.e., domestic/international) may have varying requirements, within those categories the requirements are the same. This allows for meaningful comparisons for banks in the same categories. |
| EC6 | The supervisor has the power to request and receive any relevant information from banks, as well as any entities in the wider group, irrespective of their activities, where the supervisor believes that it is material to the condition of the bank or banking group, or to the assessment of the risks of the bank or banking group or is needed to support resolution planning. This includes internal management information. |
| Description and findings re EC6 | The CBoB has the ability to request and receive relevant information from banks, including information on any entities in the wider group, but this power to request this information in with the SFI it regulates. Section 35 of the CBBA provides that the CBoB may require a bank to supply it in such form and within such time as it may determine such information as CBoB considers necessary to enable it to carry out its functions under the Act. Further, CBoB may require a bank, a person connected to the bank, or a person reasonably believed to have information relevant to an enquiry by CBoB to provide any information which it reasonably requires in connection with the carrying out of its functions. S. 13(3) of the BTCRA the Inspector may call upon the manager or any officer designated by the manager of any licensee for such information or explanation as he may reasonably require for the purpose of enabling him to perform his functions under this Act. |
| EC7 | The supervisor has the power to access26 all bank records for the furtherance of supervisory work. The supervisor also has similar access to the bank’s Board, management and staff, when required. |
| Description and findings re EC7 | S. 13(3) of the BTCRA indicates that the Inspector is entitled at all reasonable times to have access to such books, records, vouchers, documents, cash and securities of the bank and to call upon the management or any officer designated by the manager of any bank for such information or explanation as Inspector may reasonably require for the purpose off enabling it to perform its functions. CBOB also sets limits within which licensees must operate for single, related party and large exposures vis its Large Exposure Regulations and Guidelines. CBoB conducts discussion with DSIB senior management on a semi-annual and annual basis. CBoB off-site supervision surveillance speaks to management and staff when required. CBoB released a press statement in 2018 to the financial sector that it intends to engage SFI Boards of Directors on an annual basis beginning 2019. Copies of Results of On-site examinations are provided to the Board of Directors. |
| EC8 | The supervisor has a means of enforcing compliance with the requirement that the information be submitted on a timely and accurate basis. The supervisor determines the appropriate level of the bank’s senior management is responsible for the accuracy of supervisory returns, imposes sanctions for misreporting and persistent errors, and requires that inaccurate information be amended. |
| Description and findings re EC8 | As part of CBoB’s supervisory intervention regime, a licensee can be staged for intervention, particularly at Stage 1 in accordance with the Ladder of Intervention Guideline where a licensee may experience the following issues:
SFIs provide a certification regarding the compliance and accuracy of the reporting of information. CBoB has a wide range of supervisory measures that it can impose on licensees including administrative fines and monetary penalties. The Bank’s monetary penalties regime was officially implemented on 5th September 2016 with the coming into force of the Banks and Trust Companies (Administrative Monetary Penalties) Regulations, 2016 and the Bank’s “Guidelines for the Administration of Monetary Penalties”, amended 31st August 2016 (“AMP guidelines”). The AMP guidelines outline the monetary sanctions that the Bank can impose, under statutory authority, for violations related to late or erroneous filing of returns, amongst others. S. 37 of the CBBA and S. 11 and 13 of the BTCRA impose criminal sanctions in relation to the provision of false or misleading information. Fines of up to $100,000 or five years imprisonment or both are specified in the law. |
| EC9 | The supervisor utilizes policies and procedures to determine the validity and integrity of supervisory information. This includes a program for the periodic verification of supervisory returns by means either of the supervisor’s own staff or of external experts.27 |
| Description and findings re EC9 | During on-site inspections, examiners review the integrity of supervisory information. In addition, the External Auditors Guidelines, issued by the CBoB, contain a requirement for external experts to bring material short comings to the attention of the supervisors. Additionally, CBoB has staff members designated to verify that financial returns submitted via its ORIMS Portal use the correct reporting format and to check for inconsistencies between report forms (this is in addition to inconsistencies between reports identified by the ORIMS software). If any of the aforementioned exist, it is flagged and the licensee(s) and/or registrant(s) along with the supervisory teams are informed and the licensees and/or registrants are required to re-submit the relevant return before they are analyzed. |
| EC10 | The supervisor clearly defines and documents the roles and responsibilities of external experts,28 including the scope of the work, when they are appointed to conduct supervisory tasks. The supervisor assesses the suitability of experts for the designated task(s) and the quality of the work and takes into consideration conflicts of interest that could influence the output/recommendations by external experts. External experts may be utilized for routine validation or to examine specific aspects of banks’ operations. |
| Description and findings re EC10 | CBoB has the power to appoint external experts to assist it in the performance of its duty (S. 13 (4) of BTCRA). It is not the policy of CBoB to utilize external experts to assist in carrying out supervisory functions, per se. However, it does use external experts when, for instance, introducing a new skill (e.g., the supervision of market risk) or for the purpose of conducting overseas reviews of banks that have extensive outsourcing of activities abroad. CBoB has also engaged external auditors to conduct in-depth credit reviews (e.g. forensic review on a stage 4 SFI). |
| EC11 | The supervisor requires that external experts bring to its attention promptly any material shortcomings identified during the course of any work undertaken by them for supervisory purposes. |
| Description and findings re EC11 | S. 12(4) of the BTCRA provides that the external auditor of a bank, and in some cases a former external auditor of a bank, is required to inform CBoB in writing of any fact or matter of which the auditor has or had become aware and which is, or is likely to be of material significance for the CBoB in relation to the discharge of its duties. “Facts and matters of material significance” are set out in the Banks and Trust Companies (Auditors) (Facts and Matters of Material Significance) Regulations and include a situation where the auditor identifies any evidence of deliberate attempts by a chief executive or other senior executive to mislead the Inspector through the provision of materially false or misleading information |
| EC12 | The supervisor has a process in place to periodically review the information collected to determine that it satisfies a supervisory need. |
| Description and findings re EC12 | CBoB periodically reviews the information collected from prudential returns to reassess the ongoing needs of its supervisors. This review process has taken place more regularly in recent years than in the past given the need necessity to rely on prudential return information as part of CBoB’s newly developed electronic ever-greening supervisory assessment tool. |
| Assessment re Principle 10 | Compliant |
| Comments | CBoB has appropriate authority to collect the data that it needs to carry out its supervisory responsibilities. Prudential and statistical reporting by the SFIs provide information on supervised firms’ risk exposures, operating performance and financial condition. CBoB is committed to refining its data gathering efforts as well as working towards full implementation of an electronic ever greening risk assessment tool. CBoB’s strategy includes continuing to increase the use of quantitative analyses (evidenced by the creation of an analytics unit). |
| Principle 11 | Corrective and sanctioning powers of supervisors. The supervisor acts at an early stage to address unsafe and unsound practices or activities that could pose risks to banks or to the banking system. The supervisor has at its disposal an adequate range of supervisory tools to bring about timely corrective actions. This includes the ability to revoke the banking license or to recommend its revocation. |
| Essential criteria | |
| EC1 | The supervisor raises supervisory concerns with the bank’s management or, where appropriate, the bank’s Board, at an early stage, and requires that these concerns be addressed in a timely manner. Where the supervisor requires the bank to take significant corrective actions, these are addressed in a written document to the bank’s Board. The supervisor requires the bank to submit regular written progress reports and checks that corrective actions are completed satisfactorily. The supervisor follows through conclusively and in a timely manner on matters that are identified. |
| Description and findings re EC1 | The BTCRA provides a wide range of discretionary enforcement powers to the CBoB to address situations that give the CBoB cause for concern. S. 18 of the BTCRA outlines the enforcement powers of the CBoB with respect to banks and other SFIs. This includes the power to ultimately revoke a licence. S. 24 of the BTCRA empowers the Governor to make regulations and to establish fines. The CBoB’s Ladder of Intervention Guidelines outlines procedures for addressing regulatory and supervisory breaches. The objective of the intervention process is to identify areas of concern early and to intervene early and effectively to minimize problems and losses to depositors and other creditors of licensees. Licensees whose overall risk assessment is deemed medium high or greater may also be placed on CBoB’s Watch List for enhanced monitoring until the relevant issues/concerns are satisfactorily addressed. Licensees’ progress with corrective action is closely monitored by the off-site supervision surveillances team. CBoB communicates findings and recommendations to licensees senior management and where appropriate Board representatives in a timely manner. With respect to onsite examinations, CBoB’s internal policy requires that the final examination report be provided to the bank within four weeks (20 business days) from the completion of the onsite examination. The CBoB notifies SFI’s in writing of any enforcement action that is being taken or will be taken. The BTCRA enables the CBoB to share information with other supervisory authorities. CBoB monitors SFI’s progress in remediating actions (progress against plan with a sign-off/attestation from internal audit at times), |
| EC2 | The supervisor has available29 an appropriate range of supervisory tools for use when, in the supervisor’s judgment, a bank is not complying with laws, regulations or supervisory actions, is engaged in unsafe or unsound practices or in activities that could pose risks to the bank or the banking system, or when the interests of depositors are otherwise threatened. |
| Description and findings re EC2 | Where a bank is found to be in breach of a prudential requirement or any other conditions set by the CBoB, the CBoB may agree or impose a plan of corrective action with the bank. In considering the appropriate supervisory intervention to take in the event of a concern arising or a supervisory breach by a bank, the CBoB will take into account, amongst other things, the following: the requirement for an SFI to increase provisioning for NPLs, increase in capital or liquidity, the removal of directors and management, requiring expanded external audits, the imposition of fines and restrictions on payment of dividends, lending or investment activities, accepting new deposits and other restrictions deemed appropriate. |
| EC3 | The supervisor has the power to act where a bank falls below established regulatory threshold requirements, including prescribed regulatory ratios or measurements. The supervisor also has the power to intervene at an early stage to require a bank to take action to prevent it from reaching its regulatory threshold requirements. The supervisor has a range of options to address such scenarios. |
| Description and findings re EC3 | The minimum capital prudential limit is 8 percent. However, commercial banks are required to maintain a target level of 17 percent and a trigger level of 14 percent. The Ladder of Intervention Guidelines refer to a 2 percent margin that can be used in determining when a licensee may be reaching its capital adequacy ratio (CAR) and/or liquidity ratio prudential limits. This trigger is introduced at Stage 2 “Heightened Risk to Financial Viability or Solvency” where a licensee is compliant with established prudential norms, but is approaching the limit. The range of intervention measures that can be used is outlined in the Ladder of Supervisory Intervention Guidelines. |
| EC4 | The supervisor has available a broad range of possible measures to address, at an early stage, such scenarios as described in essential criterion 2 above. These measures include the ability to require a bank to take timely corrective action or to impose sanctions expeditiously. In practice, the range of measures is applied in accordance with the gravity of a situation. The supervisor provides clear prudential objectives or sets out the actions to be taken, which may include restricting the current activities of the bank, imposing more stringent prudential limits and requirements, withholding approval of new activities or acquisitions, restricting or suspending payments to shareholders or share repurchases, restricting asset transfers, barring individuals from the banking sector, replacing or restricting the powers of managers, Board members or controlling owners, facilitating a takeover by or merger with a healthier institution, providing for the interim management of the bank, and revoking or recommending the revocation of the banking license. |
| Description and findings re EC4 | The Ladder Intervention Guidelines outlines the conditions to initiate the Bank’s intervention measures which include but are not limited to the following: (i) concerns about the licensee’s ability to meet capital and/or liquidity requirements on an ongoing basis; (ii) noticeable deterioration in the quality of loan and/or investment portfolio, which could negatively impact the licensee’s/registrant’s asset values; (iii) less than satisfactory management quality or deficiency in risk management procedures or controls (including material breaches of standards of sound business and financial practices/prudential violations); (iv) rapid asset and/or liability growth relative to the other institutions in the industry and (v) noncompliance with regulatory requirements. Supervisory intervention measures outlined in the Ladder of Intervention Guideline may include the requirement for an SFI to increase provisioning for NPLs, increase in capital or liquidity, the removal of directors and management, requiring expanded external audits, the imposition of fines and restrictions on payment of dividends, lending or investment activities, accepting new deposits and other restrictions deemed appropriate. |
| EC5 | The supervisor applies sanctions not only to the bank but, when and if necessary, also to management and/or the Board, or individuals therein. |
| Description and findings re EC5 | CBoB has imposed fines under the CBBA for non-compliance with liquidity requirements; additionally, amendments to the BTCRA and regulations have been made to enhance the CBoB’s ability to impose administrative monetary penalties for supervisory breaches by granting the authority to apply sanctions to individuals. S. 18E, 18F and 18G of the BTCRA empower the CBoB to issue prohibition orders against individuals who are not or have ceased to be fit and proper persons. S. 18 of the BTCRA empowers CBoB to remove a director or officer of a licensee and apply the administrative penalties regime to sanction management and the board when deemed necessary. |
| EC6 | The supervisor has the power to take corrective actions, including ring-fencing of the bank from the actions of parent companies, subsidiaries, parallel-owned banking structures and other related entities in matters that could impair the safety and soundness of the bank or the banking system. |
| Description and findings re EC6 | In general, the CBoB has broad authority to protect the licensee or branch from affiliate transactions. The CBoB may impose conditions or limitations on a bank’s licence and may also issue directives to require the bank to take such action as the CBoB requires in the interests of the bank’s safety and soundness (see BTCRA s.6(4) and 18(1)(h)). This would include the ability to ring fence assets of SFIs operating in The Bahamas. |
| EC7 | The supervisor cooperates and collaborates with relevant authorities in deciding when and how to effect the orderly resolution of a problem bank situation (which could include closure, or assisting in restructuring, or merger with a stronger institution). |
| Description and findings re EC7 | According to Section 4(4)(f) of the BTCRA, as a part of the licensing criteria, the home supervisory authority must agree to inform the Governor of problems that could affect the licensee. Section 38(3) of the CBBA gives the CBoB the authority to cooperate with overseas regulators for the purposes of cross-border supervision. The Ladder of Intervention Guidelines provides some guidance on the actions required to recover and resolve a problem SFI as part of the staging mechanisms. The Guideline advocates collaboration between home and host regulators when a licensee is having problems. The proposed amendments to the BTCRA will formalize CBoB’s resolution regime in the law. |
| Additional criteria | |
| AC1 | Laws or regulations guard against the supervisor unduly delaying appropriate corrective actions. |
| Description and findings re AC1 | There are no regulatory requirements specifying timeframes for taking corrective action. |
| AC2 | When taking formal corrective action in relation to a bank, the supervisor informs the supervisor of non-bank related financial entities of its actions and, where appropriate, coordinates its actions with them. |
| Description and findings re AC2 | The CBoB has regular meetings with the other regulators. The Ladder of Intervention Guidelines advocates that the CBoB inform/ discuss/collaborate with the MoF, the Deposit Insurance Corporation and other domestic regulators, as is necessary, where substantive actions are undertaken. |
| Assessment re principle 11 | Compliant |
| Comments | CBoB has a broad range of tools and authorities across the spectrum to address problems at SFIs ranging from the requirement to increase capital, liquidity and provisioning levels to the removal of board and senior management, restrictions on dividends, payment of bonus to revoking a banking license. These powers are not explicitly stated in the BTCRA, although the proposed draft amendments, which will not only introduce added powers to assist CBoB with the resolution of bank, but it will specifically state the regulatory tools described above. CBoB’s preferred approach is to identify potential concerns on an ongoing basis and work with SFIs to address them before a firm is in danger of breaching a prudential standard or requirement (e.g. encouraging Board to remove incompetent senior management), rather than taking formal action. The supervision process provides for early intervention in the form of staging requiring enhanced supervisory oversight. |
| Principle 12 | Consolidated supervision. An essential element of banking supervision is that the supervisor supervises the banking group on a consolidated basis, adequately monitoring and, as appropriate, applying prudential standards to all aspects of the business conducted by the banking group worldwide.30 |
| Essential criteria | |
| EC1 | The supervisor understands the overall structure of the banking group and is familiar with all the material activities (including non-banking activities) conducted by entities in the wider group, both domestic and cross-border. The supervisor understands and assesses how group-wide risks are managed and takes action when risks arising from the banking group and other entities in the wider group, in particular contagion and reputation risks, may jeopardize the safety and soundness of the bank and the banking system. |
| Description and findings re EC1 | Section 14 of the BTCRA provides for the cooperation with supervisors in other jurisdictions to the extent necessary for the purposes of cross-border consolidated supervision. Banks are required to get prior written approval from the CBoB to establish a subsidiary branch, agency or representative office outside The Bahamas. Under the BTCRA, a banking license shall not be granted to an entity having its head office outside The Bahamas, unless the entity is subject to adequate consolidated supervision. The CBoB maintains contact with the home country regulator of parent institutions of CBoB banks on at least an annual basis, typically through the ‘annual regulatory letter’. Home regulators are asked to inform the CBoB of any information which has come to their attention which should be highlighted to the CBoB supervisors. Banks are required to prepare financial reports on a consolidated basis. The CBoB also receives the financial statements of banks’ parent companies and significant financial subsidiaries. Further contact with the bank or the overseas regulator is made in the event a material matter/ concerns arise. This contact is permitted by the BTCRA and the CBBA. The CBoB can engage the external auditors of banks to conduct overseas reviews of banks that have extensive outsourcing of activities abroad. The CBoB maintains one Regulatory College to inform the oversight of the one financial conglomerate operating in The Bahamas. CBoB participates in regulatory colleges in the Caribbean and Canada for Bahamian domestic systemically important commercial banks. The CBoB/SCB/ICB have an MoU for information sharing that has been in place since 2011. Through coordination with nonbank financial supervisors the CBoB evaluates impacts from other companies and has conducted joint examinations with nonbank domestic supervisors. The CBoB collects financial information from nonbank affiliates. However, guidance for examiners in the incorporation of impacts from nonbank affiliates and unregulated companies is very limited. The CBoB supervision department is a member of the Caribbean Group of Banking Supervisors and the Group’s working group on consolidated supervision. Since the prior FSAP report, CBoB completed its benchmarking exercise on jurisdictions with consolidated supervision guidance and has drafted Guidelines for Consolidated Supervision, but they have yet to be put out for public comment. The CBoB has the appropriate authority and supervises banks on a consolidated basis, including any overseas activities. Licensing rules include requirements for verifying home country consolidated supervision and obtaining the agreement of the home country supervisor on the establishment of banks, branches and subsidiaries in the Bahamian jurisdiction. Where the CBoB becomes aware that the home country supervisor is making significant changes to its regulatory framework, an assessment of whether the home country supervisor will continue to practice effective consolidated supervision is conducted. Banks must seek prior approval before the establishing any subsidiary (either locally or overseas). Changes in the ownership or group structure of a bank are reviewed for their effects on consolidated supervision. |
| EC2 | The supervisor imposes prudential standards and collects and analyses financial and other information on a consolidated basis for the banking group, covering areas such as capital adequacy, liquidity, large exposures, and exposures to related parties, lending limits and group structure. |
| Description and findings re EC2 | As noted above, the CBoB has authority to conduct consolidated supervision. However, it is typically the host regulator. The CBoB has not issued guidance to specifically define consolidated supervision, how The Bahamas will apply it and how its enforcement powers will apply to entities that would be part of the consolidated supervision umbrella. The CBoB cooperates with its overseas bank regulatory partners to assist in ensuring that The Bahamas is not used to escape proper oversight and that institutions established and based in The Bahamas are in compliance with internationally accepted standards and norms. To promote comprehensive oversight of commercial banks with regional cross-border operations, the CBoB regularly participates in supervisory colleges for foreign-owned domestically systemically important banks (DSIBs), which are led and hosted by the home supervisor of these institutions. |
| EC3 | The supervisor reviews whether the oversight of a bank’s foreign operations by management (of the parent bank or head office and, where relevant, the holding company) is adequate having regard to their risk profile and systemic importance and there is no hindrance in host countries for the parent bank to have access to all the material information from their foreign branches and subsidiaries. The supervisor also determines that banks’ policies and processes require the local management of any cross-border operations to have the necessary expertise to manage those operations in a safe and sound manner, and in compliance with supervisory and regulatory requirements. The home supervisor takes into account the effectiveness of supervision conducted in the host countries in which its banks have material operations. |
| Description and findings re EC3 | Foreign operations of Bahamian banks are small and closely supervised. CBoB, along with the other domestic financial regulators, released an Information Sharing Handbook, which outlines the procedures for regulatory requests from overseas regulators. Cross-border activities by locally incorporated banks are limited and closely monitored. It is part of the approval process and ongoing as relations with home supervisors are maintained. Assessment of management oversight of foreign operations is reviewed through ongoing supervision and surveillance activities and may be addressed during onsite examinations, where viewed as necessary. |
| EC4 | The home supervisor visits the foreign offices periodically, the location and frequency being determined by the risk profile and systemic importance of the foreign operation. The supervisor meets the host supervisors during these visits. The supervisor has a policy for assessing whether it needs to conduct on-site examinations of a bank’s foreign operations, or require additional reporting, and has the power and resources to take those steps as and when appropriate. |
| Description and findings re EC4 | The CBoB does not make visits to foreign jurisdictions for the purposes of direct supervision of foreign offices given the immaterial size of locally incorporated banks’ operations outside the Bahamas. |
| EC5 | The supervisor reviews the main activities of parent companies, and of companies affiliated with the parent companies, that have a material impact on the safety and soundness of the bank and the banking group, and takes appropriate supervisory action. |
| Description and findings re EC5 | Where applicable, CBoB supervisors request information on the controlling company to assess financial support. They also receive information on parent entities through discussions with home country supervisors, participation in regulatory colleges and through publicly available sources in order to keep abreast of parent operations and condition. Under the BTCRA, the CBoB may not grant a license to a foreign-based bank unless the home supervisory authority has agreed to inform the CBoB as soon as reasonably possible of any circumstances that arise which may seriously jeopardize the interests of creditors of a supervised financial institution. |
| EC6 | The supervisor limits the range of activities the consolidated group may conduct and the locations in which activities can be conducted (including the closing of foreign offices) if it determines that:
|
| Description and findings re EC6 | The BTCRA gives the CBoB the authority to impose, amend or vary any conditions upon the license of a SFI or require such action to be taken by the SFI that CBoB considers necessary. As outlined in the “Guidelines for the Establishment or Acquisition of Overseas Branches, Subsidiaries and Representative Offices”, CBoB may revoke approval of specific activities when it determines the operation may have an adverse impact on the SFI. The Ladder of Supervisory Intervention Guidelines allows the CBoB to restrict an increase in the number of branches of SFIs, close branches, downsize operations and restrict new business. |
| EC7 | In addition to supervising on a consolidated basis, the responsible supervisor supervises individual banks in the group. The responsible supervisor supervises each bank on a stand-alone basis and understands its relationship with other members of the group.31 |
| Description and findings re EC7 | CBoB supervisors at the bank level and the holding company level where a holding company assessment is warranted – i.e., there is activity at the holding company level. Financial strength is assessed at both banks and holding companies. As noted above in BCP 8, CBoB uses a combination of quantitative and qualitative methods in supervising SFIs. These methods include: the review of consolidated annual reports of the parent company as well as the production of consolidated prudential reports; risk-based supervisory reviews of SFIs; off-site surveillance and monitoring, on-site and joint examinations of licensees; exchange of information through home/host relationships; and Memoranda of Understanding (MOUs) with other domestic and foreign regulatory authorities including CARICOM member states. |
| Additional criteria | |
| AC1 | For countries which allow corporate ownership of banks, the supervisor has the power to establish and enforce fit and proper standards for owners and senior management of parent companies. |
| Description and findings re AC1 | The CBoB can request information on the controlling company to determine fit and proper qualifications. Current regulations do not provide the CBoB with the authority to take specific actions with respect to a non-financial parent of a SFI. There is only one such firm operating in the Bahamas at this time. |
| Assessment of Principle 12 | Largely Compliant |
| Comments | CBoB is currently working on drafting guidelines for consolidated supervision. On balance the supervisory approach is adequate for the consolidated supervision issues they face. However, they would benefit from the issuance of formal expectations articulated in guidelines. In addition, the creation of authorities that would allow CBoB to directly assess the strength of support provided by the parent entity and hold accountable the non-bank parent of a SFI if its actions and/or practices negatively affect bank soundness and prudential management. |
| Principle 13 | Home-host relationships. Home and host supervisors of cross-border banking groups share information and cooperate for effective supervision of the group and group entities, and effective handling of crisis situations. Supervisors require the local operations of foreign banks to be conducted to the same standards as those required of domestic banks. |
| Essential criteria | |
| EC1 | The home supervisor establishes bank-specific supervisory colleges for banking groups with material cross-border operations to enhance its effective oversight, taking into account the risk profile and systemic importance of the banking group and the corresponding needs of its supervisors. In its broadest sense, the host supervisor who has a relevant subsidiary or a significant branch in its jurisdiction and who, therefore, has a shared interest in the effective supervisory oversight of the banking group, is included in the college. The structure of the college reflects the nature of the banking group and the needs of its supervisors. |
| Description and findings re EC1 | The CBOB is a member of the Caribbean Group of Banking Supervisors (CGBS). The CGBS has its goal enhancing, and coordinating on the harmonization of, bank supervisory practices in the English-speaking Caribbean, with a view to bring them more in line with internationally accepted practices. CBoB supervisors participate in supervisory colleges hosted by home country supervisors of the parent entities of SFIs operating in its jurisdiction, particularly with respect to foreign-owned Bahamian DSIBs. CBoB will occasionally lead colleges and discussions on cross-border banking operations which are facilitated through the CGBS. The Bank is also a member of the CGBS Steering Committee, Association of Banks of the Americas (ASBA), Offshore Group of Banking Supervisors (OGBS), and the Caribbean Financial Action Task Force (CFATF). |
| EC2 | Home and host supervisors share appropriate information on a timely basis in line with their respective roles and responsibilities, both bilaterally and through colleges. This includes information both on the material risks and risk management practices of the banking group32 and on the supervisors’ assessments of the safety and soundness of the relevant entity under their jurisdiction. Informal or formal arrangements (such as memoranda of understanding) are in place to enable the exchange of confidential information. |
| Description and findings re EC2 | As noted above, the BTCRA requires that in licensing a bank with a head office outside The Bahamas, the CBoB must be satisfied that the bank is subject to adequate consolidated supervision by the home supervisory authority and that the supervisory authority has no objection to the establishment of the branch or subsidiary in The Bahamas. The CBoB can allow the head office of a SFI to be located outside of The Bahamas if the home supervisor agrees to inform the CBoB of adverse circumstances which may seriously jeopardize the interest of creditors of the SFI. Under the BTCRA, the CBoB must cooperate with inspectors and supervisors in other jurisdictions to the extent necessary for the purposes of cross-border supervision. Section 14 of the BTCRA provides that a home country supervisor of a parent entity (in the performance of consolidated supervision) can conduct examinations of the books and accounts of a Bahamian bank to determine if the group has adequate risk management and meets other relevant prudential standards. The CBoB has the authority to provide information on the beneficial owners, directors, officers and operations of a bank to the home country supervisor responsible. The CBBA gives the CBoB the authority to assist and cooperate with overseas regulatory authorities. The CBBA also permits the CBoB to share with overseas regulatory authorities information necessary to enable such authorities to exercise regulatory functions, including the conduct of civil or administrative investigations and proceedings to enforce laws, regulations and rules administered by that authority. In practice, home/host supervisory letters for consolidated supervision purposes are issued periodically. Additionally, as noted above, senior staff participate in regulatory colleges for domestically systemically important commercial banks in the Caribbean and Canada. There are no material operations of Bahamian banks in other jurisdictions. Nevertheless, the CBoB has established arrangements to obtain and share information as needed. |
| EC3 | Home and host supervisors coordinate and plan supervisory activities or undertake collaborative work if common areas of interest are identified in order to improve the effectiveness and efficiency of supervision of cross-border banking groups. |
| Description and findings re EC3 | As noted in EC2 above, the CBoB has information sharing arrangements and coordinates as necessary with other regulators. The CBoB sends an annual letter to banks’ home country supervisors highlighting areas of regulatory concern and requesting that the home supervisor inform CBoB of any concerns with the parent institution. The BTCRA and the CBBA permit the sharing of information between The Bahamas and SFIs other foreign supervisors. As noted above, the BTCRA permits the on-site examination of banks in the Bahamas by home supervisory authorities. The CBoB and the other domestic financial regulators have jointly published a handbook outlining the procedures to be followed for addressing foreign regulatory requests for information. The Bahamas has established a number of MoUs to allow for cooperation arrangements. CBoB maintains communications with significant home country supervisors and collects needed information. |
| EC4 | The home supervisor develops an agreed communication strategy with the relevant host supervisors. The scope and nature of the strategy reflects the risk profile and systemic importance of the cross-border operations of the bank or banking group. Home and host supervisors also agree on the communication of views and outcomes of joint activities and college meetings to banks, where appropriate, to ensure consistency of messages on group-wide issues. |
| Description and findings re EC4 | Such arrangements are not warranted given the small size of Bahamian operations in relation to the parent companies. Typically, the home/host letters and regulatory colleges are sufficient. |
| EC5 | Where appropriate, due to the bank’s risk profile and systemic importance, the home supervisor, working with its national resolution authorities, develops a framework for cross-border crisis cooperation and coordination among the relevant home and host authorities. The relevant authorities share information on crisis preparations from an early stage in a way that does not materially compromise the prospect of a successful resolution and subject to the application of rules on confidentiality. |
| Description and findings re EC5 | The CBoB is typically a host jurisdiction with only very modest operations of Bahamian SFIs abroad. Nonetheless, as outlined in the Ladder of Supervisory Intervention Guidelines, discussions are to be held with home regulators, especially where severe risk to financial viability or solvency exists, which if not remedied could lead to resolution. Proposed amendments to the BTCRA are expected to address resolution and recovery issues, if passed into law. The assessors observed no material current efforts in this area. |
| EC6 | Where appropriate, due to the bank’s risk profile and systemic importance, the home supervisor, working with its national resolution authorities and relevant host authorities, develops a group resolution plan. The relevant authorities share any information necessary for the development and maintenance of a credible resolution plan. Supervisors also alert and consult relevant authorities and supervisors (both home and host) promptly when taking any recovery and resolution measures. |
| Description and findings re EC6 | The CBoB is typically a host jurisdiction with only very modest operations of Bahamian SFIs abroad. Nonetheless, as outlined in the Ladder of Supervisory Intervention Guidelines, discussions are to be held with home regulators, especially where severe risk to financial viability or solvency exists, which if not remedied could lead to resolution. Proposed amendments to the BTCRA are expected to address resolution and recovery issues, if passed into law. The assessors observed no material current efforts in this area. |
| EC7 | The host supervisor’s national laws or regulations require that the cross-border operations of foreign banks are subject to prudential, inspection and regulatory reporting requirements similar to those for domestic banks. |
| Description and findings re EC7 | All banks in The Bahamas are subject to the same prudential standards. |
| EC8 | The home supervisor is given on-site access to local offices and subsidiaries of a banking group in order to facilitate their assessment of the group’s safety and soundness and compliance with customer due diligence requirements. The home supervisor informs host supervisors of intended visits to local offices and subsidiaries of banking groups. |
| Description and findings re EC8 | As noted in EC 2 above, The Bahamas allows home supervisors to conduct onsite examinations of Bahamian operations. |
| EC9 | The host supervisor supervises booking offices in a manner consistent with internationally agreed standards. The supervisor does not permit shell banks or the continued operation of shell banks. |
| Description and findings re EC9 | The Bahamas no longer permits shell banks to operate in its jurisdiction. All SFIs must have physical operations located in The Bahamas. |
| EC10 | A supervisor that takes consequential action on the basis of information received from another supervisor consults with that supervisor, to the extent possible, before taking such action. |
| Description and findings re EC10 | The standard MOU CBoB uses with foreign supervisors—in clauses 8 and 9—includes an agreement not to use information received from other supervisors for purposes not agreed upon between the two supervisors. |
| Assessment of Principle 13 | Largely Compliant |
| Comments | Current MoU’s in place are based on high level notification and sharing of information agreements. Although a formal legislative resolution framework will be put in place in the near future, the current lack of resolution plans or planning for the failure of SFI’s of systemic importance will be key for CBoB to address. |
| Principle 1 | Responsibilities, objectives and powers. An effective system of banking supervision has clear responsibilities and objectives for each authority involved in the supervision of banks and banking groups.6 A suitable legal framework for banking supervision is in place to provide each responsible authority with the necessary legal powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address safety and soundness concerns.7 |
| Essential criteria | |
| EC1 | The responsibilities and objectives of each of the authorities involved in banking supervision8 are clearly defined in legislation and publicly disclosed. Where more than one authority is responsible for supervising the banking system, a credible and publicly available framework is in place to avoid regulatory and supervisory gaps. |
| Description and findings re EC1 | The Central Bank of the Bahamas Act, 2015 (CBBA), the Banks and Trust Companies Regulation Act, 2015 (BTCRA) and the Bahamas Co-operative Credit Unions Act and the Bahamas Cooperative Credit Unions Regulations, 2015 (CUA) set out the powers, responsibilities, and objectives of the Central Bank of The Bahamas (CBoB) as the supervisor of banks (including branches of foreign banks), trust companies, credit unions and money transfer businesses (referred to as supervised financial institutions or SFIs) operating within and from within The Bahamas. The Acts and Regulations are complemented by a series of Guidelines that supplement but do not replace any requirements under the relevant legislation or accounting standards. S. 13 of the BTCRA designates the CBoB (in the person of the Inspector) as the banking supervisor and gives it such powers as are reasonably necessary to perform its supervisory function. S. 17 (First Schedule) of the BTCRA sets out the rules of inspection and supervision of banks. All legislation, regulations and guidelines are published and are available on the CBoB Website. |
| EC2 | The primary objective of banking supervision is to promote the safety and soundness of banks and the banking system. If the banking supervisor is assigned broader responsibilities, these are subordinate to the primary objective and do not conflict with it. |
| Description and findings re EC2 | S. 17 (First Schedule) of BTCRA states that the Inspector of Banks and Trust Companies of the CBoB (Inspector) is responsible to regularly evaluate the condition of solvency and liquidity of all licensees and to establish appropriate and prudent standards for the conduction safe and sound banking and trust business. CBoB’s risk-based supervision framework includes an off-site examination together with an off-site supervision surveillance program designed to make judgments about the financial soundness of banks. |
| EC3 | Laws and regulations provide a framework for the supervisor to set and enforce minimum prudential standards for banks and banking groups. The supervisor has the power to increase the prudential requirements for individual banks and banking groups based on their risk profile9 and systemic importance.10 |
| Description and findings re EC3 | S. 17 (First Schedule) of the BTCRA specifies that CBoB (the Inspector) shall establish appropriate and prudent standards for conducting safe and sound banking (and trust business). The Schedule also states that CBoB shall set prudent and appropriate capital adequacy requirements for banks not less than those in the Basel Capital Accord and Amendments. Detailed prudential standards are set out in Regulations. Further S. 6 of the BTCRA, states that the CBOB may impose new conditions or limitations on the license of an SFI or amend or revoke any authorization, condition or limitation contained in the license. In addition, S. 18(1)(h), the CBOB may issue directions requiring a licensee to cease or refrain from committing an act or pursuing a course of conduct that is an unsafe or unsound practice, or that is in contravention of any law, or to perform a remedial act, or to do anything required to be done; and require such action to be taken by the licensee as CBoB considers necessary. The Guideline entitled “A Guide to the Central Bank’s Ladder of Supervisory Intervention”, revised May 2017 (Ladder of Intervention Guideline) outlines a wide range of discretionary intervention actions that CBoB may take if it determines that the cause of concern is not being addressed. |
| EC4 | Banking laws, regulations and prudential standards are updated as necessary to ensure that they remain effective and relevant to changing industry and regulatory practices. These are subject to public consultation, as appropriate. |
| Description and findings re EC4 | The BTCRA and the CBBA, updated in 2015, together with several Guidelines pertaining to various risks (Market, Operational, Interest Rate Risk, etc) together with several guidelines and legislation pertaining to Anti-Money Laundering and Terrorist Financing (AML, CFT) have been introduced in the past several years. All amendments to laws, regulations and material changes to guidelines are issued for public consultation as a normal practice. |
| EC5 | The supervisor has the power to:
|
| Description and findings re EC5 | S. 35 of CBBA and S.13(3) of BTCRA authorize CBoB to have access to such information and records of each bank as it requires to enable it to perform its duties and to require banks to provide such information in the form and frequency deemed necessary. S. 13(3) of BTCRA specifies that CBoB (the Inspector) shall be entitled at all reasonable times to have access to such books, records, vouchers, documents, cash, and securities of a bank and to call upon the manager or any officer designated by the manager of any bank for such information or explanation as is reasonably required to enable the CBoB to carry out its functions under the Act. |
| EC6 | When, in a supervisor’s judgment, a bank is not complying with laws or regulations, or it is or is likely to be engaging in unsafe or unsound practices or actions that have the potential to jeopardize the bank or the banking system, the supervisor has the power to:
|
| Description and findings re EC6 | S. 18 (1)(h) of BTCRA, states that the CBoB may issues directions requiring a licensee to cease or refrain from committing an act or pursuing a course of conduct that is an unsafe or unsound practice, or that is in contravention of any law, or to perform a remedial act, or to do anything required to be done and require such action to be taken by the licensee as the central bank considers necessary. S. 18 of the BTCRA also states that the CBOB may impose a range of sanctions from issuing a warning, suspension or the revocation of the license. The Ladder of Intervention Guideline outline the various steps CBoB’s may take to intervene in the case of supervisory/regulatory breaches, or where the bank poses a risk to depositors. These discretionary intervention measures range from the issuance of warnings, more intensive supervision, increase in capital, liquidity and provisioning levels, imposition of fines, conditions/directions (e.g., restricting further lending/deposit-taking), removal of directors/senior management, appointment of special advisors, increased reporting from the external auditor, suspension of license, revocation of license. These measures are not explicitly stated in the BTCRA at this time (the proposed 2018 Amendment to the BTCRA proposes the insertion these intervention measures). CBoB has successfully been able to utilize s. 18(1)(h) of the BTCRA in the past to take the necessary intervention measures required to deal with problem entities. The proposed 2018 Amendment to the BTCRA will enhance CBoB’s powers by explicitly listing the intervention measurers CBoB has typically utilized in the past. In a situation where CBoB has issued a direction which is not being honored, CBoB may apply to the Supreme Court for an order to compel the bank to comply with the direction. Draft amendments have been proposed to the BTCRA to establish an enhanced bank resolution framework. CBoB has signed MOUs with all relevant domestic and foreign supervisory authorities to share information during a time of crisis. The CBoB does not have a formal legislative resolution regime in place at this time. |
| EC7 | The supervisor has the power to review the activities of parent companies and of companies affiliated with parent companies to determine their impact on the safety and soundness of the bank and the banking group. |
| Description and findings re EC7 | CBoB requires banks to prepare financial reports on a consolidated basis. CBoB also receives the financial statements of the bank’s parent company and significant financial subsidiaries. |
| Assessment of Principle 1 | Compliant |
| Comments | CBoB has broad powers and clear responsibilities underpinned mainly in the CBBA, BTCRA and CUA. CBoB’s primary objective is to promote financial system stability in The Bahamas. CBoB has broad corrective action and sanction powers. Laws and regulations provide CBoB with broad power to set and enforce prudential regulations to support delivery of its statutory mandate. Draft amendments have been proposed to the BTCRA to establish an enhanced bank resolution framework. |
| Principle 2 | Independence, accountability, resourcing and legal protection for supervisors. The supervisor possesses operational independence, transparent processes, sound governance, budgetary processes that do not undermine autonomy and adequate resources, and is accountable for the discharge of its duties and use of its resources. The legal framework for banking supervision includes legal protection for the supervisor. |
| Essential criteria | |
| EC1 | The operational independence, accountability and governance of the supervisor are prescribed in legislation and publicly disclosed. There is no government or industry interference that compromises the operational independence of the supervisor. The supervisor has full discretion to take any supervisory actions or decisions on banks and banking groups under its supervision. |
| Description and findings re EC1 | S. 5(3) of the CBBA states that CBoB shall have power to do anything, whether in The Bahamas or elsewhere, which is calculated to facilitate, or is incidental or conducive to the discharge of its duty under this section. For significant actions or activities, the CBoB is required to make notification to the Minister of Finance (MoF), for example when an SFI is a category stage 3 in accordance with the Ladder of Intervention Guideline. After the fact notifications to the MoF would include the granting of, or refusal to grant a license (see BTCRA s.4(2)(c)) and the revocation of a license (see BTCRA s. 18(1)(a)). In practice, CBoB’s ability to act with complete independence may not be the case for state-owned banks. Although CBoB is only required to notify (post decision) the MoF of intervention measures taken with respect to problem entities staged rated 3 and above, with respect to the state-owned bank, CBoB should strengthen its ability to undertake regulatory and supervisory processes on a timely basis without undue influence from the government or the MoF. |
| EC2 | The process for the appointment and removal of the head(s) of the supervisory authority and members of its governing body is transparent. The head(s) of the supervisory authority is (are) appointed for a minimum term and is removed from office during his/her term only for reasons specified in law or if (s)he is not physically or mentally capable of carrying out the role or has been found guilty of misconduct. The reason(s) for removal is publicly disclosed. |
| Description and findings re EC2 | The Schedule to CBBA sets out the terms under which the Governor (or any other director) may be removed. These include where the director: is absent from meetings longer than three consecutive months without the permission of the board of directors; declared bankrupted; is incapacitated by physical or mental health; has a court conviction involving dishonesty; becomes a member of Parliament; becomes a director, officer or employee of, or is a shareholder of with an interest of one percent or more in the ordinary paid up share capital of, or has a controlling interest in, any financial institution regulated by CBoB. The head(s) of the supervisory authority is (are) appointed for a minimum term. At this time, CBoB is not required to publicly disclose the reasons for the removal of the Governor. |
| EC3 | The supervisor publishes its objectives and is accountable through a transparent framework for the discharge of its duties in relation to those objectives.11 |
| Description and findings re EC3 | CBoB’s objectives are set out in the CBBA and the BTCRA. S. 32 of the CBBA requires CBoB, within four months after the end of each financial year, cause to be made and transmit to the MoF, a report of the operations of the Bank during the year and a statement of the accounts of CBoB in respect of that year certified by auditors. The MoF lays a copy of the report before both Houses of Parliament and causes a copy to be published in the Official Gazette. The Governor also holds regular meetings with the MoF. |
| EC4 | The supervisor has effective internal governance and communication processes that enable supervisory decisions to be taken at a level appropriate to the significance of the issue and timely decisions to be taken in the case of an emergency. The governing body is structured to avoid any real or perceived conflicts of interest. |
| Description and findings re EC4 | The Inspector oversees the Bank Supervision Division (BSD) which has internal mechanisms for raising significant issues. Further, the Inspector reports to the Governor any issues of significance on a regular basis. The Governor meets with the MoF on a weekly basis and is able to raise any issues of significance when required on an emergency basis. SFIs rated stage 1 and above are subjected to enhanced supervision and reporting requirements (Stage 1: early warning; Stage 2: heightened risk to financial viability or solvency; Stage 3: severe risk to financial viability or solvency; Stage 4: imminent insolvency or non-viability; Stage 5: insolvency or non-viability). The decision to stage or change the stage rating of an SFI is discussed with BSD senior management and senior representatives within CBOB. Further, the status of stage rated SFIs are discussed regularly with CBoB senior management. |
| EC5 | The supervisor and its staff have credibility based on their professionalism and integrity. There are rules on how to avoid conflicts of interest and on the appropriate use of information obtained through work, with sanctions in place if these are not followed. |
| Description and findings re EC5 | CBoB’s supervision has a staff complement of over 70 persons. Technical staff with direct supervisory and examination responsibilities are well qualified with university degrees, with some risk specialist expertise in AML, credit, Operational and IT risk. With respect to confidentiality and conflict of interest, upon joining CBoB, staff sign a confidentiality agreement on the appropriate use of information obtained through work. In addition, staff are subject to Code of Conduct requirements. |
| EC6 | The supervisor has adequate resources for the conduct of effective supervision and oversight. It is financed in a manner that does not undermine its autonomy or operational independence. This includes:
|
| Description and findings re EC6 | CBoB uses its own resources (fees paid by SFIs) to carry out its statutory objectives and responsibilities, including the supervision and regulation of SFIs. CBoB’s BSD has a current complement of 70 staff with only a few vacancies at this time. Salary scales are acceptable as CBoB has been able to retain or attract staff as needed. There is a training budget and a technology budget to sufficiently equip staff. CBoB is able to commission external experts when needed (as demonstrated in the past). |
| EC7 | As part of their annual resource planning exercise, supervisors regularly take stock of existing skills and projected requirements over the short- and medium-term, taking into account relevant emerging supervisory practices. Supervisors review and implement measures to bridge any gaps in numbers and/or skill-sets identified. |
| Description and findings re EC7 | CBoB provides learning opportunities to ensure that all members of staff have the requisite technical competencies and soft skills to perform all of their functions effectively. They are expected to be very knowledgeable and aware of financial services sector trends and best practices, and have the ability to adjust to the evolving needs of the Bank. A series of in-house, local, and overseas training opportunities were facilitated by the Department over the year. Supervision staff specifically, benefit from a vocational training arrangement designed to balance depth and breadth in their knowledge and experience. The framework defines specialties that are vocationally valuable to Supervision and the CBoB and matches training to staff career progression. The Assessors observed that the BSD could use additional staff to ensure that the Domestic Systemically Important Banks (DSIBs) are subject to regular full scope on-site examinations (which may entail additional risk specialists to be hired) and added staff to oversee the off-site supervision surveillance program as well as the implementation of regulatory reforms (Basel II/III) and address the need for enhanced supervision pertaining to SFI’s compliance with AML/ATF standards. |
| EC8 | In determining supervisory programs and allocating resources, supervisors take into account the risk profile and systemic importance of individual banks and banking groups, and the different mitigation approaches available. |
| Description and findings re EC8 | CBoB assesses banks on a risk-based approach. This assessment is used to better allocate supervisory resources with high risk banks being assessed more frequently. In addition, the DSIB SFIs are grouped together under the Domestic Financial Institution Unit. |
| EC9 | Laws provide protection to the supervisor and its staff against lawsuits for actions taken and/or omissions made while discharging their duties in good faith. The supervisor and its staff are adequately protected against the costs of defending their actions and/or omissions made while discharging their duties in good faith. |
| Description and findings re EC9 | S. 13A of the BTCRA provides that no civil or criminal liability shall attach to the Inspector or a staff member for anything done or omitted in the good faith discharge or purported discharge of such person’s functions under the Act. S. 13A of the BTCRA also provides that the CBoB’s Board of Directors may indemnify the Governor and the Governor may indemnify the Inspector or staff member against the cost of defending their actions while discharging their functions in good faith. |
| Assessment of Principle 2 | Largely Compliant |
| Comments | CBoB needs to reassess the adequacy of its supervision complement given the wide range of emerging risks impacting SFIs, including the AML/CFT enhanced monitoring, the needed continued focus on credit risk in-depth on-site reviews required for all DSIBs and the need to conduct more in-depth and frequent corporate governance/internal controls reviews). Further, additional resources may be required to deal with proposed regulatory reforms (Basel II/III, IFRS, AML). The reasons for the removal of a CBoB board member or the Governor should be required to be publicly disclosed. The Schedule to the draft Central Bank of The Bahamas Bill, 2018 provides for public disclosure of the reasons for the removal of the Governor. The proposed amendments to the BTCRA 2018 will introduce added legal protection for any proceedings brought against CBBA, the Inspector, a director, officer, employee of the CBoB in relation to any action taken relating to intervening in or resolving banks. CBoB should contemplate the creation of regulations or guidelines that would help strengthen its ability to regulate and supervise state-owned banks. |
| Principle 3 | Cooperation and collaboration. Laws, regulations or other arrangements provide a framework for cooperation and collaboration with relevant domestic authorities and foreign supervisors. These arrangements reflect the need to protect confidential information.12 |
| Essential criteria | |
| EC1 | Arrangements, formal or informal, are in place for cooperation, including analysis and sharing of information, and undertaking collaborative work, with all domestic authorities with responsibility for the safety and soundness of banks, other financial institutions and/or the stability of the financial system. There is evidence that these arrangements work in practice, where necessary. |
| Description and findings re EC1 | S. 38 (9) of the CBBA allows CBoB to cooperate and exchange information with any other regulatory authority in The Bahamas where it is considered by the Governor that such cooperation or information may be relevant to the functions of such other regulatory authority or as a necessary part of a framework for consolidated supervision, oversight or regulation of the financial services sector. The Group of Financial Service Regulators (GFSR), represented by: CBoB, Securities Commission, Insurance Commission, Compliance Commission, and the Inspector of Financial and Corporate Services have signed a Memorandum of Understanding (MoU) specifying the terms of co-operation and collaboration and has been in force since 2002. Information sharing amongst the domestic regulatory agencies, as well as between these agencies and foreign regulatory authorities, is governed by the Information Sharing Arrangements in the Bahamas, July 2008 (referred to as the Information Sharing Handbook). The GFSR meets periodically to coordinate regulation/examination of financial institutions and to coordinate their activities within the financial sector. The CBoB is the lead regulator for bank and trust companies. The MoF is not a member of the GFSR. |
| EC2 | Arrangements, formal or informal, are in place for cooperation, including analysis and sharing of information, and undertaking collaborative work, with relevant foreign supervisors of banks and banking groups. There is evidence that these arrangements work in practice, where necessary. |
| Description and findings re EC2 | S. 38 (3) of the CBBA provides that CBoB may disclose to an overseas regulatory authority information necessary to enable that authority to exercise regulatory functions including the conduct of civil or administrative investigations and proceedings to enforce laws, regulations and rules administered by that authority. S. 19 (5) of the BTCRA permits the CBoB to share information on the beneficial owners, director, officers and operations of a bank with the supervisory authority responsible for regulating the head office of the bank for the purpose of consolidated supervision. The Information Sharing Handbook also provides guidance of the manner in which all domestic regulatory authorities, including CBoB, will share with foreign supervisory authorities. CBoB has signed MoUs with a number of jurisdictions including Argentina, Canada, Costa Rica, Brazil, Guatemala, Panama, Peru, and an MoU with regional supervisory authorities (CARICOM). CBoB has responded to requests to share information with foreign supervisory authorities on a timely basis. |
| EC3 | The supervisor may provide confidential information to another domestic authority or foreign supervisor but must take reasonable steps to determine that any confidential information so released will be used only for bank-specific or system-wide supervisory purposes and will be treated as confidential by the receiving party. |
| Description and findings re EC3 | S. 38 (7) of the CBBA authorizes CBoB to disclosure information only where CBoB has satisfied itself that the assistance requested by the overseas regulator is required for the purposes of the overseas authority’s regulatory functions. Any confidential information acquired by others, including a Supervisory Authority, is covered by the confidentiality provisions (S. 19) of BTCRA. CBoB is required to share information as necessary as it pertains to AML/CFT disclosure reporting requirements. |
| EC4 | The supervisor receiving confidential information from other supervisors uses the confidential information for bank-specific or system-wide supervisory purposes only. The supervisor does not disclose confidential information received to third parties without the permission of the supervisor providing the information and is able to deny any demand (other than a court order or mandate from a legislative body) for confidential information in its possession. In the event that the supervisor is legally compelled to disclose confidential information it has received from another supervisor, the supervisor promptly notifies the originating supervisor, indicating what information it is compelled to release and the circumstances surrounding the release. Where consent to passing on confidential information is not given, the supervisor uses all reasonable means to resist such a demand or protect the confidentiality of the information. |
| Description and findings re EC4 | S. 7 of the CBBA authorized the CBoB to deny any demand for confidential information when it is not satisfied that it will be treated confidentially or used for supervisory purposes and that it must be given an undertaking by the recipient authority not to disclose the information provided without the consent of the CBoB. |
| EC5 | Processes are in place for the supervisor to support resolution authorities (e.g. central banks and finance ministries as appropriate) to undertake recovery and resolution planning and actions. |
| Description and findings re EC5 | Certain provisions of the CBBA, the BTCRA and the Protection of Depositors Act and Regulations describe current processes CBoB will undertake with respect to recovery and resolution planning and actions. No formal recovering planning or resolution planning is in place at this time. |
| Assessment of Principle 3 | Largely Compliant |
| Comments | CBoB has MoUs in place to support information sharing as well as co-operation and coordination between both domestic and foreign regulatory authorities in dealing with a crisis. Proposed amendments to the CBBA and the BTCRA and Regulations to provide for the establishment of CBoB as the sole resolution authority for banks and to expand the regulatory toolkit available to CBoB to address issues relating to failing banks (e.g. the ability to appoint a statutory administrator), including the requirement for SFIs to have recovery plans and CBoB to have resolution plans in place for DSIBs. |
| Principle 4 | Permissible activities. The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined and the use of the word “bank” in names is controlled. |
| Essential criteria | |
| EC1 | The term “bank” is clearly defined in laws or regulations. |
| Description and findings re EC1 | The term “bank” is defined in S. 2 of the BTCRA as any person lawfully carrying on banking business including the acceptance of deposits of money withdrawable by cheque. |
| EC2 | The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined either by supervisors, or in laws or regulations. |
| Description and findings re EC2 | S. 3 of the BTCRA specifies that only banks authorized by the CBoB may carry out the business of banking and S. 2 defines “banking business” as the business of accepting deposits of money which may be withdrawn or repaid on demand or after a fixed period or after notice and employing those deposits in whole or in part by lending or otherwise investing them for the account and at the risk of the person accepting them. It also includes the provision of money transmission services. |
| EC3 | The use of the word “bank” and any derivations such as “banking” in a name, including domain names, is limited to licensed and supervised institutions in all circumstances where the general public might otherwise be misled. |
| Description and findings re EC3 | S. 7 of BTCRA as well as the Banks and Trust Companies (Restriction on the Use of Banking Names and Descriptions) Regulations, 2001 (as revised in 2002) specifies that no person other than a bank license holder can use the term “bank” or any derivative thereof without the permission of the CBoB. CBoB’s general policy is not to give consent for the use of a prohibited word where its use could mislead the public into believing that the company in question is, or may be a bank license holder or that it is under the direct supervision of CBoB. The Registrar of Companies will refer any company whose name contains a restricted word to CBoB for its review. |
| EC4 | The taking of deposits from the public is reserved for institutions that are licensed and subject to supervision as banks.13 |
| Description and findings re EC4 | Other than banks, credit unions are the only entities permitted to accept deposits from the public. |
| EC5 | The supervisor or licensing authority publishes or otherwise makes available a current list of licensed banks, including branches of foreign banks, operating within its jurisdiction in a way that is easily accessible to the public. |
| Description and findings re EC5 | The CBoB publishes a list of all licensed banks, including branches of foreign banks, on a quarterly basis on its website. Up-to-date lists are available from CBoB on request. |
| Assessment of Principle 4 | Compliant |
| Comments | The BTCRA clearly defines the “banking business” and restricts deposit taking activities to banks and credit unions only. |
| Principle 5 | Licensing criteria. The licensing authority has the power to set criteria and reject applications for establishments that do not meet the criteria. At a minimum, the licensing process consists of an assessment of the ownership structure and governance (including the fitness and propriety of Board members and senior management)14 of the bank and its wider group, and its strategic and operating plan, internal controls, risk management and projected financial condition (including capital base). Where the proposed owner or parent organization is a foreign bank, the prior consent of its home supervisor is obtained. |
| Essential criteria | |
| EC1 | The law identifies the authority responsible for granting and withdrawing a banking license. The licensing authority could be the banking supervisor or another competent authority. If the licensing authority and the supervisor are not the same, the supervisor has the right to have its views on each application considered, and its concerns addressed. In addition, the licensing authority provides the supervisor with any information that may be material to the supervision of the licensed bank. The supervisor imposes prudential conditions or limitations on the newly licensed bank, where appropriate. |
| Description and findings re EC1 | S. 3 (1) of the BTCRA provides that the CBoB is the only authority responsible for the granting of a bank license. S. 4(6) of the BTCRA states that the CBOB may impose conditions or limitations on a new or existing license. S. 8 of the CUA stipulates the criteria for the registration of a credit union. |
| EC2 | Laws or regulations give the licensing authority the power to set criteria for licensing banks. If the criteria are not fulfilled or if the information provided is inadequate, the licensing authority has the power to reject an application. If the licensing authority or supervisor determines that the license was based on false information, the license can be revoked. |
| Description and findings re EC2 | S. 4 of the BTCRA sets the criteria for the licensing of banks (and trust companies). It also provides that the CBoB may reject an application if the applicant does not meet the necessary authorization criteria, including: the fitness and probity of the applicant to carry out banking business; the fitness and probity of the directors and senior management; the sufficiency of financial resources to provide continuing financial support; the soundness and feasibility of the business plan; the business record and experience of the applicant; the best interests of the financial system of the Bahamas. The CBoB may also refuse to grant a license if it considers it to be in the public interest. The Bank and Trust Companies (License Application) Regulations, 2008 (License Regulations) which detail the requirements for new license applications, are augmented by the Guidelines for Licence Applications for Banks and/or Trust Companies, May 2015 (Licence Guideline) and the Applications Manual, December 6, 2018. Section 18(1)(a)(vi) of the BTCRA provides that the CBoB may revoke a license, the granting of which was based on false or misleading information. |
| EC3 | The criteria for issuing licenses are consistent with those applied in ongoing supervision. |
| Description and findings re EC3 | Banks are required to provide at the authorization stage details of their proposed internal organization structures including internal audit and compliance arrangements and the outline of their internal policies on risk management requirements as they relate, for instance, to such issues as credit, liquidity, provisioning, large exposure, country risk. CBoB does not review policies in detail at the time of issuing a license. It generally performs an onsite visit to the newly licensed SFI within 18 months of operation. |
| EC4 | The licensing authority determines that the proposed legal, managerial, operational and ownership structures of the bank and its wider group will not hinder effective supervision on both a solo and a consolidated basis.15 The licensing authority also determines, where appropriate, that these structures will not hinder effective implementation of corrective measures in the future. |
| Description and findings re EC4 | CBoB carries out a review of the proposed legal, managerial, operational and ownership structures during the licensing application process. CBoB will only authorize banks where it is satisfied that it can carry out effective supervision on both a solo and consolidated basis (see S. 4(4)(b) of the BTCRA). |
| EC5 | The licensing authority identifies and determines the suitability of the bank’s major shareholders, including the ultimate beneficial owners, and others that may exert significant influence. It also assesses the transparency of the ownership structure, the sources of initial capital and the ability of shareholders to provide additional financial support, where needed. |
| Description and findings re EC5 | S. 4 (2) of the BTCRA states that the CBoB must be satisfied about the nature and sufficiency of the financial resources of the applicant (body corporate, annual statements plus most recent unaudited financial statements, for each applicant current statement of assets and liabilities certified by a public accountant) to provide continuing financial support to carry on banking business, before the granting of a license. Additionally, the Licence Regulations permit CBoB to vet the suitability of all shareholders proposing to hold 5 per cent or more of the shares, directly or indirectly, in the bank. |
| EC6 | A minimum initial capital amount is stipulated for all banks. |
| Description and findings re EC6 | Page 19 of the Licence Guidelines indicate that the CBoB has established the minimum paid up capital requirements at $5 million for commercial and public banks as reflected in the Licence Guideline. CBoB can stipulate a higher minimum figure based on a review of the proposed business activities of the applicant. |
| EC7 | The licensing authority, at authorization, evaluates the bank’s proposed Board members and senior management as to expertise and integrity (fit and proper test), and any potential for conflicts of interest. The fit and proper criteria include: (i) skills and experience in relevant financial operations commensurate with the intended activities of the bank; and (ii) no record of criminal activities or adverse regulatory judgments that make a person unfit to uphold important positions in a bank.16 The licensing authority determines whether the bank’s Board has collective sound knowledge of the material activities the bank intends to pursue, and the associated risks. |
| Description and findings re EC7 | S. 4 (2) of the BTCRA stipulates that the CBoB must be satisfied that those who will operate the bank (or trust company) will do so responsibly and that such persons have the character, competence and experience for operating a bank. This requirement is supplemented by the Licence Regulations which allow CBoB to analyze the proposed ownership and managerial structure and the background, integrity and suitability of proposed directors and managers using traditional fit and proper criteria. Tools such as World Check and regulatory contacts are used during the due diligence process in assessing the fitness and probity of the promoters, shareholders, directors, and senior management of applicants. Senior management are required to submit police certificates from their respective home jurisdictions and to declare, inter alia, information related to criminal records, or adverse regulatory judgments in a confidential statement. S. 3E and 4(2) of the BTCRA, states that the Board (and senior) management must satisfy the CBoB that they will manage the bank responsibly and that they have the proper character, competence and experience to operate a bank. CBoB also assesses the collective sound knowledge of material activities of the proposed licensee. |
| EC8 | The licensing authority reviews the proposed strategic and operating plans of the bank. This includes determining that an appropriate system of corporate governance, risk management and internal controls, including those related to the detection and prevention of criminal activities, as well as the oversight of proposed outsourced functions, will be in place. The operational structure is required to reflect the scope and degree of sophistication of the proposed activities of the bank.17 |
| Description and findings re EC8 | S. 4(2) of the BTCRA states that each applicant must submit for consideration by the CBoB such information as the CBoB deems necessary to undertake a full assessment of the application. CBoB relies upon a number of Regulations and Guidelines including Licence Regulations, Guidelines for Assessing the Fitness and Propriety of Applicants for Regulated Functions and General Information Guidelines for Licence Applications. The Licence Guidelines require the applicant to submit a strategic and operating plan and feasibility study, pro-forma financial statements covering a three to five-year timeframe, information on its internal organization, details on internal audit and compliance functions. These are supplemented by the CBoB’s Guidelines on corporate governance, internal controls, outsourcing, AML/CFT and risk management requirements. The submitted data is required to take into account the nature and complexity of the proposed activities of the applicant. CBoB’s authorization division is responsible for the processing of authorizations. Once an application has been approved a supervisor/analysist is assigned to the supervisory oversight of the new SFI. The SFI is monitored by the off-site supervision surveillance team and in general an on-site examination is conducted within 18 months of operation. At the time of licensing, CBoB’s authorization division examines the general outline of risk management policies and has discussions with the applicants regarding the corporate governance and internal control framework for the proposed SFI. |
| EC9 | The licensing authority reviews pro forma financial statements and projections of the proposed bank. This includes an assessment of the adequacy of the financial strength to support the proposed strategic plan as well as financial information on the principal shareholders of the bank. |
| Description and findings re EC9 | The Licence Regulations require applicants to provide pro forma financial statements covering a three year to five-year timeframe. Applicants must also submit a strategic and operating plan and feasibility study. Shareholders are required to submit net worth statements to enable CBoB to assess their financial strength. Where an application is made by a corporate entity or a bank, audited financial statements for the three years immediately preceding the application are required to assess the financial strength of the parent. S. 4 (2) of the BTCRA states that the CBoB must be satisfied about the nature and sufficiency of the financial resources of the applicant to provide continuing financial support for the bank. |
| EC10 | In the case of foreign banks establishing a branch or subsidiary, before issuing a license, the host supervisor establishes that no objection (or a statement of no objection) from the home supervisor has been received. For cross-border banking operations in its country, the host supervisor determines whether the home supervisor practices global consolidated supervision. |
| Description and findings re EC10 | S. 4(4) of the BTCRA stipulates that a license shall not be granted unless the CBoB is satisfied that the bank will be subject to adequate consolidated supervision by the home supervisor; that the latter makes no objection to the establishment of the branch or subsidiary in the Bahamas; and that there are no constraints on internal or external audits imposed by the home regulator. |
| EC11 | The licensing authority or supervisor has policies and processes to monitor the progress of new entrants in meeting their business and strategic goals, and to determine that supervisory requirements outlined in the license approval are being met. |
| Description and findings re EC11 | The CBoB’s off-site supervision surveillance monitor the progress of its new licensees in meeting their business and strategic goals through a quarterly review of financial statements (as well as audited statements when they become available), prudential discussions are held with banks on an annual basis or more frequently if the need arises. All banks are subject to periodic on-site inspection. |
| Assessment of Principle 5 | Compliant |
| Comments | CBoB has a thorough licensing framework and processes in place to assess licensing applications, CBoB follows criteria explicit criteria pertaining to financial strengthen of investors, fit and proper guidance for the appointment of senior management and Board members, analysis of proposed business strategy, and minimum capital adequacy requirements. To avoid problems at a later date, for new licensees who do not have a strong parent company to oversee the startup of operations, CBoB should conduct a more in-depth review of applicant’s risk management policies and conduct an on-site view prior to the 18 months of operation of the SFI. |
| Principle 6 | Transfer of significant ownership. The supervisor18 has the power to review, reject and impose prudential conditions on any proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties. |
| Essential criteria | |
| EC1 | Laws or regulations contain clear definitions of “significant ownership” and “controlling interest”. |
| Description and findings re EC1 | S. 2 of the BTCRA outlines the definition of “controller” which means a person who is able to exercise a significant influence over the management of a licensee by virtue of (i) a holding of shares or other securities in the licenses or such other company; (ii) an entitlement to exercise, or control the exercise of, the voting power at any general meeting of the licensee, or such other company. S. 6A of the BTCRA states that the CBoB may grant/refuse approval of an application by a person to become a controller of a licensee or to increase a controller’s shareholding in a licensee. S. 6 of the BTCRA states that in the case of publicly traded banks approval is required at the 5 percent level and notification at the 3 percent level (as stated in the Acquisition of Shares Regulations (ASR)). |
| EC2 | There are requirements to obtain supervisory approval or provide immediate notification of proposed changes that would result in a change in ownership, including beneficial ownership, or the exercise of voting rights over a particular threshold or change in controlling interest. |
| Description and findings re EC2 | S. 6 of BTCRA specifies that no shares in a bank or any other securities shall be issued and no issued shares shall be transferred or disposed of in any manner without the prior approval of the CBoB. S. 6A of the BTCRA also empowers the CBoB to approve the application of a person who wishes to become a controller of a licensee. This is also reflected in the ASR which requires that any person wishing to acquire shares in a bank (5 percent in the case of a publicly traded bank) must receive the prior approval of CBoB. Paragraph 2(a)(i) of the Schedule to the ASR—requires banks to provide a list of, and background information on, all direct or indirect shareholders who represent, either individually or as a group acting together, 10 percent or more of the voting rights, shares and/or other controlling interest of each applicant at the time of the application. Paragraph 2 (a)(iii) of the Schedule also requires the applicant to provide CBoB with an organization chart showing the structure of the direct and indirect shareholding of each applicant analyzed according to holdings of voting rights, shares and/or other controlling interests. The Registrar of Beneficial Ownership Bill, 2018, effective January 1, 2019 will provide the CBoB with an additional source of information to check prior to granting any approvals related to a controller pertaining to the prevention of criminals or associates from holding any interest, significant or otherwise in the any SFI. |
| EC3 | The supervisor has the power to reject any proposal for a change in significant ownership, including beneficial ownership, or controlling interest, or prevent the exercise of voting rights in respect of such investments to ensure that any change in significant ownership meets criteria comparable to those used for licensing banks. If the supervisor determines that the change in significant ownership was based on false information, the supervisor has the power to reject, modify or reverse the change in significant ownership. |
| Description and findings re EC3 | S. 6 of the BTCRA indicates that no shares can change hands without the consent of CBoB. The same criteria that apply upon authorization apply also, where relevant, upon change of ownership. Accordingly, the proposed new owners and controllers must meet the fitness and propriety criteria and the acquisition must not hinder effective supervision and must be in the best interests of the financial system of The Bahamas. |
| EC4 | The supervisor obtains from banks, through periodic reporting or on-site examinations, the names and holdings of all significant shareholders or those that exert controlling influence, including the identities of beneficial owners of shares being held by nominees, custodians and through vehicles that might be used to disguise ownership. |
| Description and findings re EC4 | Banks are required to submit an annual statement of shareholders, directors and senior officers to CBoB (as well as to the Registrar of Companies). As stipulated in the Licensing Guidelines and the Applications Manual, the Confidential Statement (which is completed by all shareholders, directors and senior officers seeking CBoB’s approval of their appointment) requires that each SFI should inform CBoB, within 21 days, if it becomes aware of any material information that may affect the completeness or accuracy of the information contained in the statement (as per s. 13B of the BTCRA). |
| EC5 | The supervisor has the power to take appropriate action to modify, reverse or otherwise address a change of control that has taken place without the necessary notification to or approval from the supervisor. |
| Description and findings re EC5 | S. 6 of BTCRA states that no acquisition is valid without the consent of CBoB and specifically 6B states that CBoB may object to an existing controller and may take steps to ensure that such a person ceases to be a controller. |
| EC6 | Laws or regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest. |
| Description and findings re EC6 | The Confidential Statement (which is completed by all shareholders, directors and senior officers seeking CBoB’s approval of their appointment) requires that each bank should inform the Inspector, within 21 days, if it becomes aware of any material information that may affect the completeness or accuracy of the information contained in the statement. |
| Assessment of principle 6 | Compliant |
| Comments | CBoB has the power to review, reject, and impose prudential conditions on proposals to transfer significant ownership or controlling interests in SFIs. |
| Principle 7 | Major acquisitions. The supervisor has the power to approve or reject (or recommend to the responsible authority the approval or rejection of), and impose prudential conditions on, major acquisitions or investments by a bank, against prescribed criteria, including the establishment of cross-border operations, and to determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision. |
| Essential criteria | |
| EC1 | Laws or regulations clearly define:
|
| Description and findings re EC1 | The Banks and Trust Companies (Equity Investments) Regulations 2005 (Equity Regulations) stipulates that no bank, without the prior written approval of CBoB can acquire, either directly or indirectly, more than 5 percent of the shares, securities and/or any other interest in any other person (e.g., companies, partnerships, trusts, etc.) S. 5 of the BTCRA requires that written approval of CBoB be obtained for the establishment of foreign subsidiaries (as well as foreign branches and representative offices) by banks. Regulation 3 of the Equity Regulations specifies that no bank shall, without the prior written approval of the CBoB, acquire or hold the shares, securities or other interests in or of any person that is a related party to the bank. |
| EC2 | Laws or regulations provide criteria by which to judge individual proposals. |
| Description and findings re EC2 | In general, the CBoB seeks to ensure that any acquisition proposal made by a bank is sound and feasible and is in the best interests of depositors and the financial system in The Bahamas. If the proposed investment is in a bank (or trust company), the proposal is judged by the criteria outlined in S. 4(2) of the BTCRA. (i.e., authorization criteria). |
| EC3 | Consistent with the licensing requirements, among the objective criteria that the supervisor uses is that any new acquisitions and investments do not expose the bank to undue risks or hinder effective supervision. The supervisor also determines, where appropriate, that these new acquisitions and investments will not hinder effective implementation of corrective measures in the future.19 The supervisor can prohibit banks from making major acquisitions/investments (including the establishment of cross-border banking operations) in countries with laws or regulations prohibiting information flows deemed necessary for adequate consolidated supervision. The supervisor takes into consideration the effectiveness of supervision in the host country and its own ability to exercise supervision on a consolidated basis. |
| Description and findings re EC3 | In general, the CBoB seeks to ensure that any acquisition proposal made by a bank is sound and feasible and is in the best interests of depositors and the financial system in the Bahamas. S. 5 of the BTCRA states that a licensee incorporated or registered in The Bahamas shall not without the prior written approval of the Bank establish outside of The Bahamas, a subsidiary, branch, or representative office. S. 4 of the Guidelines for the Establishment or Acquisition of Overseas Branches, Subsidiaries and Representative Offices address the requirement for consolidated supervision and provides that for CBoB’s ability to successfully supervise entire banking groups on a consolidated basis, it must have an ability to review banking and nonbanking activities conducted by its licensees, either directly or indirectly (through branches, subsidiaries or representative offices) and activities conducted at both domestic and foreign offices. To facilitate CBoB’s ability to supervise on a consolidated basis, it has entered into several MoUs with host regulators. The Guidelines states this as a condition of final approval to the establishment of a branch or subsidiary. CBoB will only allow a bank to make significant investments in other countries where it is satisfied that the supervisors in those other countries implements adequate consolidated supervision and there are no constraints on internal and external audits imposed by those supervisory authorities. The CBoB will only allow an acquisition where it can effectively supervise the bank on a consolidated basis (S. 7 of the Licence Guidelines). |
| EC4 | The supervisor determines that the bank has, from the outset, adequate financial, managerial and organizational resources to handle the acquisition/investment. |
| Description and findings re EC4 | Section 4 (2) of BTCRA provides that CBoB must be satisfied about the nature and sufficiency of the financial resources of the acquiring bank to provide continuing financial support in respect of the proposed acquisition. It must also satisfy itself regarding the soundness and feasibility of the proposal. The Guidelines for the Establishment or Acquisition of Overseas Branches, Subsidiaries and Representative Offices set out the factors which the Bank will consider when determining whether or not to approve an application to establish a foreign subsidiary. Paragraph V(1)(b) and (e) of these Guidelines includes the amongst the various criteria to be considered by the Bank: “(b) the fitness, propriety and managerial capacity of the applicant to expand its banking and/or trust business overseas in a prudent and reputable manner; and (e) the nature and sufficiency of the financial resources of the applicant to provide continuing financial support to the branch, subsidiary or representative office overseas, should it be necessary. The financial condition and likely future requirements of the entity in terms of possible injections of capital and liquidity will also be considered to ensure that there will not be undue hardship on the financial resources of the licensee;” The Equity Regulations 2005 stipulates that no bank, may without the prior written approval of CBoB acquire, either directly or indirectly, more than 5 percent of the shares, securities and/or any other interest in any other person (e.g., companies, partnerships, trusts, etc.). The off-site supervision surveillance team, together with the authorization unit, engages in discussions with SFIs of potential major acquisitions to determine if the SFI has the organizational resources to handle the acquisition or investment. |
| EC5 | The supervisor is aware of the risks that non-banking activities can pose to a banking group and has the means to take action to mitigate those risks. The supervisor considers the ability of the bank to manage these risks prior to permitting investment in non-banking activities. |
| Description and findings re EC5 | CBoB will only permit an investment in a non-banking entity where it is sound and feasible and in the best interest of depositors and the financial system in The Bahamas. |
| AC1 | The supervisor reviews major acquisitions or investments by other entities in the banking group to determine that these do not expose the bank to any undue risks or hinder effective supervision. The supervisor also determines, where appropriate, that these new acquisitions and investments will not hinder effective implementation of corrective measures in the future.20 Where necessary, the supervisor is able to effectively address the risks to the bank arising from such acquisitions or investments. |
| Description and findings re AC1 | |
| Assessment of Principle 7 | Compliant |
| Comments | The BTCRA empowers CBoB to establishes clear provisions on acquisitions and investments that require prior supervisory approval or prior notification to CBoB. |
| Principle 8 | Supervisory approach. An effective system of banking supervision requires the supervisor to develop and maintain a forward-looking assessment of the risk profile of individual banks and banking groups, proportionate to their systemic importance; identify, assess and address risks emanating from banks and the banking system as a whole; have a framework in place for early intervention; and have plans in place, in partnership with other relevant authorities, to take action to resolve banks in an orderly manner if they become non-viable. |
| Essential criteria | |
| EC1 | The supervisor uses a methodology for determining and assessing on an ongoing basis the nature, impact and scope of the risks:
The methodology addresses, among other things, the business focus, group structure, risk profile, internal control environment and the resolvability of banks, and permits relevant comparisons between banks. The frequency and intensity of supervision of banks and banking groups reflect the outcome of this analysis. |
| Description and findings re EC1 | CBoB has identified six Domestic Systemically Important Banks (DSIB) which based on their nature, impact and scope of risks were determined to have the potential impact on the safety and soundness of The Bahamas banking system. These DSIBs are subject to more enhanced off-site supervision surveillance focus requiring a three-year cycle for a risk assessment versus the other SFI’s being subject to a 5-year risk assessment cycle. The off-site supervision surveillance teams meet more frequently (semi-annually) with the DSIB’s senior management to discuss prudential issues, and progress in addressing supervisory requirements. At times, the DSIBs are also subject to more regular on-site examinations than other SFIs, however the on-site examinations do not include a deep effectiveness review of corporate governance, internal audit function nor an examination of some of the material risks (e.g. credit) on a regular basis. The international SFIs (including branch operations) are subject to similar risk assessment processes, but less frequently (e.g. annually). |
| EC2 | The supervisor has processes to understand the risk profile of banks and banking groups and employs a well-defined methodology to establish a forward-looking view of the profile. The nature of the supervisory work on each bank is based on the results of this analysis. |
| Description and findings re EC2 | CBoB’s off-site supervision surveillance includes:
When an on-site examination takes place, CBoB evaluates banks’ policies, practices, and procedures relating to their loan and investment portfolios, and ensures that banks have in place internal controls adequate to the nature and scale of their operations. The off-site supervisors prepare risk assessments (on a cycle of 3 (DSIBs) and 5 years (all other SFIs), annual/semi-annual analysis as well as reports on examinations provide for a good understanding of the overall risk profile of the SFI. The ever-greening tool which has been developed and implemented (although a few remaining adjustments are required to make it fully operational) provides the off-site supervisors the ability to update the risk assessment matrix/profile frequently, which incorporates an impact assessment of the direction of risk. |
| EC3 | The supervisor assesses banks’ and banking groups’ compliance with prudential regulations and other legal requirements. |
| Description and findings re EC3 | CBoB requires the Board of Directors to provide an annual certification which is relied upon to ensure that SFIs are in compliance with prudential regulations and other legal requirements. Additionally, banks are expected to notify the CBoB of any breaches of prudential norms or prudential regulations. |
| EC4 | The supervisor takes the macroeconomic environment into account in its risk assessment of banks and banking groups. The supervisor also takes into account cross-sectoral developments, for example in non-bank financial institutions, through frequent contact with their regulators. |
| Description and findings re EC4 | As part of the risk based supervisory framework, CBoB assesses the effect of economic factors of licensees including trends in national and regional gross domestic products (GDP), trends in national inflation and foreign investments in The Bahamas to name a few. CBoB also assess the impact of changes in the competitive environment of licensees including the impact of changes in international rules for disclosure (exchanges of information between tax authorities), levels of new entrants/exits from the industry/sector, trends in margins and profitability for the industry/sector as well as the industry structure. CBoB also conducts aggregate stress testing to test SFI’s abilities to withstand certain shocks in the macroeconomic environment. Although CBoB is in the preliminary stages of developing these macro stress tests, the stress testing to date has assisted the BSD with assessing the impact on the risk profile of the DSIBs. |
| EC5 | The supervisor, in conjunction with other relevant authorities, identifies, monitors and assesses the build-up of risks, trends and concentrations within and across the banking system as a whole. This includes, among other things, banks’ problem assets and sources of liquidity (such as domestic and foreign currency funding conditions, and costs). The supervisor incorporates this analysis into its assessment of banks and banking groups and addresses proactively any serious threat to the stability of the banking system. The supervisor communicates any significant trends or emerging risks identified to banks and to other relevant authorities with responsibilities for financial system stability. |
| Description and findings re EC5 | CBoB conducts reviews of trends and concentrations within and across the banking system as a whole. CBoB’s Quarterly Economic Review, produced by CBoB’s Research Department, reviews key economic and financial developments, including an analysis of the developments in the financial services sector, performance of the domestic banks, credit quality, capital adequacy, and profitability. The report also speaks to capital markets developments as well as developments in the international environment. This analysis, together with the marcro stress testing conducted by CBoB is factored into the risk assessment of the SFIs. In addition, based on the current credit environment in The Bahamas, the off-site supervision surveillance team has made an effort over the past 18 months to communicate these findings with the DSIBs, along with CBoB’s expectation that these SFI work towards lowering the overall level of NPLs in the banking sector. The overall NPL levels have been gradually decreasing since that time, with the exception of one DSIB. |
| EC6 | Drawing on information provided by the bank and other national supervisors, the supervisor, in conjunction with the resolution authority, assesses the bank’s resolvability where appropriate, having regard to the bank’s risk profile and systemic importance. When bank-specific barriers to orderly resolution are identified, the supervisor requires, where necessary, banks to adopt appropriate measures, such as changes to business strategies, managerial, operational and ownership structures, and internal procedures. Any such measures take into account their effect on the soundness and stability of ongoing business. |
| Description and findings re EC6 | CBoB reviews and assesses all relevant information received by licensees, other regulators or obtained by other means which may have an impact on the soundness and stability of licensees’ business operations. CBoB has the power under the BTCRA to impose intervention measures on licensees should there be any supervisory concerns. CBoB’s Ladder of Supervisory Intervention Guidelines provide CBoB with the ability to take the necessary intervention measures in a timely manner. At this time, proposed amendments to the BTCRA will enhance the CBoB’s resolution framework as well as when enacted would allow the CBoB to require banks to make changes to remove barriers to orderly resolution. |
| EC7 | The supervisor has a clear framework or process for handling banks in times of stress, such that any decisions to require or undertake recovery or resolution actions are made in a timely manner. |
| Description and findings re EC7 | At this time, CBoB works informally with the Group of Financial Services Regulators (domestic agencies through an MoU) as well as with the MoF to deal with the handling of banks in stress. Amendments to the BTCRA have proposed an enhanced resolution framework that would empower the BTCRA to require SFIs to undertake recovery or resolution actions in a timely manner. It is essential for the CBoB to be formally recognized as the Resolution Authority as well as having the power to take the necessary steps to ensure any actions that are required to be taken are done so in a timely manner. |
| EC8 | Where the supervisor becomes aware of bank-like activities being performed fully or partially outside the regulatory perimeter, the supervisor takes appropriate steps to draw the matter to the attention of the responsible authority. Where the supervisor becomes aware of banks restructuring their activities to avoid the regulatory perimeter, the supervisor takes appropriate steps to address this. |
| Description and findings re EC8 | SFIs are required to seek formal approval of any restructuring activities and therefore it would not approve of any activities that an SFI conducts in order to avoid regulatory requirements. |
| Assessment of Principle 8 | Largely Compliant |
| Comments | CBoB has a strong off-site surveillance program that entails direct interaction with the DSIBs on a semi-annual basis, international firms annually, that entails discussions around periodic reporting, discussion of emerging prudential risks (credit) that could impact the firm. CBoB must ensure that its DSIBs have an adequate on-site examination program that includes an in-depth review (which can be conducted on a cycle basis) of corporate governance, internal controls and a deep assessment of the most prominent risks in the business model (e.g. credit risk for the domestic retail asset backed lending books). This enhanced risk assessment process should be conducted more frequently for DSIBs to minimize the potential negative impact on the financial stability of the banking system in The Bahamas. A supervisory regime for the assessment of resolvability is still a work in progress. |
| Principle 9 | Supervisory techniques and tools. The supervisor uses an appropriate range of techniques and tools to implement the supervisory approach and deploys supervisory resources on a proportionate basis, taking into account the risk profile and systemic importance of banks. |
| Essential criteria | |
| EC1 | The supervisor employs an appropriate mix of on-site21 and off-site22 supervision to evaluate the condition of banks and banking groups, their risk profile, internal control environment and the corrective measures necessary to address supervisory concerns. The specific mix between on-site and off-site supervision may be determined by the particular conditions and circumstances of the country and the bank. The supervisor regularly assesses the quality, effectiveness and integration of its on-site and off-site functions, and amends its approach, as needed. |
| Description and findings re EC1 | CBoB’s off-site supervision surveillance program uses a number of methods for assessing an SFI’s financial condition and compliance with prudential requirements and standards, including those related to corporate governance and risk management. Both the domestic and international SFIs are subject to the same risk based supervisory framework with more emphasis being placed on the largest SFIs in both categories. The on-site examination program does not include a deep effectiveness assessment of DSIB’s key corporate governance, risk management and internal controls practices, as well as in-depth reviews of material risks (e.g. credit risk) depending on the business model on a regular basis. |
| EC2 | The supervisor has a coherent process for planning and executing on-site and off-site activities. There are policies and processes to ensure that such activities are conducted on a thorough and consistent basis with clear responsibilities, objectives and outputs, and that there is effective coordination and information sharing between the on-site and off-site functions. |
| Description and findings re EC2 | Each year the BSD formulates a strategic plan that references the continuous off-site supervision surveillance requirements (including semi-annual/annual meetings with senior management of SFIs), planned on-site examination work required to be undertaken depending on the in-depth risk assessments conducted by the off-site supervision surveillance team’s requirements together with the requirement to address all regulatory guidance needs (e.g. implementing Basel II/III reform initiatives, etc.). |
| EC3 | The supervisor uses a variety of information to regularly review and assess the safety and soundness of banks, the evaluation of material risks, and the identification of necessary corrective actions and supervisory actions. This includes information, such as prudential reports, statistical returns, information on a bank’s related entities, and publicly available information. The supervisor determines that information provided by banks is reliable23 and obtains, as necessary, additional information on the banks and their related entities. |
| Description and findings re EC3 | In addition to the documentation used in a risk assessment, CBoB reviews information obtained from statutory filings (prudential returns), financial reporting requirements for capital liquidity and earnings performance (to name a few) on a weekly, quarterly and monthly basis, external audit reports, consolidated annual reports from the parent company), correspondences, service level agreements, newspaper articles and press releases, internal audit reports, ICAAP reports and management reporting to the Board of Directors (“the Board”) (including minutes of the Board and Board committee meetings) as well as reports emanating from Discovery Review meetings. |
| EC4 | The supervisor uses a variety of tools to regularly review and assess the safety and soundness of banks and the banking system, such as:
The supervisor communicates its findings to the bank as appropriate and requires the bank to take action to mitigate any particular vulnerabilities that have the potential to affect its safety and soundness. The supervisor uses its analysis to determine follow-up work required, if any. |
| Description and findings re EC4 | CBoB uses a variety of tools to regularly review and assess the safety and soundness of SFIs, including the review and analysis of financial statements and accounts, business model analysis (part of the analysis conducted annually as well as the in-depth risk assessments conducted every 3 years for DSIBs land 5 years for all other SFIs). Horizontal peer reviews are conducted in an informal manner, but it is conducted nonetheless. The outcome of SFI produced stress tests are reviewed and discussed with the institution when relevant. CBoB on-site examiners review corporate governance, including risk management and internal control systems when a specific risk is being reviewed as part of the examination. In general, CBoB does not conduct a deep dive review of corporate governance per se. |
| EC5 | The supervisor, in conjunction with other relevant authorities, seeks to identify, assess and mitigate any emerging risks across banks and to the banking system as a whole, potentially including conducting supervisory stress tests (on individual banks or system-wide). The supervisor communicates its findings as appropriate to either banks or the industry and requires banks to take action to mitigate any particular vulnerabilities that have the potential to affect the stability of the banking system, where appropriate. The supervisor uses its analysis to determine follow-up work required, if any. |
| Description and findings re EC5 | CBoB is in its early stages of developing appropriate models and detailed guidelines for supervisory stress testing, but these have not been issued as yet. Most licensees are subsidiaries or branches of international banking groups and have advanced models that are employed subject to home country supervision standards. For the local operation, the CBoB reviews the results of the models and stress testing and is initiating work with the local operation to adapt their models. |
| EC6 | The supervisor evaluates the work of the bank’s internal audit function, and determines whether, and to what extent, it may rely on the internal auditors’ work to identify areas of potential risk. |
| Description and findings re EC6 | The off-site supervision surveillance receives all internal audit reports throughout the year on all SFIs and the team meets face to face with the internal auditors to review the findings of such reports. In addition, the on-site examiners review the scope and work papers of the auditor during onsite examination visits. As part of a licensee’s risk assessment, examiners also assess the issues identified and recommendations made in internal and group internal audit reports. |
| EC7 | The supervisor maintains sufficiently frequent contacts as appropriate with the bank’s Board, non-executive Board members and senior and middle management (including heads of individual business units and control functions) to develop an understanding of and assess matters such as strategy, group structure, corporate governance, performance, capital adequacy, liquidity, asset quality, risk management systems and internal controls. Where necessary, the supervisor challenges the bank’s Board and senior management on the assumptions made in setting strategies and business models. |
| Description and findings re EC7 | It is CBoB’s policy, that all licensees meet at least annually with BSD. These meetings encompass all material issues arising from both off-site monitoring of prudential indicators and the CBoB’s on-site examinations. The frequency for onsite examinations is determined by the risk-rating of the bank. For example, a bank rated as high Risk (i.e., high probability of an event occurring and high systemic or jurisdictional impact if the event crystallizes) would be subject to at least annual reviews. Lower risk banks will be subject to less frequent reviews (based on the risk rating). Licensees are required to submit, in advance of the meetings, relevant recent internal risk reports for their operations in The Bahamas, as well as internal audit reviews and the external auditor’s management letter. More frequent meetings are held with higher risk entities. Licensees are required to notify the CBoB of any significant changes in their activities, as well as discuss activities and financial performance at the annual prudential meeting. The inclusion of external auditors, non-executive directors and middle management of licensees in prudential discussions is determined on a case-by-case basis (at the discretion of the Inspector). The risk–based assessment (profile) for licensees is used for determining the frequency of examinations. Meetings are routinely held and correspondence regularly exchanged with the external auditors of banks. In general, CBoB has focused mainly on SFI senior management executives, however, CBoB recently communicated its intent to engage boards directly on a go forward basis. The intent is to engage more closely with the boards of supervised financial institutions on matters of financial and AML risk. |
| EC8 | The supervisor communicates to the bank the findings of its on- and off-site supervisory analyses in a timely manner by means of written reports or through discussions or meetings with the bank’s management. The supervisor meets with the bank’s senior management and the Board to discuss the results of supervisory examinations and the external audits, as appropriate. The supervisor also meets separately with the bank’s independent Board members, as necessary. |
| Description and findings re EC8 | CBoB traditionally meets with SFI senior management either through regular prudential meetings (annual/semi-annual) or to discuss a Report of Examination which is provided to the licensee after the examination. In the past, CBoB has taken sometimes months to release its Report of Examination. However, in 2018 CBoB has narrowed the release of final Reports of Examination within 20 business days after the onsite visit. Licensees are expected to satisfactorily address all issues/deficiencies identified in the report in a timely manner. Validation of same is conducted during the next onsite examination visits. Since 2018 CBoB has conducted quarterly/semi-annual meetings with the DSIBs to discuss, among other things, progress in addressing the overall level of NPLs (specifically focusing on the top 20 large exposures as well as the top 20 NPLs) These meetings with the DSIBs have provided a perspective of the credit profile, lending initiatives and the licensees’ perspective on the marketplace trends, as well as delinquency management practices. |
| EC9 | The supervisor undertakes appropriate and timely follow-up to check that banks have addressed supervisory concerns or implemented requirements communicated to them. This includes early escalation to the appropriate level of the supervisory authority and to the bank’s Board if action points are not addressed in an adequate or timely manner. |
| Description and findings re EC9 | CBoB monitors the progress of licensees’ ability to satisfactorily address issues or deficiencies identified in the Report of Examination by way of letter. Licensees are required to provide status updates periodically to CBoB via “Response to Report of Examination” letters until all matters are fully addressed. CBoB advises the licensee of the next reporting date in each letter until all matters are resolved. Further enhancement was made to the monitoring process this year via the development of a “Register of Supervisory Issues”, which is a compilation of all outstanding supervisory matters for each licensee. Included in the register are all outstanding directives, requirements, expectations and requests made of a licensee by the CBoB. The register is provided to licensees each year and they are advised to share the document with external auditors and other persons listed in Section 16(1) of the BTCRA. In addition, CBoB has required the Internal audit function to provide an attestation that confirms the SFI has in fact addressed any outstanding supervisory requirement. |
| EC10 | The supervisor requires banks to notify it in advance of any substantive changes in their activities, structure and overall condition, or as soon as they become aware of any material adverse developments, including breach of legal or prudential requirements. |
| Description and findings re EC10 | The BTCRA indicates that licensees are expected to inform CBoB in advance of any significant change that may impact the operation of their business. For example, via Notice, licensees were directed by the CBoB to immediately notify the Inspector of Banks and Trust Companies, if they become aware that a material event could have a significant adverse impact on its safety and soundness or reputation. The matter is to be reported whether it had already occurred, or may occur in the foreseeable future. |
| EC11 | The supervisor may make use of independent third parties, such as auditors, provided there is a clear and detailed mandate for the work. However, the supervisor cannot outsource its prudential responsibilities to third parties. When using third parties, the supervisor assesses whether the output can be relied upon to the degree intended and takes into consideration the biases that may influence third parties. |
| Description and findings re EC11 | The BTCRA enables CBoB to use independent third parties. Section 13 (3) (c), (d) (e) and 4 of the BTCRA notes the following: “In the performance of his functions under this Act and subject to the provisions of section 19, the Inspector shall be entitled at all reasonable times — (c) to call upon the auditors of any licensee for such auditor’s reports, working papers, information or explanation; (d) to require that the auditor of a bank report to the Inspector on the extent of the procedures of the auditor in the examination of the annual financial statements and may require that the auditors enlarge the scope of that examination or direct that any other particular procedure be performed in any particular case; (e) to require that the auditor make a particular examination relating to the adequacy of the procedures adopted by the bank for the safety of its creditors and shareholders, or any other examination as considered necessary by the Inspector, as the Inspector may reasonably require for the purpose of enabling him to perform his functions under this Act. (4) The Inspector with the approval of the Governor may in writing authorise any other person to assist the Inspector in the performance of his functions under this Act.” |
| EC12 | The supervisor has an adequate information system which facilitates the processing, monitoring and analysis of prudential information. The system aids the identification of areas requiring follow-up action. |
| Description and findings re EC12 | In 2015, CBoB launched its Online Reporting Information System (ORIMS), an electronic portal for licensees to upload their regulatory returns and submit same to the Bank. The ORIMS is an enhancement to CBoB’s existing infrastructure for regulatory filings, analytics and reporting. ORIMS allows licensees and other respondents to securely submit data, filings and documents via online forms submissions and file uploads. The system includes a mechanism for the downloading and subsequent uploading of returns through a secure web-based platform and built-in validation and integrity checks at the form submission level. There have been several updates since the system was launched, all in an effort to streamline the information exchange and to provide an efficient reporting system for licensees. Updates and enhancements to the system will continue as necessary. The supervisory team is then able to access the returns in the portal and conduct their own financial analysis of licensees. Areas of concern are addressed with the licensee with follow-ups if necessary. |
| Additional criteria | |
| AC1 | The supervisor has a framework for periodic independent review, for example by an internal audit function or third party assessor, of the adequacy and effectiveness of the range of its available supervisory tools and their use, and makes changes as appropriate. |
| Description and findings re AC1 | CBoB’s internal audit periodically conducts a review of all of the Bank’s processes and procedures. Findings and recommendations are provided to the Bank via an internal audit report with timelines to address any matters of concern. The last CBoB internal audit of the BSD was in the process of being finalized in January 2019. |
| Assessment of Principle 9 | Largely Compliant |
| Comments | CBoB has a good set of supervisory tools to allow for effective execution of its supervisory activities. The mix of off-site surveillance and on-site examination work needs to be reassessed by BSD to ensure the right balance and adequate coverage of the assessment of risk. Staff are knowledgeable, and assessors observed the work done by both the off-site supervisors and the on-site examiners. Written communications clearly articulate issues and through frequent engagement CBoB provides clarity to the firms on the issues raised and the general high-level expectations for addressing them. That being said, it will be important for CBoB to directly engage SFI Boards of Directors, especially DSIBs on a regular basis. Although CBoB made a public announcement that it plans to engage Boards more directly, this has not been a regular past practice. |
| Principle 10 | Supervisory reporting. The supervisor collects, reviews and analyses prudential reports and statistical returns24 from banks on both a solo and a consolidated basis, and independently verifies these reports through either on-site examinations or use of external experts. |
| Essential criteria | |
| EC1 | The supervisor has the power25 to require banks to submit information, on both a solo and a consolidated basis, on their financial condition, performance, and risks, on demand and at regular intervals. These reports provide information such as on- and off-balance sheet assets and liabilities, profit and loss, capital adequacy, liquidity, large exposures, risk concentrations (including by economic sector, geography and currency), asset quality, loan loss provisioning, related party transactions, interest rate risk, and market risk. |
| Description and findings re EC1 | S. 35 (1) of the CBBA empowers CBoB to gather any information from licensee at regular intervals, e.g., weekly, monthly, quarterly, in order for it to carry out its statutory function. Information received includes detailed profit and loss accounts and balance sheets and information on capital adequacy, liquidity, large exposures, risk concentrations, asset quality/impairment data, aggregate loan loss data, exposures to related parties, interest rate risk and market risk. S. 35 of the CBBA provides that the CBoB may require a bank to supply it in such form and within such time as it may determine such information as CBoB considers necessary to enable it to carry out its functions under the Act. Further, CBoB may require a bank, a person connected to the bank, or a person reasonably believed to have information relevant to an enquiry by CBoB to provide any information which it reasonably requires in connection with the carrying out of its functions or for the purpose of assisting an overseas regulator. S 4(4)(b), 8(3), 9 and 14 of the BTCRA supports consolidated supervision and the gathering of applicable information by obtaining key information on licensees and their parent and/or subsidiaries through regular and frequent teleconferences with other relevant regulators as well as consistently attending supervisory colleges held by foreign regulatory authorities. |
| EC2 | The supervisor provides reporting instructions that clearly describe the accounting standards to be used in preparing supervisory reports. Such standards are based on accounting principles and rules that are widely accepted internationally. |
| Description and findings re EC2 | Section 35 of the CBBA provides that CBoB can direct the form and content of financial returns. These must be prepared in accordance with IAS as adopted by the Bahamas Institute of Chartered Accountants (BICA) which is the body in The Bahamas statutorily charged with overseeing the implementation of accounting and auditing standards (See Regulation 38 of The Bahamas Institute of Chartered Accountants (General) Regulations, 2016). Further, CBoB has instructed SFI’s to be IFRS 9 compliant beginning January 1, 2018. |
| EC3 | The supervisor requires banks to have sound governance structures and control processes for methodologies that produce valuations. The measurement of fair values maximizes the use of relevant and reliable inputs and is consistently applied for risk management and reporting purposes. The valuation framework and control procedures are subject to adequate independent validation and verification, either internally or by an external expert. The supervisor assesses whether the valuation used for regulatory purposes is reliable and prudent. Where the supervisor determines that valuations are not sufficiently prudent, the supervisor requires the bank to make adjustments to its reporting for capital adequacy or regulatory reporting purposes. |
| Description and findings re EC3 | SFIs must abide by the valuation rules consistent with IAS and IFRS 9 CBoB relies on views of the external auditors to attest to the valuation practices of SFI’s and where necessary, SFI’s have had to make adjustments to prudential reporting requirements. |
| EC4 | The supervisor collects and analyses information from banks at a frequency commensurate with the nature of the information requested, and the risk profile and systemic importance of the bank. |
| Description and findings re EC4 | S. 9 of BTCRA requires banks to furnish to CBoB a special return and any such information as it reasonably sees fit to call for. It is on this basis that CBoB has requested that it receive weekly, monthly, quarterly and annual returns, and any other returns it requires from the SFIs. The type of information received will depend on the nature and complexity of the business of the bank. For instance, the domestic banks are subject to a more demanding regime regarding information requirements than the international banks. |
| EC5 | In order to make meaningful comparisons between banks and banking groups, the supervisor collects data from all banks and all relevant entities covered by consolidated supervision on a comparable basis and related to the same dates (stock data) and periods (flow data). |
| Description and findings re EC5 | In general, supervisory returns are received on a weekly, monthly, quarterly and annual basis. The layout and content of these returns are the same and banks are required to submit them at the same dates. While the different categories of banks (i.e., domestic/international) may have varying requirements, within those categories the requirements are the same. This allows for meaningful comparisons for banks in the same categories. |
| EC6 | The supervisor has the power to request and receive any relevant information from banks, as well as any entities in the wider group, irrespective of their activities, where the supervisor believes that it is material to the condition of the bank or banking group, or to the assessment of the risks of the bank or banking group or is needed to support resolution planning. This includes internal management information. |
| Description and findings re EC6 | The CBoB has the ability to request and receive relevant information from banks, including information on any entities in the wider group, but this power to request this information in with the SFI it regulates. Section 35 of the CBBA provides that the CBoB may require a bank to supply it in such form and within such time as it may determine such information as CBoB considers necessary to enable it to carry out its functions under the Act. Further, CBoB may require a bank, a person connected to the bank, or a person reasonably believed to have information relevant to an enquiry by CBoB to provide any information which it reasonably requires in connection with the carrying out of its functions. S. 13(3) of the BTCRA the Inspector may call upon the manager or any officer designated by the manager of any licensee for such information or explanation as he may reasonably require for the purpose of enabling him to perform his functions under this Act. |
| EC7 | The supervisor has the power to access26 all bank records for the furtherance of supervisory work. The supervisor also has similar access to the bank’s Board, management and staff, when required. |
| Description and findings re EC7 | S. 13(3) of the BTCRA indicates that the Inspector is entitled at all reasonable times to have access to such books, records, vouchers, documents, cash and securities of the bank and to call upon the management or any officer designated by the manager of any bank for such information or explanation as Inspector may reasonably require for the purpose off enabling it to perform its functions. CBOB also sets limits within which licensees must operate for single, related party and large exposures vis its Large Exposure Regulations and Guidelines. CBoB conducts discussion with DSIB senior management on a semi-annual and annual basis. CBoB off-site supervision surveillance speaks to management and staff when required. CBoB released a press statement in 2018 to the financial sector that it intends to engage SFI Boards of Directors on an annual basis beginning 2019. Copies of Results of On-site examinations are provided to the Board of Directors. |
| EC8 | The supervisor has a means of enforcing compliance with the requirement that the information be submitted on a timely and accurate basis. The supervisor determines the appropriate level of the bank’s senior management is responsible for the accuracy of supervisory returns, imposes sanctions for misreporting and persistent errors, and requires that inaccurate information be amended. |
| Description and findings re EC8 | As part of CBoB’s supervisory intervention regime, a licensee can be staged for intervention, particularly at Stage 1 in accordance with the Ladder of Intervention Guideline where a licensee may experience the following issues:
SFIs provide a certification regarding the compliance and accuracy of the reporting of information. CBoB has a wide range of supervisory measures that it can impose on licensees including administrative fines and monetary penalties. The Bank’s monetary penalties regime was officially implemented on 5th September 2016 with the coming into force of the Banks and Trust Companies (Administrative Monetary Penalties) Regulations, 2016 and the Bank’s “Guidelines for the Administration of Monetary Penalties”, amended 31st August 2016 (“AMP guidelines”). The AMP guidelines outline the monetary sanctions that the Bank can impose, under statutory authority, for violations related to late or erroneous filing of returns, amongst others. S. 37 of the CBBA and S. 11 and 13 of the BTCRA impose criminal sanctions in relation to the provision of false or misleading information. Fines of up to $100,000 or five years imprisonment or both are specified in the law. |
| EC9 | The supervisor utilizes policies and procedures to determine the validity and integrity of supervisory information. This includes a program for the periodic verification of supervisory returns by means either of the supervisor’s own staff or of external experts.27 |
| Description and findings re EC9 | During on-site inspections, examiners review the integrity of supervisory information. In addition, the External Auditors Guidelines, issued by the CBoB, contain a requirement for external experts to bring material short comings to the attention of the supervisors. Additionally, CBoB has staff members designated to verify that financial returns submitted via its ORIMS Portal use the correct reporting format and to check for inconsistencies between report forms (this is in addition to inconsistencies between reports identified by the ORIMS software). If any of the aforementioned exist, it is flagged and the licensee(s) and/or registrant(s) along with the supervisory teams are informed and the licensees and/or registrants are required to re-submit the relevant return before they are analyzed. |
| EC10 | The supervisor clearly defines and documents the roles and responsibilities of external experts,28 including the scope of the work, when they are appointed to conduct supervisory tasks. The supervisor assesses the suitability of experts for the designated task(s) and the quality of the work and takes into consideration conflicts of interest that could influence the output/recommendations by external experts. External experts may be utilized for routine validation or to examine specific aspects of banks’ operations. |
| Description and findings re EC10 | CBoB has the power to appoint external experts to assist it in the performance of its duty (S. 13 (4) of BTCRA). It is not the policy of CBoB to utilize external experts to assist in carrying out supervisory functions, per se. However, it does use external experts when, for instance, introducing a new skill (e.g., the supervision of market risk) or for the purpose of conducting overseas reviews of banks that have extensive outsourcing of activities abroad. CBoB has also engaged external auditors to conduct in-depth credit reviews (e.g. forensic review on a stage 4 SFI). |
| EC11 | The supervisor requires that external experts bring to its attention promptly any material shortcomings identified during the course of any work undertaken by them for supervisory purposes. |
| Description and findings re EC11 | S. 12(4) of the BTCRA provides that the external auditor of a bank, and in some cases a former external auditor of a bank, is required to inform CBoB in writing of any fact or matter of which the auditor has or had become aware and which is, or is likely to be of material significance for the CBoB in relation to the discharge of its duties. “Facts and matters of material significance” are set out in the Banks and Trust Companies (Auditors) (Facts and Matters of Material Significance) Regulations and include a situation where the auditor identifies any evidence of deliberate attempts by a chief executive or other senior executive to mislead the Inspector through the provision of materially false or misleading information |
| EC12 | The supervisor has a process in place to periodically review the information collected to determine that it satisfies a supervisory need. |
| Description and findings re EC12 | CBoB periodically reviews the information collected from prudential returns to reassess the ongoing needs of its supervisors. This review process has taken place more regularly in recent years than in the past given the need necessity to rely on prudential return information as part of CBoB’s newly developed electronic ever-greening supervisory assessment tool. |
| Assessment re Principle 10 | Compliant |
| Comments | CBoB has appropriate authority to collect the data that it needs to carry out its supervisory responsibilities. Prudential and statistical reporting by the SFIs provide information on supervised firms’ risk exposures, operating performance and financial condition. CBoB is committed to refining its data gathering efforts as well as working towards full implementation of an electronic ever greening risk assessment tool. CBoB’s strategy includes continuing to increase the use of quantitative analyses (evidenced by the creation of an analytics unit). |
| Principle 11 | Corrective and sanctioning powers of supervisors. The supervisor acts at an early stage to address unsafe and unsound practices or activities that could pose risks to banks or to the banking system. The supervisor has at its disposal an adequate range of supervisory tools to bring about timely corrective actions. This includes the ability to revoke the banking license or to recommend its revocation. |
| Essential criteria | |
| EC1 | The supervisor raises supervisory concerns with the bank’s management or, where appropriate, the bank’s Board, at an early stage, and requires that these concerns be addressed in a timely manner. Where the supervisor requires the bank to take significant corrective actions, these are addressed in a written document to the bank’s Board. The supervisor requires the bank to submit regular written progress reports and checks that corrective actions are completed satisfactorily. The supervisor follows through conclusively and in a timely manner on matters that are identified. |
| Description and findings re EC1 | The BTCRA provides a wide range of discretionary enforcement powers to the CBoB to address situations that give the CBoB cause for concern. S. 18 of the BTCRA outlines the enforcement powers of the CBoB with respect to banks and other SFIs. This includes the power to ultimately revoke a licence. S. 24 of the BTCRA empowers the Governor to make regulations and to establish fines. The CBoB’s Ladder of Intervention Guidelines outlines procedures for addressing regulatory and supervisory breaches. The objective of the intervention process is to identify areas of concern early and to intervene early and effectively to minimize problems and losses to depositors and other creditors of licensees. Licensees whose overall risk assessment is deemed medium high or greater may also be placed on CBoB’s Watch List for enhanced monitoring until the relevant issues/concerns are satisfactorily addressed. Licensees’ progress with corrective action is closely monitored by the off-site supervision surveillances team. CBoB communicates findings and recommendations to licensees senior management and where appropriate Board representatives in a timely manner. With respect to onsite examinations, CBoB’s internal policy requires that the final examination report be provided to the bank within four weeks (20 business days) from the completion of the onsite examination. The CBoB notifies SFI’s in writing of any enforcement action that is being taken or will be taken. The BTCRA enables the CBoB to share information with other supervisory authorities. CBoB monitors SFI’s progress in remediating actions (progress against plan with a sign-off/attestation from internal audit at times), |
| EC2 | The supervisor has available29 an appropriate range of supervisory tools for use when, in the supervisor’s judgment, a bank is not complying with laws, regulations or supervisory actions, is engaged in unsafe or unsound practices or in activities that could pose risks to the bank or the banking system, or when the interests of depositors are otherwise threatened. |
| Description and findings re EC2 | Where a bank is found to be in breach of a prudential requirement or any other conditions set by the CBoB, the CBoB may agree or impose a plan of corrective action with the bank. In considering the appropriate supervisory intervention to take in the event of a concern arising or a supervisory breach by a bank, the CBoB will take into account, amongst other things, the following: the requirement for an SFI to increase provisioning for NPLs, increase in capital or liquidity, the removal of directors and management, requiring expanded external audits, the imposition of fines and restrictions on payment of dividends, lending or investment activities, accepting new deposits and other restrictions deemed appropriate. |
| EC3 | The supervisor has the power to act where a bank falls below established regulatory threshold requirements, including prescribed regulatory ratios or measurements. The supervisor also has the power to intervene at an early stage to require a bank to take action to prevent it from reaching its regulatory threshold requirements. The supervisor has a range of options to address such scenarios. |
| Description and findings re EC3 | The minimum capital prudential limit is 8 percent. However, commercial banks are required to maintain a target level of 17 percent and a trigger level of 14 percent. The Ladder of Intervention Guidelines refer to a 2 percent margin that can be used in determining when a licensee may be reaching its capital adequacy ratio (CAR) and/or liquidity ratio prudential limits. This trigger is introduced at Stage 2 “Heightened Risk to Financial Viability or Solvency” where a licensee is compliant with established prudential norms, but is approaching the limit. The range of intervention measures that can be used is outlined in the Ladder of Supervisory Intervention Guidelines. |
| EC4 | The supervisor has available a broad range of possible measures to address, at an early stage, such scenarios as described in essential criterion 2 above. These measures include the ability to require a bank to take timely corrective action or to impose sanctions expeditiously. In practice, the range of measures is applied in accordance with the gravity of a situation. The supervisor provides clear prudential objectives or sets out the actions to be taken, which may include restricting the current activities of the bank, imposing more stringent prudential limits and requirements, withholding approval of new activities or acquisitions, restricting or suspending payments to shareholders or share repurchases, restricting asset transfers, barring individuals from the banking sector, replacing or restricting the powers of managers, Board members or controlling owners, facilitating a takeover by or merger with a healthier institution, providing for the interim management of the bank, and revoking or recommending the revocation of the banking license. |
| Description and findings re EC4 | The Ladder Intervention Guidelines outlines the conditions to initiate the Bank’s intervention measures which include but are not limited to the following: (i) concerns about the licensee’s ability to meet capital and/or liquidity requirements on an ongoing basis; (ii) noticeable deterioration in the quality of loan and/or investment portfolio, which could negatively impact the licensee’s/registrant’s asset values; (iii) less than satisfactory management quality or deficiency in risk management procedures or controls (including material breaches of standards of sound business and financial practices/prudential violations); (iv) rapid asset and/or liability growth relative to the other institutions in the industry and (v) noncompliance with regulatory requirements. Supervisory intervention measures outlined in the Ladder of Intervention Guideline may include the requirement for an SFI to increase provisioning for NPLs, increase in capital or liquidity, the removal of directors and management, requiring expanded external audits, the imposition of fines and restrictions on payment of dividends, lending or investment activities, accepting new deposits and other restrictions deemed appropriate. |
| EC5 | The supervisor applies sanctions not only to the bank but, when and if necessary, also to management and/or the Board, or individuals therein. |
| Description and findings re EC5 | CBoB has imposed fines under the CBBA for non-compliance with liquidity requirements; additionally, amendments to the BTCRA and regulations have been made to enhance the CBoB’s ability to impose administrative monetary penalties for supervisory breaches by granting the authority to apply sanctions to individuals. S. 18E, 18F and 18G of the BTCRA empower the CBoB to issue prohibition orders against individuals who are not or have ceased to be fit and proper persons. S. 18 of the BTCRA empowers CBoB to remove a director or officer of a licensee and apply the administrative penalties regime to sanction management and the board when deemed necessary. |
| EC6 | The supervisor has the power to take corrective actions, including ring-fencing of the bank from the actions of parent companies, subsidiaries, parallel-owned banking structures and other related entities in matters that could impair the safety and soundness of the bank or the banking system. |
| Description and findings re EC6 | In general, the CBoB has broad authority to protect the licensee or branch from affiliate transactions. The CBoB may impose conditions or limitations on a bank’s licence and may also issue directives to require the bank to take such action as the CBoB requires in the interests of the bank’s safety and soundness (see BTCRA s.6(4) and 18(1)(h)). This would include the ability to ring fence assets of SFIs operating in The Bahamas. |
| EC7 | The supervisor cooperates and collaborates with relevant authorities in deciding when and how to effect the orderly resolution of a problem bank situation (which could include closure, or assisting in restructuring, or merger with a stronger institution). |
| Description and findings re EC7 | According to Section 4(4)(f) of the BTCRA, as a part of the licensing criteria, the home supervisory authority must agree to inform the Governor of problems that could affect the licensee. Section 38(3) of the CBBA gives the CBoB the authority to cooperate with overseas regulators for the purposes of cross-border supervision. The Ladder of Intervention Guidelines provides some guidance on the actions required to recover and resolve a problem SFI as part of the staging mechanisms. The Guideline advocates collaboration between home and host regulators when a licensee is having problems. The proposed amendments to the BTCRA will formalize CBoB’s resolution regime in the law. |
| Additional criteria | |
| AC1 | Laws or regulations guard against the supervisor unduly delaying appropriate corrective actions. |
| Description and findings re AC1 | There are no regulatory requirements specifying timeframes for taking corrective action. |
| AC2 | When taking formal corrective action in relation to a bank, the supervisor informs the supervisor of non-bank related financial entities of its actions and, where appropriate, coordinates its actions with them. |
| Description and findings re AC2 | The CBoB has regular meetings with the other regulators. The Ladder of Intervention Guidelines advocates that the CBoB inform/ discuss/collaborate with the MoF, the Deposit Insurance Corporation and other domestic regulators, as is necessary, where substantive actions are undertaken. |
| Assessment re principle 11 | Compliant |
| Comments | CBoB has a broad range of tools and authorities across the spectrum to address problems at SFIs ranging from the requirement to increase capital, liquidity and provisioning levels to the removal of board and senior management, restrictions on dividends, payment of bonus to revoking a banking license. These powers are not explicitly stated in the BTCRA, although the proposed draft amendments, which will not only introduce added powers to assist CBoB with the resolution of bank, but it will specifically state the regulatory tools described above. CBoB’s preferred approach is to identify potential concerns on an ongoing basis and work with SFIs to address them before a firm is in danger of breaching a prudential standard or requirement (e.g. encouraging Board to remove incompetent senior management), rather than taking formal action. The supervision process provides for early intervention in the form of staging requiring enhanced supervisory oversight. |
| Principle 12 | Consolidated supervision. An essential element of banking supervision is that the supervisor supervises the banking group on a consolidated basis, adequately monitoring and, as appropriate, applying prudential standards to all aspects of the business conducted by the banking group worldwide.30 |
| Essential criteria | |
| EC1 | The supervisor understands the overall structure of the banking group and is familiar with all the material activities (including non-banking activities) conducted by entities in the wider group, both domestic and cross-border. The supervisor understands and assesses how group-wide risks are managed and takes action when risks arising from the banking group and other entities in the wider group, in particular contagion and reputation risks, may jeopardize the safety and soundness of the bank and the banking system. |
| Description and findings re EC1 | Section 14 of the BTCRA provides for the cooperation with supervisors in other jurisdictions to the extent necessary for the purposes of cross-border consolidated supervision. Banks are required to get prior written approval from the CBoB to establish a subsidiary branch, agency or representative office outside The Bahamas. Under the BTCRA, a banking license shall not be granted to an entity having its head office outside The Bahamas, unless the entity is subject to adequate consolidated supervision. The CBoB maintains contact with the home country regulator of parent institutions of CBoB banks on at least an annual basis, typically through the ‘annual regulatory letter’. Home regulators are asked to inform the CBoB of any information which has come to their attention which should be highlighted to the CBoB supervisors. Banks are required to prepare financial reports on a consolidated basis. The CBoB also receives the financial statements of banks’ parent companies and significant financial subsidiaries. Further contact with the bank or the overseas regulator is made in the event a material matter/ concerns arise. This contact is permitted by the BTCRA and the CBBA. The CBoB can engage the external auditors of banks to conduct overseas reviews of banks that have extensive outsourcing of activities abroad. The CBoB maintains one Regulatory College to inform the oversight of the one financial conglomerate operating in The Bahamas. CBoB participates in regulatory colleges in the Caribbean and Canada for Bahamian domestic systemically important commercial banks. The CBoB/SCB/ICB have an MoU for information sharing that has been in place since 2011. Through coordination with nonbank financial supervisors the CBoB evaluates impacts from other companies and has conducted joint examinations with nonbank domestic supervisors. The CBoB collects financial information from nonbank affiliates. However, guidance for examiners in the incorporation of impacts from nonbank affiliates and unregulated companies is very limited. The CBoB supervision department is a member of the Caribbean Group of Banking Supervisors and the Group’s working group on consolidated supervision. Since the prior FSAP report, CBoB completed its benchmarking exercise on jurisdictions with consolidated supervision guidance and has drafted Guidelines for Consolidated Supervision, but they have yet to be put out for public comment. The CBoB has the appropriate authority and supervises banks on a consolidated basis, including any overseas activities. Licensing rules include requirements for verifying home country consolidated supervision and obtaining the agreement of the home country supervisor on the establishment of banks, branches and subsidiaries in the Bahamian jurisdiction. Where the CBoB becomes aware that the home country supervisor is making significant changes to its regulatory framework, an assessment of whether the home country supervisor will continue to practice effective consolidated supervision is conducted. Banks must seek prior approval before the establishing any subsidiary (either locally or overseas). Changes in the ownership or group structure of a bank are reviewed for their effects on consolidated supervision. |
| EC2 | The supervisor imposes prudential standards and collects and analyses financial and other information on a consolidated basis for the banking group, covering areas such as capital adequacy, liquidity, large exposures, and exposures to related parties, lending limits and group structure. |
| Description and findings re EC2 | As noted above, the CBoB has authority to conduct consolidated supervision. However, it is typically the host regulator. The CBoB has not issued guidance to specifically define consolidated supervision, how The Bahamas will apply it and how its enforcement powers will apply to entities that would be part of the consolidated supervision umbrella. The CBoB cooperates with its overseas bank regulatory partners to assist in ensuring that The Bahamas is not used to escape proper oversight and that institutions established and based in The Bahamas are in compliance with internationally accepted standards and norms. To promote comprehensive oversight of commercial banks with regional cross-border operations, the CBoB regularly participates in supervisory colleges for foreign-owned domestically systemically important banks (DSIBs), which are led and hosted by the home supervisor of these institutions. |
| EC3 | The supervisor reviews whether the oversight of a bank’s foreign operations by management (of the parent bank or head office and, where relevant, the holding company) is adequate having regard to their risk profile and systemic importance and there is no hindrance in host countries for the parent bank to have access to all the material information from their foreign branches and subsidiaries. The supervisor also determines that banks’ policies and processes require the local management of any cross-border operations to have the necessary expertise to manage those operations in a safe and sound manner, and in compliance with supervisory and regulatory requirements. The home supervisor takes into account the effectiveness of supervision conducted in the host countries in which its banks have material operations. |
| Description and findings re EC3 | Foreign operations of Bahamian banks are small and closely supervised. CBoB, along with the other domestic financial regulators, released an Information Sharing Handbook, which outlines the procedures for regulatory requests from overseas regulators. Cross-border activities by locally incorporated banks are limited and closely monitored. It is part of the approval process and ongoing as relations with home supervisors are maintained. Assessment of management oversight of foreign operations is reviewed through ongoing supervision and surveillance activities and may be addressed during onsite examinations, where viewed as necessary. |
| EC4 | The home supervisor visits the foreign offices periodically, the location and frequency being determined by the risk profile and systemic importance of the foreign operation. The supervisor meets the host supervisors during these visits. The supervisor has a policy for assessing whether it needs to conduct on-site examinations of a bank’s foreign operations, or require additional reporting, and has the power and resources to take those steps as and when appropriate. |
| Description and findings re EC4 | The CBoB does not make visits to foreign jurisdictions for the purposes of direct supervision of foreign offices given the immaterial size of locally incorporated banks’ operations outside the Bahamas. |
| EC5 | The supervisor reviews the main activities of parent companies, and of companies affiliated with the parent companies, that have a material impact on the safety and soundness of the bank and the banking group, and takes appropriate supervisory action. |
| Description and findings re EC5 | Where applicable, CBoB supervisors request information on the controlling company to assess financial support. They also receive information on parent entities through discussions with home country supervisors, participation in regulatory colleges and through publicly available sources in order to keep abreast of parent operations and condition. Under the BTCRA, the CBoB may not grant a license to a foreign-based bank unless the home supervisory authority has agreed to inform the CBoB as soon as reasonably possible of any circumstances that arise which may seriously jeopardize the interests of creditors of a supervised financial institution. |
| EC6 | The supervisor limits the range of activities the consolidated group may conduct and the locations in which activities can be conducted (including the closing of foreign offices) if it determines that:
|
| Description and findings re EC6 | The BTCRA gives the CBoB the authority to impose, amend or vary any conditions upon the license of a SFI or require such action to be taken by the SFI that CBoB considers necessary. As outlined in the “Guidelines for the Establishment or Acquisition of Overseas Branches, Subsidiaries and Representative Offices”, CBoB may revoke approval of specific activities when it determines the operation may have an adverse impact on the SFI. The Ladder of Supervisory Intervention Guidelines allows the CBoB to restrict an increase in the number of branches of SFIs, close branches, downsize operations and restrict new business. |
| EC7 | In addition to supervising on a consolidated basis, the responsible supervisor supervises individual banks in the group. The responsible supervisor supervises each bank on a stand-alone basis and understands its relationship with other members of the group.31 |
| Description and findings re EC7 | CBoB supervisors at the bank level and the holding company level where a holding company assessment is warranted – i.e., there is activity at the holding company level. Financial strength is assessed at both banks and holding companies. As noted above in BCP 8, CBoB uses a combination of quantitative and qualitative methods in supervising SFIs. These methods include: the review of consolidated annual reports of the parent company as well as the production of consolidated prudential reports; risk-based supervisory reviews of SFIs; off-site surveillance and monitoring, on-site and joint examinations of licensees; exchange of information through home/host relationships; and Memoranda of Understanding (MOUs) with other domestic and foreign regulatory authorities including CARICOM member states. |
| Additional criteria | |
| AC1 | For countries which allow corporate ownership of banks, the supervisor has the power to establish and enforce fit and proper standards for owners and senior management of parent companies. |
| Description and findings re AC1 | The CBoB can request information on the controlling company to determine fit and proper qualifications. Current regulations do not provide the CBoB with the authority to take specific actions with respect to a non-financial parent of a SFI. There is only one such firm operating in the Bahamas at this time. |
| Assessment of Principle 12 | Largely Compliant |
| Comments | CBoB is currently working on drafting guidelines for consolidated supervision. On balance the supervisory approach is adequate for the consolidated supervision issues they face. However, they would benefit from the issuance of formal expectations articulated in guidelines. In addition, the creation of authorities that would allow CBoB to directly assess the strength of support provided by the parent entity and hold accountable the non-bank parent of a SFI if its actions and/or practices negatively affect bank soundness and prudential management. |
| Principle 13 | Home-host relationships. Home and host supervisors of cross-border banking groups share information and cooperate for effective supervision of the group and group entities, and effective handling of crisis situations. Supervisors require the local operations of foreign banks to be conducted to the same standards as those required of domestic banks. |
| Essential criteria | |
| EC1 | The home supervisor establishes bank-specific supervisory colleges for banking groups with material cross-border operations to enhance its effective oversight, taking into account the risk profile and systemic importance of the banking group and the corresponding needs of its supervisors. In its broadest sense, the host supervisor who has a relevant subsidiary or a significant branch in its jurisdiction and who, therefore, has a shared interest in the effective supervisory oversight of the banking group, is included in the college. The structure of the college reflects the nature of the banking group and the needs of its supervisors. |
| Description and findings re EC1 | The CBOB is a member of the Caribbean Group of Banking Supervisors (CGBS). The CGBS has its goal enhancing, and coordinating on the harmonization of, bank supervisory practices in the English-speaking Caribbean, with a view to bring them more in line with internationally accepted practices. CBoB supervisors participate in supervisory colleges hosted by home country supervisors of the parent entities of SFIs operating in its jurisdiction, particularly with respect to foreign-owned Bahamian DSIBs. CBoB will occasionally lead colleges and discussions on cross-border banking operations which are facilitated through the CGBS. The Bank is also a member of the CGBS Steering Committee, Association of Banks of the Americas (ASBA), Offshore Group of Banking Supervisors (OGBS), and the Caribbean Financial Action Task Force (CFATF). |
| EC2 | Home and host supervisors share appropriate information on a timely basis in line with their respective roles and responsibilities, both bilaterally and through colleges. This includes information both on the material risks and risk management practices of the banking group32 and on the supervisors’ assessments of the safety and soundness of the relevant entity under their jurisdiction. Informal or formal arrangements (such as memoranda of understanding) are in place to enable the exchange of confidential information. |
| Description and findings re EC2 | As noted above, the BTCRA requires that in licensing a bank with a head office outside The Bahamas, the CBoB must be satisfied that the bank is subject to adequate consolidated supervision by the home supervisory authority and that the supervisory authority has no objection to the establishment of the branch or subsidiary in The Bahamas. The CBoB can allow the head office of a SFI to be located outside of The Bahamas if the home supervisor agrees to inform the CBoB of adverse circumstances which may seriously jeopardize the interest of creditors of the SFI. Under the BTCRA, the CBoB must cooperate with inspectors and supervisors in other jurisdictions to the extent necessary for the purposes of cross-border supervision. Section 14 of the BTCRA provides that a home country supervisor of a parent entity (in the performance of consolidated supervision) can conduct examinations of the books and accounts of a Bahamian bank to determine if the group has adequate risk management and meets other relevant prudential standards. The CBoB has the authority to provide information on the beneficial owners, directors, officers and operations of a bank to the home country supervisor responsible. The CBBA gives the CBoB the authority to assist and cooperate with overseas regulatory authorities. The CBBA also permits the CBoB to share with overseas regulatory authorities information necessary to enable such authorities to exercise regulatory functions, including the conduct of civil or administrative investigations and proceedings to enforce laws, regulations and rules administered by that authority. In practice, home/host supervisory letters for consolidated supervision purposes are issued periodically. Additionally, as noted above, senior staff participate in regulatory colleges for domestically systemically important commercial banks in the Caribbean and Canada. There are no material operations of Bahamian banks in other jurisdictions. Nevertheless, the CBoB has established arrangements to obtain and share information as needed. |
| EC3 | Home and host supervisors coordinate and plan supervisory activities or undertake collaborative work if common areas of interest are identified in order to improve the effectiveness and efficiency of supervision of cross-border banking groups. |
| Description and findings re EC3 | As noted in EC2 above, the CBoB has information sharing arrangements and coordinates as necessary with other regulators. The CBoB sends an annual letter to banks’ home country supervisors highlighting areas of regulatory concern and requesting that the home supervisor inform CBoB of any concerns with the parent institution. The BTCRA and the CBBA permit the sharing of information between The Bahamas and SFIs other foreign supervisors. As noted above, the BTCRA permits the on-site examination of banks in the Bahamas by home supervisory authorities. The CBoB and the other domestic financial regulators have jointly published a handbook outlining the procedures to be followed for addressing foreign regulatory requests for information. The Bahamas has established a number of MoUs to allow for cooperation arrangements. CBoB maintains communications with significant home country supervisors and collects needed information. |
| EC4 | The home supervisor develops an agreed communication strategy with the relevant host supervisors. The scope and nature of the strategy reflects the risk profile and systemic importance of the cross-border operations of the bank or banking group. Home and host supervisors also agree on the communication of views and outcomes of joint activities and college meetings to banks, where appropriate, to ensure consistency of messages on group-wide issues. |
| Description and findings re EC4 | Such arrangements are not warranted given the small size of Bahamian operations in relation to the parent companies. Typically, the home/host letters and regulatory colleges are sufficient. |
| EC5 | Where appropriate, due to the bank’s risk profile and systemic importance, the home supervisor, working with its national resolution authorities, develops a framework for cross-border crisis cooperation and coordination among the relevant home and host authorities. The relevant authorities share information on crisis preparations from an early stage in a way that does not materially compromise the prospect of a successful resolution and subject to the application of rules on confidentiality. |
| Description and findings re EC5 | The CBoB is typically a host jurisdiction with only very modest operations of Bahamian SFIs abroad. Nonetheless, as outlined in the Ladder of Supervisory Intervention Guidelines, discussions are to be held with home regulators, especially where severe risk to financial viability or solvency exists, which if not remedied could lead to resolution. Proposed amendments to the BTCRA are expected to address resolution and recovery issues, if passed into law. The assessors observed no material current efforts in this area. |
| EC6 | Where appropriate, due to the bank’s risk profile and systemic importance, the home supervisor, working with its national resolution authorities and relevant host authorities, develops a group resolution plan. The relevant authorities share any information necessary for the development and maintenance of a credible resolution plan. Supervisors also alert and consult relevant authorities and supervisors (both home and host) promptly when taking any recovery and resolution measures. |
| Description and findings re EC6 | The CBoB is typically a host jurisdiction with only very modest operations of Bahamian SFIs abroad. Nonetheless, as outlined in the Ladder of Supervisory Intervention Guidelines, discussions are to be held with home regulators, especially where severe risk to financial viability or solvency exists, which if not remedied could lead to resolution. Proposed amendments to the BTCRA are expected to address resolution and recovery issues, if passed into law. The assessors observed no material current efforts in this area. |
| EC7 | The host supervisor’s national laws or regulations require that the cross-border operations of foreign banks are subject to prudential, inspection and regulatory reporting requirements similar to those for domestic banks. |
| Description and findings re EC7 | All banks in The Bahamas are subject to the same prudential standards. |
| EC8 | The home supervisor is given on-site access to local offices and subsidiaries of a banking group in order to facilitate their assessment of the group’s safety and soundness and compliance with customer due diligence requirements. The home supervisor informs host supervisors of intended visits to local offices and subsidiaries of banking groups. |
| Description and findings re EC8 | As noted in EC 2 above, The Bahamas allows home supervisors to conduct onsite examinations of Bahamian operations. |
| EC9 | The host supervisor supervises booking offices in a manner consistent with internationally agreed standards. The supervisor does not permit shell banks or the continued operation of shell banks. |
| Description and findings re EC9 | The Bahamas no longer permits shell banks to operate in its jurisdiction. All SFIs must have physical operations located in The Bahamas. |
| EC10 | A supervisor that takes consequential action on the basis of information received from another supervisor consults with that supervisor, to the extent possible, before taking such action. |
| Description and findings re EC10 | The standard MOU CBoB uses with foreign supervisors—in clauses 8 and 9—includes an agreement not to use information received from other supervisors for purposes not agreed upon between the two supervisors. |
| Assessment of Principle 13 | Largely Compliant |
| Comments | Current MoU’s in place are based on high level notification and sharing of information agreements. Although a formal legislative resolution framework will be put in place in the near future, the current lack of resolution plans or planning for the failure of SFI’s of systemic importance will be key for CBoB to address. |
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
B. Prudential Regulations and Requirements
| Principle 14 | Corporate governance. The supervisor determines that banks and banking groups have robust corporate governance policies and processes covering, for example, strategic direction, group and organizational structure, control environment, responsibilities of the banks’ Boards and senior management,33 and compensation. These policies and processes are commensurate with the risk profile and systemic importance of the bank. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor establish the responsibilities of a bank’s Board and senior management with respect to corporate governance to ensure there is effective control over the bank’s entire business. The supervisor provides guidance to banks and banking groups on expectations for sound corporate governance. |
| Description and findings re EC1 | CBoB issued in 2001 the “Guidelines for the Corporate Governance of Banks and Trust Companies Licensed to do Business Within and from Within The Bahamas” (Corporate Governance guidelines). The guidelines were amended and expanded in 2013. These guidelines detail the minimum standards that CBoB expects its supervised institutions to adopt with respect to corporate governance. The guidelines are based on the premise that the Directors are stewards of the organization, responsible for providing overall direction and oversight, and that senior management is responsible for carrying out the day-to-day operations of the organization and implementing an appropriate and effective board-approved governance process and internal control program. In line with CBOB’s principles-based approach, the guidelines are meant to provide direction and outline basic principles from which a corporate governance process that is suitable for the specific institution is expected to be developed and implemented. The corporate governance guidelines apply to all banks and trust companies, as well as branches of foreign banks, with the exception of “nominee trust companies” or “restricted trust companies” which have operations that are limited to only conducting business on behalf of one client or clients who are members of the same family. |
| EC2 | The supervisor regularly assesses a bank’s corporate governance policies and practices, and their implementation, and determines that the bank has robust corporate governance policies and processes commensurate with its risk profile and systemic importance. The supervisor requires banks and banking groups to correct deficiencies in a timely manner. |
| Description and findings re EC2 | CBoB primarily directly assesses licensee’s corporate governance policies and practices during ‘special focus’ on-site examinations—i.e., exams of specific activities or practices, during which assessments of controls and audit for the respective area may be included. For example, recent examinations of AML/CTF risk management included assessments of some elements of corporate governance-related processes. CBoB could also examine corporate governance during a full scope examination, though assessors’ discussions with CBOB supervision staff indicated that full-scope exams are not a regular part of CBOB’s risk-focused supervision framework. During onsite exams, CBoB determines whether a licensee’s corporate governance process and risk management and control program provide assurance that the risk in the business activities and operations are appropriately and effectively identified, monitored and controlled. The findings from on-site exams are reported through a report of examination. CBoB expects the firms to satisfactorily address issues/deficiencies that have been identified in a timely manner. Verification of all issues addressed is validated through ongoing supervisory processes, including discussions with firms’ management and review of internal audit assessments of remediation and/or during the next scheduled onsite examination. The boards of directors of all licensed banks and trusts are required to submit an annual certification to CBoB as to the firms’ compliance with established corporate governance guidelines. A standard certification template created by CBOB is used. |
| EC3 | The supervisor determines that governance structures and processes for nominating and appointing Board members are appropriate for the bank and across the banking group. Board membership includes experienced non-executive members, where appropriate. Commensurate with the risk profile and systemic importance, Board structures include audit, risk oversight and remuneration committees with experienced non-executive members. |
| Description and findings re EC3 | The Guidelines for the Corporate Governance specifies that the board should generally include both executive and non- executive members—except in cases where specific exemptions have been granted—as appropriate to the organization’s needs. Board members are expected to be able to act independent of undue influence from internal and external sources. CBoB expects the role of the Chairman and Chief Executive Officer to be separate as it contributes to achieving an appropriate balance of power by increasing accountability and enhancing the board’s capacity for decision making independent of senior management. Where a firm does not have this separation, appropriate controls are expected to be in place to ensure that management is accountable to the board. Particularly for DSIBs, CBoB staff noted that they expect, at a minimum, that the firms the following board committees: Executive Committee, Risk Management Committee, Credit Committee, Trust & Fiduciary Committee, Asset & Liability Committee, Audit Committee, Compliance Committee, Compensation Committee and Nomination Committee. Most of the largest SFIs have these committees in place. Boards of foreign-owned offshore banks and trusts are not expected to have the same level of non-executive directors or subcommittees as domestic firms. |
| EC4 | Board members are suitably qualified, effective and exercise their “duty of care” and “duty of loyalty.”34 |
| Description and findings re EC 4 | CBoB approves all proposed board members and management of regulated functions and assesses the fitness and propriety of Board members against the criteria outlined in section 3E of the BTCRA and the “Guidelines for Assessing the Fitness and Propriety of Applicants for Regulated Functions” (Fit and Proper Guidelines). Individuals seeking to serve as a Board member are granted approval to act as same once CBOB has run a due diligence process and is satisfied that the candidate is fit and proper to fulfill the role. |
| EC5 | The supervisor determines that the bank’s Board approves and oversees implementation of the bank’s strategic direction, risk appetite35 and strategy, and related policies, establishes and communicates corporate culture and values (e.g. through a code of conduct), and establishes conflicts of interest policies and a strong control environment. |
| Description and findings re EC5 | Examiners review banks’ policies and procedural manuals and conduct interviews with relevant senior management regarding the approval process for these processes and how they are communicated to the staff. Additionally, the examiners are expected to review board minutes to confirm that all policies and procedures have been presented to for review and approved by the Board. Examiners confirm via board minutes that the strategic plan has been approved by the board. Supervised entities are expected to have risk appetite statements, which are expected to be reviewed by the supervisors. While there is not a formal requirement that firms specifically have a code of conduct and conflict of interest policies, CBOB supervision staff told the assessors they are generally expected to and that most supervised banks do have them. Assessors noted there were some notifications on related party transactions and conflicts of interest. |
| EC6 | The supervisor determines that the bank’s Board, except where required otherwise by laws or regulations, has established fit and proper standards in selecting senior management, maintains plans for succession, and actively and critically oversees senior management’s execution of Board strategies, including monitoring senior management’s performance against standards established for them. |
| Description and findings re EC6 | Verification of same is done during on-site examinations. The Examiner reviews the licensee’s Board minutes to confirm evidence of Board discussion of the appointment of senior management and a review of their past experience is completed to ensure that they have the appropriate skill set for the position. The Board packages are also expected to contain reports from senior management on the performance of the areas under their supervision. Examiners interview management regarding the establishment of a succession plan for key staff members. Management succession plans are required and are reviewed by CBoB supervisors. |
| EC7 | The supervisor determines that the bank’s Board actively oversees the design and operation of the bank’s and banking group’s compensation system, and that it has appropriate incentives, which are aligned with prudent risk taking. The compensation system, and related performance standards, are consistent with long-term objectives and financial soundness of the bank and is rectified if there are deficiencies. |
| Description and findings re EC7 | These issues are expected to be covered during on-site examinations. Examiners interview members of the Compensation Committee (if the bank has such a committee) and review the compensation policies and programs for senior management and staff. A review of Board minutes is also completed to confirm whether the staff compensation is discussed by the Board and that the Board is satisfied that compensation is in line with industry standards. Staff explained that CBOB does not expect banks’ compensation programs to have incentive-based compensation schemes related directly to risk taking and does not view the FSB incentive compensation guidelines as appropriate for the Bahamas. |
| EC8 | The supervisor determines that the bank’s Board and senior management know and understand the bank’s and banking group’s operational structure and its risks, including those arising from the use of structures that impede transparency (e.g. special-purpose or related structures). The supervisor determines that risks are effectively managed and mitigated, where appropriate. |
| Description and findings re EC8 | The Examiners determine that the Board and senior management has completed an Enterprise Risk Management Exercise of the entire operation to identify the relevant risk to their business, how the various risks are measured/graded (high, medium, low) and what controls are in place for managing the various risk identified. Controls are directly related back to risks as part of the risk assessment framework, which is carried out comprehensively every three or five years depending on the perceived impact of the firm, with DSIBs and other with scores above ‘medium’ requiring full assessments every three years. Between these assessments CBOB has a required ‘evergreen’ process for keeping the assessments up to date. (See BCP 8 and 9 on supervision approach and tools.) |
| EC9 | The supervisor has the power to require changes in the composition of the bank’s Board if it believes that any individuals are not fulfilling their duties related to the satisfaction of these criteria. |
| Description and findings re EC9 | Under Section 18 of the BTCRA, which covers the enforcement powers of CBoB, it may require the replacement of any director or officer of a bank if it believes that to be in the public interest or in the interests of depositors or other creditors of a bank. CBoB has the authority to approve or deny an individual to serve a regulated function in accordance with Regulation 3 of the Banks and Trust Companies (New Appointments) Regulations, 2005. Further, CBoB may assess the continuing fitness and propriety of persons already performing regulated functions. CBOB has required the removal of board members and senior managers. |
| Additional criteria | |
| AC1 | Laws, regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any material and bona fide information that may negatively affect the fitness and propriety of a bank’s Board member or a member of the senior management. |
| Description and findings re AC1 | Section 13B(1) of the BTCRA requires licensees to immediately notify the central bank of any material information that may negatively affect the fitness and propriety of a director or senior manager of the licensee. |
| Assessment of Principle 14 | Largely Compliant |
| Comments | While CBOB expectations cover the key areas of corporate governance, given the infrequency of comprehensive onsite exams it is not clear that supervisors have the opportunity to directly assess all key aspects of corporate governance on a regular basis. Moreover, while the Risk Assessment Process does include a section on oversight and governance for each inherent risk area, as well as a composite governance rating, it does not specifically cover such areas as the board’s effectiveness with respect to the broad set of expectations in the Corporate Governance Guidelines, including its responsibility to ensure there is an effective internal audit function and its oversight of senior management. Weaknesses in areas ultimately under the responsibility of the board—e.g., risk management and internal controls framework, internal audit effectiveness, etc.—are not linked directly to an assessment of the board, as there is no explicit board assessment required. While CBOB may well make that linkage and raise it during discussions with board members (when those infrequently occur), the supervisory program would be enhanced by greater direct linkage between weaknesses in risk management and control practices and assessments of the board and senior management. The value of the practices of requiring annual certifications of compliance from boards of directors could be enhanced by (1) undertaking periodic reviews of all aspects of the certification process at the SFIs and (2) a formal policy of rapid escalation of expectations in this area when it is found that a certification was materially incorrect. For example, requiring an SFI to retain the services of an independent third party to provide a ‘reasonable assurance’ level assessment across all key areas covered in the certification. |
| Principle 15 | Risk management process. The supervisor determines that banks36 have a comprehensive risk management process (including effective Board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate37 all material risks on a timely basis and to assess the adequacy of their capital and liquidity in relation to their risk profile and market and macroeconomic conditions. This extends to development and review of contingency arrangements (including robust and credible recovery plans where warranted) that take into account the specific circumstances of the bank. The risk management process is commensurate with the risk profile and systemic importance of the bank.38 |
| Essential criteria | |
| EC1 | The supervisor determines that banks have appropriate risk management strategies that have been approved by the banks’ Boards and that the Boards set a suitable risk appetite to define the level of risk the banks are willing to assume or tolerate. The supervisor also determines that the Board ensures that:
|
| Description and findings re EC1 | The CBoB-required Board of Directors’ Annual Certification includes, among other things, an annual attestation as to whether the firm has appropriate risk management procedures and strategies in place. Boards are required to report any material deficiencies and problems that are identified within the bank, along with specific action plans and timetables for their remediation. Detailed information on banks’ risk management processes is gathered by CBoB supervisors and, as part of the recent enhancements to the risk-based supervision framework, structured interviews are held with bank risk managers via “Discovery Review” meetings or Prudential meetings during which supervisors discuss with the banks:
The assessment of risk management practices is complemented by onsite compliance tests, procedures for which are described in examination modules. When evaluating the quality of risk management/corporate governance, emphasis is expected to be placed on: (1) active board and senior management oversight, (2) adequate policies, procedures, and limits, (3) adequate risk-measurement and-monitoring supported by the appropriate management information systems, (4) a comprehensive process of control, and (5) an appropriate human resource management system, including training programs. Related review processes are as follows:
|
| EC2 | The supervisor requires banks to have comprehensive risk management policies and processes to identify, measure, evaluate, monitor, report and control or mitigate all material risks. The supervisor determines that these processes are adequate:
|
| Description and findings re EC2 | Under the BCTRA CBoB is required to “ensure that banks: (i) have in place and use systems that accurately measure, monitor and adequately control market and other risks; (ii) have in place internal controls adequate to the nature and scale of their operations, and adequate policies, practices and procedures, including strict know-your- customer (KYC) rules that promote high ethical and professional standards, and so prevent the use of the bank for criminal purposes; and (iii) management information systems that enable management to identify portfolio concentration in line with established limits.” CBoB reviews policies and procedures and analyzes quarterly data submitted by the firms to assess the adequacy of the policies and procedures. The “Guidance Note on Accounting and Other Records and Internal Control Systems and Reporting Accountants’ Reports Thereon” provides guidance on accounting and internal control systems and supervisory expectations for these. CBoB’s revised Corporate Governance Guidelines outlines the responsibility of banks’ management and board of directors in managing the various types of risks. Banks boards must certify to the CBoB that the appropriate risk management systems are in place and sustainable. These certifications are required to submitted to CBoB within 120 days of the end of the calendar year. The Corporate Governance Guidelines against which the required annual certifications are made state that the Board should determine that:
The Corporate Governance Guidelines also state that “Management, under the general direction of and oversight by the Board, should develop and implement a comprehensive risk management system, commensurate with the scope of the licensee’s activities, incorporating continuous identification, measurement, monitoring and controlling of risk. The Board itself should specifically address significant issues in the system’s development and implementation, as well as implement an effective process to independently determine that the risk management system is appropriate and ensure that its effectiveness is regularly assessed. The Guidelines also require that, “where the size and nature of a bank’s businesses warrant, as determined by the Board, separate and independent risk management and internal audit functions” should be established.” In addition to the above, CBoB developed an Internal Capital Adequacy Assessment Process (ICAAP) framework and issued ICAAP guidelines in 2016. The guidelines specifically address banks’ responsibility to develop and implement an ICAAP for the purpose of setting internal capital targets and developing strategies for achieving internal targets that are consistent with its business plans, risk profile and the current operating environment, including macroeconomic conditions. Supervised firms must complete the ICAAP report on a frequency determined by CBoB on a case by case basis. For DSIBs this is at least every two years; annually if viewed as a problem SFI. For all others it is at least every three years or when there are significant change(s) in risk exposures. CBoB does not approve a firm’s ICAAP, but generally does some high-level work to review and assess these reports and advise firms of the results of such assessments. Assessors note that the ICAAP Guidelines state that firms must do an ICAAP every year. The change in requirements should be captured in an update of the Guidelines. Assessors discussions with CBoB supervision staff indicated that these assessments do not typically include a deep dive into all aspects of the ICAAP process but tend to focus primarily on discussions with the banks about the assumptions underlying any scenario analyses that is used and of the output of the process. CBoB’s oversight of risk management is carried out largely through the discussions and analyses inherent in carrying out the risk assessment process, which informs CBoB’s risk-focused supervision approach. Risk assessments are required to be carried out every 3 or 5 years, depending on the impact assessment of the firms; DSIBs are expected to have a risk assessment every three years. In between those risk assessments the supervisory teams are expected to remain up to date on the key areas of risk, as well as on business strategies/activities and progress banks are making addressing identified weaknesses in practices relative to their own internal policies and procedures and supervisory expectations. This updated process is referred to as the ‘evergreening’ process. The evergreening process is being rolled out and has yet to become a full part of the program. Assessors found the risk assessments we reviewed and resulting letters to the firms to be reasonably comprehensive covering business and strategic risks as well as risk management and internal controls and oversight and governance assessments. Assessors strongly encourage CBoB to ensure Risk Assessments for the DSIBs and other large SFIs are kept up to date. |
| EC3 | The supervisor determines that risk management strategies, policies, processes and limits are:
The supervisor determines that exceptions to established policies, processes and limits receive the prompt attention of, and authorization by, the appropriate level of management and the bank’s Board where necessary. |
| Description and findings re EC3 | Assessments of strategy, policies & procedures, and limits relative to boards of directors’ stated risk appetites is carried through onsite reviews and offsite analyses of reporting from the banks. In addition, supervisory teams will meet with the banks on a periodic basis to discuss risk management and control practices as well as business strategy, new business activities and their risk appetites. CBoB supervisors review board minutes and management reports to determine how exceptions to policies are handled. Supervisors also assess the quality and timeliness of related reporting to senior management and the board. |
| EC4 | The supervisor determines that the bank’s Board and senior management obtain sufficient information on, and understand the nature and level of risk being taken by the bank and how this risk relates to adequate levels of capital and liquidity. The supervisor also determines that the Board and senior management regularly review and understand the implications and limitations (including the risk measurement uncertainties) of the risk management information that they receive. |
| Description and findings re EC4 | As noted above, as expressed in the Corporate Governance Guidelines, CBoB expects bank Boards to assess whether the control environment is appropriate and effective, taking into account the bank’s unique character, approach to governance, management and communications style, organizational structure, resource availability, procedures and controls, and the conduct of its staff. Boards must certify the effectiveness of the above on an annual basis. The certification also is required to provide an update on the progress made on remediating any identified weakness (by the bank or the supervisor) relative to the planned timeline. In addition, a bank’s board and management, as well as external and internal auditors, are expected to proactively provide information to CBoB regarding any issue or weakness which may impact the strength of risk management and controls.
The CBoB’s risk-based supervisory framework provides a score for each of a bank’s inherent risks and evaluates the risk management and controls in place against those risks. The approach informs CBoB assessments of the risk-profiles of the banks and requires an assessment of the efficiency of a bank’s ability to identify, measure, monitor and control risks. Each bank is risk- rated within the CBoB’s internal risk rating system and supervisory resources are allocated through this process. The framework includes an evaluation of a bank’s financial condition, in particular, to ascertain to what extent the bank maintains capital and liquidity that is sufficient given the risk profile. The risk-based supervision framework primarily includes the following:
Banks’ ICAAP reports also are expected to explicitly provide details on the banks’ own understanding of their risks and how they relate to capital needs. |
| EC5 | The supervisor determines that banks have an appropriate internal process for assessing their overall capital and liquidity adequacy in relation to their risk appetite and risk profile. The supervisor reviews and evaluates banks’ internal capital and liquidity adequacy assessments and strategies. |
| Description and findings re EC5 | As described in EC2 and EC 4, CBoB’s review and evaluation of licensees’ ICAAP and the risk- based supervisory review framework enables CBoB to determine capital adequacy as well as the frequency and scope of on-site visits and the level of off-site scrutiny. Assessors observed that the ICAAP is a relatively new process (guidelines issues in 2016) and has not been a particularly deep area of focus for CBoB supervisors to date. Given the broad range of coverage in an ICAAP process, and the need for solid risk identification, measurement, and management, as well as internal controls and board and senior management oversight, to do an ICAAP effectively, CBoB supervision would be enhanced by periodic deep dive reviews into key aspects of the banks’ ICAAPs. Liquidity assessments are done periodically and primarily through required reporting and surveillance. Please see the detailed assessment of BCP 17 – Liquidity Risk Management – for the assessors views on this area. |
| EC6 | Where banks use models to measure components of risk, the supervisor determines that:
The supervisor assesses whether the model outputs appear reasonable as a reflection of the risks assumed. |
| Description and findings re EC6 | For the most part, focus on banks’ stress testing and modeling by CBoB is in its early stages and detailed guidelines have not been issued. Where models are used, for example with respect to credit rating systems, examiners told the assessors a key focus is on checking that they are validated and that validations are updated as needed. Most banks are subsidiaries or branches of international banking groups and have advanced models that are employed subject to home country supervision standards. For their local operations supervisors would look at results of the models and stress testing. |
| EC7 | The supervisor determines that banks have information systems that are adequate (both under normal circumstances and in periods of stress) for measuring, assessing and reporting on the size, composition and quality of exposures on a bank-wide basis across all risk types, products and counterparties. The supervisor also determines that these reports reflect the bank’s risk profile and capital and liquidity needs, and are provided on a timely basis to the bank’s Board and senior management in a form suitable for their use. |
| Description and findings re EC7 | Supervisors review and assess risk reporting and MIS used largely through offsite monitoring and discussions with the SFIs. In addition, they review internal audit reports and track progress on remediation efforts related to identified weaknesses. Surveillance and monitoring efforts cover the capture of all bank-wide risks and review the positions relative to policies, limits, risk appetite and risk profile. Exposures and positions are reviewed relative to a SFI’s capital and liquidity positions and if exposures threaten either CBoB has the authority to require SFIs to increase capital and liquidity or reduce positions and activities. |
| EC8 | The supervisor determines that banks have adequate policies and processes to ensure that the banks’ Boards and senior management understand the risks inherent in new products,39 material modifications to existing products, and major management initiatives (such as changes in systems, processes, business model and major acquisitions). The supervisor determines that the Boards and senior management are able to monitor and manage these risks on an ongoing basis. The supervisor also determines that the bank’s policies and processes require the undertaking of any major activities of this nature to be approved by their Board or a specific committee of the Board. |
| Description and findings re EC8 | There are no specific new product approval process requirements in CBoB guidelines. The CBoB collects information from the banks concerning new products and the banks’ risk review process. Areas of potential concern are assessed and analyzed and new products are reviewed to see how they fit with the bank’s strategy and risk appetite. Offsite supervisors meet with or write to firms to discuss new products and to gather information. CBoB operational risk guidelines include new products, and the Board and Senior management understanding the nature and complexity of the risks inherent in its products, services and activities, including new business. The ICAAP report gives information on risks related to all of the licensee’s activities, including new business, and the capital that is allocated to cover those risks. |
| EC9 | The supervisor determines that banks have risk management functions covering all material risks with sufficient resources, independence, authority and access to the banks’ Boards to perform their duties effectively. The supervisor determines that their duties are clearly segregated from risk-taking functions in the bank and that they report on risk exposures directly to the Board and senior management. The supervisor also determines that the risk management function is subject to regular review by the internal audit function. |
| Description and findings re EC9 | The guidelines issued by CBoB, the information collected from banks and the focus of supervisory teams and onsite examinations provide a view of the bank’s risk management, risk mitigation techniques, as well as the role and independence of risk management, internal audit, the money laundering reporting officer (MLRO) and reporting lines. In discussions with examiners the assessors observed that segregation of duties was an explicit area of focus in exams. It is also looked at by internal and external auditors and internal controls are included in the annual attestation/certification CBoB requires boards of directors to make annually as noted in the Corporate Governance Guidelines. Where banks are required to have internal audit (see BCP 26 details below) it is expected IA will review risk management as part of its regular audit program. CBoB supervisors ‘rely’ on these audits and review them before an examination and in between undertaking an exam of risk management. They also meet periodically with internal auditors. |
| EC10 | The supervisor requires larger and more complex banks to have a dedicated risk management unit overseen by a Chief Risk Officer (CRO) or equivalent function. If the CRO of a bank is removed from his/her position for any reason, this should be done with the prior approval of the Board and generally should be disclosed publicly. The bank should also discuss the reasons for such removal with its supervisor. |
| Description and findings re EC10 | The Corporate Governance Guidelines requires that the Board ensure effective management of risk, inclusive of overseeing and participating in the appointment of senior executives with the skills necessary to manage and supervise the licensee’s business and staff and the establishment of key committees, as appropriate given the size and complexity of the bank. The Board must also ensure, where the size and nature of a banks business warrants, there are separate and independent risk management and internal audit functions, which is verified during onsite examinations and ongoing supervisory work by the supervision teams. CBoB supervisors also determine that the risk management function is subject to regular review by the internal audit function. All ‘regulated function’ roles must be approved by CBoB, including the role of CRO. The removal of a CRO would initiate a CBoB fit and proper review of prosed replacement. In discussions with CBoB management, the assessors were told that if CBoB had to initiate a fit and proper review for a replacement CRO and had not been told the current CRO was fired and why, it could lead to escalation to the board of directors who would be viewed as being uncooperative. Assessors did not observe a situation that would require such escalation. |
| EC11 | The supervisor issues standards related to, in particular, credit risk, market risk, liquidity risk, interest rate risk in the banking book and operational risk. |
| Description and findings re EC11 | Regulations and/or guidelines have been issued for credit risk, liquidity risk, outsourcing, business continuity risks, operational risk, market risk and interest rate risk in the banking book. The revised Interest Rate Risk Guidelines addresses the trading and banking book. |
| EC12 | The supervisor requires banks to have appropriate contingency arrangements, as an integral part of their risk management process, to address risks that may materialize and actions to be taken in stress conditions (including those that will pose a serious risk to their viability). If warranted by its risk profile and systemic importance, the contingency arrangements include robust and credible recovery plans that take into account the specific circumstances of the bank. The supervisor, working with resolution authorities as appropriate, assesses the adequacy of banks’ contingency arrangements in the light of their risk profile and systemic importance (including reviewing any recovery plans) and their likely feasibility during periods of stress. The supervisor seeks improvements if deficiencies are identified. |
| Description and findings re EC12 | Recovery planning is not currently required. There is a proposal to require recovery planning in proposed capital guidelines that have been put out for public comment. |
| EC13 | The supervisor requires banks to have forward-looking stress testing programs, commensurate with their risk profile and systemic importance, as an integral part of their risk management process. The supervisor regularly assesses a bank’s stress testing program and determines that it captures material sources of risk and adopts plausible adverse scenarios. The supervisor also determines that the bank integrates the results into its decision-making, risk management processes (including contingency arrangements) and the assessment of its capital and liquidity levels. Where appropriate, the scope of the supervisor’s assessment includes the extent to which the stress testing program:
The supervisor requires corrective action if material deficiencies are identified in a bank’s stress testing program or if the results of stress tests are not adequately taken into consideration in the bank’s decision-making process |
| Description and findings re EC13 | As noted in EC 6 above, supervisory guidelines for stress testing have not been issued. Banks are expected to use stress testing in their risk management and ICAAP, but CBoB is not focused on in depth assessments of stress testing. In discussions assessors had with CBoB supervisors it was stated they primarily look at the assumptions used and results. |
| EC14 | The supervisor assesses whether banks appropriately account for risks (including liquidity impacts) in their internal pricing, performance measurement and new product approval process for all significant business activities. |
| Description and findings re EC14 | There are no specific supervisory expectations with respect to internal (transfer) pricing arrangements. As noted above, there are not specific expectations or requirements regarding a formal new product approval process. The Corporate Governance Guidelines broadly requires that the Board and management of each licensee should analyze its own existing and prospective business, products and services to identify and measure the types and significance of the current and potential risks that must be managed and controlled, both individually and taken together. It specifies that an Asset and Liability Committee can be charged with overseeing the organization’s operations relating to interest-rate risk, market risk and liquidity risk and, in particular, ensures that the organization has adequate funds to meet its obligations. |
| Additional criteria | |
| AC1 | The supervisor requires banks to have appropriate policies and processes for assessing other material risks not directly addressed in the subsequent Principles, such as reputational and strategic risks. |
| Description and findings re AC1 | Detailed guidelines have not been issued addressing reputational and strategic risks. ICAAP requires that these risks be considered and aims to quantify them. |
| Assessment of Principle 15 | Largely Compliant |
| Comments | CBoB has a quite comprehensive Risk Assessment Process that includes coverage of risk management, internal controls and governance/oversight. As discussed throughout in this note, they place substantial emphasis on reviews of required regulatory reports on financial condition and risk exposures, internal risk reports of the firms, internal audit reports, required annual certifications of compliance from SFIs’ boards and external audit coverage of financial statements and related controls. This is complemented by regular meetings with the firms and onsite examinations where deemed warranted by the risk assessment process. Risk management supervision would benefit from a better balance between onsite and offsite supervisory efforts (which would likely require an increase in staffing levels) and the use of more thematic reviews assessing key risk areas and practices across firms. For example, assessors noted that in some areas (e.g., credit risk management) it has been quite some time since a comprehensive review was carried out across all DSIBs and other large firms. More frequent and comprehensive exams of key risks—credit, AML, ICAAP/capital planning—including reviews that cover all aspects of risk management, internal controls and corporate governance in these areas would allow for greater confidence in the supervisors’ assessments of the SFIs. In addition, such reviews could make valuable contributions to understanding the effectiveness of governance across the firms and holding boards and management accountable for the carrying out the duties articulated in CBoB’s Corporate Governance Guidelines. Thematic reviews would be beneficial. Having a strong understanding of the relative strengths and weaknesses of practices across firms provides helpful context and can inform constructive dialogue with the industry and individual firms. While SFIs in the jurisdiction are generally quite straightforward in their business models and associated risks, greater emphasis on firms’ stress testing practices (especially for DSIBs) would help promote financial resilience and would provide for an opportunity to assess the variety of important practices that inform and support stress testing. These include risk identification, measurement and management, internal controls and data integrity, as well as corporate governance and internal audit effectiveness. Recovery planning is not currently required. There is a proposal under consideration to include recovery planning requirements going forward. CBoB should move ahead with efforts to require SFIs to increase their preparedness to take effective recovery actions. |
| Principle 16 | Capital adequacy.40 The supervisor sets prudent and appropriate capital adequacy requirements for banks that reflect the risks undertaken by, and presented by, a bank in the context of the markets and macroeconomic conditions in which it operates. The supervisor defines the components of capital, bearing in mind their ability to absorb losses. At least for internationally active banks, capital requirements are not less than the applicable Basel standards. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to calculate and consistently observe prescribed capital requirements, including thresholds by reference to which a bank might be subject to supervisory action. Laws, regulations or the supervisor define the qualifying components of capital, ensuring that emphasis is given to those elements of capital permanently available to absorb losses on a going concern basis. |
| Description and findings re EC1 | The BTCRA requires CBoB to set capital adequacy requirements not less than those established in the Basel Capital Accord and its amendments. CBoB has implemented Basel II and the capital definition elements of the Basel III regime, which were rolled out as of Q2 2013 and went live during the first quarter of 2016. The following guidelines have been released to the industry for their implementation and to set expectations:
CBoB has the authority to take actions including requiring capital raises if capital falls below required levels (which are discussed below in EC 2). CBoB requires SFIs to have capital ratios in excess of the minimum Basel requirements. Current capital requirements impose trigger and target ratios on individual SFIs on a case by case basis, with the DSIBs having the highest requirements. DSIB requirements are super equivalent to Basel requirements. For instance, a target ratio of 17 percent and a trigger ratio of 14 percent is set for the commercial (domestic) banks. The current aggregate ratio for all banks is in excess of 20 percent, with the vast majority of regulatory capital at the largest firms comprised of CET 1. CBoB uses the standardized approach to credit with RWA calculations fully in line with Basel 2 guidelines except for residential mortgages—the majority of exposures in the domestic banking system—which are risk weighted at 50 percent. |
| EC2 | At least for internationally active banks,41 the definitions of capital, risk coverage, method of calculation and thresholds for the prescribed requirements are not lower than those established in the applicable Basel standards. |
| Description and findings re EC2 | All SFIs must meet capital adequacy requirements not less than those established in the Basel Capital Accord and its amendments. As per the capital adequacy guidelines, the minimum capital adequacy requirements placed on licensees are consistent with Basel 2 and 3. A proposal for the full implementation of Basel 3 is under consideration. CBoB focuses on the following elements when assessing a SFI’s capital adequacy:
CBoB requires SFIs to have capital ratios in excess of the minimum Basel requirements. Current capital requirements impose trigger and target ratios on individual SFIs on a case by case basis. These ratios are super equivalent to Basel requirements. For instance, a target ratio of 17 percent and a trigger ratio of 14 percent is set for the commercial (domestic) banks and the aggregate ratio for all banks is in excess of 20 percent, as noted above. |
| EC3 | The supervisor has the power to impose a specific capital charge and/or limits on all material risk exposures, if warranted, including in respect of risks that the supervisor considers not to have been adequately transferred or mitigated through transactions (e.g. securitization transactions)42 entered into by the bank. Both on-balance sheet and off-balance sheet risks are included in the calculation of prescribed capital requirements. |
| Description and findings re EC3 | Under the BTCRA CBoB has the power to impose specific capital charges and/or limits on all material risk exposures. SFIs are now (since 2016) required to produce ICAAP reports which address the material risks inherent in their businesses and submit them to CBoB for review and assessment. If a licensee’s risk profile (pillar 2 risks) as per the ICAAP indicates that it needs more capital than Pillar 1 standards require, the SFI would be required to maintain this additional capital. The assessors did not observe any SFIs that were required to raise capital to meet combines Pillar 1 and 2 capital charges as capital levels already above Pillar 1 charges have been sufficient to absorb any Pillar 2 charges. Assessors observed reviews of ICAAP reports at a high level – e.g., checking to make sure the reports contained information for all categories as outlined in the 2016 Guidelines. Assessors did not observe specific examination work or more in-depth assessments of ICAAP, which are fairly new in the Bahamas. |
| EC4 | The prescribed capital requirements reflect the risk profile and systemic importance of banks43 in the context of the markets and macroeconomic conditions in which they operate and constrain the build-up of leverage in banks and the banking sector. Laws and regulations in a particular jurisdiction may set higher overall capital adequacy standards than the applicable Basel requirements. |
| Description and findings re EC4 | In line with the Basel II and III frameworks, current capital requirements capture the full risk profile of SFIs, including both Pillar I—credit, market, and operational—and Pillar II risks—liquidity, interest rate risk in the banking book, reputation, legal, business/strategic risks, and ‘other’ risks. As noted above in EC2 and EC3, CBoB has the power to set higher regulatory capital requirements than those established by Basel and has done so. |
| EC5 | The use of banks’ internal assessments of risk as inputs to the calculation of regulatory capital is approved by the supervisor. If the supervisor approves such use:
|
| Description and findings re EC5 | Reponses to the corresponding requirements above are:
|
| EC6 | The supervisor has the power to require banks to adopt a forward-looking approach to capital management (including the conduct of appropriate stress testing).44 The supervisor has the power to require banks:
|
| Description and findings re EC6 | The BTCRA gives CBoB the authority to require banks to adopt a forward-looking approach to capital management. Currently, at a minimum, licensees are expected to incorporate stress testing into their ICAAPs and hold capital commensurate with assessed needs. There is no explicit ‘post-stress’ capital requirement including with respect possible changes in market conditions. If CBoB determines that a SFI is not holding sufficient capital relative to its risk profile—a determination which may come through the risk assessment process or specific exposures the bank might have—it has the authority to make the bank hold more capital. Assessments of ICAAPs to date that were observed by the assessors consisted of desktop reviews checking to ensure the SFI had included all of the appropriate information in its ICAAP report rather than an assessment of the adequacy and robustness of that information or of the capital planning process more broadly. SFIs are required to have capital contingency plans. These are typically also a part of ICAAP. In addition, CBoB’s Risk Assessment Process specifically looks at contingency plans and will give a SFI some credit for a plan that assumes it can raise more capital under stress. Assessors note that capital is usually least available when it is most needed and caution CBoB from giving firms any credit for asserting they can get capital under stress unless it is contractually committed and there are no materially adverse conditions clauses. |
| AC1 | For non-internationally active banks, capital requirements, including the definition of capital, the risk coverage, the method of calculation, the scope of application and the capital required, are broadly consistent with the principles of the applicable Basel standards relevant to internationally active banks. |
| Description and findings re AC1 | The CBoB regulatory capital regime is the same for all SFIs. |
| AC2 | The supervisor requires adequate distribution of capital within different entities of a banking group according to the allocation of risks.45 |
| Description and findings re AC2 | CBoB calculates capital ratios on a solo and consolidated basis. CBoB requires adequate capital across entities of a banking group according to the allocation of risks. |
| Assessment of Principle 16 | Compliant |
| Comments | Through the issuance of its Capital Adequacy, ICAAP, and revised Interest Rate Risk guidelines, CBoB has implemented Pillars I, II the Basel II framework. CBoB is working towards implementing phased-in arrangements under the Basel III framework and has released for public consultation Discussion Papers on its revised approach to capital and its position with respect to Capital Buffers, credit risk, operational risk, market risk and the Leverage Ratio. Capital requirements are in line with or stronger than the Basel regime and the largest SFIs have CET 1 capital well above required minimums. Triggers requiring further attention and possible requirements to increase capital are currently in place, and set at 14 percent for the DSIBs. CBoB has the authority to require firms to hold capital in relation to their risk profiles and well above required Basel minimums. While ICAAP is not a well-established process the assessors have taken that into consideration in BCP 16, Risk Management. CBoB needs to enhance its processes for reviewing all material aspects of the ICAAP and capital planning practices of the DSIBs. |
| Principle 17 | Credit risk.46 The supervisor determines that banks have an adequate credit risk management process that takes into account their risk appetite, risk profile and market and macroeconomic conditions. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate credit risk47 (including counterparty credit risk)48 on a timely basis. The full credit lifecycle is covered including credit underwriting, credit evaluation, and the ongoing management of the bank’s loan and investment portfolios. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to have appropriate credit risk management processes that provide a comprehensive bank-wide view of credit risk exposures. The supervisor determines that the processes are consistent with the risk appetite, risk profile, systemic importance and capital strength of the bank, take into account market and macroeconomic conditions and result in prudent standards of credit underwriting, evaluation, administration and monitoring. |
| Description and findings re EC1 | CBoB’s Guideline on Credit Risk Management (dated 16 October 2003) (CRM Guideline), suggests that all licensees have a board approved comprehensive credit risk strategy and policy, risk tolerance and portfolio limits, established controls and systems to measure, monitor and control large exposures and other risk concentrations. Further, the Guideline states that licensees should have written policies and procedures, effective systems for credit administration, measurement and monitoring. The Guideline also states that the credit risk management program in each SFI will depend on the scope and sophistication of the activities of the SFI. |
| EC2 | The supervisor determines that a bank’s Board approves, and regularly reviews, the credit risk management strategy and significant policies and processes for assuming,49 identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating credit risk (including counterparty credit risk and associated potential future exposure) and that these are consistent with the risk appetite set by the Board. The supervisor also determines that senior management implements the credit risk strategy approved by the Board and develops the aforementioned policies and processes. |
| Description and findings re EC2 | S. 17 (First Schedule) of the BTCRA states that the Inspector shall (among other things):
CBoB’s Guidelines pertaining to Corporate Governance stipulate that the board and senior management are responsible for addressing all significant risks identified in the organization. The board is also required to make an annual certification to CBoB that it has an appropriate corporate governance regime in place for prudently managing risk, including credit risk. CBoB’s CRM Guidelines state that banks should have a written statement of their credit risk strategy and a policy to implement the strategy. The credit risk strategy and policy should be disseminated to, and understood by, all relevant staff, should be approved by the board of directors and be consistent with the bank’s degree of risk tolerance, the level of capital available for credit activities and credit management expertise. The board should review the strategy and policy periodically (at least annually) to ensure their adequacy, and relevance given the changing operating circumstances, economic cycles, activities and risks that the SFI may face. The firm’s credit manual should stipulate sound, well-defined criteria for granting credit, including a thorough understanding of the borrower or counterparty, the purpose and structure of the credit and its source of repayment. The off-site supervisory teams regularly review financial information provided to CBoB with respect to credit quality, large exposures and engage senior management in discussions on specific credit related matters when the need arises. If deemed to be warranted through the risk assessment process, CBoB conducts on-site examinations of SFI’s board approved credit policies and procedures during on-site examinations, which include the review of SFI’s reporting against risk appetite, risk profile, portfolio limits, credit underwriting, evaluation, administration and monitoring. |
| EC3 | The supervisor requires, and regularly determines, that such policies and processes establish an appropriate and properly controlled credit risk environment, including:
|
| Description and findings re EC3 | The CRM Guidelines require SFIs to have the following:
CBoB’s off-site supervision surveillance team monitors SFI’s credit risk exposures on a quarterly basis, including having a prudential discussion of the top 20 largest credit exposures for the DSIBs as well as a discussion around the top 20 largest non-performing loans (NPLs). CBoB has communicated its expectations to individual SFIs regarding the importance of working towards lowering NPL levels. SFIs are required to ensure that credit decisions are supported by adequate evaluation of the borrower’s repayment ability, based on reliable information. An issue impacting banks’ ability to measure borrowers’ repayment capacity is the lack of a credit bureau. With the creation of the Credit Risk Agency, once operational in 2020, will oversee the licensing of credit bureau establishments, including ensuring the adequacy and availably of individual credit information At this time, there exists a wide range of practices amongst the DSIBs with respect to both asset classification systems (e.g. definition of arrears less than 90 days, etc.) as well as varying practices around the determination of loan loss provisioning (e.g. at what point does an SFI book 100 percent provisioning, regardless of the value of the collateral against a real estate backed loan that is greater than 3–5 years in arrears). On site credit risk management examinations are conducted when deemed warranted through the risk assessment process. When on-site examinations are conducted, examiners review overall credit risk governance, the credit initiation process, credit administration and disbursement and the delinquency management and credit collection process. Additionally, a credit rating system has been developed that is being used to: (1) assess individual credit quality during the substantive testing process; (2) comp are the examiners’ assessment to the rating system used by the bank to determine the extent of reliance that can be placed on the bank’s assessment; and (3) assess the overall quality of the portfolio. This process normally focuses on the top 20 largest loan exposures as well as the top 20 largest NPLs. The on-site examiners, if conducting a full-scope credit risk management review, undertake to review: (1) active board and senior management oversight; (2) adequate policies, procedures, and limits; (3) adequate risk-measurement; monitoring, and management information systems; (4) a comprehensive process of control; and (5) appropriateness of human resource management and training program. CBoB has two credit risk specialists on the on-site examination team who have credit experience at both commercial and international banks. |
| EC4 | The supervisor determines that banks have policies and processes to monitor the total indebtedness of entities to which they extend credit and any risk factors that may result in default including significant unhedged foreign exchange risk. |
| Description and findings re EC4 | Total indebtedness is reviewed and large exposure limits established. Banks make market inquiries, request information from borrower and aggregate exposure in their databases. |
| EC5 | The supervisor requires that banks make credit decisions free of conflicts of interest and on an arm’s length basis. |
| Description and findings re EC5 | S. VI ss 1. of CBoB CRM Guidelines states that all credit should be granted on an arm’s length basis. In addition, CBoB’s Large Exposure Guidelines stipulate that all exposures to related parties be (a) negotiated on an arm’s length basis and b) specifically be approved by the bank’s Board of Directors. This is also reflected in paragraph 5.2 of the Large Exposures Guidelines and paragraph 5.10, 6.6 and 10.6(g) of the Corporate Governance Guideline. |
| EC6 | The supervisor requires that the credit policy prescribes that major credit risk exposures exceeding a certain amount or percentage of the bank’s capital are to be decided by the bank’s Board or senior management. The same applies to credit risk exposures that are especially risky or otherwise not in line with the mainstream of the bank’s activities. |
| Description and findings re EC6 | CBoB’s CRM Guidelines note that the credit authority should be clearly delegated by the Board and should be appropriate for the products or portfolios assigned to the Credit Committee or individual credit officers and should also be commensurate with their credit experience and expertise. CBoB expects SFIs to ensure that credit authority is required and designated for all types of credit exposures. Delegated credit authority should be subject to regular review to ensure that it remains appropriate to current market conditions and the levels of their credit officers’ performance and expertise. CBoB’s Large Exposure Guidelines stipulate that firms must set prudent limits, monitor these limits and obtain approval for all exceptions to these limits. In general, CBoB on-site examiners indicated that they do not expect Board members or Senior management to be involved in credit decisions within Board approved limits/delegated authorities. |
| EC7 | The supervisor has full access to information in the credit and investment portfolios and to the bank officers involved in assuming, managing, controlling and reporting on credit risk. |
| Description and findings re EC7 | S. 13 (3) of the BTCRA states that CBoB’s Inspector has the authority to have access to such books, records, of any licensee or to call upon the manager or any officer designated by the manager of any licensee for such information or explanation. |
| EC8 | The supervisor requires banks to include their credit risk exposures into their stress testing programs for risk management purposes. |
| Description and findings re EC8 | Although CBoB does not currently have a Stress Testing guideline in place that explicitly addresses licensees’ credit risk exposures, CBoB expects firms to conduct stress testing on their inherent risks (inclusive of credit risk exposures) as part of their risk management practices and as part of their ICAAP analysis. CBoB also expects senior management to discuss the relevance of the results of the credit stress testing with the Board of Directors. |
| Assessment of Principle 17 | Largely Compliant |
| Comment | CBoB’s credit risk guidance is somewhat outdated requiring a renewed focus of the Off-site supervisors and the on-site examination team to conduct in-depth reviews of DSIBs loan portfolios (only 5 in-depth reviews carried out since 2015). In general, CBoB has spent a great amount of time focusing on the strength of credit risk management policies, procedures and practices at one particular DSIB. The credit risk specialists at CBoB have adequate knowledge to conduct deep dive reviews, however, with the additional needed focus on AML issues during 2018 for the on-site examination team, the amount of deep dive credit risk reviews on the remaining DSIBs has not been able to take place. In general, CBoB’s credit risk guidance allows for a wide range of practice, both from an asset classification and loan loss provisioning perspective. Under estimation of potential credit losses together with an over estimation of the level of provisioning could lead to an inaccurate view of the credit risk cycle for the overall banking sector. CBoB therefore may contemplate a thematic credit review of DSIB’s effectiveness of credit risk management practices, to satisfy itself of the accuracy of SFI NPL reporting and provisioning. CBoB’s supervisors need to continue with their efforts of ensuring a proper oversight by the banks’ board over the banks’ credit risk profile. |
| Principle 18 | Problem assets, provisions and reserves.50 The supervisor determines that banks have adequate policies and processes for the early identification and management of problem assets, and the maintenance of adequate provisions and reserves.51 |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to formulate policies and processes for identifying and managing problem assets. In addition, laws, regulations or the supervisor require regular review by banks of their problem assets (at an individual level or at a portfolio level for assets with homogenous characteristics) and asset classification, provisioning and write-offs. |
| Description and findings re EC1 | S. 17 (First Schedule) of the BTCRA authorizes CBoB to evaluate banks’ policies, practices and procedures related to the granting of loans and making of investments, and the ongoing management of the loans and investment portfolios, and to take measures to ensure that banks adhere to these policies. It also states that the Inspector ensure that banks establish and adhere to adequate policies, practices and procedures for evaluating the quality of assets and the adequacy of loan-loss provisioning and loan loss reserves. Part III of the Guidelines for the Measurement, Monitoring and Control of Impaired Assets (Asset Impairment Guideline) provides guidance to SFIs on the recognition of impairment of an asset which states that an asset is impaired where there is no longer reasonable assurance of timely collection of the full amount of principal and interest due to a deterioration in the credit quality of the counterparty. Although the Asset Impairment Guideline does not stipulate the requirement for board policies and processes pertaining to impaired assets, this requirement can be found in the CRM Guideline which is to be read in conjunction with the Asset Impairment Guideline. S. VII (1) of the CRM Guideline suggests that SFI’s conduct a review of all facilities at least annually (except consumer loans repayable by instalment need not be reviewed if current). With respect to asset classification, provisioning and write-offs requirements: the CRM Guideline states the following:
As a result of some of the criteria in both the CRM Guideline and the Impaired Asset Guideline, the Assessors observed a number of differing asset classification and loan loss provisioning practices, especially amongst the DSIBs. CBoB has required all SFI to be compliant with IFRS 9 accounting requirements effective January 1, 2018. CBoB has indicated that it will not pre-approve the validation of credit risk models used to assess and measure expected credit losses. The Assessors observed a lack of CBoB guidance, pertaining to its expectations and discretion with respect to the IFRS 9 implementation. |
| EC2 | The supervisor determines the adequacy of a bank’s policies and processes for grading and classifying its assets and establishing appropriate and robust provisioning levels. The reviews supporting the supervisor’s opinion may be conducted by external experts, with the supervisor reviewing the work of the external experts to determine the adequacy of the bank’s policies and processes. |
| Description and findings re EC2 | CBoB undertakes to assess SFI’s adequacy of bank’s policies and processes for grading and classifying its assets provisioning levels through on-site examinations. These on-site examinations are only carried out periodically and if determined to be a priority through the risk assessment process. Since 2015 five in-depth credit risk management reviews have taken place at the DSIBs. In general, the supervisory in-depth risk assessments are carried out on cycle of three years for larger SFIs and five years for smaller SFIs. Once this assessment is conducted and the off-site supervisor surveillance team have conducted a mitigation plan, there may be a determination to conduct an on-site credit risk review. When a credit risk on-site examination is carried out, the CBoB examiner focuses on:
The off-site supervision surveillance team monitors the level of non-performing assets, together with provisioning levels, on a quarterly basis and engages senior management of SFI’s twice yearly to discuss expectations on overall levels of NPLs (e.g. focus of discussion on the top 20 loan exposures and the top 20 non-performing loans). |
| EC3 | The supervisor determines that the bank’s system for classification and provisioning takes into account off-balance sheet exposures.52 |
| Description and findings re EC3 | S. VII (3) (a) of the CRM Guideline indicates that the asset classification system should include off-balance sheet exposures. Further, S. III of the Impaired Asset Guideline indicates that an SFI should include an impaired asset assessment of off-balance sheet assets, however no guidance was provided beyond this statement. Where an on-site examination takes place, the examiners may review the classification systems, including the off-balance sheet exposures if this is deemed warranted by the risk assessment process. |
| EC4 | The supervisor determines that banks have appropriate policies and processes to ensure that provisions and write-offs are timely and reflect realistic repayment and recovery expectations, taking into account market and macroeconomic conditions. |
| Description and findings re EC4 | The on-site examination team, when it has the opportunity to conduct an on-site credit review as part of the risk based supervisory process, will examine SFI’s policies and processes with respect to provisions levels and write-offs. From a macroeconomic standpoint, it is broadly known that The Bahamas has an excess supply of distressed real estate assets. Keeping this fact in mind, the focus on the timing of when SFIs are expected to set provisioning levels at 100 per cent is to be one of the key indicators for this jurisdiction versus when an SFI write-off a loan. The Assessors observed that SFIs have varying provisioning practices with respect to the timing of the requirement to book 100 percent of arrears. For example, asset-backed real estate loans in general are not written-off on a consistent basis and therefore tend to be kept on the books of the SFIs for periods ranging from 3 to 10 years. Some SFI’s will book 100 percent of the NPL at the 3-year mark, regardless of the value of the collateral of the real estate while other SFIs utilize 5 years and so on. In general, the Impaired Assets Guideline states that the overarching test of impairment of an asset is reasonable doubt over the ultimate collectability of principal and/or interest. The existence of any of the following conditions should be considered to indicate that the institution no longer has reasonable assurance of timely collection of the full amount of the principal and interest and the facility should be recognized as impaired:
|
| EC5 | The supervisor determines that banks have appropriate policies and processes, and organizational resources for the early identification of deteriorating assets, for ongoing oversight of problem assets, and for collecting on past due obligations. For portfolios of credit exposures with homogeneous characteristics, the exposures are classified when payments are contractually in arrears for a minimum number of days (e.g. 30, 60, 90 days). The supervisor tests banks’ treatment of assets with a view to identifying any material circumvention of the classification and provisioning standards (e.g. rescheduling, refinancing or reclassification of loans). |
| Description and findings re EC5 | S. VIII (3) of the CRM Guideline recommends a dedicated resource to handle the recovery and work-out of problem loans with appropriate policies in place as well as having a well-defined credit collections and arrears management process. Although both the CRM Guideline and the Impaired Asset Guideline provide for the ability of SFIs to classify impairment for portfolio of credit exposures with homogeneous characteristics, CBoB has simply determined two broad categories for impaired assets, namely “past due” assets which are less than 90 days overdue or “non-accrual” assets which are 90 days past due. As part of the supervisory process, when an on-site credit examination is determined to be warranted to be conducted, the examiners review the bank’s management of problem credits, whether resources are allocated to recovery and work-out of problem credits, and the adequacy and timeliness of provisioning policy. |
| EC6 | The supervisor obtains information on a regular basis, and in relevant detail, or has full access to information concerning the classification of assets and provisioning. The supervisor requires banks to have adequate documentation to support their classification and provisioning levels. |
| Description and findings re EC6 | The CBoB monitors the asset quality of the DSIBs on a monthly and quarterly basis for both arrears and non-performing loans both on an individual loan basis (focusing on the top 20 loan exposures, top 20 NPLs) and on an aggregate basis (aging by past dues and NPLs by sector) as well as a breakdown of restructured loans (consumer, mortgages and commercial loans). Provisioning information is on a total loans basis only. |
| EC7 | The supervisor assesses whether the classification of the assets and the provisioning is adequate for prudential purposes. If asset classifications are inaccurate or provisions are deemed to be inadequate for prudential purposes (e.g. if the supervisor considers existing or anticipated deterioration in asset quality to be of concern or if the provisions do not fully reflect losses expected to be incurred), the supervisor has the power to require the bank to adjust its classifications of individual assets, increase its levels of provisioning, reserves or capital and, if necessary, impose other remedial measures. |
| Description and findings re EC7 | The CBoB is granted broad powers to require actions by the banks to strengthen their financial position, including higher provisions. The CRM Guideline indicates that banks having a credit risk management methodology and/or level of provisioning (specific and general allowances) that is assessed as “Not Acceptable,” is required to submit an action plan and timeline for compliance with the CBoB’s requirements. The bank may be subject to enhanced monitoring of its risk management processes, until the licensee achieves an “Acceptable” or better rating. In addition, licensees that do not achieve an “Acceptable” rating for the level of provisioning may be expected to provide an additional level of capital or equivalent to minimize the adverse effects of not having a sufficient level of provisioning. When it is determined that an SFI requires an on-site credit review as part of the supervisory process, the on-site examination would pay special attention is paid to the bank’s delinquency management processes. S. 18 (h) of the BTCRA indicates that the CBoB may issue directions requiring a licensee to cease or refrain from committing an act or pursuing a course of conduct that is unsafe or unsound practice, or that is in contravention of any law or perform a remedial act. The Ladder of Intervention Guide indicate that the CBoB has the ability to issue a direction for an SFI to increase its level of specific provisions when found to be deficient. It is noted that the proposed amendment to the BTCRA is expected to, among other things, require a licensee to dispose of specified assets or to require shareholders to contribute additional capital when required. The Assessors observed that CBoB has on occasion issued a directive to an SFI when remedial action was needed to increase an SFI’s provisioning levels. |
| EC8 | The supervisor requires banks to have appropriate mechanisms in place for regularly assessing the value of risk mitigants, including guarantees, credit derivatives and collateral. The valuation of collateral reflects the net realizable value, taking into account prevailing market conditions. |
| Description and findings re EC8 | The CRM Guidelines requires the periodic re-assessment of risk mitigants which states that licensees should revalue their collateral and mitigation instruments on a regular basis. The method and frequency of revaluation depends on the nature of the mitigation and the products involved. |
| EC9 | Laws, regulations or the supervisor establish criteria for assets to be:
|
| Description and findings re EC9 | S. III of the Impaired Asset Guideline provides for:
|
| EC10 | The supervisor determines that the bank’s Board obtains timely and appropriate information on the condition of the bank’s asset portfolio, including classification of assets, the level of provisions and reserves and major problem assets. The information includes, at a minimum, summary results of the latest asset review process, comparative trends in the overall quality of problem assets, and measurements of existing or anticipated deterioration in asset quality and losses expected to be incurred. |
| Description and findings re EC10 | The CRM Guidelines require licensees to conduct credit audits to assess individual credits and their overall quality. The Guidelines specifically state that the findings of independent credit audits should be reported to the Board or the Audit Committee on a timely basis, and appropriate remedial actions should be taken to address any concerns and weakness raised. |
| EC11 | The supervisor requires that valuation, classification and provisioning, at least for significant exposures, are conducted on an individual item basis. For this purpose, supervisors require banks to set an appropriate threshold for the purpose of identifying significant exposures and to regularly review the level of the threshold. |
| Description and findings re EC11 | CBoB’s CRM Guidelines require SFI to determine their own asset classification systems and provisioning levels. The Large Exposure Guideline defines a large exposure (both single and aggregate) and requires SFI to monitor exposures against board approved limits. SFI’s must seek CBoB’s approval to underwrite loans greater than 10 percent of total capital. Beginning August 2017, the off-site supervision surveillance team met twice yearly with the DSIBs to discuss the Inspector’s expectation that SFIs work towards resolving their 20 largest non-performing loans and to reduce the overall level of NPLs in general on a go forward basis. As part of these discussions, letters were sent to the DSIBs (May 2018 and November 2018) regarding some high-level expectations with respect to valuation practices for real estate back lending (e.g. preference for SFI to utilize market selling prices versus sales listing prices for residential housing). The industry would greatly benefit from updated guidance related to the CBoB’s expectations of SFIs collateral asset valuation practices. With the 2018 announcement by the Government of the establishment of the Credit Rating Agency (expected to be operational in 2020), the ability of SFIs to make use of this valuation information should help ensure firms are using consistent collateral valuation practices. |
| EC12 | The supervisor regularly assesses any trends and concentrations in risk and risk build-up across the banking sector in relation to banks’ problem assets and takes into account any observed concentration in the risk mitigation strategies adopted by banks and the potential effect on the efficacy of the mitigant in reducing loss. The supervisor considers the adequacy of provisions and reserves at the bank and banking system level in the light of this assessment. |
| Description and findings re EC12 | The Market Research Division of CBoB conducts periodic stress testing of credit risk within the banking sector in relation to banks’ problem assets. The off-site surveillance teams are aware of the results of the macro stress tests and take the results into consideration when assessing the prudential information provided by SFI’s regarding their NPLs. |
| Assessment of Principle 18 | Largely Compliant |
| Comments | CBoB’s Impaired Assets Guidelines are somewhat outdated with evidence of industry practice varying on agreed definitions for the valuation of collateral and timing of loan loss provisioning. Although some of these practices do not align with Basel Guidelines on prudential treatment of problem assets, with the implementation of IFRS 9 (effective January 1, 2018), the requirement for SFIs to report expected losses will soon come into effect. It will be important for the CBoB to update its guidance to industry with respect to its expectations and discretion as it pertains to the validation of credit risk models used to assess and measure expected credit losses. CBoB has been meeting regularly with DSIB firms to discuss prudential concerns surrounding the level of non-performing loans, progress to decrease the overall levels and some general advice to DSIBs regarding the use of market sales prices for regarding valuation practices of SFIs for their real estate back loans. CBoB off-site surveillance team monitors the top 20 largest exposures as well as the top NPLs, together with the level of provisioning for NPLs on a regular basis. |
| Principle 19 | Concentration risk and large exposure limits. The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate concentrations of risk on a timely basis. Supervisors set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties.53 |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to have policies and processes that provide a comprehensive bank-wide view of significant sources of concentration risk.54 Exposures arising from off-balance sheet as well as on-balance sheet items and from contingent liabilities are captured. |
| Description and findings re EC1 | The BTCRA Large Exposure Regulations and CBOB’s Large Exposure Guidelines require SFIs to have policies and processes for measuring and limiting firm-wide concentrations. In addition, SFIs are required to have large exposure measures and limits in place that cover economic sector, country/geographical and to individual borrowers and groups of related borrowers. The Large Exposure Regulation defines ‘exposure’ as:
|
| EC2 | The supervisor determines that a bank’s information systems identify and aggregate on a timely basis, and facilitate active management of, exposures creating risk concentrations and large exposure55 to single counterparties or groups of connected counterparties. |
| Description and findings re EC2 | The BTCRA requires supervisors (as delegated by the Inspector of CBoB supervision) to ensure the banks have management information systems that enable management to identify portfolio concentration in line with the firm’s risk appetite and associated board-established limits. Typically, supervisors monitor this through off-sight surveillance of required regulatory reporting on large exposures (quarterly) and gain a deeper understanding through structured meetings with the firms or “Discovery Reviews”, and reviews of risk reports to management and the board. When onsite credit examinations are performed, if this issue is deemed to represent a significant risk by the risk assessment process, examiners would include a review of the adequacy of information systems. Assessors observed and reviewed the required periodic reporting by SFIs of their large exposures and concentrations. The Policy Statement on Large Exposures requires bank directors/management to review the policy statement periodically but at least annually. |
| EC3 | The supervisor determines that a bank’s risk management policies and processes establish thresholds for acceptable concentrations of risk, reflecting the bank’s risk appetite, risk profile and capital strength, which are understood by, and regularly communicated to, relevant staff. The supervisor also determines that the bank’s policies and processes require all material concentrations to be regularly reviewed and reported to the bank’s Board. |
| Description and findings re EC3 | In addition to the limits imposed by CBoB, banks are required to adopt and set out in writing their internal limits, as outlined in the Large Exposure Guidelines. As noted above, these should cover economic sectoral and country/geographical exposures as well as exposures to individual borrowers and groups of related borrowers. There are no required regulatory limits on economic sectoral or country/geographical exposures. Supervisors monitor such exposures on an individual basis where applicable. SFIs are required to review large exposure and concentration policies not less than annually. Changes to policies and procedures will be communicated to supervisors who may conduct further work if warranted as per the risk assessment process. |
| EC4 | The supervisor regularly obtains information that enables concentrations within a bank’s portfolio, including sectoral, geographical and currency exposures, to be reviewed. |
| Description and findings re EC4 | SFIs must submit detailed regulatory reports on large exposures on a quarterly basis. These are reviewed and assessed by supervisors to determine compliance with internal board-approved limits and the exposure limits outlined in the Large Exposure Guidelines. Economic sectoral and country/geographical exposures are reviewed during on-site inspections, if determined to be warranted in the risk assessment process, and as part of the review of the quarterly accounts (unaudited) and annual accounts (audited). |
| EC5 | In respect of credit exposure to single counterparties or groups of connected counterparties, laws or regulations explicitly define, or the supervisor has the power to define, a “group of connected counterparties” to reflect actual risk exposure. The supervisor may exercise discretion in applying this definition on a case by case basis. |
| Description and findings re EC5 | The BCTRA Large Exposure Regulations (amendment of 2012) and the CBoB Large Exposures Guidelines define a group of connected parties as two or more individual counterparties that constitute a single risk and include:
|
| EC6 | Laws, regulations or the supervisor set prudent and appropriate56 requirements to control and constrain large credit exposures to a single counterparty or a group of connected counterparties. “Exposures” for this purpose include all claims and transactions (including those giving rise to counterparty credit risk exposure), on-balance sheet as well as off-balance sheet. The supervisor determines that senior management monitors these limits and that they are not exceeded on a solo or consolidated basis. |
| Description and findings re EC6 | The Large Exposures Regulations define ‘large exposure’ as an exposure which is equal to or exceeds 10 percent or more of the capital of the bank. All exposures of 10 percent or more in aggregate cannot exceed 800 percent of capital. SFIs must get approval to invest in any debt security to an individual issuer of greater than 10 percent of capital. The regulatory limit on exposures to an individual counterparty or group of connected parties is 25 percent of the bank’s capital. Additionally, a bank may not hold investments in debt securities of a single issuer greater than 10 percent of the bank’s capital. Exposures that are exempt from the above requirements (see below for list of exempt exposures), cannot be greater than exceed 800 percent of capital.
The CBoB may set lower limits for any SFI if it considers it necessary. SFIs are required to maintain policies and procedures for large exposures/concentrations and bank management must regularly review compliance with the large exposures policy. Attestation of compliance is part of the annual corporate governance certification. The CBoB can grant exemptions from the large exposure limits if requested by a SFI. Licensees seeking prior approval or an exemption from the large exposure limits must apply via a specific Large Exposures Application Form. Applications are expected to be submitted at least one month prior to taking on such an exposure. In assessing possible exemptions, CBoB will have regard to whether the exposure(s) would significantly increase the risk to depositors of the licensee and whether the exposure(s) is/are consistent with the SFI’s large exposures policy statement. Typically, supervisors monitor large exposure policies and exposures relative to regulatory and internal limits through off-sight surveillance of required regulatory reporting on large exposures (quarterly) and gain a deeper understanding of processes, if needed or if changes are made, through structured meetings with the firms or so-called “Discovery Reviews”, as well as reviews of risk reports sent to SFI management and boards. Assessors observed and reviewed the required periodic reporting by SFIs of their large exposures and concentrations. |
| EC7 | The supervisor requires banks to include the impact of significant risk concentrations into their stress testing programs for risk management purposes. |
| Description and findings re EC7 | CBoB currently does not have formal stress testing guidelines other than requiring stress testing to be used in ICAAP. SFIs are required to include stress testing as part of the ICAAPs for risk management and capital assessment purposes. Stress testing reviews have not been an area of particular focus for CBoB supervisors, though they do require credit stress tests and closely review the results. These tests are expected to capture all credit positions and thus would capture large exposures. |
| Additional criteria | |
| AC1 | In respect of credit exposure to single counterparties or groups of connected counterparties, banks are required to adhere to the following:
Minor deviations from these limits may be acceptable, especially if explicitly temporary or related to very small or specialized banks. |
| Description and findings re AC1 | CBoB applies both the 10 percent and 25 percent criteria. As noted above, some deviations from these limits may be allowed with the permission of CBoB. This permission must be requested in writing by the SFI. |
| Assessment of Principle 19 | Compliant |
| Comments | Given the strong focus by CBoB on closely monitoring large exposures the assessors view the practices described above as sufficient for a banking system of this size and complexity. CBoB requires monthly reporting on large exposure of DSIBs. While formal stress testing guidelines have not been developed and ICAAP reviews should be expanded and enhanced, these are addressed in BCP 15, Risk Management. |
| Principle 20 | Transactions with related parties. In order to prevent abuses arising in transactions with related parties57 and to address the risk of conflict of interest, the supervisor requires banks to enter into any transactions with related parties58 on an arm’s length basis; to monitor these transactions; to take appropriate steps to control or mitigate the risks; and to write off exposures to related parties in accordance with standard policies and processes. |
| Essential criteria | |
| EC1 | Laws or regulations provide, or the supervisor has the power to prescribe, a comprehensive definition of “related parties”. This considers the parties identified in the footnote to the Principle. The supervisor may exercise discretion in applying this definition on a case by case basis. |
| Description and findings re EC1 | The BTCRA Large Exposures Regulations define related party to include:
|
| EC2 | Laws, regulations or the supervisor require that transactions with related parties are not undertaken on more favorable terms (e.g. in credit assessment, tenor, interest rates, fees, amortization schedules, requirement for collateral) than corresponding transactions with non-related counterparties.59 |
| Description and findings re EC2 | The Large Exposure Guidelines require that exposures to related parties must be:
The Guidelines require the Board to have approved policies on related party exposures as well as on intra group lending. As part of the policies the Board must identify the SFI’s related parties and procedures for related party lending, including the limits for exposures entered into for treasury management purposes. SFIs are required to submit their large exposure policy statement to the CBoB and any material changes must be reported. |
| EC3 | The supervisor requires that transactions with related parties and the write-off of related-party exposures exceeding specified amounts or otherwise posing special risks are subject to prior approval by the bank’s Board. The supervisor requires that Board members with conflicts of interest are excluded from the approval process of granting and managing related party transactions. |
| Description and findings re EC3 | The Guidelines also require SFIs’ policies to include specific policies for entering into transactions with related parties and for write-offs of related party exposures that exceed amounts specified by policy or otherwise posing special risks, and to be subject to prior approval by the bank’s board. A directive sent in October 2012 providing notification that Board members with conflicts of interest must be excluded from the approval process. |
| EC4 | The supervisor determines that banks have policies and processes to prevent persons benefiting from the transaction and/or persons related to such a person from being part of the process of granting and managing the transaction. |
| Description and findings re EC4 | The requirement referred to above (in EC3) requires banks to have policies and processes in place to prevent persons benefiting from related-party exposures and/or persons related to such a person from being part of the process of granting and managing the exposure. |
| EC5 | Laws or regulations set, or the supervisor has the power to set on a general or case by case basis, limits for exposures to related parties, to deduct such exposures from capital when assessing capital adequacy, or to require collateralization of such exposures. When limits are set on aggregate exposures to related parties, those are at least as strict as those for single counterparties or groups of connected counterparties. |
| Description and findings re EC5 | The Large Exposure Regulations and Guidelines specify that a bank may not incur an exposure on an aggregate basis to its related parties of greater than 15 percent of its capital base. Regulation 5 of the Regulations provides that CBoB may deduct related party exposures from capital if, in its opinion, such lending is in the nature of a capital investment or made on concessionary terms. |
| EC6 | The supervisor determines that banks have policies and processes to identify individual exposures to and transactions with related parties as well as the total amount of exposures, and to monitor and report on them through an independent credit review or audit process. The supervisor determines that exceptions to policies, processes and limits are reported to the appropriate level of the bank’s senior management and, if necessary, to the Board, for timely action. The supervisor also determines that senior management monitors related party transactions on an ongoing basis, and that the Board also provides oversight of these transactions. |
| Description and findings re EC6 | The Guidelines for the Management of Credit Risk state that all credit to related borrowers should be monitored carefully and steps should be taken to control or reduce the risks of connected lending. In the conduct of risk based onsite examinations, when those are carried out, if related party lending is deemed a priority through the risk assessment process, supervisors would:
CBoB last conducted onsite examinations with a focus on concentration risk and related party exposures in 2014–2015. Related party transactions would be reviewed as part of CBoB’s credit risk examinations if the risk assessment process identifies these as a priority. In the absence of onsite examinations supervisors would review internal audit reports and discuss related practices with SFI management, along with surveillance activities of monitoring the firms required regulatory reporting to CBoB. See BCP discussion of supervision approach for a discussion of the CBoB’s general approach to supervision. |
| EC7 | The supervisor obtains and reviews information on aggregate exposures to related parties. |
| Description and findings re EC7 | CBoB receives quarterly reports on related party lending. CBoB’s quarterly financial returns include information on related party deposits and lending which are assessed in line with the Large Exposure Guidelines. The supervisor determines the level of compliance or lack thereof with prudential norms or any exceptions granted. |
| Assessment of Principle 20 | Largely Compliant |
| Comments | Comprehensive coverage of related party risk management would be expected to be carried out through onsite credit examinations, of which there has been only a limited number since 2015. The monitoring process is effective with respect to reviewing related party exposures relative to large exposure limits, but only captures related party exposures that would also appear in the large exposure reporting. CBoB should review and monitor all related party exposures to ensure compliance with requirements. The directive sent by letter to the firms in 2012 (see EC 3 above) should be incorporated directly into supervisory guidelines/requirements. |
| Principle 21 | Country and transfer risks. The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate country risk60 and transfer risk61 in their international lending and investment activities on a timely basis. |
| Essential criteria | |
| EC1 | The supervisor determines that a bank’s policies and processes give due regard to the identification, measurement, evaluation, monitoring, reporting and control or mitigation of country risk and transfer risk. The supervisor also determines that the processes are consistent with the risk profile, systemic importance and risk appetite of the bank, take into account market and macroeconomic conditions and provide a comprehensive bank-wide view of country and transfer risk exposure. Exposures (including, where relevant, intra-group exposures) are identified, monitored and managed on a regional and an individual country basis (in addition to the end-borrower/end-counterparty basis). Banks are required to monitor and evaluate developments in country risk and in transfer risk and apply appropriate countermeasures. |
| Description and findings re EC1 | Section 2 of the Guidelines for the Management of Country Risk specifies that a SFI’s senior management is responsible for implementing board-approved, sound, well defined country risk management policies and procedures that:
The Guidelines also require SFIs to have adequate country risk provisions given their assessment of the probability of losses arising from cross-border exposures. Supervisory assessments of policies and procedures, including associated limits and exposures is largely carried through off-site supervision, meetings with firms, reviews of risk appetite statements and regular required reports of country risk exposures. If onsite examinations are deemed warranted by the risk assessment process, supervisors would include an assessment of country and transfer risk management in the scope of the exams. |
| EC2 | The supervisor determines that banks’ strategies, policies and processes for the management of country and transfer risks have been approved by the banks’ Boards and that the Boards oversee management in a way that ensures that these policies and processes are implemented effectively and fully integrated into the banks’ overall risk management process. |
| Description and findings re EC2 | Reviews of board approval of policies and procedures is generally done by the supervisory teams through reviewing board meeting minutes and/or minutes of the relevant subcommittees. The Risk Assessment Process includes Governance and Oversight as a key mitigant against inherent risks. This will include aspects of corporate governance and could include a review of board oversight of management, but does not necessarily include that. Supervisors get a more general sense of board oversight than do specific assessments. Country risk management and corporate governance around it can be assessed during onsite examinations if the risk assessment process finds it warranted. |
| EC3 | The supervisor determines that banks have information systems, risk management systems and internal control systems that accurately aggregate, monitor and report country exposures on a timely basis; and ensure adherence to established country exposure limits. |
| Description and findings re EC3 | The Guidelines specify that each bank has in place risk management policies and procedures as well as an effective process for analyzing country risk. In particular, Section IV—Supervisory Approach—of the Guidelines specifies that CBoB supervisors will seek to determine that there is:
CBoB considers the size and complexity of a bank’s cross border business and other factors set out in the Guidelines in considering whether the bank has appropriate systems to control country risk and maintains adequate provisions for such risk. Section VI—Internal Controls and Audit—of the Guidelines specifies that banks should ensure that their country risk management process includes adequate internal controls, and that there is an audit mechanism to ensure the integrity of the information used by senior management and the Board to monitor compliance with country risk policies and exposures limits. The system of internal controls should, for example, ensure that responsibilities for marketing and lending personnel are properly segregated from the responsibilities of personnel who analyze and rate country risk, and set country limits. CBoB requires regular periodic reporting by SFIs on country and transfer risk. Monitoring against limits is done offsite through this process. |
| EC4 | There is supervisory oversight of the setting of appropriate provisions against country risk and transfer risk. There are different international practices that are all acceptable as long as they lead to risk-based results. These include:
|
| Description and findings re EC4 | Section VII—Country Risk Provisioning—of the Guidelines specifically addresses provisions against country risk and transfer risk. SFIs are required to provision for these risks to absorb potential losses arising from exposures to country risk. Banks may decide to assign provisions by either:
Regardless of the approach banks adopt, they are expected to have adequate country risk provisions for the assessment of potential losses from their cross-border exposures. CBoB assesses country risk in the context of reviewing the policies, procedures and practices of SFIs as they relate to the broader set of credit risk controls. The assessment takes into account the effectiveness of controls around credit concentration, approved limits, and provisioning and is largely carried out offsite. If the Risk Assessment process determined this area warranted the attention of an onsite examination, it would normally be covered as part of broader reviews. CBoB assesses the adequacy of provisioning primarily through its off-site supervisory regime and places reliance on external auditors audits of financial statements. The external auditor takes provisioning into account when arriving at a true and fair view of the bank. |
| EC5 | The supervisor requires banks to include appropriate scenarios into their stress testing programs to reflect country and transfer risk analysis for risk management purposes. |
| Description and findings re EC5 | If it is assessed as a separate risk, it would be assessed as ‘other identified risks’ as part of the licensee’s ICAAP assessment, where the capital required would be reflected as a Pillar 2 charge. The CBoB requires licensees to effectively manage country risk through the ICAAP process, which is required to include stress testing in the analyses, as well as through periodic stress testing of international exposures as part of the credit stress testing requirements. |
| EC6 | The supervisor regularly obtains and reviews sufficient information on a timely basis on the country risk and transfer risk of banks. The supervisor also has the power to obtain additional information, as needed (e.g. in crisis situations). |
| Description and findings re EC6 | CBoB receives details of country risk exposure on a quarterly basis which is analyzed through its offsite supervisory monitoring regime. Under the BTCRA, CBoB has the authority to request any information it requires from a SFI in order to carry out its duties. |
| Assessment of Principle 21 | Compliant |
| Comments | Assessors found that country and transfer risk were sufficiently covered through the offsite processes described above. Lack of sufficient onsite examination coverage of credit risk management more broadly is captured in the assessment of BCP 17. |
| Principle 22 | Market risk. The supervisor determines that banks have an adequate market risk management process that takes into account their risk appetite, risk profile, and market and macroeconomic conditions and the risk of a significant deterioration in market liquidity. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate market risks on a timely basis. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to have appropriate market risk management processes that provide a comprehensive bank-wide view of market risk exposure. The supervisor determines that these processes are consistent with the risk appetite, risk profile, systemic importance and capital strength of the bank; take into account market and macroeconomic conditions and the risk of a significant deterioration in market liquidity; and clearly articulate the roles and responsibilities for identification, measuring, monitoring and control of market risk. |
| Description and findings re EC1 | CBoB issued its Guidelines for the Management of Market Risk in 2012. The guidelines are supported by written examiner guidance and modules for examination. The guidelines aim to ensure that SFIs engaged in activities that give rise to risks associated with potential movements in market prices adopt management practices and meet capital requirements that are commensurate with the risks involved. Where applicable—currently at 6 firms—SFIs are required to establish sound and reliable systems for market risk management that are commensurate with the nature, scale and complexity of their business. CBoB expects SFIs management of market risk to include the following basic elements:
Under the Guidelines for Market Risk, SFIs must establish sound and reliable systems for market risk management commensurate with the nature, scale and complexity of the business. SFIs must also establish and maintain adequate systems and controls sufficient to give management and supervisors the confidence that their valuation estimates are prudent and reliable. These systems must be integrated with other risk management systems within the organization (such as credit analysis). Under the BTCRA, the CBoB has issued Corporate Governance Guidelines that outline the responsibility of the bank’s management and board in managing market risks. As directed by the Corporate Governance Guidelines, boards of SFIs must certify each year where they stand with respect supervisory expectations and regulatory requirements. The BTCRA requires CBoB to ensure that banks have in place and use systems that accurately measure, monitor and adequately control market risk and other risks. CBoB module for examiners when undertaking onsite examinations directs them to assess whether:
The assessors did not observe that any market risk examinations had been carried out over the past four years and discussions with examiners indicated that market risk is not an area on which they would typically focus. Market risk reporting requirements for applicable SFIs have been developed and incorporated into the ERS. Supervisors review required regulatory reports on market risk. |
| EC2 | The supervisor determines that banks’ strategies, policies and processes for the management of market risk have been approved by the banks’ Boards and that the Boards oversee management in a way that ensures that these policies and processes are implemented effectively and fully integrated into the banks’ overall risk management process. |
| Description and findings re EC2 | CBoB issued its Guidelines for the Management of Market Risk in 2012. The guidelines are supported by written examiner guidance and modules for examination. The guidelines aim to ensure that SFIs engaged in activities that give rise to risks associated with potential movements in market prices adopt management practices and meet capital requirements that are commensurate with the risks involved. Where applicable—currently at 6 firms—SFIs are required to establish sound and reliable systems for market risk management that are commensurate with the nature, scale and complexity of their business. CBoB expects SFIs management of market risk to include the following basic elements:
Under the Guidelines for Market Risk, SFIs must establish sound and reliable systems for market risk management commensurate with the nature, scale and complexity of the business. SFIs must also establish and maintain adequate systems and controls sufficient to give management and supervisors the confidence that their valuation estimates are prudent and reliable. These systems must be integrated with other risk management systems within the organization (such as credit analysis). Under the BTCRA, the CBoB has issued Corporate Governance Guidelines that outline the responsibility of the bank’s management and board in managing market risks. As directed by the Corporate Governance Guidelines, boards of SFIs must certify each year where they stand with respect supervisory expectations and regulatory requirements. The BTCRA requires CBoB to ensure that banks have in place and use systems that accurately measure, monitor and adequately control market risk and other risks. CBoB module for examiners when undertaking onsite examinations directs them to assess whether:
The assessors did not observe that any onsite market risk examinations had been carried out over the past four years and discussions with examiners indicated that market risk is not an area on which they would typically focus. Market risk is captured in the ICAAP reports provided by the SFIs. Securities Commission examiners reportedly assess market risk management issues on a regular basis. Assessment of the Securities Commission’s supervision was not part of this review. |
| EC3 | The supervisor determines that the bank’s policies and processes establish an appropriate and properly controlled market risk environment including:
|
| Description and findings re EC3 | CBoB does not directly review market risk through onsite examinations. Staff told the assessors that the Securities Commission (which is outside the scope of this assessment) carries out examinations of market risk and CBoB would rely on them to provide information if problems arise. Assessment of policies, limits and exposures versus limits is carried out offsite with exposures captured in required regulatory reporting. Only four SFIs exceed the de minimus exposure thresholds and must report exposures and hold capital under pillar 1. For three of the four firms the exposures are not material and for the fourth (which is a foreign-owned SFI) the positions generating the exposures are not complex. |
| EC4 | The supervisor determines that there are systems and controls to ensure that bank’ marked-to-market positions are revalued frequently. The supervisor also determines that all transactions are captured on a timely basis and that the valuation process uses consistent and prudent practices, and reliable market data verified by a function independent of the relevant risk-taking business units (or, in the absence of market prices, internal or industry-accepted models). To the extent that the bank relies on modeling for the purposes of valuation, the bank is required to ensure that the model is validated by a function independent of the relevant risk-taking businesses units. The supervisor requires banks to establish and maintain policies and processes for considering valuation adjustments for positions that otherwise cannot be prudently valued, including concentrated, less liquid, and stale positions. |
| Description and findings re EC4 | The Market Risk Guidelines address internal audit monitoring of the banks’ trading and market risk activities. CBoB supervisors review internal audit reports on all risk areas including market risk. They follow up on internal audit identified weaknesses and track progress on SFIs remediation plans. External auditors include reviews of valuation methods and outcomes as part of auditing financial statements. The annual board certification includes assessment of compliance with all laws, rules and Guidelines. |
| EC5 | The supervisor determines that banks hold appropriate levels of capital against unexpected losses and make appropriate valuation adjustments for uncertainties in determining the fair value of assets and liabilities. |
| Description and findings re EC5 | The CBoB requires licensees that meet the de minimis threshold to report on market risk capital allocated to support this risk (on a quarterly basis), which supervisors review on a quarterly basis. There was no indication provided to the assessors that the supervisors make a determination regarding the appropriateness of valuation adjustments for valuation uncertainties. Rather, CBoB supervisors stated they would typically would look to external auditors to determine appropriate valuations and valuation practices as part of their audits of SFIs’ preparation of public financial statements. |
| EC6 | The supervisor requires banks to include market risk exposure into their stress testing programs for risk management purposes. |
| Description and findings re EC6 | Given the limited volume of trading activities, guidelines on stress testing or scenario analysis have not been issued. As part of the ICAAP, SFIs are expected to incorporate stress testing to complement other measures and help them understand and validate their risks, and the interaction of those risks under stressed conditions. The Guidelines for the Internal Capital Adequacy Assessment Process (ICAAP) states that, “banks must have methodologies that enable them to assess and actively manage all material market risks, wherever they arise throughout the institution (i.e., position, trading desk, business line or firm-level). For more sophisticated licensees, the assessment of internal capital adequacy for market risk, at a minimum, should be based on both value-at-risk (VaR) or similar modeling and stress testing, including an assessment of concentration risk and the assessment of illiquidity under stressful market scenarios.” The ICAAP Guidelines were issued in August 2016. To date SFIs’ ICAAP has not been an area subject to in depth assessments through onsite examinations. |
| Assessment of Principle 22 | Compliant |
| Comments | Given the small number of SFIs—four—with market risk exposures and the generally small size or relatively low risk nature of those exposures, the assessors view the current practices for market risk as sufficient. Three of the four banks have market risk exposures less than 10 percent of capital. The fourth has market risk exposures of 33 percent of capital. This bank has market risk positions are straightforward vanilla instruments such as sovereign and corporate bonds and repurchase agreements. We recommend that CBoB increase its focus on assessments of ICAAP at the SFIs and include a review of the SFIs’ treatment of market risk exposures in that context. |
| Principle 23 | Interest rate risk in the banking book. The supervisor determines that banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk62 in the banking book on a timely basis. These systems take into account the bank’s risk appetite, risk profile and market and macroeconomic conditions. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to have an appropriate interest rate risk strategy and interest rate risk management framework that provides a comprehensive bank-wide view of interest rate risk. This includes policies and processes to identify, measure, evaluate, monitor, report and control or mitigate material sources of interest rate risk. The supervisor determines that the bank’s strategy, policies and processes are consistent with the risk appetite, risk profile and systemic importance of the bank, take into account market and macroeconomic conditions, and are regularly reviewed and appropriately adjusted, where necessary, with the bank’s changing risk profile and market developments. |
| Description and findings re EC1 | CBoB’s reporting system for commercial banks (ERS) is used to collect data for supervisors to use to monitor interest rate risk. SFIs have been reporting on interest rate risks since end of the third quarter 2011. Guidelines for the Management of Interest Rate Risk were issued in August 2012 and updated in December 2016. CBoB’s Interest Rate Risk Guidelines are comprehensive and cover all normal areas including governance (board and senior management oversight), risk management, limits, internal controls, and internal audit review. Supervisory expectations are proportional to the size and complexity of the firms and their asset/liability positions, their interest rate risk position, and their risk appetite and risk profile. Interest rate risk is expected to be reviewed as part of on-site review of banks’ liquidity and treasury risk management. Templates have been developed, as part of CBoB’s stress-testing framework, to analyze interest rate risk under stress in commercial banks. This looks at sensitivity to parallel shifts in the yield curve and the impact on economic value. The Guidelines require the periodic performance of stress tests to measure banks’ vulnerability to loss under adverse interest rate movements as follows: Guidelines require SFIs to measure vulnerability to IRRB losses in stressed market conditions by conducting stress tests. Interest rate scenarios are expected to measure different stressed market conditions, including “worst case” scenarios in addition to more probable scenarios. Special consideration is expected to be given to instruments or positions that may be difficult to liquidate or offset in stressful situations. Board and senior management are expected to consider the results of stress tests when establishing and reviewing strategies, policies and limits for interest rate risk. CBoB supervisors, as part of offsite supervision, review board reporting, minutes and risk appetite statements and limits to assess risks against stated risk appetite. SFIs are required to report the results of their IRR stress/sensitivity tests to CBoB on a regular basis in regulatory reporting. SFIs with IRRB that leads to an economic value decline of more than 20 percent of the sum of Tier 1 and Tier 2 under these standardized interest rate shocks or an equivalent, would be required to either reduce the risk, hold an additional amount of capital to support the level of risk, or a combination of the two. IRRB is captured under Pillar 2 in the Bahamas, and supervisors will review ICAAP reports to ensure completeness, including that IRRB is being considered in ICAAPs. |
| EC2 | The supervisor determines that a bank’s strategy, policies and processes for the management of interest rate risk have been approved, and are regularly reviewed, by the bank’s Board. The supervisor also determines that senior management ensures that the strategy, policies and processes are developed and implemented effectively. |
| Description and findings re EC2 | CBoB requires SFIs’ boards to approve objectives and strategies and the major policies governing interest rate risk management, assess compliance with approved strategies and policies, and assess the performance of senior management in monitoring and controlling interest rate risks in compliance with approved strategies and policies. Supervisors review bard minutes and board meeting risk packages to confirm approval and periodic internal reviews of policies and procedures. In addition, they review actual risk measures and reporting against approved policies. |
| EC3 | The supervisor determines that banks’ policies and processes establish an appropriate and properly controlled interest rate risk environment including:
|
| Description and findings re EC3 | CBoB requires banks to have in place policies and procedures to identify, evaluate, monitor and control material risks including interest rate risk. Interest rate risk and the maintenance of appropriate controls are reviewed and assessed as a part of the risk assessment process in the risk-based supervision framework. This is largely an offsite process that can also include review of relevant internal audit reports meetings/discussions with management and control function personnel. The assessment of IRRB risk management techniques and practices would also be assessed through onsite examinations, should the risk assessment process determine that this rises to the level of a priority warranting an exam of this area. Onsite exams are guided by reasonably comprehensive examination modules that include guidance to review (i) board and senior management oversight; (ii) policies, procedures, and limits; (iii) adequate risk-measurement and monitoring supported by the appropriate management information systems; and (iv) a comprehensive process of internal controls. During an examination, the review could include an assessment of the quality and timeliness of reporting to senior management and the board. Interest rate risk would also be examined as part of the review of the banks’ liquidity management, should the risk assessment process identify that as an area warranting such a review. SFIs ICAAPs is expected to include consideration of all material interest rate risk positions and consider all relevant repricing and maturity data. A SFI is expected to be able to support assumptions about the behavioral characteristics of non-maturity and other assets and liabilities, especially those exposures characterized by embedded optionality. Given uncertainty in such assumptions, stress testing and scenario analysis should be used in the analysis of interest rate risk. |
| EC4 | The supervisor requires banks to include appropriate scenarios into their stress testing programs to measure their vulnerability to loss under adverse interest rate movements. |
| Description and findings re EC4 | The Interest Rate Risk Guidelines require the periodic performance of stress tests to measure banks’ vulnerability to loss under adverse interest rate movements, as follows: “banks should measure their vulnerability to loss in stressed market conditions by conducting stress tests. Banks should use interest rate scenarios that are sufficiently varied to encompass different stressful market conditions. Stress tests should include “worst case” scenarios in addition to more probable scenarios. In conducting stress tests, special consideration should be given to instruments or positions that may be difficult to liquidate or offset in stressful situations. Board and senior management should consider the results of stress tests when establishing and reviewing strategies policies and limits for interest rate risk.” In practice CBoB supervisors are in the early stages of working with SFIs on stress testing practices. This includes work with local offices of international banks to adapt the firms’ global methods to local operating conditions. |
| Additional criteria | |
| AC1 | The supervisor obtains from banks the results of their internal interest rate risk measurement systems, expressed in terms of the threat to economic value, including using a standardized interest rate shock on the banking book. |
| Description and findings re AC1 | The CBoB receives detailed interest rate risk reports from SFIs on a monthly and quarterly basis (depending on the firm). SFIs are required to assess interest rate risk as part of their ICAAP. As part of its assessment of SFIs interest rate risk measurement, the CBoB requires SFIs to provide results of sensitivity analyses expressed in terms of the threat to economic value, using standardized interest rate shock. At a minimum, the standardized rate shock should include either of the following:
|
| AC2 | The supervisor assesses whether the internal capital measurement systems of banks adequately capture interest rate risk in the banking book. |
| Description and findings re AC2 | CBoB reviews SFIs ICAAPs to ensure IRRB is being captured and measured for capital purposes. In addition, as noted above, SSFIs are required to run sensitivity analysis of IRRB against the economic value of the firm and report the results as part of quarterly regulatory filings. If a high level of potential economic loss is identified CBoB can require a reduction in the position or an increase in capital. The assessors did not observe any cases where this risk reduction or increased capital requirement was relevant and put into practice. |
| Assessment of Principle 23 | Compliant |
| Comments | IRRB is a clear focus of CBoB supervisors and is looked at through required reporting of the economic value of sensitivities, reviews of SFIs’ ICAAP reports, liquidity/treasury management assessments or onsite exams and most typically, the Risk Assessment Process and semi-annual offsite assessments of the condition of the firms. Assessors view the approach described above in BCP 23 as sufficient for the size, complexity and risk profiles of the SFIs. |
| Principle 24 | Liquidity risk. The supervisor sets prudent and appropriate liquidity requirements (which can include either quantitative or qualitative requirements or both) for banks that reflect the liquidity needs of the bank. The supervisor determines that banks have a strategy that enables prudent management of liquidity risk and compliance with liquidity requirements. The strategy takes into account the bank’s risk profile as well as market and macroeconomic conditions and includes prudent policies and processes, consistent with the bank’s risk appetite, to identify, measure, evaluate, monitor, report and control or mitigate liquidity risk over an appropriate set of time horizons. At least for internationally active banks, liquidity requirements are not lower than the applicable Basel standards. |
| Essential criteria | |
| EC1 | Laws, regulations, or the supervisor require banks to consistently observe prescribed liquidity requirements including thresholds by reference to which a bank is subject to supervisory action. At least for internationally active banks, the prescribed requirements are not lower than, and the supervisor uses a range of liquidity monitoring tools no less extensive than, those prescribed in the applicable Basel standards. |
| Description and findings re EC1 | The Banks and Trust Companies (Liquidity Risk Management) Regulations 2011 (LRMR) require licensees, exclusive of commercial banks, to maintain a liquidity ratio of not less than 20 percent. Regulation 6(2) of (LRMR), state that the liquidity ratio shall not currently apply to licensees that are subject to the provisions of section 19 and 20 of the CBBA. Commercial banks therefore are subject to a prescribed statutory reserve (e.g., primary reserve 5 percent against their Bahamian dollar liabilities, plus a secondary reserve referred to as the Liquid Asset Ratio (LAR), which mandates commercial banks to maintain an average ratio of liquid assets in relation to their Bahamian dollar deposit liabilities. The LAR is currently at 20 percent of demand deposits, 15 percent of savings and fixed deposits and 15 percent of borrowings due to for from CBoB as well as inter-bank deposits. CBoB indicated it is working towards the implementation of Basel III requirements (consultation paper released, implementation expected in 2019). Penalties and conditions/limitations are imposed for failure to maintain required levels of liquidity, as outlined in the LRMR and the CBBA. The CBoB may issue a direction to an SFI who does not meet the prescribed liquidity requirements. |
| EC2 | The prescribed liquidity requirements reflect the liquidity risk profile of banks (including on- and off-balance sheet risks) in the context of the markets and macroeconomic conditions in which they operate. |
| Description and findings re EC2 | The Guidelines for the Management of Liquidity Risk (Liquidity Risk Guideline or the Guideline) states that a licensee’s obligations (both on- and off-balance sheet risks) and the funding sources used to meet them depend significantly on its business mix, balance sheet structure, and the cash-flow profiles of its on- and off-balance sheet obligations. In addition, the Guideline states that an SFI, in managing their cash flows, licensees may need to confront various situations that can give rise to increased liquidity risk. These include funding mismatches, market constraints on the ability to convert assets into cash or in accessing sources of funds (i.e., market liquidity), and contingent liquidity events. Changes in economic conditions or exposure to credit, market, operation, legal, and reputation risks also can affect a licensee’s liquidity risk profile. The Liquidity Risk Guideline states that ALCO must identify, test (market access) and monitor alternative sources of funding, set concentration limits of funding sources as well as setting diversification targets (time horizons, retail versus secured/unsecured wholesale) and ensure regular reporting to the Board. Supervisors continuously monitor the liquidity position of all SFIs (DSIBs on a weekly basis as well as during quarterly meetings with SFI senior management). Supervisors also review the SFI’s liquidity risk management strategy and maturity wise analysis (net cumulative cash flow for buckets up to 3 months) as well as longer duration time horizons. |
| EC3 | The supervisor determines that banks have a robust liquidity management framework that requires the banks to maintain sufficient liquidity to withstand a range of stress events, and includes appropriate policies and processes for managing liquidity risk that have been approved by the banks’ Boards. The supervisor also determines that these policies and processes provide a comprehensive bank-wide view of liquidity risk and are consistent with the banks’ risk profile and systemic importance |
| Description and findings re EC3 | The Liquidity Risk Guideline states that SFIs should have a sound liquidity risk management framework that includes appropriate strategies, policies, procedures, and limits used to manage and mitigate liquidity risk. In addition, the SFI must have adequate levels of highly liquid marketable securities free of legal, regulatory, or operational impediments that can be used to meet liquidity needs in stressful situations. CBoB’s off-site Supervision surveillance monitors SFI’s compliance with the LRMR requirements as well as compliance to the Liquidity Risk Guidelines. Daily liquidity data on the DSIBs is received and analyzed on a daily/weekly basis and liquidity positions are discussed with DSIB senior management on a quarterly basis. CBoB routinely test and confirm compliance with the Liquidity Risk Guideline and the institution’s established liquidity and funding policies through its on-site examination program, to identify weaknesses or deficiencies that require attention and/or improvement. |
| EC4 | The supervisor determines that banks’ liquidity strategy, policies and processes establish an appropriate and properly controlled liquidity risk environment including:
|
| Description and findings re EC4 | Liquidity risk is analyzed as part of the CBoB’s RBSF. CBoB reviews the risk management policy environment, the systems for the ongoing monitoring of liquidity risk, contingency planning and the day-to-day management of liquidity. The CBoB also conducts quarterly structured meetings with the DSIBs, which cover their liquidity risk management strategy. Further, CBoB conducts aggregate liquidity stress tests on the DSIB’s operations and the results discussed during these meetings with the banks’ risk managers. Further, SFI’s are required to provide CBoB with copies of their liquidity risk management strategies. CBoB expects changes in a licensee’s liquidity risk management to be communicated to the Inspector within two weeks of being approved by the Board (S. 2.2 of the Liquidity Guideline). Further, if a licensee has concerns about their current or future liquidity position, they are required to immediately inform CBoB of same and their plans to address these concerns. Liquidity risk management practices by SFIs may also reviewed during an on-site examination, if determined to be warranted through the risk assessment process. An on-site examination would typically review a bank’s liquidity management strategy, including: (1) The institution’s stock of liquid assets and their quality; (2) The volatility and diversity of deposits; (3) The quality and diversity of the loan book; (4) Contingent liabilities and loan commitments; (5) The availability and reliability of undrawn standby facilities; (6) The extent to which liquidity is managed, and supervised, on an integrated global basis; (7) The ability and willingness of the parent/head office to provide liquidity; and (8) The institution’s market standing and the quality of its treasury management. The on-site examination would typically determine whether the Board has established a level of tolerance for liquidity risk, the Board has a full understanding of the risks, contingency plans are adequate in relation to the size and complexity of bank operations and if management information systems provide concise, timely and relevant information for monitoring liquidity needs. |
| EC5 | The supervisor requires banks to establish, and regularly review, funding strategies and policies and processes for the ongoing measurement and monitoring of funding requirements and the effective management of funding risk. The policies and processes include consideration of how other risks (e.g. credit, market, operational and reputation risk) may impact the bank’s overall liquidity strategy, and include:
|
| Description and findings re EC5 | The Liquidity Risk Guideline address the following:
|
| EC6 | The supervisor determines that banks have robust liquidity contingency funding plans to handle liquidity problems. The supervisor determines that the bank’s contingency funding plan is formally articulated, adequately documented and sets out the bank’s strategy for addressing liquidity shortfalls in a range of stress environments without placing reliance on lender of last resort support. The supervisor also determines that the bank’s contingency funding plan establishes clear lines of responsibility, includes clear communication plans (including communication with the supervisor) and is regularly tested and updated to ensure it is operationally robust. The supervisor assesses whether, in the light of the bank’s risk profile and systemic importance, the bank’s contingency funding plan is feasible and requires the bank to address any deficiencies. |
| Description and findings re EC6 | The LRMR requires SFI to maintain liquidity contingency plans. CBoB examiner guidance on the review of contingency planning is detailed and addresses written policy requirements, defining alternative funding sources, ranking of customers in importance and volatility and media communication plans for emergency situations. The LRMR require contingency planning and informing the CBoB of any liquidity concerns (referred to in S. 5.1viii and S. 6.17 vi of the LRMR) The on-site examination team may review the strength of SFI’s liquidity contingency plans during an on-site liquidity risk management review if determined to be warranted through the risk assessment process. |
| EC7 | The supervisor requires banks to include a variety of short-term and protracted bank-specific and market-wide liquidity stress scenarios (individually and in combination), using conservative and regularly reviewed assumptions, into their stress testing programs for risk management purposes. The supervisor determines that the results of the stress tests are used by the bank to adjust its liquidity risk management strategies, policies and positions and to develop effective contingency funding plans. |
| Description and findings re EC7 | S.7.21 of the Guideline require SFIs to conduct stress tests on a regular basis for a variety of short term and protracted institution-specific and market-wide events across multiple time-zones, including on an intra-day basis. CBoB expects the results from such stress tests to be utilized by senior management to ensure current exposures are adequately managed with liquidity risk tolerance limits. The Guideline also requires an independent review (internal/external auditor) on the adequacy and effectiveness of the operations of an SFI’s stress testing program. CBoB reviews both the results of the stress testing and the independent reviews. The Guideline indicates that the Board has ultimate responsibility for the overall stress testing programme and should be aware of any key findings from the liquidity stress tests. The CBoB also conducts its own liquidity stress tests on an aggregate basis and encourages the commercial banks to integrate stress testing models that incorporates liquidity shocks as a part of their ICAAPs. |
| EC8 | The supervisor identifies those banks carrying out significant foreign currency liquidity transformation. Where a bank’s foreign currency business is significant, or the bank has significant exposure in a given currency, the supervisor requires the bank to undertake separate analysis of its strategy and monitor its liquidity needs separately for each such significant currency. This includes the use of stress testing to determine the appropriateness of mismatches in that currency and, where appropriate, the setting and regular review of limits on the size of its cash flow mismatches for foreign currencies in aggregate and for each significant currency individually. In such cases, the supervisor also monitors the bank’s liquidity needs in each significant currency, and evaluates the bank’s ability to transfer liquidity from one currency to another across jurisdictions and legal entities. |
| Description and findings re EC8 | SFI’s currency exposure is monitored quarterly by the off-site supervision surveillance team. However, banks are subject to a net open B$ position limit of up to $5,000,000, which is monitored daily by the SFIs. An on-site examination/review of an SFI’s currency exposures would include a of an SFI’s foreign currency liquidity management policies. exposures in a number of different segments (e.g., currency, geographic, industry), banks’ compliance with Exchange Control Regulations Act and self- imposed limits; as well as a detailed analysis of financial statements and accompanying notes. Currency Exposures reviews could occur during an on-site liquidity risk management review if determined to be warranted through the risk assessment. |
| Additional criteria | |
| AC1 | The supervisor determines that banks’ levels of encumbered balance-sheet assets are managed within acceptable limits to mitigate the risks posed by excessive levels of encumbrance in terms of the impact on the banks’ cost of funding and the implications for the sustainability of their long-term liquidity position. The supervisor requires banks to commit to adequate disclosure and to set appropriate limits to mitigate identified risks. |
| Description and findings re AC1 | |
| Assessment of Principle 24 | Compliant |
| Comments | CBoB’s LRMR, together with the Liquidity Risk Guideline, provide provides a thorough set of requirements and guidance in relation to SFI’s liquidity risk management. CBoB’s off-site surveillance team review and actively monitor SFI’s liquidity risk management and conditions (weekly for DSIB’s). CBoB recently released, for consultation with the industry, proposals regarding Basel III Liquidity Reforms on implementing a liquidity coverage ratio (LCR) and net stable funding ratio (NSFR) in The Bahamas. All SFIs would convert to these liquidity requirements when the reforms are implemented. |
| Principle 25 | Operational risk. The supervisor determines that banks have an adequate operational risk management framework that takes into account their risk appetite, risk profile and market and macroeconomic conditions. This includes prudent policies and processes to identify, assess, evaluate, monitor, report, and control or mitigate operational risk63 on a timely basis. |
| Essential criteria | |
| EC1 | Law, regulations or the supervisor require banks to have appropriate operational risk management strategies, policies and processes to identify, assess, evaluate, monitor, report and control or mitigate operational risk. The supervisor determines that the bank’s strategy, policies and processes are consistent with the bank’s risk profile, systemic importance, risk appetite and capital strength, take into account market and macroeconomic conditions, and address all major aspects of operational risk prevalent in the businesses of the bank on a bank-wide basis (including periods when operational risk could increase). |
| Description and findings re EC1 | CBoB’s Corporate Governance Guidelines outline the responsibility of the bank’s management and board in managing all types of risks to which the SFI is exposed, including operational risk. As noted elsewhere in this report, under the Guidelines on Corporate Governance SFIs’ Boards are required to annually certify to CBoB that the appropriate risk management systems are in place and sustainable. In addition, external auditors are required to inform CBoB if they become aware of anything that could interfere with the supervisors carrying out their responsibilities, such as materially inadequate controls that could threaten the SFI’s financial soundness. CBoBs Guidance Note on Accounting and Other Records and Internal Control Systems and Reporting Accountants’ Reports Thereon (1998) provides guidance on basic accounting and internal control systems and expectations. CBoB’s Business Continuity Guidelines require SFIs to have BCPs that are proportionate to the institution’s operational risk. CBoB also recently released Technology Risk Guidelines (2016) to address the potential impact technology issues can have on an organization’s ability to meet overall business objectives (including regulatory and prudential issues). CBoB’s Operational Risk Guidelines (issued in November 2013) require SFIs to have risk management frameworks that identify, assess, evaluate, monitor, report and control or mitigate operational risk. With respect to IT, the Guidelines require SFIs to ensure that IT systems are appropriately developed and maintained; and
Additionally, banks are required to: “Notify the Central Bank of any operational risk matter that may/has adversely impact the institution. This requirement includes, but is not limited to, notification of:
SFIs operational risk policies and processes could be assessed and tested by the onsite examination team if the Risk Assessment process deems a review of this area is warranted. The assessors noted that operational risks is an area where there has been significant onsite examination focus over the past four years, including an emphasis on outsourcing risk. In addition to using the basic indicator approach to assess regulatory capital for operational risk, CBoB also requires operational risk to be captured in an SFI’s ICAAP. |
| EC2 | The supervisor requires banks’ strategies, policies and processes for the management of operational risk (including the banks’ risk appetite for operational risk) to be approved and regularly reviewed by the banks’ Boards. The supervisor also requires that the Board oversees management in ensuring that these policies and processes are implemented effectively. |
| Description and findings re EC2 | As per EC 1 above, the Corporate Governance Guidelines outline the key responsibilities of the board and the management team. The board must certify annually that appropriate risk management systems have been put in place by management and are sustainable. Operational Risk Guidelines require SFIs’ boards of directors to “approve, and review on a regular basis, the risk appetite and tolerance statement that articulates the nature, types and levels of operational risk that the licensee is willing to assume. When approving and reviewing the risk appetite and tolerance statement, the Board should consider all relevant risks, the licensee’s risk aversion, its current financial condition and its strategic direction. The Board should also approve the appropriate thresholds/limits for specific operational risks and an overall operational risk appetite and tolerance. This review should consider changes in the external environment, material increases in business or activity volumes, the quality of the control environment, the effectiveness of risk management or mitigation strategies, loss experience and the frequency, volume, or nature of limit breaches. The Board should monitor management adherence to the risk appetite and tolerance statement and provide timely detection and remediation of breaches”. Additionally, the Guidelines state that “To ensure effective operational risk management, the Central Bank requires that the senior management of each of its licensees, under the approval of the board of directors, develop and implement an operational risk management framework (the framework) that explicitly recognizes operational risk as a distinct risk to the institution and aims to efficiently manage it”. |
| EC3 | The supervisor determines that the approved strategy and significant policies and processes for the management of operational risk are implemented effectively by management and fully integrated into the bank’s overall risk management process. |
| Description and findings re EC3 | CBoB obtains information on risk management programs and uses that information off-site to supervise SFIs’ risk identification, monitoring, and controlling processes. To assist in this process, CBoB review banks’ internal audit reports. In early 2010, the CBoB implemented its RBSF, which involves assessing all aspects of a licensee’s inherent business risks and its controls over those risks (including operational risks and operational control areas). As part of this exercise, the CBoB engages in structured meetings with banks to discuss their risk management techniques, including the management of operational risk. The following areas are discussed at these meetings:
The assessment of risk management techniques and practices is complemented by substantive on-site compliance tests, using a process of selective sampling as described in the examination modules. When evaluating the quality of risk management/corporate governance, emphasisis placed on the following elements: (1) active board and senior management oversight, (2) adequate policies, procedures, and limits (3) adequate risk-measurement and-monitoring supported by the appropriate management information systems, (4) a comprehensive process of control, and (5) appropriateness of human resource management system, including training programs. When an onsite examination is deemed warranted through the Risk Assessment process, an examination could review the existence, application and sustainability of the SFI’s policies and procedures. The onsite examination process would places significant emphasis on control processes. CBoB examiners can use a range of audit programs (designed specifically for examiners), depending upon the size and complexity of the bank. This process includes reviewing the quality and timeliness of information that is provided to senior management and the board. Assessors noted that among the onsite examinations carried out over the prior four years operational risk was a regular area of focus, particularly with respect to assessing an SFI’s outsourcing arrangements. |
| EC4 | The supervisor reviews the quality and comprehensiveness of the bank’s disaster recovery and business continuity plans to assess their feasibility in scenarios of severe business disruption which might plausibly affect the bank. In so doing, the supervisor determines that the bank is able to operate as a going concern and minimize losses, including those that may arise from disturbances to payment and settlement systems, in the event of severe business disruption. |
| Description and findings re EC4 | The CBoB has issued detailed business continuity planning guidance and reviews the banks’ plans and independent reviews that may be performed by third parties. CBoB requires an annual certification from an SFI’s board that the business continuity plans are still valid, and that the SFI’s BCP management team and/or an independent party have properly tested the BCP during the period. CBoB’s Business Continuity Guidelines (revised in October 2008) outline the key principles supervisors use to assess the adequacy of its licensees’ Business Continuity Plans (BCPs). CBoB expects all licensees to develop and implement workable and effective BCPs to ensure that specified operations can be maintained or recovered in a timely manner in the event of a disruption, consistent with the nature, size, and scope of their operations and complexity of their business. BCPs are expected to involve the following: business impact analyses, business recovery strategies, testing, training programs, communications and crisis management. SFIs are also expected to inform the CBoB Inspector as soon as possible after activation of its BCP. Further, the Board is required to include a statement in the Annual Corporate Governance Certificate confirming that the Board is satisfied that the recovery strategies adopted in the BCP are still valid, and that the licensee’s BCP management team and/or an independent party have properly tested the BCP during the period. CBoB will, in the course of its on-site examinations, review the BCP implemented, taking into consideration the extent to which a licensee has observed the guidelines and its risk profile. If the BCP is in the scope of an on-site examination, the onsite team will verify that:
Assessors noted a number of operational risk onsite reviews, including some that included BCP in the scope. |
| EC5 | The supervisor determines that banks have established appropriate information technology policies and processes to identify, assess, monitor, and manage technology risks. The supervisor also determines that banks have appropriate and sound information technology infrastructure to meet their current and projected business requirements (under normal circumstances and in periods of stress), which ensures data and system integrity, security and availability and supports integrated and comprehensive risk management. |
| Description and findings re EC5 | Typically, CBoB has relied on independent reports assessing the banks’ IT systems, often carried out by external auditors hired by the bank. Reports are reviewed for timeliness and content. Verification of the adequacy of banks’ IT systems is increasingly expected to be performed during onsite examinations. Since the prior FSAP, CBoB now has specialized IT examiners in place to assess information systems. In addition to reviewing the adequacy of the IT environment, examiners also assess data aggregation and reporting. This includes assessing the infrastructure for reporting key information, the decision-making process, management of information across branches and the speed at which information is available for decisions to be made. CBoB developed and issued Technology Risk Management Guidelines in January 2016. The Guidelines provide firms with general guidance for addressing risks associated with managing the technology used in their operations. The aim of the guidelines is to highlight risks inherent to the deployment and management of technology as well as to provide broad guidance for firms on risk management principles and security practices which may assist the financial sector with establishing a robust technology risk management framework; strengthening IT system security, reliability, availability and recoverability; and emphasizing the benefit of using appropriate technologies and control mechanisms that protect customer data and transactions. |
| EC6 | The supervisor determines that banks have appropriate and effective information systems to:
|
| Description and findings re EC6 | If deemed warranted through the Risk Assessment process, CBoB supervisors would conduct examinations of licensees’ operational risk information systems. Assessors noted that there have been several examinations focused on IT risks since 2015. |
| EC7 | The supervisor requires that banks have appropriate reporting mechanisms to keep the supervisor apprised of developments affecting operational risk at banks in their jurisdictions. |
| Description and findings re EC7 | CBoB Guidelines require SFIs to have communication plans to inform the regulators and other interested parties in the event of operational issues. In addition, the Technology Risk Guidelines require SFIs to have procedures in place to communicate with the central bank in the event that critical systems failure. |
| EC8 | The supervisor determines that banks have established appropriate policies and processes to assess, manage and monitor outsourced activities. The outsourcing risk management program covers:
Outsourcing policies and processes require the bank to have comprehensive contracts and/or service level agreements with a clear allocation of responsibilities between the outsourcing provider and the bank. |
| Description and findings re EC8 | Operational Risk Guidelines state: “Licensees’ outsourcing policies and risk management activities should encompass: (a) procedures for determining whether and how activities can be outsourced; (b) processes for conducting due diligence in the selection of potential service providers; (c) sound structuring of the outsourcing arrangement, including ownership and confidentiality of data, as well as termination rights; (d) programs for managing and monitoring the risks associated with the outsourcing arrangement, including the financial condition of the service provider; (e) establishment of an effective control environment at the licensee and the service provider; (f) development of viable contingency plans; and (g) execution of comprehensive service level agreements with a clear allocation of responsibilities between the outsourcing provider and the licensee”. CBoB has issued detailed Guidelines on the Minimum Standards for the Outsourcing of Material Functions (the Outsourcing Guidelines). The Guidelines state that: The bank’s management must satisfy the central bank that adequate procedures are in place and that it has the ability to monitor and control the outsourced function on an ongoing basis. The central bank will hold the bank’s board and management responsible for ensuring that the outsourced functions are carried out to an appropriate standard and that the integrity of the bank’s systems and controls is maintained. The guidelines reflect international practice and the Joint Forum guidelines. Proposals to outsource material functions are reviewed by the CBoB. The CBoB considers and examines the effects of the outsourced activity on the operational risk of the bank. |
| Additional criteria | |
| AC1 | The supervisor regularly identifies any common points of exposure to operational risk or potential vulnerability (e.g. outsourcing of key operations by many banks to a common service provider or disruption to outsourcing providers of payment and settlement activities). |
| Description and findings re AC1 | CBoB does not collect information on this area. |
| Assessment of Principle 25 | Compliant |
| Comments | Since the prior BCP assessment, CBoB has issued guidelines for operational risk management supervision and hired staff with IT expertise, addressing recommendations from that assessment. Assessors observed that operational (and IT) risks have been an area of focus for CBoB, including through a number of onsite examinations. Operational risk management supervision is assessed as sufficient for the jurisdiction. |
| Principle 26 | Internal control and audit. The supervisor determines that banks have adequate internal control frameworks to establish and maintain a properly controlled operating environment for the conduct of their business taking into account their risk profile. These include clear arrangements for delegating authority and responsibility; separation of the functions that involve committing the bank, paying away its funds, and accounting for its assets and liabilities; reconciliation of these processes; safeguarding the bank’s assets; and appropriate independent64 internal audit and compliance functions to test adherence to these controls as well as applicable laws and regulations. |
| Essential criteria | |
| EC1 | Laws, regulations, or the supervisor require banks to have internal control frameworks that are adequate to establish a properly controlled operating environment for the conduct of their business, taking into account their risk profile. These controls are the responsibility of the bank’s Board and/or senior management and deal with organizational structure, accounting policies and processes, checks and balances, and the safeguarding of assets and investments (including measures for the prevention and early detection and reporting of misuse such as fraud, embezzlement, unauthorized trading and computer intrusion). More specifically, these controls address:
|
| Description and findings re EC1 | The Guidelines for the Corporate Governance of Banks and Trust Companies Licensed to do Business within and from within The Bahamas (Section 4.3) specify that the Board is ultimately responsible for ensuring that an adequate, effective, comprehensive and transparent process of corporate governance, which is consistent with the unique character of the bank and the nature, complexity and risks inherent in the bank’s business activities, and is able to respond to the changes in the bank’s business environment, is maintained and implemented. Section 4.4 states the Board is ultimately responsible for setting and confirming the organization’s strategic direction, business focus and corporate values. Section 4.5 provides that the bank’s senior management is responsible for the day-to-day operations of the business, serving as a link between the Board and staff. The senior management responsibilities include: (a) implementing the bank’s strategic plan; (b) keeping the board adequately informed about the performance of the bank through financial and management reports and the reports prepared by internal auditors, external auditors, the compliance officer and regulators; (c) advising the board on the appropriate structure, and ensuring that the quantity and quality of staff resources are available to carry out all tasks, including internal and external audit and compliance; (d) implementing and maintaining risk management systems appropriate to the scale, nature and complexity of the bank; and (e) overseeing management information systems to enable timely and accurate dissemination of information to the Board and regulators. Section 4.7 stipulates that management, under the general direction of and oversight of the Board, should develop and implement a comprehensive risk management system commensurate with the scope of the bank’s activities, incorporating continuous identification, measurement, monitoring and control of risk. The Board itself should specifically address significant issues in the system’s development and implementation, as well as implement an effective process to independently determine that the risk management system is appropriate and ensure that its effectiveness is regularly assessed. The Guidelines require the Board to provide a certification to CBoB as to the bank’s compliance or non-compliance with the expectations detailed in the Guidelines. Additionally, the certification requires the Board, with advice and assistance from management, to attest it has independently assessed and documented whether the bank’s corporate governance process is effective and whether it has successfully achieved its objectives. The Board must report to CBoB any materially deficiencies and problems that are identified within the bank, along with plans and timetables for their correction. The Guidelines requires Boards of SFIs to determine that the entity’s internal controls:
The Guidance Note On Accounting and Other Records and Internal Control Systems and Reporting Accountants’ Report Thereon provides (Section 3) that the scope and nature of the specific control objectives which are required for the business to be conducted in a prudent manner should be commensurate with the bank’s needs and particular circumstances. They are also expected to be appropriate given the manner in which the business is structured, organized and managed, its size and the nature, volume and complexity of its transactions and commitments. Subject to this each SFI should address the following control objectives:
Accountants appointed by the bank and not objected to by CBoB must form an opinion on whether the SFI’s accounting and other records and internal control systems have been maintained by management during the period examined (generally the SFI’s financial year) in accordance with the Guidelines. In forming this opinion, the Reporting Accountants are expected to view effectiveness with regard to the nature and scale of the business undertaken by the SFI. The report should be completed, dated and submitted to the SFI not more than three months after the end of the period examined. The SFI then submits the report to CBoB with such comments as management sees fit to make, not more than one month after the date of the report. |
| EC2 | The supervisor determines that there is an appropriate balance in the skills and resources of the back office, control functions and operational management relative to the business origination units. The supervisor also determines that the staff of the back office and control functions have sufficient expertise and authority within the organization (and, where appropriate, in the case of control functions, sufficient access to the bank’s Board) to be an effective check and balance to the business origination units. |
| Description and findings re EC2 | When a risk area or operating activity is deemed through the Risk Assessment Process to warrant an onsite review, the on-site examination process may place emphasis on the controls at the SFI, using a range of audit programs designed to assist supervisors. This could include a review of skills and resources and an assessment of the control functions relative to front and back activities. In addition, as indicated in EC 3, the directors, in their annual certification, must identify any material deficiencies or problem in their bank. As noted elsewhere in this report, CBoB’s risk-based supervisory approach does much of the control process assessments through offsite supervision—surveillance and monitoring—and with respect to internal controls places particular emphasis on the work of internal and external auditors and the annual certification the SFIs’ boards of directors are required to provide. Assessors did observe assessments of key control processes in the Risk Assessment documents as well as in reports of examination, for areas where onsite reviews have been conducted since 2015. |
| EC3 | The supervisor determines that banks have an adequately staffed, permanent and independent compliance function65 that assists senior management in managing effectively the compliance risks faced by the bank. The supervisor determines that staff within the compliance function are suitably trained, have relevant experience and have sufficient authority within the bank to perform their role effectively. The supervisor determines that the bank’s Board exercises oversight of the management of the compliance function. |
| Description and findings re EC3 | The Guidelines for the Corporate Governance of Banks (and Trust Companies) specify that the Board of a SFI must appoint a Compliance Officer (who may also function as the Money Laundering Reporting Officer (MLRO)), to be responsible, under its guidance, for ensuring that the bank is in full compliance with the laws of The Bahamas. In 90 percent of CBoB SFIs, the MLRO and the CO are the same person. The Compliance Officer should be independent and free from influences that may affect his/her ability to perform his/her duties objectively. He/she should also have direct, unrestricted access to the Board and/or Group Compliance. Assessors note that the 2017–2018 AML/CFT thematic reviews did assess the role of the MLRO and the compliance function; compliance with AML/CFT requirements was the primary area of supervisory focus for 2017–2018. When CBoB carries out reviews of SFI’s Corporate Governance framework, they assess the role and effectiveness of the compliance function throughout the organization. |
| EC4 | The supervisor determines that banks have an independent, permanent and effective internal audit function66 charged with:
|
| Description and findings re EC4 | The ‘Guidance Note on Accounting and Other Records and Internal Controls Systems and Reporting Accountants’ Reports Thereon’ requires that an internal audit function be established and maintained by management and should be distinct from the primary control functions. Not all SFIs are required to have an internal audit function, at the discretion of the CBoB Inspector. Smaller trust companies are more likely to outsource to an external auditor than banks and almost all banks have an internal audit function, either within the institution or as part of the international group’s wider internal audit function, where relevant. The following are expected of an internal audit function:
Internal audit work papers and reports are reviewed periodically offsite in association with tracking of firms’ progress against required remedial actions. Internal audit can also be reviewed during an onsite examination where that is deemed warranted by the risk assessment process. Assessors noted some coverage of internal audit both in risk assessments and onsite reviews, which largely consisted of reviewing the work of internal audit in the area being examined and discussing issues with auditors. Where a full onsite review of internal would be undertaken, if deemed warranted through the Risk Assessment process, the examination could cover verifying the independence of the IA function through the following supervision procedures:
Additionally, during the onsite examination, the examiners would:
|
| EC5 | The supervisor determines that the internal audit function:
|
| Description and findings re EC5 | The First Schedule of the BTCRA—Rules of Inspection and Supervision of Banks—specifies that CBoB shall ensure that banks have in place internal controls adequate to the nature and scale of their operations, and adequate policies, practices and procedures. In addition, the Guidelines for the Corporate Governance of Banks (and Trust Companies) specifies that it is the responsibility of senior management in a bank to advise the Board on the appropriate organizational structure, and ensure that the quantity and quality of staff resources are available to carry out all tasks, including internal audit and compliance. If an onsite review of IA is deemed warranted through the Risk Assessment process, the onsite examination would be expected to assess the following:
The examination team also reviews the IA Charter/Governance documents, policies or procedures to ensure IA has the authority to assess outsourced functions. Additionally, the team ensures the audit plan includes an assessment of the outsourced function and its inclusion in the audit plan. |
| Assessment of Principle 26 | Largely Compliant |
| Comments | Typically, the quality of internal audit is assessed through offsite reviews of their reports and their work on following up on issues supervisors have required the SFIs to address. Internal audit is specifically discussed/considered in the Risk Assessment Process as it is a part of the required assessment of governance and oversight and is seen as serving as a mitigant to inherent risks. Independence is assessed as described in the ECs above with a primary focus on reviewing the organizational structure and reporting lines therein. In addition, in the course of most onsite exams there would be review of the work of audit in the specific area being examined and discussions with the auditor about its work, which primarily allows for an understanding of the general competence of IA in the context of the specific area being reviewed. Broader coverage of internal audit effectiveness would typically occur during an operational risk examination under CBoB’s current procedures. The assessors were able to ascertain that CBoB supervisors did have an informed view of the effectiveness of internal audit at SFIs through a combination of the activities noted above. However, a broader holistic view of internal audit as a critical contributing element to an effective corporate governance regime did not appear to be an area of focus. Assessors recommend considering this approach as it would enhance the ability to assess overall internal audit effectiveness as a third line of defense on a firm-wide basis and to assess corporate governance and the effectiveness of the board and senior management with respect to the responsibilities outlined in the Guidelines for Corporate Governance. |
| Principle 27 | Financial reporting and external audit. The supervisor determines that banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance with accounting policies and practices that are widely accepted internationally and annually publish information that fairly reflects their financial condition and performance and bears an independent external auditor’s opinion. The supervisor also determines that banks and parent companies of banking groups have adequate governance and oversight of the external audit function. |
| Essential criteria | |
| EC1 | The supervisor67 holds the bank’s Board and management responsible for ensuring that financial statements are prepared in accordance with accounting policies and practices that are widely accepted internationally and that these are supported by recordkeeping systems in order to produce adequate and reliable data. |
| Description and findings re EC1 | CBoB Guidelines specify that it is the responsibility of a SFI’s board of directors and management to ensure that adequate records and systems are maintained. Under the BTCRA, every SFI must publish a statement of its accounts and the external auditor must certify that the statement of accounts provides a true and correct view of the state of the bank’s affairs as evidenced by the books and records of the bank. Financial statements are not accepted as audited unless signed by the external auditor and a manager or anyone duly authorized to sign on behalf of the bank. Such statements shall be published in such form and manner and shall contain such particulars as the CBoB may direct. The annual audited statement of accounts must be prepared in accordance with IFRSs. Exceptions are made for subsidiaries and branches of United States banks, which may report using U.S. GAAP. BICA has adopted and implemented best international audit practice in The Bahamas. |
| EC2 | The supervisor holds the bank’s Board and management responsible for ensuring that the financial statements issued annually to the public bear an independent external auditor’s opinion as a result of an audit conducted in accordance with internationally accepted auditing practices and standards. |
| Description and findings re EC2 | SFI’s must include an external auditor’s opinion in the publication of its financial statements. The annual audited statement of accounts must be prepared in accordance with IFRS. |
| EC3 | The supervisor determines that banks use valuation practices consistent with accounting standards widely accepted internationally. The supervisor also determines that the framework, structure and processes for fair value estimation are subject to independent verification and validation, and that banks document any significant differences between the valuations used for financial reporting purposes and for regulatory purposes. |
| Description and findings re EC3 | CBoB requires banks to be compliant with international accounting standards. The BTCRA provides that the CBoB Inspector shall ensure that banks establish and adhere to practices and procedures for evaluating the quality of assets and the adequacy of loan loss provisions and loan loss reserves. CBoB places reliance on the external auditor to serve as an independent source for valuation and to ensure accurate valuations and associated books and records. Where an external auditor is found to be ineffective, CBoB can replace the external auditor. |
| EC4 | Laws or regulations set, or the supervisor has the power to establish the scope of external audits of banks and the standards to be followed in performing such audits. These require the use of a risk and materiality based approach in planning and performing the external audit. |
| Description and findings re EC4 | The BICA is the body statutorily charged with the oversight of accounting and auditing in The Bahamas. BICA has adopted and implemented International Accounting Reporting Standards (IFRS) and best international auditing practices in The Bahamas. The BTCRA gives CBoB the authority to require that the auditor of a bank report to CBoB on the extent of the procedures of the auditor in the examination of the annual financial statements and may require that the auditors enlarge the scope of that examination or direct that any other particular procedure be performed in any particular case. CBoB can also require that the auditor make a particular examination relating to the adequacy of the procedures adopted by the bank for the safety of its creditors and shareholders, or any other examination as considered necessary by CBoB. Under Section 13 of BTCRA, CBoB can request an external auditor to undertake a specific review of a bank’s operations or risk management system and CBoB has used external auditors for ‘special reviews’ of certain areas. |
| EC5 | Supervisory guidelines or local auditing standards determine that audits cover areas such as the loan portfolio, loan loss provisions, non-performing assets, asset valuations, trading and other securities activities, derivatives, asset securitizations, consolidation of and other involvement with off-balance sheet vehicles and the adequacy of internal controls over financial reporting. |
| Description and findings re EC5 | Local auditing standards, which are in line with international practices, covers all the areas referred to in EC 5 to allow for the auditor to form an opinion on the true and fair position of a SFI. External auditors provide an opinion on the financial statements of the SFIs though they do not sign off on the adequacy of specific internal control processes of the SFI with respect to supervisory expectations for these practices. Their opinion is on the true and fair statement of the financials. |
| EC6 | The supervisor has the power to reject and rescind the appointment of an external auditor who is deemed to have inadequate expertise or independence, or is not subject to or does not adhere to established professional standards. |
| Description and findings re EC6 | Section 12 of the BTCRA provides that CBoB may at any time require the replacement of a SFI’s external auditor. |
| EC7 | The supervisor determines that banks rotate their external auditors (either the firm or individuals within the firm) from time to time. |
| Description and findings re EC7 | There is no formal requirement for external auditors to rotate. It is industry practice to rotate periodically and the assessors were told that CBoB does check to see if there is appropriate rotation. CBoB meets periodically with external auditors and can replace them if it feels that is warranted. |
| EC8 | The supervisor meets periodically with external audit firms to discuss issues of common interest relating to bank operations. |
| Description and findings re EC8 | Meetings between the Bank and the auditors are held as required (e.g., where the central bank would want the auditors to include a specific test or to confirm a control or internal procedure or to sensitize the auditors to issues which may have a bearing on the audit or where the auditor proposes to vary the scope of the audit). CBoB also chairs an auditors’ Advisory Committee (which comprises members of the main accounting firms) that meets on a semi-annual basis to discuss issues of common interest. |
| EC9 | The supervisor requires the external auditor, directly or through the bank, to report to the supervisor matters of material significance, for example failure to comply with the licensing criteria or breaches of banking or other laws, significant deficiencies and control weaknesses in the bank’s financial reporting process or other matters that they believe are likely to be of material significance to the functions of the supervisor. Laws or regulations provide that auditors who make any such reports in good faith cannot be held liable for breach of a duty of confidentiality. |
| Description and findings re EC9 | The BTCRA requires the external auditor—and in some instances a former external auditor—to inform the CBoB Inspector in writing of any matter of which the auditor has or had become aware and which is, or is likely to be, of material significance for the Inspector in relation to the discharge of his duties. Section 13(5) of the BTCRA states that, “no duty of confidentiality to which an auditor or former auditor of a licensee may be subject shall be regarded as having been breached by reason of his communicating in good faith to the Inspector any information or opinion which is relevant to the functions and responsibilities of the Inspector under this Act, whether or not such information or opinion is provided in response to a request made by the Inspector.” |
| Additional criteria | |
| AC1 | The supervisor has the power to access external auditors’ working papers, where necessary. |
| Description and findings re AC1 | Under the BTCRA, the CBoB Inspector can call upon the external auditor to produce working papers, information or explanation. |
| Assessment of Principle 27 | Compliant |
| Comments | Industry practice in The Bahamas is for audit firms to rotate as external auditors every 7– 10 years. Assessors recommend that CBoB put in place a requirement that they rotate on a reasonable cycle to promote independence, require a ‘fresh set of eyes’ periodically, and reduce the potential for conflicts of interest to develop. |
| Principle 28 | Disclosure and transparency. The supervisor determines that banks and banking groups regularly publish information on a consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects their financial condition, performance, risk exposures, risk management strategies and corporate governance policies and processes. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require periodic public disclosures68 of information by banks on a consolidated and, where appropriate, solo basis that adequately reflect the bank’s true financial condition and performance, and adhere to standards promoting comparability, relevance, reliability and timeliness of the information disclosed. |
| Description and findings re EC1 | Section 8 of BTCRA requires that a SFI, within four months of the end of its financial year, publish a true and full yearly statement of its accounts. The external auditor of the bank shall certify that such statement is a true and correct view of the state of the SFI’s affairs as shown by the books and records of the bank. All audited financial statements must be posted in the Official Gazette or on the bank’s website. If a bank opts for the posting of an abridged version, it must indicate in a footnote to the abridged version that the public may obtain a copy of the full set of the audited financial statements at its registered office in The Bahamas. Banks that take deposits from the Bahamian public (i.e., commercial banks/domestic banks) are required to publish their financial statements in the local newspapers. International SFIs are not required to publish their profit and loss statements. The lack of a standardized and consistent asset classification regime could lead to inconsistency across firms with respect to provisioning and loan loss reserves as each can define its own classification scheme for problem loans. |
| EC2 | The supervisor determines that the required disclosures include both qualitative and quantitative information on a bank’s financial performance, financial position, risk management strategies and practices, risk exposures, aggregate exposures to related parties, transactions with related parties, accounting policies, and basic business, management, governance and remuneration. The scope and content of information provided and the level of disaggregation and detail is commensurate with the risk profile and systemic importance of the bank. |
| Description and findings re EC2 | All banks must prepare their accounts in line with IFRS requirements and include the disclosures required by that regime. There are currently no specific requirements for the disclosure of qualitative information put in place by CBoB. |
| EC3 | Laws, regulations or the supervisor require banks to disclose all material entities in the group structure. |
| Description and findings re EC3 | There are currently no specific CBoB requirements to disclose all material entities in the group structure. |
| EC4 | The supervisor or another government agency effectively reviews and enforces compliance with disclosure standards. |
| Description and findings re EC4 | The BICA—the statutory body charged with the oversight of accounting and auditing—monitors requirements re IFRS disclosure standards. |
| EC5 | The supervisor or other relevant bodies regularly publishes information on the banking system in aggregate to facilitate public understanding of the banking system and the exercise of market discipline. Such information includes aggregate data on balance sheet indicators and statistical parameters that reflect the principal aspects of banks’ operations (balance sheet structure, capital ratios, income earning capacity, and risk profiles). |
| Description and findings re EC5 | The CBoB publishes aggregate information in its Quarterly Statistical Digests on the domestic banking sector. It has recently begun to publish aggregate data for the international/offshore SFIs. |
| Additional criteria | |
| AC1 | The disclosure requirements imposed promote disclosure of information that will help in understanding a bank’s risk exposures during a financial reporting period, for example on average exposures or turnover during the reporting period. |
| Description and findings re AC1 | There are no requirements for disclosing intra-period balances. |
| Assessment of Principle 28 | Largely Compliant |
| Comments | CBoB issued Minimum Disclosure Guidelines in December 2016 for all public licensees that are subject to Basel II reporting. Due to feedback received from industry, however, CBoB withdrew this Guideline in March of 2017 in order to reconsider the intended balance between the costs and benefits of public disclosure and the burdens placed on the SFIs. In August 2018, CBoB released its proposed approach for minimum disclosures in a Discussion Paper for industry feedback. The proposal includes the disclosure of all necessary bank data at a dedicated and publicly accessible location on CBoB’s website, which will optimize accessibility, consistency and comparability of bank’s financial information, without imposing any additional regulatory burden or costs. Assessors encourage CBoB to set disclosure requirements such that the public can gain a full picture of key practices, exposures and condition of SFIs in a manner that allows for a clear assessment of the firms in a comparable manner. It is important that requirements cover qualitative information on practices as well as quantitative information. The balance of costs versus benefits in this area can be hard to gauge as the specific benefits to all potential users of the information can be particularly hard to value. CBoB should proceed with caution with respect to taking on the responsibility for ensuring disclosure of accurate information about the firms. This may be a costly endeavor and could place CBoB in a role of information and data verification that could require substantial resources. Where information is being provided by the SFIs with only a limited (internal consistency) verification process by CBoB, care should be taken to clarify that CBoB does not attest to the veracity of all the information. Even with such clarification, CBoB will increase its reputational risk with this proposal as it is likely to be the case that even if CBoB is not held directly accountable if/when inaccurate data/information is published, it will raise questions as to why, as the SFIs supervisor, they are not taking stronger actions to ensure the integrity of this information in the first place. |
| Principle 29 | Abuse of financial services. The supervisor determines that banks have adequate policies and processes, including strict customer due diligence (CDD) rules to promote high ethical and professional standards in the financial sector and prevent the bank from being used, intentionally or unintentionally, for criminal activities.69 |
| Essential criteria | |
| EC1 | Laws or regulations establish the duties, responsibilities and powers of the supervisor related to the supervision of banks’ internal controls and enforcement of the relevant laws and regulations regarding criminal activities. |
| Description and findings re EC1 | S. 17 (h) (First Schedule) of the BTCRA states that the Inspector of CBoB shall ensure that banks and trust companies have in place internal controls adequate to the nature and scale of their operations, and adequate policies, practices and procedures, including strict know-your-customer rules that promote high ethical standards, and so prevent the use of the bank for criminal purposes. Part II of the Guidelines For Supervised Financial Institutions on the Prevention of Money Laundering, Countering The Financing of Terrorism & Proliferation Financing (Revised 29 August 2018) (AML/CFT/PF Guidelines) provide guidance to SFIs (including credit unions) on internal Controls, policies and procedures, including the requirement for SFIs to conduct risk self-assessment, identification and assessment of inherent risk, establish risk tolerance, risk mitigation, evaluate residual risk and monitor and review risks pertaining to criminal activities. Further, the Financial Transaction Reporting Act, 2018 (FTRA) provides additional guidance on customer due diligence requirements (S. 6–14) and internal controls requirements (S. 19–24). Enforcement provisions, including fines, penalties and criminal convictions, that banks, including credit unions are subject to for the failure of ensuring adequate policy, procedures for the prevention, detection and reporting of such criminal activity is included in the following relevant provisions of legislation:
CBoB issued a guidance note (effective 14 December 2018) which applied to entities supervised pursuant to BTCRA and the Regulations as well as COCUA on AML Administrative Monetary Penalties (AML AMP) in accordance with the provisions of the FTRA, 2018. Pursuant to section 57 of the FTRA, the CBoB as a Supervisory Authority is empowered to impose AMPs against any SFI or person (employees, director or senior managers of an SFI), in respect of their contravention of provisions of FTRA. The schedule to the guidance note outlined all AMPs that can be administered promptly. S. 22 of the AML/CFT/PF Guidelines states that the CBoB has informed all of its Licensees that failure to implement or maintain adequate policies and procedures relating to money laundering and terrorist financing would be taken into account in determining if the licensee continues to satisfy the criteria for licensing laid down in BTCRA. In addition, it has advised all licensees that these Guidelines would be used as part of the criteria against which it will assess the adequacy of a licensee’s systems to prevent money laundering and terrorist financing |
| EC2 | The supervisor determines that banks have adequate policies and processes that promote high ethical and professional standards and prevent the bank from being used, intentionally or unintentionally, for criminal activities. This includes the prevention and detection of criminal activity, and reporting of such suspected activities to the appropriate authorities. |
| Description and findings re EC2 | The CBB issued revised AML/CFT/CPF Guidelines on August 29, 2018, to reflect the changes resulting from the enactment of the ATA 2018, FTRA 2018 (and its regulations), and POCA 2018. S. 22 of the AML/CFT/PF Guidelines stipulates that SFIs are required to establish clear responsibilities and accountabilities to ensure that policies, procedures, and controls which deter criminals from using their facilities for money laundering or the financing of terrorism, are implemented and maintained, thus ensuring that they comply with their obligations under the law. SFIs should have in place sufficient controls and monitoring systems for timely detection and reporting of suspicious transactions. S. 13(2) of the BTCRA empowers the Inspector to conduct on-site examinations and off-site supervision of the business of the licensee for the purpose of satisfying himself that the provisions of the FTRA are being complied with. In the cases where the Inspector is unable to conduct such examination or supervision, to appoint an auditor to conduct such examination or supervision and to report to the Governor. As indicated in the press release dated December 2017 of the summary results of the National Risk Assessment of The Bahamas, CBoB created an AML Analytics Unit on November 1, 2017 that undertook the enhancement of the AML supervisory framework and risk model. CBoB also conducted focused AML/CFT risk assessments during 2018 of all public and active Banks, Bank and Trusts, Trust Companies and Credit Unions as well as carrying out targeted on-site examinations of SFIs compliance programs. As a result, CBoB has undertaken increased monitoring and supervision for higher risk SFIs. |
| EC3 | In addition to reporting to the financial intelligence unit or other designated authorities, banks report to the banking supervisor suspicious activities and incidents of fraud when such activities/incidents are material to the safety, soundness or reputation of the bank.70 |
| Description and findings re EC3 | Licensees are required to notify CBoB immediately if they become aware that a material event (for example, suspicious activity, incidence of fraud or regulatory infringement actions) could have a significant impact on the banks’ safety and soundness or reputation. |
| EC4 | If the supervisor becomes aware of any additional suspicious transactions, it informs the financial intelligence unit and, if applicable, other designated authority of such transactions. In addition, the supervisor, directly or indirectly, shares information related to suspected or actual criminal activities with relevant authorities. |
| Description and findings re EC4 | The PCA requires CBoB to report any information it obtains which in its opinion indicates that any person has or may have been engaged in money laundering or terrorist financing and to disclose that information to the Financial Intelligence Unit (FIU) or the law enforcement authorities. S. 27.1 of the AML/CFT/PF Guidelines stipulates that all licensees are required to establish a point of contact with the Financial Intelligence Unit (FIU) in order to handle the reported suspicions of their staff regarding money laundering or terrorist financing. SFIs are required to appoint a MLRO/CO to undertake this role, and such officer is not only required to be registered with the FIU, but to report suspicious transactions directly to the FIU. Section 38 (9) of the CBBA allows CBoB to cooperate and exchange information with any other regulatory authority in The Bahamas where it is considered by the Governor that such cooperation or information may be relevant to the functions of such other regulatory authority or as a necessary part of a framework for consolidated supervision, oversight or regulation of the financial services sector. S. 38 (3) of the CBBA provides that CBoB may disclose to an overseas regulatory authority information necessary to enable that authority to exercise regulatory functions including the conduct of civil or administrative investigations and proceedings to enforce laws, regulations and rules administered by that authority. |
| EC5 | The supervisor determines that banks establish CDD policies and processes that are well documented and communicated to all relevant staff. The supervisor also determines that such policies and processes are integrated into the bank’s overall risk management and there are appropriate steps to identify, assess, monitor, manage and mitigate risks of money laundering and the financing of terrorism with respect to customers, countries and regions, as well as to products, services, transactions and delivery channels on an ongoing basis. The CDD management program, on a group-wide basis, has as its essential elements:
|
| Description and findings re EC5 | S. 25 of the AML/CFT/PF Guidelines stipulates that every licensee is required to develop and implement a risk rating framework which is approved by its Board of Directors as being appropriate for the type of products offered by the Licensee, and capable of assessing the level of potential risk each client relationship poses to the Licensee. At a minimum, the risk rating framework should include: (a) differentiation of client relationships by risk categories (Such as high, moderate or low); (b) differentiation of client relationships by risk factors (e.g., client type/profession, country of domicile, etc.); (c) the KYC documentation and due diligence information requirements appropriate for each risk category and risk factor; and (d) a process for the approval of the downgrading/upgrading of risk ratings through the periodic review of the customer relationship.
CBoB’s AML Analytics Unit, along with the Supervisory teams, carried out a targeted off-site review of all SFI’s AML/CFT policies and procedures in 2018, together with collecting information on SFI’s self-assessment against AML/CFT requirements through a survey. After this review was carried out, CBoB conducted targeted AML on-site examinations during 2018 to include the review of most of these components regarding SFI’s compliance with their own CDD policies and procedures. SFI’s received post-examination letters outlining CBoB’s expectations in addressing any deficiencies found as a result of the on-site review. CBoB is in the process of sending each SFI a letter outlining the results of its off-site and on-site AML/CFT review where in SFI’s are expected to address any gaps in compliance on a timely basis. |
| EC6 | The supervisor determines that banks have in addition to normal due diligence, specific policies and processes regarding correspondent banking. Such policies and processes include:
|
| Description and findings re EC6 | S. 150 of the AML/CFT/PF Guidelines provides that licensees should obtain senior management approval before establishing new correspondent relationships and a review of the correspondent banking relationship should be conducted at least annually to ensure AML/CFT requirements are met. S. 151 provides that transactions conducted through correspondent relationships need to be monitored according to perceived risk. Where the respondent bank or counterparty is not regulated by a country listed in the First Schedule of the FTRA (i.e., OECD- type countries), additional due diligence should be carried out to ascertain and assess whether the AML/CTF controls are in accordance with standards which are at least equivalent to those required under Bahamian law. Correspondent relationships could be reviewed during an onsite AML review, if determined to be warranted through the risk assessment process. |
| EC7 | The supervisor determines that banks have sufficient controls and systems to prevent, identify and report potential abuses of financial services, including money laundering and the financing of terrorism. |
| Description and findings re EC7 | S. 13 (2) (b) of the BTCRA provides that the CBoB shall conduct on-site examinations and off-site supervision of the business of licensees for the purpose of satisfying itself that the provisions of the BTCRA and the FTRA (which requires financial institutions to identify their customers) are being complied with and that the bank is in sound financial condition. The on-site examination program pertaining to AML reviews examines SFI’s controls and systems to prevent, identify and report potential abuses of financial services pertaining to AML/CFT. In addition, annually, within 120 days of the end of each calendar year, the Board will be required to provide a certification to CBoB as to the bank’s compliance or otherwise with the contents of the Guidelines. Additionally, the certification should also state that, using the advice and assistance of management, the Board has independently assessed and documented whether the bank’s corporate governance process is effective and whether it has successfully achieved its objectives. The Board must report any material deficiencies and problems that are identified within the bank, along with plans and timetables for their correction. The off-site surveillance team examines these annual Board certifications for self-identified gaps pertaining to AML/CFT related issues. |
| EC8 | The supervisor has adequate powers to take action against a bank that does not comply with its obligations related to relevant laws and regulations regarding criminal activities. |
| Description and findings re EC8 | S. 18 of the BTCRA and S. 14 of the CUA speak to a wide range of sanctions for non-compliance with AML/CFT requirements including the power to issue directions, impose, amend or vary conditions upon the licence, requiring the substitution of directors and officers, restricting, suspending or revoking licences, or suspending and cancelling registrations. CBoB issued a guidance note (effective 14 December 2018) which applied to entities supervised pursuant to BTCRA and the Regulations as well as COCUA on AML Administrative Monetary Penalties (AML AMP) in accordance with the provisions of the FTRA, 2018. In general, failure to comply with the AML/CFT/PF Guidelines is an offense, punishable by maximum fines of $10,000 (on summary conviction); $50,000 (for a first offence on conviction in the Supreme Court); and $100,000 for any subsequent offence on conviction in the Supreme Court. Under the Financial Transactions Reporting (Wire Transfers) Regulations, a maximum fine of $2,000 (civil penalty) applies. To date no SFI has been fined or been issued a direction by the CBoB related to AML/CFT issues, as these issues are typically dealt with through the normal supervisory interaction between CBoB and the SFI. |
| EC9 | The supervisor determines that banks have:
|
| Description and findings re EC9 | Section 3.5 of the Guidance Note on Accounting and Other Records and Internal Control Systems and Reporting Accountants’ Reports require that, in general, the internal auditor must undertake a review of the appropriate scope, efficiency and effectiveness of internal control systems, a detailed testing of transactions and balances and the operation of individual internal controls to ensure that specific control objectives have been met and a review of the implementation of management policies has been undertaken. CBoB has access to any such reports. Section 213 of the AML/CFT/PF Guidelines stipulates that banks should appoint a Money Laundering Reporting Officer (MLRO) (this function can be combined with the Compliance Officer (CO) depending on the size of the SFI’s operations, to whom employees must report their knowledge or suspicions of customers who are engaged in money laundering or the financing of terrorism. The MLRO is required to establish a point of contact with the FIU in order to deal with staff reports. S. 28 of the AML/CFT/PF Guidelines state that SFIs must establish and implement appropriate policies and procedures to ensure high standards are being followed when hiring employees. To this end, SFIs must deploy screening procedures which effect diligent and appropriate enquiries about the personal history and probity of the potential employee, and obtaining the appropriate references. S. 217 of the AML/CFT/PF Guidelines—Education and Training sets down requirements for the education of staff at entry level and on a continuous basis. The Financial Intelligence (Transactions Reporting) Regulations provide that, at least once a year, financial institutions shall provide relevant employees with appropriate training in the recognition and handling of transactions carried out by persons who may be engaged in money laundering. |
| EC10 | The supervisor determines that banks have and follow clear policies and processes for staff to report any problems related to the abuse of the banks’ financial services to either local management or the relevant dedicated officer or to both. The supervisor also determines that banks have and utilize adequate management information systems to provide the banks’ Boards, management and the dedicated officers with timely and appropriate information on such activities. |
| Description and findings re EC10 | S. 27 of the AML/CFT/PF Guidelines provides that banks appoint a Money Laundering Reporting Officer (MLRO) or combine this role with the Compliance Officer (CO) if a smaller SFI, to whom employees must report their knowledge or suspicions of customers who are engaged in money laundering or the financing of terrorism. The MLRO/CO has in place appropriate procedures, controls and monitoring systems for timely detection and prompt investigation of suspicious activity and if appropriate, subsequent reporting to the FIU and to the CBoB. The MLRO/CO must not be restricted from reporting and findings on a timely basis to the SFI Board, FIU or CBoB. |
| EC11 | Laws provide that a member of a bank’s staff who reports suspicious activity in good faith either internally or directly to the relevant authority cannot be held liable. |
| Description and findings re EC11 | S. 19 of the AML/CFT/PF Guidelines refers to S. 26 of the FTRA which states that “Where any information is disclosed or supplied in any suspicious transaction report made, pursuant to Section 14, no civil, criminal or disciplinary proceedings shall lie against that person (a) in respect of the disclosure or supply, or the manner of the disclosure or supply, of that person, or (b) for any consequences that follow from the disclosure or supply of that information.” |
| EC12 | The supervisor, directly or indirectly, cooperates with the relevant domestic and foreign financial sector supervisory authorities or shares with them information related to suspected or actual criminal activities where this information is for supervisory purposes. |
| Description and findings re EC12 | S. 38 (3) of the CBOBA provides that CBoB may disclose to an overseas regulatory authority information necessary to enable that authority to exercise regulatory functions including the conduct of civil or administrative investigations and proceedings to enforce laws, regulations and rules administered by that authority. S. 38 (9) of the CBOBA allows CBoB to cooperate and exchange information with any other regulatory authority in the Bahamas where it is considered by the Governor that such cooperation or information may be relevant to the functions of such other regulatory authority or as a necessary part of a framework for consolidated supervision, oversight or regulation of the financial services sector. S. 19 (7) (c) of the BTRA requires the CBoB to share pertinent information with the FUI as specified in the FTRA. The FUI as well as the National Steering Committee however does not have the same legal powers to share information with related authorities. CBoB, as a member of the GFSR shares information with the other domestic regulatory agencies. |
| EC13 | Unless done by another authority, the supervisor has in-house resources with specialist expertise for addressing criminal activities. In this case, the supervisor regularly provides information on risks of money laundering and the financing of terrorism to the banks. |
| Description and findings re EC13 | Anti-Terrorism Act, 2018 (ATA), s. 47 of ATA provides that the Commissioner of Police, upon instruction from the Auditor General, to investigate and place charges against a financial institution. |
| Assessment of Principle 29 | Largely Compliant |
| Comments | CBoB created the AML Analytics Unit to undertake an enhanced off-site surveillance function to review each SFI’s AML/CFT’s board approved policies. The AML Analytics Unit, together with the supervisory teams, conducted and reviewed a survey that the SFI’s self-assessed for compliance to AML/CFT regulatory compliance requirements early in 2018. CBoB also conducted 22 targeted on-site examinations of SFI’s requiring a deep-dive review for AML compliance. Further, CBoB updated its risk-based supervisory tools to specifically address AML inherent risks which was tested during its 2018 on-site examinations. CBoB was in the process of sending out letters to each SFI with the results of the AML/CFT review. Given that several pieces of new or revised legislation (namely FTRA and Regulations, ATA, PCA, ATA and the Registrar of BO), and supervisory guidance (AML/CFT/PF Guidelines, the Corrigendum to the AML/CFT/PF Guideline, as well as AML AMP) were recently updated or released in 2018, CBoB will need to continue its supervisory oversight to ensure that all SFI’s (including banks, credit unions and money transfer business’) are administering these various legislative requirements on a consistent and effective basis. Where CBoB is discovering gaps in AML requirements, it should take additional courses of actions (making use of the AMP regime) to ensure SFI’s are brought into compliance on a timely basis. CBoB should contemplate have one or two individuals who are considered AML/CFT risk specialists that supervision can call upon when needed. These individuals require additional in-depth training (beyond certification). CBoB should create a supervision manual to reflect its risk-based supervisory AML assessment |
| Principle 14 | Corporate governance. The supervisor determines that banks and banking groups have robust corporate governance policies and processes covering, for example, strategic direction, group and organizational structure, control environment, responsibilities of the banks’ Boards and senior management,33 and compensation. These policies and processes are commensurate with the risk profile and systemic importance of the bank. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor establish the responsibilities of a bank’s Board and senior management with respect to corporate governance to ensure there is effective control over the bank’s entire business. The supervisor provides guidance to banks and banking groups on expectations for sound corporate governance. |
| Description and findings re EC1 | CBoB issued in 2001 the “Guidelines for the Corporate Governance of Banks and Trust Companies Licensed to do Business Within and from Within The Bahamas” (Corporate Governance guidelines). The guidelines were amended and expanded in 2013. These guidelines detail the minimum standards that CBoB expects its supervised institutions to adopt with respect to corporate governance. The guidelines are based on the premise that the Directors are stewards of the organization, responsible for providing overall direction and oversight, and that senior management is responsible for carrying out the day-to-day operations of the organization and implementing an appropriate and effective board-approved governance process and internal control program. In line with CBOB’s principles-based approach, the guidelines are meant to provide direction and outline basic principles from which a corporate governance process that is suitable for the specific institution is expected to be developed and implemented. The corporate governance guidelines apply to all banks and trust companies, as well as branches of foreign banks, with the exception of “nominee trust companies” or “restricted trust companies” which have operations that are limited to only conducting business on behalf of one client or clients who are members of the same family. |
| EC2 | The supervisor regularly assesses a bank’s corporate governance policies and practices, and their implementation, and determines that the bank has robust corporate governance policies and processes commensurate with its risk profile and systemic importance. The supervisor requires banks and banking groups to correct deficiencies in a timely manner. |
| Description and findings re EC2 | CBoB primarily directly assesses licensee’s corporate governance policies and practices during ‘special focus’ on-site examinations—i.e., exams of specific activities or practices, during which assessments of controls and audit for the respective area may be included. For example, recent examinations of AML/CTF risk management included assessments of some elements of corporate governance-related processes. CBoB could also examine corporate governance during a full scope examination, though assessors’ discussions with CBOB supervision staff indicated that full-scope exams are not a regular part of CBOB’s risk-focused supervision framework. During onsite exams, CBoB determines whether a licensee’s corporate governance process and risk management and control program provide assurance that the risk in the business activities and operations are appropriately and effectively identified, monitored and controlled. The findings from on-site exams are reported through a report of examination. CBoB expects the firms to satisfactorily address issues/deficiencies that have been identified in a timely manner. Verification of all issues addressed is validated through ongoing supervisory processes, including discussions with firms’ management and review of internal audit assessments of remediation and/or during the next scheduled onsite examination. The boards of directors of all licensed banks and trusts are required to submit an annual certification to CBoB as to the firms’ compliance with established corporate governance guidelines. A standard certification template created by CBOB is used. |
| EC3 | The supervisor determines that governance structures and processes for nominating and appointing Board members are appropriate for the bank and across the banking group. Board membership includes experienced non-executive members, where appropriate. Commensurate with the risk profile and systemic importance, Board structures include audit, risk oversight and remuneration committees with experienced non-executive members. |
| Description and findings re EC3 | The Guidelines for the Corporate Governance specifies that the board should generally include both executive and non- executive members—except in cases where specific exemptions have been granted—as appropriate to the organization’s needs. Board members are expected to be able to act independent of undue influence from internal and external sources. CBoB expects the role of the Chairman and Chief Executive Officer to be separate as it contributes to achieving an appropriate balance of power by increasing accountability and enhancing the board’s capacity for decision making independent of senior management. Where a firm does not have this separation, appropriate controls are expected to be in place to ensure that management is accountable to the board. Particularly for DSIBs, CBoB staff noted that they expect, at a minimum, that the firms the following board committees: Executive Committee, Risk Management Committee, Credit Committee, Trust & Fiduciary Committee, Asset & Liability Committee, Audit Committee, Compliance Committee, Compensation Committee and Nomination Committee. Most of the largest SFIs have these committees in place. Boards of foreign-owned offshore banks and trusts are not expected to have the same level of non-executive directors or subcommittees as domestic firms. |
| EC4 | Board members are suitably qualified, effective and exercise their “duty of care” and “duty of loyalty.”34 |
| Description and findings re EC 4 | CBoB approves all proposed board members and management of regulated functions and assesses the fitness and propriety of Board members against the criteria outlined in section 3E of the BTCRA and the “Guidelines for Assessing the Fitness and Propriety of Applicants for Regulated Functions” (Fit and Proper Guidelines). Individuals seeking to serve as a Board member are granted approval to act as same once CBOB has run a due diligence process and is satisfied that the candidate is fit and proper to fulfill the role. |
| EC5 | The supervisor determines that the bank’s Board approves and oversees implementation of the bank’s strategic direction, risk appetite35 and strategy, and related policies, establishes and communicates corporate culture and values (e.g. through a code of conduct), and establishes conflicts of interest policies and a strong control environment. |
| Description and findings re EC5 | Examiners review banks’ policies and procedural manuals and conduct interviews with relevant senior management regarding the approval process for these processes and how they are communicated to the staff. Additionally, the examiners are expected to review board minutes to confirm that all policies and procedures have been presented to for review and approved by the Board. Examiners confirm via board minutes that the strategic plan has been approved by the board. Supervised entities are expected to have risk appetite statements, which are expected to be reviewed by the supervisors. While there is not a formal requirement that firms specifically have a code of conduct and conflict of interest policies, CBOB supervision staff told the assessors they are generally expected to and that most supervised banks do have them. Assessors noted there were some notifications on related party transactions and conflicts of interest. |
| EC6 | The supervisor determines that the bank’s Board, except where required otherwise by laws or regulations, has established fit and proper standards in selecting senior management, maintains plans for succession, and actively and critically oversees senior management’s execution of Board strategies, including monitoring senior management’s performance against standards established for them. |
| Description and findings re EC6 | Verification of same is done during on-site examinations. The Examiner reviews the licensee’s Board minutes to confirm evidence of Board discussion of the appointment of senior management and a review of their past experience is completed to ensure that they have the appropriate skill set for the position. The Board packages are also expected to contain reports from senior management on the performance of the areas under their supervision. Examiners interview management regarding the establishment of a succession plan for key staff members. Management succession plans are required and are reviewed by CBoB supervisors. |
| EC7 | The supervisor determines that the bank’s Board actively oversees the design and operation of the bank’s and banking group’s compensation system, and that it has appropriate incentives, which are aligned with prudent risk taking. The compensation system, and related performance standards, are consistent with long-term objectives and financial soundness of the bank and is rectified if there are deficiencies. |
| Description and findings re EC7 | These issues are expected to be covered during on-site examinations. Examiners interview members of the Compensation Committee (if the bank has such a committee) and review the compensation policies and programs for senior management and staff. A review of Board minutes is also completed to confirm whether the staff compensation is discussed by the Board and that the Board is satisfied that compensation is in line with industry standards. Staff explained that CBOB does not expect banks’ compensation programs to have incentive-based compensation schemes related directly to risk taking and does not view the FSB incentive compensation guidelines as appropriate for the Bahamas. |
| EC8 | The supervisor determines that the bank’s Board and senior management know and understand the bank’s and banking group’s operational structure and its risks, including those arising from the use of structures that impede transparency (e.g. special-purpose or related structures). The supervisor determines that risks are effectively managed and mitigated, where appropriate. |
| Description and findings re EC8 | The Examiners determine that the Board and senior management has completed an Enterprise Risk Management Exercise of the entire operation to identify the relevant risk to their business, how the various risks are measured/graded (high, medium, low) and what controls are in place for managing the various risk identified. Controls are directly related back to risks as part of the risk assessment framework, which is carried out comprehensively every three or five years depending on the perceived impact of the firm, with DSIBs and other with scores above ‘medium’ requiring full assessments every three years. Between these assessments CBOB has a required ‘evergreen’ process for keeping the assessments up to date. (See BCP 8 and 9 on supervision approach and tools.) |
| EC9 | The supervisor has the power to require changes in the composition of the bank’s Board if it believes that any individuals are not fulfilling their duties related to the satisfaction of these criteria. |
| Description and findings re EC9 | Under Section 18 of the BTCRA, which covers the enforcement powers of CBoB, it may require the replacement of any director or officer of a bank if it believes that to be in the public interest or in the interests of depositors or other creditors of a bank. CBoB has the authority to approve or deny an individual to serve a regulated function in accordance with Regulation 3 of the Banks and Trust Companies (New Appointments) Regulations, 2005. Further, CBoB may assess the continuing fitness and propriety of persons already performing regulated functions. CBOB has required the removal of board members and senior managers. |
| Additional criteria | |
| AC1 | Laws, regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any material and bona fide information that may negatively affect the fitness and propriety of a bank’s Board member or a member of the senior management. |
| Description and findings re AC1 | Section 13B(1) of the BTCRA requires licensees to immediately notify the central bank of any material information that may negatively affect the fitness and propriety of a director or senior manager of the licensee. |
| Assessment of Principle 14 | Largely Compliant |
| Comments | While CBOB expectations cover the key areas of corporate governance, given the infrequency of comprehensive onsite exams it is not clear that supervisors have the opportunity to directly assess all key aspects of corporate governance on a regular basis. Moreover, while the Risk Assessment Process does include a section on oversight and governance for each inherent risk area, as well as a composite governance rating, it does not specifically cover such areas as the board’s effectiveness with respect to the broad set of expectations in the Corporate Governance Guidelines, including its responsibility to ensure there is an effective internal audit function and its oversight of senior management. Weaknesses in areas ultimately under the responsibility of the board—e.g., risk management and internal controls framework, internal audit effectiveness, etc.—are not linked directly to an assessment of the board, as there is no explicit board assessment required. While CBOB may well make that linkage and raise it during discussions with board members (when those infrequently occur), the supervisory program would be enhanced by greater direct linkage between weaknesses in risk management and control practices and assessments of the board and senior management. The value of the practices of requiring annual certifications of compliance from boards of directors could be enhanced by (1) undertaking periodic reviews of all aspects of the certification process at the SFIs and (2) a formal policy of rapid escalation of expectations in this area when it is found that a certification was materially incorrect. For example, requiring an SFI to retain the services of an independent third party to provide a ‘reasonable assurance’ level assessment across all key areas covered in the certification. |
| Principle 15 | Risk management process. The supervisor determines that banks36 have a comprehensive risk management process (including effective Board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate37 all material risks on a timely basis and to assess the adequacy of their capital and liquidity in relation to their risk profile and market and macroeconomic conditions. This extends to development and review of contingency arrangements (including robust and credible recovery plans where warranted) that take into account the specific circumstances of the bank. The risk management process is commensurate with the risk profile and systemic importance of the bank.38 |
| Essential criteria | |
| EC1 | The supervisor determines that banks have appropriate risk management strategies that have been approved by the banks’ Boards and that the Boards set a suitable risk appetite to define the level of risk the banks are willing to assume or tolerate. The supervisor also determines that the Board ensures that:
|
| Description and findings re EC1 | The CBoB-required Board of Directors’ Annual Certification includes, among other things, an annual attestation as to whether the firm has appropriate risk management procedures and strategies in place. Boards are required to report any material deficiencies and problems that are identified within the bank, along with specific action plans and timetables for their remediation. Detailed information on banks’ risk management processes is gathered by CBoB supervisors and, as part of the recent enhancements to the risk-based supervision framework, structured interviews are held with bank risk managers via “Discovery Review” meetings or Prudential meetings during which supervisors discuss with the banks:
The assessment of risk management practices is complemented by onsite compliance tests, procedures for which are described in examination modules. When evaluating the quality of risk management/corporate governance, emphasis is expected to be placed on: (1) active board and senior management oversight, (2) adequate policies, procedures, and limits, (3) adequate risk-measurement and-monitoring supported by the appropriate management information systems, (4) a comprehensive process of control, and (5) an appropriate human resource management system, including training programs. Related review processes are as follows:
|
| EC2 | The supervisor requires banks to have comprehensive risk management policies and processes to identify, measure, evaluate, monitor, report and control or mitigate all material risks. The supervisor determines that these processes are adequate:
|
| Description and findings re EC2 | Under the BCTRA CBoB is required to “ensure that banks: (i) have in place and use systems that accurately measure, monitor and adequately control market and other risks; (ii) have in place internal controls adequate to the nature and scale of their operations, and adequate policies, practices and procedures, including strict know-your- customer (KYC) rules that promote high ethical and professional standards, and so prevent the use of the bank for criminal purposes; and (iii) management information systems that enable management to identify portfolio concentration in line with established limits.” CBoB reviews policies and procedures and analyzes quarterly data submitted by the firms to assess the adequacy of the policies and procedures. The “Guidance Note on Accounting and Other Records and Internal Control Systems and Reporting Accountants’ Reports Thereon” provides guidance on accounting and internal control systems and supervisory expectations for these. CBoB’s revised Corporate Governance Guidelines outlines the responsibility of banks’ management and board of directors in managing the various types of risks. Banks boards must certify to the CBoB that the appropriate risk management systems are in place and sustainable. These certifications are required to submitted to CBoB within 120 days of the end of the calendar year. The Corporate Governance Guidelines against which the required annual certifications are made state that the Board should determine that:
The Corporate Governance Guidelines also state that “Management, under the general direction of and oversight by the Board, should develop and implement a comprehensive risk management system, commensurate with the scope of the licensee’s activities, incorporating continuous identification, measurement, monitoring and controlling of risk. The Board itself should specifically address significant issues in the system’s development and implementation, as well as implement an effective process to independently determine that the risk management system is appropriate and ensure that its effectiveness is regularly assessed. The Guidelines also require that, “where the size and nature of a bank’s businesses warrant, as determined by the Board, separate and independent risk management and internal audit functions” should be established.” In addition to the above, CBoB developed an Internal Capital Adequacy Assessment Process (ICAAP) framework and issued ICAAP guidelines in 2016. The guidelines specifically address banks’ responsibility to develop and implement an ICAAP for the purpose of setting internal capital targets and developing strategies for achieving internal targets that are consistent with its business plans, risk profile and the current operating environment, including macroeconomic conditions. Supervised firms must complete the ICAAP report on a frequency determined by CBoB on a case by case basis. For DSIBs this is at least every two years; annually if viewed as a problem SFI. For all others it is at least every three years or when there are significant change(s) in risk exposures. CBoB does not approve a firm’s ICAAP, but generally does some high-level work to review and assess these reports and advise firms of the results of such assessments. Assessors note that the ICAAP Guidelines state that firms must do an ICAAP every year. The change in requirements should be captured in an update of the Guidelines. Assessors discussions with CBoB supervision staff indicated that these assessments do not typically include a deep dive into all aspects of the ICAAP process but tend to focus primarily on discussions with the banks about the assumptions underlying any scenario analyses that is used and of the output of the process. CBoB’s oversight of risk management is carried out largely through the discussions and analyses inherent in carrying out the risk assessment process, which informs CBoB’s risk-focused supervision approach. Risk assessments are required to be carried out every 3 or 5 years, depending on the impact assessment of the firms; DSIBs are expected to have a risk assessment every three years. In between those risk assessments the supervisory teams are expected to remain up to date on the key areas of risk, as well as on business strategies/activities and progress banks are making addressing identified weaknesses in practices relative to their own internal policies and procedures and supervisory expectations. This updated process is referred to as the ‘evergreening’ process. The evergreening process is being rolled out and has yet to become a full part of the program. Assessors found the risk assessments we reviewed and resulting letters to the firms to be reasonably comprehensive covering business and strategic risks as well as risk management and internal controls and oversight and governance assessments. Assessors strongly encourage CBoB to ensure Risk Assessments for the DSIBs and other large SFIs are kept up to date. |
| EC3 | The supervisor determines that risk management strategies, policies, processes and limits are:
The supervisor determines that exceptions to established policies, processes and limits receive the prompt attention of, and authorization by, the appropriate level of management and the bank’s Board where necessary. |
| Description and findings re EC3 | Assessments of strategy, policies & procedures, and limits relative to boards of directors’ stated risk appetites is carried through onsite reviews and offsite analyses of reporting from the banks. In addition, supervisory teams will meet with the banks on a periodic basis to discuss risk management and control practices as well as business strategy, new business activities and their risk appetites. CBoB supervisors review board minutes and management reports to determine how exceptions to policies are handled. Supervisors also assess the quality and timeliness of related reporting to senior management and the board. |
| EC4 | The supervisor determines that the bank’s Board and senior management obtain sufficient information on, and understand the nature and level of risk being taken by the bank and how this risk relates to adequate levels of capital and liquidity. The supervisor also determines that the Board and senior management regularly review and understand the implications and limitations (including the risk measurement uncertainties) of the risk management information that they receive. |
| Description and findings re EC4 | As noted above, as expressed in the Corporate Governance Guidelines, CBoB expects bank Boards to assess whether the control environment is appropriate and effective, taking into account the bank’s unique character, approach to governance, management and communications style, organizational structure, resource availability, procedures and controls, and the conduct of its staff. Boards must certify the effectiveness of the above on an annual basis. The certification also is required to provide an update on the progress made on remediating any identified weakness (by the bank or the supervisor) relative to the planned timeline. In addition, a bank’s board and management, as well as external and internal auditors, are expected to proactively provide information to CBoB regarding any issue or weakness which may impact the strength of risk management and controls.
The CBoB’s risk-based supervisory framework provides a score for each of a bank’s inherent risks and evaluates the risk management and controls in place against those risks. The approach informs CBoB assessments of the risk-profiles of the banks and requires an assessment of the efficiency of a bank’s ability to identify, measure, monitor and control risks. Each bank is risk- rated within the CBoB’s internal risk rating system and supervisory resources are allocated through this process. The framework includes an evaluation of a bank’s financial condition, in particular, to ascertain to what extent the bank maintains capital and liquidity that is sufficient given the risk profile. The risk-based supervision framework primarily includes the following:
Banks’ ICAAP reports also are expected to explicitly provide details on the banks’ own understanding of their risks and how they relate to capital needs. |
| EC5 | The supervisor determines that banks have an appropriate internal process for assessing their overall capital and liquidity adequacy in relation to their risk appetite and risk profile. The supervisor reviews and evaluates banks’ internal capital and liquidity adequacy assessments and strategies. |
| Description and findings re EC5 | As described in EC2 and EC 4, CBoB’s review and evaluation of licensees’ ICAAP and the risk- based supervisory review framework enables CBoB to determine capital adequacy as well as the frequency and scope of on-site visits and the level of off-site scrutiny. Assessors observed that the ICAAP is a relatively new process (guidelines issues in 2016) and has not been a particularly deep area of focus for CBoB supervisors to date. Given the broad range of coverage in an ICAAP process, and the need for solid risk identification, measurement, and management, as well as internal controls and board and senior management oversight, to do an ICAAP effectively, CBoB supervision would be enhanced by periodic deep dive reviews into key aspects of the banks’ ICAAPs. Liquidity assessments are done periodically and primarily through required reporting and surveillance. Please see the detailed assessment of BCP 17 – Liquidity Risk Management – for the assessors views on this area. |
| EC6 | Where banks use models to measure components of risk, the supervisor determines that:
The supervisor assesses whether the model outputs appear reasonable as a reflection of the risks assumed. |
| Description and findings re EC6 | For the most part, focus on banks’ stress testing and modeling by CBoB is in its early stages and detailed guidelines have not been issued. Where models are used, for example with respect to credit rating systems, examiners told the assessors a key focus is on checking that they are validated and that validations are updated as needed. Most banks are subsidiaries or branches of international banking groups and have advanced models that are employed subject to home country supervision standards. For their local operations supervisors would look at results of the models and stress testing. |
| EC7 | The supervisor determines that banks have information systems that are adequate (both under normal circumstances and in periods of stress) for measuring, assessing and reporting on the size, composition and quality of exposures on a bank-wide basis across all risk types, products and counterparties. The supervisor also determines that these reports reflect the bank’s risk profile and capital and liquidity needs, and are provided on a timely basis to the bank’s Board and senior management in a form suitable for their use. |
| Description and findings re EC7 | Supervisors review and assess risk reporting and MIS used largely through offsite monitoring and discussions with the SFIs. In addition, they review internal audit reports and track progress on remediation efforts related to identified weaknesses. Surveillance and monitoring efforts cover the capture of all bank-wide risks and review the positions relative to policies, limits, risk appetite and risk profile. Exposures and positions are reviewed relative to a SFI’s capital and liquidity positions and if exposures threaten either CBoB has the authority to require SFIs to increase capital and liquidity or reduce positions and activities. |
| EC8 | The supervisor determines that banks have adequate policies and processes to ensure that the banks’ Boards and senior management understand the risks inherent in new products,39 material modifications to existing products, and major management initiatives (such as changes in systems, processes, business model and major acquisitions). The supervisor determines that the Boards and senior management are able to monitor and manage these risks on an ongoing basis. The supervisor also determines that the bank’s policies and processes require the undertaking of any major activities of this nature to be approved by their Board or a specific committee of the Board. |
| Description and findings re EC8 | There are no specific new product approval process requirements in CBoB guidelines. The CBoB collects information from the banks concerning new products and the banks’ risk review process. Areas of potential concern are assessed and analyzed and new products are reviewed to see how they fit with the bank’s strategy and risk appetite. Offsite supervisors meet with or write to firms to discuss new products and to gather information. CBoB operational risk guidelines include new products, and the Board and Senior management understanding the nature and complexity of the risks inherent in its products, services and activities, including new business. The ICAAP report gives information on risks related to all of the licensee’s activities, including new business, and the capital that is allocated to cover those risks. |
| EC9 | The supervisor determines that banks have risk management functions covering all material risks with sufficient resources, independence, authority and access to the banks’ Boards to perform their duties effectively. The supervisor determines that their duties are clearly segregated from risk-taking functions in the bank and that they report on risk exposures directly to the Board and senior management. The supervisor also determines that the risk management function is subject to regular review by the internal audit function. |
| Description and findings re EC9 | The guidelines issued by CBoB, the information collected from banks and the focus of supervisory teams and onsite examinations provide a view of the bank’s risk management, risk mitigation techniques, as well as the role and independence of risk management, internal audit, the money laundering reporting officer (MLRO) and reporting lines. In discussions with examiners the assessors observed that segregation of duties was an explicit area of focus in exams. It is also looked at by internal and external auditors and internal controls are included in the annual attestation/certification CBoB requires boards of directors to make annually as noted in the Corporate Governance Guidelines. Where banks are required to have internal audit (see BCP 26 details below) it is expected IA will review risk management as part of its regular audit program. CBoB supervisors ‘rely’ on these audits and review them before an examination and in between undertaking an exam of risk management. They also meet periodically with internal auditors. |
| EC10 | The supervisor requires larger and more complex banks to have a dedicated risk management unit overseen by a Chief Risk Officer (CRO) or equivalent function. If the CRO of a bank is removed from his/her position for any reason, this should be done with the prior approval of the Board and generally should be disclosed publicly. The bank should also discuss the reasons for such removal with its supervisor. |
| Description and findings re EC10 | The Corporate Governance Guidelines requires that the Board ensure effective management of risk, inclusive of overseeing and participating in the appointment of senior executives with the skills necessary to manage and supervise the licensee’s business and staff and the establishment of key committees, as appropriate given the size and complexity of the bank. The Board must also ensure, where the size and nature of a banks business warrants, there are separate and independent risk management and internal audit functions, which is verified during onsite examinations and ongoing supervisory work by the supervision teams. CBoB supervisors also determine that the risk management function is subject to regular review by the internal audit function. All ‘regulated function’ roles must be approved by CBoB, including the role of CRO. The removal of a CRO would initiate a CBoB fit and proper review of prosed replacement. In discussions with CBoB management, the assessors were told that if CBoB had to initiate a fit and proper review for a replacement CRO and had not been told the current CRO was fired and why, it could lead to escalation to the board of directors who would be viewed as being uncooperative. Assessors did not observe a situation that would require such escalation. |
| EC11 | The supervisor issues standards related to, in particular, credit risk, market risk, liquidity risk, interest rate risk in the banking book and operational risk. |
| Description and findings re EC11 | Regulations and/or guidelines have been issued for credit risk, liquidity risk, outsourcing, business continuity risks, operational risk, market risk and interest rate risk in the banking book. The revised Interest Rate Risk Guidelines addresses the trading and banking book. |
| EC12 | The supervisor requires banks to have appropriate contingency arrangements, as an integral part of their risk management process, to address risks that may materialize and actions to be taken in stress conditions (including those that will pose a serious risk to their viability). If warranted by its risk profile and systemic importance, the contingency arrangements include robust and credible recovery plans that take into account the specific circumstances of the bank. The supervisor, working with resolution authorities as appropriate, assesses the adequacy of banks’ contingency arrangements in the light of their risk profile and systemic importance (including reviewing any recovery plans) and their likely feasibility during periods of stress. The supervisor seeks improvements if deficiencies are identified. |
| Description and findings re EC12 | Recovery planning is not currently required. There is a proposal to require recovery planning in proposed capital guidelines that have been put out for public comment. |
| EC13 | The supervisor requires banks to have forward-looking stress testing programs, commensurate with their risk profile and systemic importance, as an integral part of their risk management process. The supervisor regularly assesses a bank’s stress testing program and determines that it captures material sources of risk and adopts plausible adverse scenarios. The supervisor also determines that the bank integrates the results into its decision-making, risk management processes (including contingency arrangements) and the assessment of its capital and liquidity levels. Where appropriate, the scope of the supervisor’s assessment includes the extent to which the stress testing program:
The supervisor requires corrective action if material deficiencies are identified in a bank’s stress testing program or if the results of stress tests are not adequately taken into consideration in the bank’s decision-making process |
| Description and findings re EC13 | As noted in EC 6 above, supervisory guidelines for stress testing have not been issued. Banks are expected to use stress testing in their risk management and ICAAP, but CBoB is not focused on in depth assessments of stress testing. In discussions assessors had with CBoB supervisors it was stated they primarily look at the assumptions used and results. |
| EC14 | The supervisor assesses whether banks appropriately account for risks (including liquidity impacts) in their internal pricing, performance measurement and new product approval process for all significant business activities. |
| Description and findings re EC14 | There are no specific supervisory expectations with respect to internal (transfer) pricing arrangements. As noted above, there are not specific expectations or requirements regarding a formal new product approval process. The Corporate Governance Guidelines broadly requires that the Board and management of each licensee should analyze its own existing and prospective business, products and services to identify and measure the types and significance of the current and potential risks that must be managed and controlled, both individually and taken together. It specifies that an Asset and Liability Committee can be charged with overseeing the organization’s operations relating to interest-rate risk, market risk and liquidity risk and, in particular, ensures that the organization has adequate funds to meet its obligations. |
| Additional criteria | |
| AC1 | The supervisor requires banks to have appropriate policies and processes for assessing other material risks not directly addressed in the subsequent Principles, such as reputational and strategic risks. |
| Description and findings re AC1 | Detailed guidelines have not been issued addressing reputational and strategic risks. ICAAP requires that these risks be considered and aims to quantify them. |
| Assessment of Principle 15 | Largely Compliant |
| Comments | CBoB has a quite comprehensive Risk Assessment Process that includes coverage of risk management, internal controls and governance/oversight. As discussed throughout in this note, they place substantial emphasis on reviews of required regulatory reports on financial condition and risk exposures, internal risk reports of the firms, internal audit reports, required annual certifications of compliance from SFIs’ boards and external audit coverage of financial statements and related controls. This is complemented by regular meetings with the firms and onsite examinations where deemed warranted by the risk assessment process. Risk management supervision would benefit from a better balance between onsite and offsite supervisory efforts (which would likely require an increase in staffing levels) and the use of more thematic reviews assessing key risk areas and practices across firms. For example, assessors noted that in some areas (e.g., credit risk management) it has been quite some time since a comprehensive review was carried out across all DSIBs and other large firms. More frequent and comprehensive exams of key risks—credit, AML, ICAAP/capital planning—including reviews that cover all aspects of risk management, internal controls and corporate governance in these areas would allow for greater confidence in the supervisors’ assessments of the SFIs. In addition, such reviews could make valuable contributions to understanding the effectiveness of governance across the firms and holding boards and management accountable for the carrying out the duties articulated in CBoB’s Corporate Governance Guidelines. Thematic reviews would be beneficial. Having a strong understanding of the relative strengths and weaknesses of practices across firms provides helpful context and can inform constructive dialogue with the industry and individual firms. While SFIs in the jurisdiction are generally quite straightforward in their business models and associated risks, greater emphasis on firms’ stress testing practices (especially for DSIBs) would help promote financial resilience and would provide for an opportunity to assess the variety of important practices that inform and support stress testing. These include risk identification, measurement and management, internal controls and data integrity, as well as corporate governance and internal audit effectiveness. Recovery planning is not currently required. There is a proposal under consideration to include recovery planning requirements going forward. CBoB should move ahead with efforts to require SFIs to increase their preparedness to take effective recovery actions. |
| Principle 16 | Capital adequacy.40 The supervisor sets prudent and appropriate capital adequacy requirements for banks that reflect the risks undertaken by, and presented by, a bank in the context of the markets and macroeconomic conditions in which it operates. The supervisor defines the components of capital, bearing in mind their ability to absorb losses. At least for internationally active banks, capital requirements are not less than the applicable Basel standards. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to calculate and consistently observe prescribed capital requirements, including thresholds by reference to which a bank might be subject to supervisory action. Laws, regulations or the supervisor define the qualifying components of capital, ensuring that emphasis is given to those elements of capital permanently available to absorb losses on a going concern basis. |
| Description and findings re EC1 | The BTCRA requires CBoB to set capital adequacy requirements not less than those established in the Basel Capital Accord and its amendments. CBoB has implemented Basel II and the capital definition elements of the Basel III regime, which were rolled out as of Q2 2013 and went live during the first quarter of 2016. The following guidelines have been released to the industry for their implementation and to set expectations:
CBoB has the authority to take actions including requiring capital raises if capital falls below required levels (which are discussed below in EC 2). CBoB requires SFIs to have capital ratios in excess of the minimum Basel requirements. Current capital requirements impose trigger and target ratios on individual SFIs on a case by case basis, with the DSIBs having the highest requirements. DSIB requirements are super equivalent to Basel requirements. For instance, a target ratio of 17 percent and a trigger ratio of 14 percent is set for the commercial (domestic) banks. The current aggregate ratio for all banks is in excess of 20 percent, with the vast majority of regulatory capital at the largest firms comprised of CET 1. CBoB uses the standardized approach to credit with RWA calculations fully in line with Basel 2 guidelines except for residential mortgages—the majority of exposures in the domestic banking system—which are risk weighted at 50 percent. |
| EC2 | At least for internationally active banks,41 the definitions of capital, risk coverage, method of calculation and thresholds for the prescribed requirements are not lower than those established in the applicable Basel standards. |
| Description and findings re EC2 | All SFIs must meet capital adequacy requirements not less than those established in the Basel Capital Accord and its amendments. As per the capital adequacy guidelines, the minimum capital adequacy requirements placed on licensees are consistent with Basel 2 and 3. A proposal for the full implementation of Basel 3 is under consideration. CBoB focuses on the following elements when assessing a SFI’s capital adequacy:
CBoB requires SFIs to have capital ratios in excess of the minimum Basel requirements. Current capital requirements impose trigger and target ratios on individual SFIs on a case by case basis. These ratios are super equivalent to Basel requirements. For instance, a target ratio of 17 percent and a trigger ratio of 14 percent is set for the commercial (domestic) banks and the aggregate ratio for all banks is in excess of 20 percent, as noted above. |
| EC3 | The supervisor has the power to impose a specific capital charge and/or limits on all material risk exposures, if warranted, including in respect of risks that the supervisor considers not to have been adequately transferred or mitigated through transactions (e.g. securitization transactions)42 entered into by the bank. Both on-balance sheet and off-balance sheet risks are included in the calculation of prescribed capital requirements. |
| Description and findings re EC3 | Under the BTCRA CBoB has the power to impose specific capital charges and/or limits on all material risk exposures. SFIs are now (since 2016) required to produce ICAAP reports which address the material risks inherent in their businesses and submit them to CBoB for review and assessment. If a licensee’s risk profile (pillar 2 risks) as per the ICAAP indicates that it needs more capital than Pillar 1 standards require, the SFI would be required to maintain this additional capital. The assessors did not observe any SFIs that were required to raise capital to meet combines Pillar 1 and 2 capital charges as capital levels already above Pillar 1 charges have been sufficient to absorb any Pillar 2 charges. Assessors observed reviews of ICAAP reports at a high level – e.g., checking to make sure the reports contained information for all categories as outlined in the 2016 Guidelines. Assessors did not observe specific examination work or more in-depth assessments of ICAAP, which are fairly new in the Bahamas. |
| EC4 | The prescribed capital requirements reflect the risk profile and systemic importance of banks43 in the context of the markets and macroeconomic conditions in which they operate and constrain the build-up of leverage in banks and the banking sector. Laws and regulations in a particular jurisdiction may set higher overall capital adequacy standards than the applicable Basel requirements. |
| Description and findings re EC4 | In line with the Basel II and III frameworks, current capital requirements capture the full risk profile of SFIs, including both Pillar I—credit, market, and operational—and Pillar II risks—liquidity, interest rate risk in the banking book, reputation, legal, business/strategic risks, and ‘other’ risks. As noted above in EC2 and EC3, CBoB has the power to set higher regulatory capital requirements than those established by Basel and has done so. |
| EC5 | The use of banks’ internal assessments of risk as inputs to the calculation of regulatory capital is approved by the supervisor. If the supervisor approves such use:
|
| Description and findings re EC5 | Reponses to the corresponding requirements above are:
|
| EC6 | The supervisor has the power to require banks to adopt a forward-looking approach to capital management (including the conduct of appropriate stress testing).44 The supervisor has the power to require banks:
|
| Description and findings re EC6 | The BTCRA gives CBoB the authority to require banks to adopt a forward-looking approach to capital management. Currently, at a minimum, licensees are expected to incorporate stress testing into their ICAAPs and hold capital commensurate with assessed needs. There is no explicit ‘post-stress’ capital requirement including with respect possible changes in market conditions. If CBoB determines that a SFI is not holding sufficient capital relative to its risk profile—a determination which may come through the risk assessment process or specific exposures the bank might have—it has the authority to make the bank hold more capital. Assessments of ICAAPs to date that were observed by the assessors consisted of desktop reviews checking to ensure the SFI had included all of the appropriate information in its ICAAP report rather than an assessment of the adequacy and robustness of that information or of the capital planning process more broadly. SFIs are required to have capital contingency plans. These are typically also a part of ICAAP. In addition, CBoB’s Risk Assessment Process specifically looks at contingency plans and will give a SFI some credit for a plan that assumes it can raise more capital under stress. Assessors note that capital is usually least available when it is most needed and caution CBoB from giving firms any credit for asserting they can get capital under stress unless it is contractually committed and there are no materially adverse conditions clauses. |
| AC1 | For non-internationally active banks, capital requirements, including the definition of capital, the risk coverage, the method of calculation, the scope of application and the capital required, are broadly consistent with the principles of the applicable Basel standards relevant to internationally active banks. |
| Description and findings re AC1 | The CBoB regulatory capital regime is the same for all SFIs. |
| AC2 | The supervisor requires adequate distribution of capital within different entities of a banking group according to the allocation of risks.45 |
| Description and findings re AC2 | CBoB calculates capital ratios on a solo and consolidated basis. CBoB requires adequate capital across entities of a banking group according to the allocation of risks. |
| Assessment of Principle 16 | Compliant |
| Comments | Through the issuance of its Capital Adequacy, ICAAP, and revised Interest Rate Risk guidelines, CBoB has implemented Pillars I, II the Basel II framework. CBoB is working towards implementing phased-in arrangements under the Basel III framework and has released for public consultation Discussion Papers on its revised approach to capital and its position with respect to Capital Buffers, credit risk, operational risk, market risk and the Leverage Ratio. Capital requirements are in line with or stronger than the Basel regime and the largest SFIs have CET 1 capital well above required minimums. Triggers requiring further attention and possible requirements to increase capital are currently in place, and set at 14 percent for the DSIBs. CBoB has the authority to require firms to hold capital in relation to their risk profiles and well above required Basel minimums. While ICAAP is not a well-established process the assessors have taken that into consideration in BCP 16, Risk Management. CBoB needs to enhance its processes for reviewing all material aspects of the ICAAP and capital planning practices of the DSIBs. |
| Principle 17 | Credit risk.46 The supervisor determines that banks have an adequate credit risk management process that takes into account their risk appetite, risk profile and market and macroeconomic conditions. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate credit risk47 (including counterparty credit risk)48 on a timely basis. The full credit lifecycle is covered including credit underwriting, credit evaluation, and the ongoing management of the bank’s loan and investment portfolios. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to have appropriate credit risk management processes that provide a comprehensive bank-wide view of credit risk exposures. The supervisor determines that the processes are consistent with the risk appetite, risk profile, systemic importance and capital strength of the bank, take into account market and macroeconomic conditions and result in prudent standards of credit underwriting, evaluation, administration and monitoring. |
| Description and findings re EC1 | CBoB’s Guideline on Credit Risk Management (dated 16 October 2003) (CRM Guideline), suggests that all licensees have a board approved comprehensive credit risk strategy and policy, risk tolerance and portfolio limits, established controls and systems to measure, monitor and control large exposures and other risk concentrations. Further, the Guideline states that licensees should have written policies and procedures, effective systems for credit administration, measurement and monitoring. The Guideline also states that the credit risk management program in each SFI will depend on the scope and sophistication of the activities of the SFI. |
| EC2 | The supervisor determines that a bank’s Board approves, and regularly reviews, the credit risk management strategy and significant policies and processes for assuming,49 identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating credit risk (including counterparty credit risk and associated potential future exposure) and that these are consistent with the risk appetite set by the Board. The supervisor also determines that senior management implements the credit risk strategy approved by the Board and develops the aforementioned policies and processes. |
| Description and findings re EC2 | S. 17 (First Schedule) of the BTCRA states that the Inspector shall (among other things):
CBoB’s Guidelines pertaining to Corporate Governance stipulate that the board and senior management are responsible for addressing all significant risks identified in the organization. The board is also required to make an annual certification to CBoB that it has an appropriate corporate governance regime in place for prudently managing risk, including credit risk. CBoB’s CRM Guidelines state that banks should have a written statement of their credit risk strategy and a policy to implement the strategy. The credit risk strategy and policy should be disseminated to, and understood by, all relevant staff, should be approved by the board of directors and be consistent with the bank’s degree of risk tolerance, the level of capital available for credit activities and credit management expertise. The board should review the strategy and policy periodically (at least annually) to ensure their adequacy, and relevance given the changing operating circumstances, economic cycles, activities and risks that the SFI may face. The firm’s credit manual should stipulate sound, well-defined criteria for granting credit, including a thorough understanding of the borrower or counterparty, the purpose and structure of the credit and its source of repayment. The off-site supervisory teams regularly review financial information provided to CBoB with respect to credit quality, large exposures and engage senior management in discussions on specific credit related matters when the need arises. If deemed to be warranted through the risk assessment process, CBoB conducts on-site examinations of SFI’s board approved credit policies and procedures during on-site examinations, which include the review of SFI’s reporting against risk appetite, risk profile, portfolio limits, credit underwriting, evaluation, administration and monitoring. |
| EC3 | The supervisor requires, and regularly determines, that such policies and processes establish an appropriate and properly controlled credit risk environment, including:
|
| Description and findings re EC3 | The CRM Guidelines require SFIs to have the following:
CBoB’s off-site supervision surveillance team monitors SFI’s credit risk exposures on a quarterly basis, including having a prudential discussion of the top 20 largest credit exposures for the DSIBs as well as a discussion around the top 20 largest non-performing loans (NPLs). CBoB has communicated its expectations to individual SFIs regarding the importance of working towards lowering NPL levels. SFIs are required to ensure that credit decisions are supported by adequate evaluation of the borrower’s repayment ability, based on reliable information. An issue impacting banks’ ability to measure borrowers’ repayment capacity is the lack of a credit bureau. With the creation of the Credit Risk Agency, once operational in 2020, will oversee the licensing of credit bureau establishments, including ensuring the adequacy and availably of individual credit information At this time, there exists a wide range of practices amongst the DSIBs with respect to both asset classification systems (e.g. definition of arrears less than 90 days, etc.) as well as varying practices around the determination of loan loss provisioning (e.g. at what point does an SFI book 100 percent provisioning, regardless of the value of the collateral against a real estate backed loan that is greater than 3–5 years in arrears). On site credit risk management examinations are conducted when deemed warranted through the risk assessment process. When on-site examinations are conducted, examiners review overall credit risk governance, the credit initiation process, credit administration and disbursement and the delinquency management and credit collection process. Additionally, a credit rating system has been developed that is being used to: (1) assess individual credit quality during the substantive testing process; (2) comp are the examiners’ assessment to the rating system used by the bank to determine the extent of reliance that can be placed on the bank’s assessment; and (3) assess the overall quality of the portfolio. This process normally focuses on the top 20 largest loan exposures as well as the top 20 largest NPLs. The on-site examiners, if conducting a full-scope credit risk management review, undertake to review: (1) active board and senior management oversight; (2) adequate policies, procedures, and limits; (3) adequate risk-measurement; monitoring, and management information systems; (4) a comprehensive process of control; and (5) appropriateness of human resource management and training program. CBoB has two credit risk specialists on the on-site examination team who have credit experience at both commercial and international banks. |
| EC4 | The supervisor determines that banks have policies and processes to monitor the total indebtedness of entities to which they extend credit and any risk factors that may result in default including significant unhedged foreign exchange risk. |
| Description and findings re EC4 | Total indebtedness is reviewed and large exposure limits established. Banks make market inquiries, request information from borrower and aggregate exposure in their databases. |
| EC5 | The supervisor requires that banks make credit decisions free of conflicts of interest and on an arm’s length basis. |
| Description and findings re EC5 | S. VI ss 1. of CBoB CRM Guidelines states that all credit should be granted on an arm’s length basis. In addition, CBoB’s Large Exposure Guidelines stipulate that all exposures to related parties be (a) negotiated on an arm’s length basis and b) specifically be approved by the bank’s Board of Directors. This is also reflected in paragraph 5.2 of the Large Exposures Guidelines and paragraph 5.10, 6.6 and 10.6(g) of the Corporate Governance Guideline. |
| EC6 | The supervisor requires that the credit policy prescribes that major credit risk exposures exceeding a certain amount or percentage of the bank’s capital are to be decided by the bank’s Board or senior management. The same applies to credit risk exposures that are especially risky or otherwise not in line with the mainstream of the bank’s activities. |
| Description and findings re EC6 | CBoB’s CRM Guidelines note that the credit authority should be clearly delegated by the Board and should be appropriate for the products or portfolios assigned to the Credit Committee or individual credit officers and should also be commensurate with their credit experience and expertise. CBoB expects SFIs to ensure that credit authority is required and designated for all types of credit exposures. Delegated credit authority should be subject to regular review to ensure that it remains appropriate to current market conditions and the levels of their credit officers’ performance and expertise. CBoB’s Large Exposure Guidelines stipulate that firms must set prudent limits, monitor these limits and obtain approval for all exceptions to these limits. In general, CBoB on-site examiners indicated that they do not expect Board members or Senior management to be involved in credit decisions within Board approved limits/delegated authorities. |
| EC7 | The supervisor has full access to information in the credit and investment portfolios and to the bank officers involved in assuming, managing, controlling and reporting on credit risk. |
| Description and findings re EC7 | S. 13 (3) of the BTCRA states that CBoB’s Inspector has the authority to have access to such books, records, of any licensee or to call upon the manager or any officer designated by the manager of any licensee for such information or explanation. |
| EC8 | The supervisor requires banks to include their credit risk exposures into their stress testing programs for risk management purposes. |
| Description and findings re EC8 | Although CBoB does not currently have a Stress Testing guideline in place that explicitly addresses licensees’ credit risk exposures, CBoB expects firms to conduct stress testing on their inherent risks (inclusive of credit risk exposures) as part of their risk management practices and as part of their ICAAP analysis. CBoB also expects senior management to discuss the relevance of the results of the credit stress testing with the Board of Directors. |
| Assessment of Principle 17 | Largely Compliant |
| Comment | CBoB’s credit risk guidance is somewhat outdated requiring a renewed focus of the Off-site supervisors and the on-site examination team to conduct in-depth reviews of DSIBs loan portfolios (only 5 in-depth reviews carried out since 2015). In general, CBoB has spent a great amount of time focusing on the strength of credit risk management policies, procedures and practices at one particular DSIB. The credit risk specialists at CBoB have adequate knowledge to conduct deep dive reviews, however, with the additional needed focus on AML issues during 2018 for the on-site examination team, the amount of deep dive credit risk reviews on the remaining DSIBs has not been able to take place. In general, CBoB’s credit risk guidance allows for a wide range of practice, both from an asset classification and loan loss provisioning perspective. Under estimation of potential credit losses together with an over estimation of the level of provisioning could lead to an inaccurate view of the credit risk cycle for the overall banking sector. CBoB therefore may contemplate a thematic credit review of DSIB’s effectiveness of credit risk management practices, to satisfy itself of the accuracy of SFI NPL reporting and provisioning. CBoB’s supervisors need to continue with their efforts of ensuring a proper oversight by the banks’ board over the banks’ credit risk profile. |
| Principle 18 | Problem assets, provisions and reserves.50 The supervisor determines that banks have adequate policies and processes for the early identification and management of problem assets, and the maintenance of adequate provisions and reserves.51 |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to formulate policies and processes for identifying and managing problem assets. In addition, laws, regulations or the supervisor require regular review by banks of their problem assets (at an individual level or at a portfolio level for assets with homogenous characteristics) and asset classification, provisioning and write-offs. |
| Description and findings re EC1 | S. 17 (First Schedule) of the BTCRA authorizes CBoB to evaluate banks’ policies, practices and procedures related to the granting of loans and making of investments, and the ongoing management of the loans and investment portfolios, and to take measures to ensure that banks adhere to these policies. It also states that the Inspector ensure that banks establish and adhere to adequate policies, practices and procedures for evaluating the quality of assets and the adequacy of loan-loss provisioning and loan loss reserves. Part III of the Guidelines for the Measurement, Monitoring and Control of Impaired Assets (Asset Impairment Guideline) provides guidance to SFIs on the recognition of impairment of an asset which states that an asset is impaired where there is no longer reasonable assurance of timely collection of the full amount of principal and interest due to a deterioration in the credit quality of the counterparty. Although the Asset Impairment Guideline does not stipulate the requirement for board policies and processes pertaining to impaired assets, this requirement can be found in the CRM Guideline which is to be read in conjunction with the Asset Impairment Guideline. S. VII (1) of the CRM Guideline suggests that SFI’s conduct a review of all facilities at least annually (except consumer loans repayable by instalment need not be reviewed if current). With respect to asset classification, provisioning and write-offs requirements: the CRM Guideline states the following:
As a result of some of the criteria in both the CRM Guideline and the Impaired Asset Guideline, the Assessors observed a number of differing asset classification and loan loss provisioning practices, especially amongst the DSIBs. CBoB has required all SFI to be compliant with IFRS 9 accounting requirements effective January 1, 2018. CBoB has indicated that it will not pre-approve the validation of credit risk models used to assess and measure expected credit losses. The Assessors observed a lack of CBoB guidance, pertaining to its expectations and discretion with respect to the IFRS 9 implementation. |
| EC2 | The supervisor determines the adequacy of a bank’s policies and processes for grading and classifying its assets and establishing appropriate and robust provisioning levels. The reviews supporting the supervisor’s opinion may be conducted by external experts, with the supervisor reviewing the work of the external experts to determine the adequacy of the bank’s policies and processes. |
| Description and findings re EC2 | CBoB undertakes to assess SFI’s adequacy of bank’s policies and processes for grading and classifying its assets provisioning levels through on-site examinations. These on-site examinations are only carried out periodically and if determined to be a priority through the risk assessment process. Since 2015 five in-depth credit risk management reviews have taken place at the DSIBs. In general, the supervisory in-depth risk assessments are carried out on cycle of three years for larger SFIs and five years for smaller SFIs. Once this assessment is conducted and the off-site supervisor surveillance team have conducted a mitigation plan, there may be a determination to conduct an on-site credit risk review. When a credit risk on-site examination is carried out, the CBoB examiner focuses on:
The off-site supervision surveillance team monitors the level of non-performing assets, together with provisioning levels, on a quarterly basis and engages senior management of SFI’s twice yearly to discuss expectations on overall levels of NPLs (e.g. focus of discussion on the top 20 loan exposures and the top 20 non-performing loans). |
| EC3 | The supervisor determines that the bank’s system for classification and provisioning takes into account off-balance sheet exposures.52 |
| Description and findings re EC3 | S. VII (3) (a) of the CRM Guideline indicates that the asset classification system should include off-balance sheet exposures. Further, S. III of the Impaired Asset Guideline indicates that an SFI should include an impaired asset assessment of off-balance sheet assets, however no guidance was provided beyond this statement. Where an on-site examination takes place, the examiners may review the classification systems, including the off-balance sheet exposures if this is deemed warranted by the risk assessment process. |
| EC4 | The supervisor determines that banks have appropriate policies and processes to ensure that provisions and write-offs are timely and reflect realistic repayment and recovery expectations, taking into account market and macroeconomic conditions. |
| Description and findings re EC4 | The on-site examination team, when it has the opportunity to conduct an on-site credit review as part of the risk based supervisory process, will examine SFI’s policies and processes with respect to provisions levels and write-offs. From a macroeconomic standpoint, it is broadly known that The Bahamas has an excess supply of distressed real estate assets. Keeping this fact in mind, the focus on the timing of when SFIs are expected to set provisioning levels at 100 per cent is to be one of the key indicators for this jurisdiction versus when an SFI write-off a loan. The Assessors observed that SFIs have varying provisioning practices with respect to the timing of the requirement to book 100 percent of arrears. For example, asset-backed real estate loans in general are not written-off on a consistent basis and therefore tend to be kept on the books of the SFIs for periods ranging from 3 to 10 years. Some SFI’s will book 100 percent of the NPL at the 3-year mark, regardless of the value of the collateral of the real estate while other SFIs utilize 5 years and so on. In general, the Impaired Assets Guideline states that the overarching test of impairment of an asset is reasonable doubt over the ultimate collectability of principal and/or interest. The existence of any of the following conditions should be considered to indicate that the institution no longer has reasonable assurance of timely collection of the full amount of the principal and interest and the facility should be recognized as impaired:
|
| EC5 | The supervisor determines that banks have appropriate policies and processes, and organizational resources for the early identification of deteriorating assets, for ongoing oversight of problem assets, and for collecting on past due obligations. For portfolios of credit exposures with homogeneous characteristics, the exposures are classified when payments are contractually in arrears for a minimum number of days (e.g. 30, 60, 90 days). The supervisor tests banks’ treatment of assets with a view to identifying any material circumvention of the classification and provisioning standards (e.g. rescheduling, refinancing or reclassification of loans). |
| Description and findings re EC5 | S. VIII (3) of the CRM Guideline recommends a dedicated resource to handle the recovery and work-out of problem loans with appropriate policies in place as well as having a well-defined credit collections and arrears management process. Although both the CRM Guideline and the Impaired Asset Guideline provide for the ability of SFIs to classify impairment for portfolio of credit exposures with homogeneous characteristics, CBoB has simply determined two broad categories for impaired assets, namely “past due” assets which are less than 90 days overdue or “non-accrual” assets which are 90 days past due. As part of the supervisory process, when an on-site credit examination is determined to be warranted to be conducted, the examiners review the bank’s management of problem credits, whether resources are allocated to recovery and work-out of problem credits, and the adequacy and timeliness of provisioning policy. |
| EC6 | The supervisor obtains information on a regular basis, and in relevant detail, or has full access to information concerning the classification of assets and provisioning. The supervisor requires banks to have adequate documentation to support their classification and provisioning levels. |
| Description and findings re EC6 | The CBoB monitors the asset quality of the DSIBs on a monthly and quarterly basis for both arrears and non-performing loans both on an individual loan basis (focusing on the top 20 loan exposures, top 20 NPLs) and on an aggregate basis (aging by past dues and NPLs by sector) as well as a breakdown of restructured loans (consumer, mortgages and commercial loans). Provisioning information is on a total loans basis only. |
| EC7 | The supervisor assesses whether the classification of the assets and the provisioning is adequate for prudential purposes. If asset classifications are inaccurate or provisions are deemed to be inadequate for prudential purposes (e.g. if the supervisor considers existing or anticipated deterioration in asset quality to be of concern or if the provisions do not fully reflect losses expected to be incurred), the supervisor has the power to require the bank to adjust its classifications of individual assets, increase its levels of provisioning, reserves or capital and, if necessary, impose other remedial measures. |
| Description and findings re EC7 | The CBoB is granted broad powers to require actions by the banks to strengthen their financial position, including higher provisions. The CRM Guideline indicates that banks having a credit risk management methodology and/or level of provisioning (specific and general allowances) that is assessed as “Not Acceptable,” is required to submit an action plan and timeline for compliance with the CBoB’s requirements. The bank may be subject to enhanced monitoring of its risk management processes, until the licensee achieves an “Acceptable” or better rating. In addition, licensees that do not achieve an “Acceptable” rating for the level of provisioning may be expected to provide an additional level of capital or equivalent to minimize the adverse effects of not having a sufficient level of provisioning. When it is determined that an SFI requires an on-site credit review as part of the supervisory process, the on-site examination would pay special attention is paid to the bank’s delinquency management processes. S. 18 (h) of the BTCRA indicates that the CBoB may issue directions requiring a licensee to cease or refrain from committing an act or pursuing a course of conduct that is unsafe or unsound practice, or that is in contravention of any law or perform a remedial act. The Ladder of Intervention Guide indicate that the CBoB has the ability to issue a direction for an SFI to increase its level of specific provisions when found to be deficient. It is noted that the proposed amendment to the BTCRA is expected to, among other things, require a licensee to dispose of specified assets or to require shareholders to contribute additional capital when required. The Assessors observed that CBoB has on occasion issued a directive to an SFI when remedial action was needed to increase an SFI’s provisioning levels. |
| EC8 | The supervisor requires banks to have appropriate mechanisms in place for regularly assessing the value of risk mitigants, including guarantees, credit derivatives and collateral. The valuation of collateral reflects the net realizable value, taking into account prevailing market conditions. |
| Description and findings re EC8 | The CRM Guidelines requires the periodic re-assessment of risk mitigants which states that licensees should revalue their collateral and mitigation instruments on a regular basis. The method and frequency of revaluation depends on the nature of the mitigation and the products involved. |
| EC9 | Laws, regulations or the supervisor establish criteria for assets to be:
|
| Description and findings re EC9 | S. III of the Impaired Asset Guideline provides for:
|
| EC10 | The supervisor determines that the bank’s Board obtains timely and appropriate information on the condition of the bank’s asset portfolio, including classification of assets, the level of provisions and reserves and major problem assets. The information includes, at a minimum, summary results of the latest asset review process, comparative trends in the overall quality of problem assets, and measurements of existing or anticipated deterioration in asset quality and losses expected to be incurred. |
| Description and findings re EC10 | The CRM Guidelines require licensees to conduct credit audits to assess individual credits and their overall quality. The Guidelines specifically state that the findings of independent credit audits should be reported to the Board or the Audit Committee on a timely basis, and appropriate remedial actions should be taken to address any concerns and weakness raised. |
| EC11 | The supervisor requires that valuation, classification and provisioning, at least for significant exposures, are conducted on an individual item basis. For this purpose, supervisors require banks to set an appropriate threshold for the purpose of identifying significant exposures and to regularly review the level of the threshold. |
| Description and findings re EC11 | CBoB’s CRM Guidelines require SFI to determine their own asset classification systems and provisioning levels. The Large Exposure Guideline defines a large exposure (both single and aggregate) and requires SFI to monitor exposures against board approved limits. SFI’s must seek CBoB’s approval to underwrite loans greater than 10 percent of total capital. Beginning August 2017, the off-site supervision surveillance team met twice yearly with the DSIBs to discuss the Inspector’s expectation that SFIs work towards resolving their 20 largest non-performing loans and to reduce the overall level of NPLs in general on a go forward basis. As part of these discussions, letters were sent to the DSIBs (May 2018 and November 2018) regarding some high-level expectations with respect to valuation practices for real estate back lending (e.g. preference for SFI to utilize market selling prices versus sales listing prices for residential housing). The industry would greatly benefit from updated guidance related to the CBoB’s expectations of SFIs collateral asset valuation practices. With the 2018 announcement by the Government of the establishment of the Credit Rating Agency (expected to be operational in 2020), the ability of SFIs to make use of this valuation information should help ensure firms are using consistent collateral valuation practices. |
| EC12 | The supervisor regularly assesses any trends and concentrations in risk and risk build-up across the banking sector in relation to banks’ problem assets and takes into account any observed concentration in the risk mitigation strategies adopted by banks and the potential effect on the efficacy of the mitigant in reducing loss. The supervisor considers the adequacy of provisions and reserves at the bank and banking system level in the light of this assessment. |
| Description and findings re EC12 | The Market Research Division of CBoB conducts periodic stress testing of credit risk within the banking sector in relation to banks’ problem assets. The off-site surveillance teams are aware of the results of the macro stress tests and take the results into consideration when assessing the prudential information provided by SFI’s regarding their NPLs. |
| Assessment of Principle 18 | Largely Compliant |
| Comments | CBoB’s Impaired Assets Guidelines are somewhat outdated with evidence of industry practice varying on agreed definitions for the valuation of collateral and timing of loan loss provisioning. Although some of these practices do not align with Basel Guidelines on prudential treatment of problem assets, with the implementation of IFRS 9 (effective January 1, 2018), the requirement for SFIs to report expected losses will soon come into effect. It will be important for the CBoB to update its guidance to industry with respect to its expectations and discretion as it pertains to the validation of credit risk models used to assess and measure expected credit losses. CBoB has been meeting regularly with DSIB firms to discuss prudential concerns surrounding the level of non-performing loans, progress to decrease the overall levels and some general advice to DSIBs regarding the use of market sales prices for regarding valuation practices of SFIs for their real estate back loans. CBoB off-site surveillance team monitors the top 20 largest exposures as well as the top NPLs, together with the level of provisioning for NPLs on a regular basis. |
| Principle 19 | Concentration risk and large exposure limits. The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate concentrations of risk on a timely basis. Supervisors set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties.53 |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to have policies and processes that provide a comprehensive bank-wide view of significant sources of concentration risk.54 Exposures arising from off-balance sheet as well as on-balance sheet items and from contingent liabilities are captured. |
| Description and findings re EC1 | The BTCRA Large Exposure Regulations and CBOB’s Large Exposure Guidelines require SFIs to have policies and processes for measuring and limiting firm-wide concentrations. In addition, SFIs are required to have large exposure measures and limits in place that cover economic sector, country/geographical and to individual borrowers and groups of related borrowers. The Large Exposure Regulation defines ‘exposure’ as:
|
| EC2 | The supervisor determines that a bank’s information systems identify and aggregate on a timely basis, and facilitate active management of, exposures creating risk concentrations and large exposure55 to single counterparties or groups of connected counterparties. |
| Description and findings re EC2 | The BTCRA requires supervisors (as delegated by the Inspector of CBoB supervision) to ensure the banks have management information systems that enable management to identify portfolio concentration in line with the firm’s risk appetite and associated board-established limits. Typically, supervisors monitor this through off-sight surveillance of required regulatory reporting on large exposures (quarterly) and gain a deeper understanding through structured meetings with the firms or “Discovery Reviews”, and reviews of risk reports to management and the board. When onsite credit examinations are performed, if this issue is deemed to represent a significant risk by the risk assessment process, examiners would include a review of the adequacy of information systems. Assessors observed and reviewed the required periodic reporting by SFIs of their large exposures and concentrations. The Policy Statement on Large Exposures requires bank directors/management to review the policy statement periodically but at least annually. |
| EC3 | The supervisor determines that a bank’s risk management policies and processes establish thresholds for acceptable concentrations of risk, reflecting the bank’s risk appetite, risk profile and capital strength, which are understood by, and regularly communicated to, relevant staff. The supervisor also determines that the bank’s policies and processes require all material concentrations to be regularly reviewed and reported to the bank’s Board. |
| Description and findings re EC3 | In addition to the limits imposed by CBoB, banks are required to adopt and set out in writing their internal limits, as outlined in the Large Exposure Guidelines. As noted above, these should cover economic sectoral and country/geographical exposures as well as exposures to individual borrowers and groups of related borrowers. There are no required regulatory limits on economic sectoral or country/geographical exposures. Supervisors monitor such exposures on an individual basis where applicable. SFIs are required to review large exposure and concentration policies not less than annually. Changes to policies and procedures will be communicated to supervisors who may conduct further work if warranted as per the risk assessment process. |
| EC4 | The supervisor regularly obtains information that enables concentrations within a bank’s portfolio, including sectoral, geographical and currency exposures, to be reviewed. |
| Description and findings re EC4 | SFIs must submit detailed regulatory reports on large exposures on a quarterly basis. These are reviewed and assessed by supervisors to determine compliance with internal board-approved limits and the exposure limits outlined in the Large Exposure Guidelines. Economic sectoral and country/geographical exposures are reviewed during on-site inspections, if determined to be warranted in the risk assessment process, and as part of the review of the quarterly accounts (unaudited) and annual accounts (audited). |
| EC5 | In respect of credit exposure to single counterparties or groups of connected counterparties, laws or regulations explicitly define, or the supervisor has the power to define, a “group of connected counterparties” to reflect actual risk exposure. The supervisor may exercise discretion in applying this definition on a case by case basis. |
| Description and findings re EC5 | The BCTRA Large Exposure Regulations (amendment of 2012) and the CBoB Large Exposures Guidelines define a group of connected parties as two or more individual counterparties that constitute a single risk and include:
|
| EC6 | Laws, regulations or the supervisor set prudent and appropriate56 requirements to control and constrain large credit exposures to a single counterparty or a group of connected counterparties. “Exposures” for this purpose include all claims and transactions (including those giving rise to counterparty credit risk exposure), on-balance sheet as well as off-balance sheet. The supervisor determines that senior management monitors these limits and that they are not exceeded on a solo or consolidated basis. |
| Description and findings re EC6 | The Large Exposures Regulations define ‘large exposure’ as an exposure which is equal to or exceeds 10 percent or more of the capital of the bank. All exposures of 10 percent or more in aggregate cannot exceed 800 percent of capital. SFIs must get approval to invest in any debt security to an individual issuer of greater than 10 percent of capital. The regulatory limit on exposures to an individual counterparty or group of connected parties is 25 percent of the bank’s capital. Additionally, a bank may not hold investments in debt securities of a single issuer greater than 10 percent of the bank’s capital. Exposures that are exempt from the above requirements (see below for list of exempt exposures), cannot be greater than exceed 800 percent of capital.
The CBoB may set lower limits for any SFI if it considers it necessary. SFIs are required to maintain policies and procedures for large exposures/concentrations and bank management must regularly review compliance with the large exposures policy. Attestation of compliance is part of the annual corporate governance certification. The CBoB can grant exemptions from the large exposure limits if requested by a SFI. Licensees seeking prior approval or an exemption from the large exposure limits must apply via a specific Large Exposures Application Form. Applications are expected to be submitted at least one month prior to taking on such an exposure. In assessing possible exemptions, CBoB will have regard to whether the exposure(s) would significantly increase the risk to depositors of the licensee and whether the exposure(s) is/are consistent with the SFI’s large exposures policy statement. Typically, supervisors monitor large exposure policies and exposures relative to regulatory and internal limits through off-sight surveillance of required regulatory reporting on large exposures (quarterly) and gain a deeper understanding of processes, if needed or if changes are made, through structured meetings with the firms or so-called “Discovery Reviews”, as well as reviews of risk reports sent to SFI management and boards. Assessors observed and reviewed the required periodic reporting by SFIs of their large exposures and concentrations. |
| EC7 | The supervisor requires banks to include the impact of significant risk concentrations into their stress testing programs for risk management purposes. |
| Description and findings re EC7 | CBoB currently does not have formal stress testing guidelines other than requiring stress testing to be used in ICAAP. SFIs are required to include stress testing as part of the ICAAPs for risk management and capital assessment purposes. Stress testing reviews have not been an area of particular focus for CBoB supervisors, though they do require credit stress tests and closely review the results. These tests are expected to capture all credit positions and thus would capture large exposures. |
| Additional criteria | |
| AC1 | In respect of credit exposure to single counterparties or groups of connected counterparties, banks are required to adhere to the following:
Minor deviations from these limits may be acceptable, especially if explicitly temporary or related to very small or specialized banks. |
| Description and findings re AC1 | CBoB applies both the 10 percent and 25 percent criteria. As noted above, some deviations from these limits may be allowed with the permission of CBoB. This permission must be requested in writing by the SFI. |
| Assessment of Principle 19 | Compliant |
| Comments | Given the strong focus by CBoB on closely monitoring large exposures the assessors view the practices described above as sufficient for a banking system of this size and complexity. CBoB requires monthly reporting on large exposure of DSIBs. While formal stress testing guidelines have not been developed and ICAAP reviews should be expanded and enhanced, these are addressed in BCP 15, Risk Management. |
| Principle 20 | Transactions with related parties. In order to prevent abuses arising in transactions with related parties57 and to address the risk of conflict of interest, the supervisor requires banks to enter into any transactions with related parties58 on an arm’s length basis; to monitor these transactions; to take appropriate steps to control or mitigate the risks; and to write off exposures to related parties in accordance with standard policies and processes. |
| Essential criteria | |
| EC1 | Laws or regulations provide, or the supervisor has the power to prescribe, a comprehensive definition of “related parties”. This considers the parties identified in the footnote to the Principle. The supervisor may exercise discretion in applying this definition on a case by case basis. |
| Description and findings re EC1 | The BTCRA Large Exposures Regulations define related party to include:
|
| EC2 | Laws, regulations or the supervisor require that transactions with related parties are not undertaken on more favorable terms (e.g. in credit assessment, tenor, interest rates, fees, amortization schedules, requirement for collateral) than corresponding transactions with non-related counterparties.59 |
| Description and findings re EC2 | The Large Exposure Guidelines require that exposures to related parties must be:
The Guidelines require the Board to have approved policies on related party exposures as well as on intra group lending. As part of the policies the Board must identify the SFI’s related parties and procedures for related party lending, including the limits for exposures entered into for treasury management purposes. SFIs are required to submit their large exposure policy statement to the CBoB and any material changes must be reported. |
| EC3 | The supervisor requires that transactions with related parties and the write-off of related-party exposures exceeding specified amounts or otherwise posing special risks are subject to prior approval by the bank’s Board. The supervisor requires that Board members with conflicts of interest are excluded from the approval process of granting and managing related party transactions. |
| Description and findings re EC3 | The Guidelines also require SFIs’ policies to include specific policies for entering into transactions with related parties and for write-offs of related party exposures that exceed amounts specified by policy or otherwise posing special risks, and to be subject to prior approval by the bank’s board. A directive sent in October 2012 providing notification that Board members with conflicts of interest must be excluded from the approval process. |
| EC4 | The supervisor determines that banks have policies and processes to prevent persons benefiting from the transaction and/or persons related to such a person from being part of the process of granting and managing the transaction. |
| Description and findings re EC4 | The requirement referred to above (in EC3) requires banks to have policies and processes in place to prevent persons benefiting from related-party exposures and/or persons related to such a person from being part of the process of granting and managing the exposure. |
| EC5 | Laws or regulations set, or the supervisor has the power to set on a general or case by case basis, limits for exposures to related parties, to deduct such exposures from capital when assessing capital adequacy, or to require collateralization of such exposures. When limits are set on aggregate exposures to related parties, those are at least as strict as those for single counterparties or groups of connected counterparties. |
| Description and findings re EC5 | The Large Exposure Regulations and Guidelines specify that a bank may not incur an exposure on an aggregate basis to its related parties of greater than 15 percent of its capital base. Regulation 5 of the Regulations provides that CBoB may deduct related party exposures from capital if, in its opinion, such lending is in the nature of a capital investment or made on concessionary terms. |
| EC6 | The supervisor determines that banks have policies and processes to identify individual exposures to and transactions with related parties as well as the total amount of exposures, and to monitor and report on them through an independent credit review or audit process. The supervisor determines that exceptions to policies, processes and limits are reported to the appropriate level of the bank’s senior management and, if necessary, to the Board, for timely action. The supervisor also determines that senior management monitors related party transactions on an ongoing basis, and that the Board also provides oversight of these transactions. |
| Description and findings re EC6 | The Guidelines for the Management of Credit Risk state that all credit to related borrowers should be monitored carefully and steps should be taken to control or reduce the risks of connected lending. In the conduct of risk based onsite examinations, when those are carried out, if related party lending is deemed a priority through the risk assessment process, supervisors would:
CBoB last conducted onsite examinations with a focus on concentration risk and related party exposures in 2014–2015. Related party transactions would be reviewed as part of CBoB’s credit risk examinations if the risk assessment process identifies these as a priority. In the absence of onsite examinations supervisors would review internal audit reports and discuss related practices with SFI management, along with surveillance activities of monitoring the firms required regulatory reporting to CBoB. See BCP discussion of supervision approach for a discussion of the CBoB’s general approach to supervision. |
| EC7 | The supervisor obtains and reviews information on aggregate exposures to related parties. |
| Description and findings re EC7 | CBoB receives quarterly reports on related party lending. CBoB’s quarterly financial returns include information on related party deposits and lending which are assessed in line with the Large Exposure Guidelines. The supervisor determines the level of compliance or lack thereof with prudential norms or any exceptions granted. |
| Assessment of Principle 20 | Largely Compliant |
| Comments | Comprehensive coverage of related party risk management would be expected to be carried out through onsite credit examinations, of which there has been only a limited number since 2015. The monitoring process is effective with respect to reviewing related party exposures relative to large exposure limits, but only captures related party exposures that would also appear in the large exposure reporting. CBoB should review and monitor all related party exposures to ensure compliance with requirements. The directive sent by letter to the firms in 2012 (see EC 3 above) should be incorporated directly into supervisory guidelines/requirements. |
| Principle 21 | Country and transfer risks. The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate country risk60 and transfer risk61 in their international lending and investment activities on a timely basis. |
| Essential criteria | |
| EC1 | The supervisor determines that a bank’s policies and processes give due regard to the identification, measurement, evaluation, monitoring, reporting and control or mitigation of country risk and transfer risk. The supervisor also determines that the processes are consistent with the risk profile, systemic importance and risk appetite of the bank, take into account market and macroeconomic conditions and provide a comprehensive bank-wide view of country and transfer risk exposure. Exposures (including, where relevant, intra-group exposures) are identified, monitored and managed on a regional and an individual country basis (in addition to the end-borrower/end-counterparty basis). Banks are required to monitor and evaluate developments in country risk and in transfer risk and apply appropriate countermeasures. |
| Description and findings re EC1 | Section 2 of the Guidelines for the Management of Country Risk specifies that a SFI’s senior management is responsible for implementing board-approved, sound, well defined country risk management policies and procedures that:
The Guidelines also require SFIs to have adequate country risk provisions given their assessment of the probability of losses arising from cross-border exposures. Supervisory assessments of policies and procedures, including associated limits and exposures is largely carried through off-site supervision, meetings with firms, reviews of risk appetite statements and regular required reports of country risk exposures. If onsite examinations are deemed warranted by the risk assessment process, supervisors would include an assessment of country and transfer risk management in the scope of the exams. |
| EC2 | The supervisor determines that banks’ strategies, policies and processes for the management of country and transfer risks have been approved by the banks’ Boards and that the Boards oversee management in a way that ensures that these policies and processes are implemented effectively and fully integrated into the banks’ overall risk management process. |
| Description and findings re EC2 | Reviews of board approval of policies and procedures is generally done by the supervisory teams through reviewing board meeting minutes and/or minutes of the relevant subcommittees. The Risk Assessment Process includes Governance and Oversight as a key mitigant against inherent risks. This will include aspects of corporate governance and could include a review of board oversight of management, but does not necessarily include that. Supervisors get a more general sense of board oversight than do specific assessments. Country risk management and corporate governance around it can be assessed during onsite examinations if the risk assessment process finds it warranted. |
| EC3 | The supervisor determines that banks have information systems, risk management systems and internal control systems that accurately aggregate, monitor and report country exposures on a timely basis; and ensure adherence to established country exposure limits. |
| Description and findings re EC3 | The Guidelines specify that each bank has in place risk management policies and procedures as well as an effective process for analyzing country risk. In particular, Section IV—Supervisory Approach—of the Guidelines specifies that CBoB supervisors will seek to determine that there is:
CBoB considers the size and complexity of a bank’s cross border business and other factors set out in the Guidelines in considering whether the bank has appropriate systems to control country risk and maintains adequate provisions for such risk. Section VI—Internal Controls and Audit—of the Guidelines specifies that banks should ensure that their country risk management process includes adequate internal controls, and that there is an audit mechanism to ensure the integrity of the information used by senior management and the Board to monitor compliance with country risk policies and exposures limits. The system of internal controls should, for example, ensure that responsibilities for marketing and lending personnel are properly segregated from the responsibilities of personnel who analyze and rate country risk, and set country limits. CBoB requires regular periodic reporting by SFIs on country and transfer risk. Monitoring against limits is done offsite through this process. |
| EC4 | There is supervisory oversight of the setting of appropriate provisions against country risk and transfer risk. There are different international practices that are all acceptable as long as they lead to risk-based results. These include:
|
| Description and findings re EC4 | Section VII—Country Risk Provisioning—of the Guidelines specifically addresses provisions against country risk and transfer risk. SFIs are required to provision for these risks to absorb potential losses arising from exposures to country risk. Banks may decide to assign provisions by either:
Regardless of the approach banks adopt, they are expected to have adequate country risk provisions for the assessment of potential losses from their cross-border exposures. CBoB assesses country risk in the context of reviewing the policies, procedures and practices of SFIs as they relate to the broader set of credit risk controls. The assessment takes into account the effectiveness of controls around credit concentration, approved limits, and provisioning and is largely carried out offsite. If the Risk Assessment process determined this area warranted the attention of an onsite examination, it would normally be covered as part of broader reviews. CBoB assesses the adequacy of provisioning primarily through its off-site supervisory regime and places reliance on external auditors audits of financial statements. The external auditor takes provisioning into account when arriving at a true and fair view of the bank. |
| EC5 | The supervisor requires banks to include appropriate scenarios into their stress testing programs to reflect country and transfer risk analysis for risk management purposes. |
| Description and findings re EC5 | If it is assessed as a separate risk, it would be assessed as ‘other identified risks’ as part of the licensee’s ICAAP assessment, where the capital required would be reflected as a Pillar 2 charge. The CBoB requires licensees to effectively manage country risk through the ICAAP process, which is required to include stress testing in the analyses, as well as through periodic stress testing of international exposures as part of the credit stress testing requirements. |
| EC6 | The supervisor regularly obtains and reviews sufficient information on a timely basis on the country risk and transfer risk of banks. The supervisor also has the power to obtain additional information, as needed (e.g. in crisis situations). |
| Description and findings re EC6 | CBoB receives details of country risk exposure on a quarterly basis which is analyzed through its offsite supervisory monitoring regime. Under the BTCRA, CBoB has the authority to request any information it requires from a SFI in order to carry out its duties. |
| Assessment of Principle 21 | Compliant |
| Comments | Assessors found that country and transfer risk were sufficiently covered through the offsite processes described above. Lack of sufficient onsite examination coverage of credit risk management more broadly is captured in the assessment of BCP 17. |
| Principle 22 | Market risk. The supervisor determines that banks have an adequate market risk management process that takes into account their risk appetite, risk profile, and market and macroeconomic conditions and the risk of a significant deterioration in market liquidity. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate market risks on a timely basis. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to have appropriate market risk management processes that provide a comprehensive bank-wide view of market risk exposure. The supervisor determines that these processes are consistent with the risk appetite, risk profile, systemic importance and capital strength of the bank; take into account market and macroeconomic conditions and the risk of a significant deterioration in market liquidity; and clearly articulate the roles and responsibilities for identification, measuring, monitoring and control of market risk. |
| Description and findings re EC1 | CBoB issued its Guidelines for the Management of Market Risk in 2012. The guidelines are supported by written examiner guidance and modules for examination. The guidelines aim to ensure that SFIs engaged in activities that give rise to risks associated with potential movements in market prices adopt management practices and meet capital requirements that are commensurate with the risks involved. Where applicable—currently at 6 firms—SFIs are required to establish sound and reliable systems for market risk management that are commensurate with the nature, scale and complexity of their business. CBoB expects SFIs management of market risk to include the following basic elements:
Under the Guidelines for Market Risk, SFIs must establish sound and reliable systems for market risk management commensurate with the nature, scale and complexity of the business. SFIs must also establish and maintain adequate systems and controls sufficient to give management and supervisors the confidence that their valuation estimates are prudent and reliable. These systems must be integrated with other risk management systems within the organization (such as credit analysis). Under the BTCRA, the CBoB has issued Corporate Governance Guidelines that outline the responsibility of the bank’s management and board in managing market risks. As directed by the Corporate Governance Guidelines, boards of SFIs must certify each year where they stand with respect supervisory expectations and regulatory requirements. The BTCRA requires CBoB to ensure that banks have in place and use systems that accurately measure, monitor and adequately control market risk and other risks. CBoB module for examiners when undertaking onsite examinations directs them to assess whether:
The assessors did not observe that any market risk examinations had been carried out over the past four years and discussions with examiners indicated that market risk is not an area on which they would typically focus. Market risk reporting requirements for applicable SFIs have been developed and incorporated into the ERS. Supervisors review required regulatory reports on market risk. |
| EC2 | The supervisor determines that banks’ strategies, policies and processes for the management of market risk have been approved by the banks’ Boards and that the Boards oversee management in a way that ensures that these policies and processes are implemented effectively and fully integrated into the banks’ overall risk management process. |
| Description and findings re EC2 | CBoB issued its Guidelines for the Management of Market Risk in 2012. The guidelines are supported by written examiner guidance and modules for examination. The guidelines aim to ensure that SFIs engaged in activities that give rise to risks associated with potential movements in market prices adopt management practices and meet capital requirements that are commensurate with the risks involved. Where applicable—currently at 6 firms—SFIs are required to establish sound and reliable systems for market risk management that are commensurate with the nature, scale and complexity of their business. CBoB expects SFIs management of market risk to include the following basic elements:
Under the Guidelines for Market Risk, SFIs must establish sound and reliable systems for market risk management commensurate with the nature, scale and complexity of the business. SFIs must also establish and maintain adequate systems and controls sufficient to give management and supervisors the confidence that their valuation estimates are prudent and reliable. These systems must be integrated with other risk management systems within the organization (such as credit analysis). Under the BTCRA, the CBoB has issued Corporate Governance Guidelines that outline the responsibility of the bank’s management and board in managing market risks. As directed by the Corporate Governance Guidelines, boards of SFIs must certify each year where they stand with respect supervisory expectations and regulatory requirements. The BTCRA requires CBoB to ensure that banks have in place and use systems that accurately measure, monitor and adequately control market risk and other risks. CBoB module for examiners when undertaking onsite examinations directs them to assess whether:
The assessors did not observe that any onsite market risk examinations had been carried out over the past four years and discussions with examiners indicated that market risk is not an area on which they would typically focus. Market risk is captured in the ICAAP reports provided by the SFIs. Securities Commission examiners reportedly assess market risk management issues on a regular basis. Assessment of the Securities Commission’s supervision was not part of this review. |
| EC3 | The supervisor determines that the bank’s policies and processes establish an appropriate and properly controlled market risk environment including:
|
| Description and findings re EC3 | CBoB does not directly review market risk through onsite examinations. Staff told the assessors that the Securities Commission (which is outside the scope of this assessment) carries out examinations of market risk and CBoB would rely on them to provide information if problems arise. Assessment of policies, limits and exposures versus limits is carried out offsite with exposures captured in required regulatory reporting. Only four SFIs exceed the de minimus exposure thresholds and must report exposures and hold capital under pillar 1. For three of the four firms the exposures are not material and for the fourth (which is a foreign-owned SFI) the positions generating the exposures are not complex. |
| EC4 | The supervisor determines that there are systems and controls to ensure that bank’ marked-to-market positions are revalued frequently. The supervisor also determines that all transactions are captured on a timely basis and that the valuation process uses consistent and prudent practices, and reliable market data verified by a function independent of the relevant risk-taking business units (or, in the absence of market prices, internal or industry-accepted models). To the extent that the bank relies on modeling for the purposes of valuation, the bank is required to ensure that the model is validated by a function independent of the relevant risk-taking businesses units. The supervisor requires banks to establish and maintain policies and processes for considering valuation adjustments for positions that otherwise cannot be prudently valued, including concentrated, less liquid, and stale positions. |
| Description and findings re EC4 | The Market Risk Guidelines address internal audit monitoring of the banks’ trading and market risk activities. CBoB supervisors review internal audit reports on all risk areas including market risk. They follow up on internal audit identified weaknesses and track progress on SFIs remediation plans. External auditors include reviews of valuation methods and outcomes as part of auditing financial statements. The annual board certification includes assessment of compliance with all laws, rules and Guidelines. |
| EC5 | The supervisor determines that banks hold appropriate levels of capital against unexpected losses and make appropriate valuation adjustments for uncertainties in determining the fair value of assets and liabilities. |
| Description and findings re EC5 | The CBoB requires licensees that meet the de minimis threshold to report on market risk capital allocated to support this risk (on a quarterly basis), which supervisors review on a quarterly basis. There was no indication provided to the assessors that the supervisors make a determination regarding the appropriateness of valuation adjustments for valuation uncertainties. Rather, CBoB supervisors stated they would typically would look to external auditors to determine appropriate valuations and valuation practices as part of their audits of SFIs’ preparation of public financial statements. |
| EC6 | The supervisor requires banks to include market risk exposure into their stress testing programs for risk management purposes. |
| Description and findings re EC6 | Given the limited volume of trading activities, guidelines on stress testing or scenario analysis have not been issued. As part of the ICAAP, SFIs are expected to incorporate stress testing to complement other measures and help them understand and validate their risks, and the interaction of those risks under stressed conditions. The Guidelines for the Internal Capital Adequacy Assessment Process (ICAAP) states that, “banks must have methodologies that enable them to assess and actively manage all material market risks, wherever they arise throughout the institution (i.e., position, trading desk, business line or firm-level). For more sophisticated licensees, the assessment of internal capital adequacy for market risk, at a minimum, should be based on both value-at-risk (VaR) or similar modeling and stress testing, including an assessment of concentration risk and the assessment of illiquidity under stressful market scenarios.” The ICAAP Guidelines were issued in August 2016. To date SFIs’ ICAAP has not been an area subject to in depth assessments through onsite examinations. |
| Assessment of Principle 22 | Compliant |
| Comments | Given the small number of SFIs—four—with market risk exposures and the generally small size or relatively low risk nature of those exposures, the assessors view the current practices for market risk as sufficient. Three of the four banks have market risk exposures less than 10 percent of capital. The fourth has market risk exposures of 33 percent of capital. This bank has market risk positions are straightforward vanilla instruments such as sovereign and corporate bonds and repurchase agreements. We recommend that CBoB increase its focus on assessments of ICAAP at the SFIs and include a review of the SFIs’ treatment of market risk exposures in that context. |
| Principle 23 | Interest rate risk in the banking book. The supervisor determines that banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk62 in the banking book on a timely basis. These systems take into account the bank’s risk appetite, risk profile and market and macroeconomic conditions. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require banks to have an appropriate interest rate risk strategy and interest rate risk management framework that provides a comprehensive bank-wide view of interest rate risk. This includes policies and processes to identify, measure, evaluate, monitor, report and control or mitigate material sources of interest rate risk. The supervisor determines that the bank’s strategy, policies and processes are consistent with the risk appetite, risk profile and systemic importance of the bank, take into account market and macroeconomic conditions, and are regularly reviewed and appropriately adjusted, where necessary, with the bank’s changing risk profile and market developments. |
| Description and findings re EC1 | CBoB’s reporting system for commercial banks (ERS) is used to collect data for supervisors to use to monitor interest rate risk. SFIs have been reporting on interest rate risks since end of the third quarter 2011. Guidelines for the Management of Interest Rate Risk were issued in August 2012 and updated in December 2016. CBoB’s Interest Rate Risk Guidelines are comprehensive and cover all normal areas including governance (board and senior management oversight), risk management, limits, internal controls, and internal audit review. Supervisory expectations are proportional to the size and complexity of the firms and their asset/liability positions, their interest rate risk position, and their risk appetite and risk profile. Interest rate risk is expected to be reviewed as part of on-site review of banks’ liquidity and treasury risk management. Templates have been developed, as part of CBoB’s stress-testing framework, to analyze interest rate risk under stress in commercial banks. This looks at sensitivity to parallel shifts in the yield curve and the impact on economic value. The Guidelines require the periodic performance of stress tests to measure banks’ vulnerability to loss under adverse interest rate movements as follows: Guidelines require SFIs to measure vulnerability to IRRB losses in stressed market conditions by conducting stress tests. Interest rate scenarios are expected to measure different stressed market conditions, including “worst case” scenarios in addition to more probable scenarios. Special consideration is expected to be given to instruments or positions that may be difficult to liquidate or offset in stressful situations. Board and senior management are expected to consider the results of stress tests when establishing and reviewing strategies, policies and limits for interest rate risk. CBoB supervisors, as part of offsite supervision, review board reporting, minutes and risk appetite statements and limits to assess risks against stated risk appetite. SFIs are required to report the results of their IRR stress/sensitivity tests to CBoB on a regular basis in regulatory reporting. SFIs with IRRB that leads to an economic value decline of more than 20 percent of the sum of Tier 1 and Tier 2 under these standardized interest rate shocks or an equivalent, would be required to either reduce the risk, hold an additional amount of capital to support the level of risk, or a combination of the two. IRRB is captured under Pillar 2 in the Bahamas, and supervisors will review ICAAP reports to ensure completeness, including that IRRB is being considered in ICAAPs. |
| EC2 | The supervisor determines that a bank’s strategy, policies and processes for the management of interest rate risk have been approved, and are regularly reviewed, by the bank’s Board. The supervisor also determines that senior management ensures that the strategy, policies and processes are developed and implemented effectively. |
| Description and findings re EC2 | CBoB requires SFIs’ boards to approve objectives and strategies and the major policies governing interest rate risk management, assess compliance with approved strategies and policies, and assess the performance of senior management in monitoring and controlling interest rate risks in compliance with approved strategies and policies. Supervisors review bard minutes and board meeting risk packages to confirm approval and periodic internal reviews of policies and procedures. In addition, they review actual risk measures and reporting against approved policies. |
| EC3 | The supervisor determines that banks’ policies and processes establish an appropriate and properly controlled interest rate risk environment including:
|
| Description and findings re EC3 | CBoB requires banks to have in place policies and procedures to identify, evaluate, monitor and control material risks including interest rate risk. Interest rate risk and the maintenance of appropriate controls are reviewed and assessed as a part of the risk assessment process in the risk-based supervision framework. This is largely an offsite process that can also include review of relevant internal audit reports meetings/discussions with management and control function personnel. The assessment of IRRB risk management techniques and practices would also be assessed through onsite examinations, should the risk assessment process determine that this rises to the level of a priority warranting an exam of this area. Onsite exams are guided by reasonably comprehensive examination modules that include guidance to review (i) board and senior management oversight; (ii) policies, procedures, and limits; (iii) adequate risk-measurement and monitoring supported by the appropriate management information systems; and (iv) a comprehensive process of internal controls. During an examination, the review could include an assessment of the quality and timeliness of reporting to senior management and the board. Interest rate risk would also be examined as part of the review of the banks’ liquidity management, should the risk assessment process identify that as an area warranting such a review. SFIs ICAAPs is expected to include consideration of all material interest rate risk positions and consider all relevant repricing and maturity data. A SFI is expected to be able to support assumptions about the behavioral characteristics of non-maturity and other assets and liabilities, especially those exposures characterized by embedded optionality. Given uncertainty in such assumptions, stress testing and scenario analysis should be used in the analysis of interest rate risk. |
| EC4 | The supervisor requires banks to include appropriate scenarios into their stress testing programs to measure their vulnerability to loss under adverse interest rate movements. |
| Description and findings re EC4 | The Interest Rate Risk Guidelines require the periodic performance of stress tests to measure banks’ vulnerability to loss under adverse interest rate movements, as follows: “banks should measure their vulnerability to loss in stressed market conditions by conducting stress tests. Banks should use interest rate scenarios that are sufficiently varied to encompass different stressful market conditions. Stress tests should include “worst case” scenarios in addition to more probable scenarios. In conducting stress tests, special consideration should be given to instruments or positions that may be difficult to liquidate or offset in stressful situations. Board and senior management should consider the results of stress tests when establishing and reviewing strategies policies and limits for interest rate risk.” In practice CBoB supervisors are in the early stages of working with SFIs on stress testing practices. This includes work with local offices of international banks to adapt the firms’ global methods to local operating conditions. |
| Additional criteria | |
| AC1 | The supervisor obtains from banks the results of their internal interest rate risk measurement systems, expressed in terms of the threat to economic value, including using a standardized interest rate shock on the banking book. |
| Description and findings re AC1 | The CBoB receives detailed interest rate risk reports from SFIs on a monthly and quarterly basis (depending on the firm). SFIs are required to assess interest rate risk as part of their ICAAP. As part of its assessment of SFIs interest rate risk measurement, the CBoB requires SFIs to provide results of sensitivity analyses expressed in terms of the threat to economic value, using standardized interest rate shock. At a minimum, the standardized rate shock should include either of the following:
|
| AC2 | The supervisor assesses whether the internal capital measurement systems of banks adequately capture interest rate risk in the banking book. |
| Description and findings re AC2 | CBoB reviews SFIs ICAAPs to ensure IRRB is being captured and measured for capital purposes. In addition, as noted above, SSFIs are required to run sensitivity analysis of IRRB against the economic value of the firm and report the results as part of quarterly regulatory filings. If a high level of potential economic loss is identified CBoB can require a reduction in the position or an increase in capital. The assessors did not observe any cases where this risk reduction or increased capital requirement was relevant and put into practice. |
| Assessment of Principle 23 | Compliant |
| Comments | IRRB is a clear focus of CBoB supervisors and is looked at through required reporting of the economic value of sensitivities, reviews of SFIs’ ICAAP reports, liquidity/treasury management assessments or onsite exams and most typically, the Risk Assessment Process and semi-annual offsite assessments of the condition of the firms. Assessors view the approach described above in BCP 23 as sufficient for the size, complexity and risk profiles of the SFIs. |
| Principle 24 | Liquidity risk. The supervisor sets prudent and appropriate liquidity requirements (which can include either quantitative or qualitative requirements or both) for banks that reflect the liquidity needs of the bank. The supervisor determines that banks have a strategy that enables prudent management of liquidity risk and compliance with liquidity requirements. The strategy takes into account the bank’s risk profile as well as market and macroeconomic conditions and includes prudent policies and processes, consistent with the bank’s risk appetite, to identify, measure, evaluate, monitor, report and control or mitigate liquidity risk over an appropriate set of time horizons. At least for internationally active banks, liquidity requirements are not lower than the applicable Basel standards. |
| Essential criteria | |
| EC1 | Laws, regulations, or the supervisor require banks to consistently observe prescribed liquidity requirements including thresholds by reference to which a bank is subject to supervisory action. At least for internationally active banks, the prescribed requirements are not lower than, and the supervisor uses a range of liquidity monitoring tools no less extensive than, those prescribed in the applicable Basel standards. |
| Description and findings re EC1 | The Banks and Trust Companies (Liquidity Risk Management) Regulations 2011 (LRMR) require licensees, exclusive of commercial banks, to maintain a liquidity ratio of not less than 20 percent. Regulation 6(2) of (LRMR), state that the liquidity ratio shall not currently apply to licensees that are subject to the provisions of section 19 and 20 of the CBBA. Commercial banks therefore are subject to a prescribed statutory reserve (e.g., primary reserve 5 percent against their Bahamian dollar liabilities, plus a secondary reserve referred to as the Liquid Asset Ratio (LAR), which mandates commercial banks to maintain an average ratio of liquid assets in relation to their Bahamian dollar deposit liabilities. The LAR is currently at 20 percent of demand deposits, 15 percent of savings and fixed deposits and 15 percent of borrowings due to for from CBoB as well as inter-bank deposits. CBoB indicated it is working towards the implementation of Basel III requirements (consultation paper released, implementation expected in 2019). Penalties and conditions/limitations are imposed for failure to maintain required levels of liquidity, as outlined in the LRMR and the CBBA. The CBoB may issue a direction to an SFI who does not meet the prescribed liquidity requirements. |
| EC2 | The prescribed liquidity requirements reflect the liquidity risk profile of banks (including on- and off-balance sheet risks) in the context of the markets and macroeconomic conditions in which they operate. |
| Description and findings re EC2 | The Guidelines for the Management of Liquidity Risk (Liquidity Risk Guideline or the Guideline) states that a licensee’s obligations (both on- and off-balance sheet risks) and the funding sources used to meet them depend significantly on its business mix, balance sheet structure, and the cash-flow profiles of its on- and off-balance sheet obligations. In addition, the Guideline states that an SFI, in managing their cash flows, licensees may need to confront various situations that can give rise to increased liquidity risk. These include funding mismatches, market constraints on the ability to convert assets into cash or in accessing sources of funds (i.e., market liquidity), and contingent liquidity events. Changes in economic conditions or exposure to credit, market, operation, legal, and reputation risks also can affect a licensee’s liquidity risk profile. The Liquidity Risk Guideline states that ALCO must identify, test (market access) and monitor alternative sources of funding, set concentration limits of funding sources as well as setting diversification targets (time horizons, retail versus secured/unsecured wholesale) and ensure regular reporting to the Board. Supervisors continuously monitor the liquidity position of all SFIs (DSIBs on a weekly basis as well as during quarterly meetings with SFI senior management). Supervisors also review the SFI’s liquidity risk management strategy and maturity wise analysis (net cumulative cash flow for buckets up to 3 months) as well as longer duration time horizons. |
| EC3 | The supervisor determines that banks have a robust liquidity management framework that requires the banks to maintain sufficient liquidity to withstand a range of stress events, and includes appropriate policies and processes for managing liquidity risk that have been approved by the banks’ Boards. The supervisor also determines that these policies and processes provide a comprehensive bank-wide view of liquidity risk and are consistent with the banks’ risk profile and systemic importance |
| Description and findings re EC3 | The Liquidity Risk Guideline states that SFIs should have a sound liquidity risk management framework that includes appropriate strategies, policies, procedures, and limits used to manage and mitigate liquidity risk. In addition, the SFI must have adequate levels of highly liquid marketable securities free of legal, regulatory, or operational impediments that can be used to meet liquidity needs in stressful situations. CBoB’s off-site Supervision surveillance monitors SFI’s compliance with the LRMR requirements as well as compliance to the Liquidity Risk Guidelines. Daily liquidity data on the DSIBs is received and analyzed on a daily/weekly basis and liquidity positions are discussed with DSIB senior management on a quarterly basis. CBoB routinely test and confirm compliance with the Liquidity Risk Guideline and the institution’s established liquidity and funding policies through its on-site examination program, to identify weaknesses or deficiencies that require attention and/or improvement. |
| EC4 | The supervisor determines that banks’ liquidity strategy, policies and processes establish an appropriate and properly controlled liquidity risk environment including:
|
| Description and findings re EC4 | Liquidity risk is analyzed as part of the CBoB’s RBSF. CBoB reviews the risk management policy environment, the systems for the ongoing monitoring of liquidity risk, contingency planning and the day-to-day management of liquidity. The CBoB also conducts quarterly structured meetings with the DSIBs, which cover their liquidity risk management strategy. Further, CBoB conducts aggregate liquidity stress tests on the DSIB’s operations and the results discussed during these meetings with the banks’ risk managers. Further, SFI’s are required to provide CBoB with copies of their liquidity risk management strategies. CBoB expects changes in a licensee’s liquidity risk management to be communicated to the Inspector within two weeks of being approved by the Board (S. 2.2 of the Liquidity Guideline). Further, if a licensee has concerns about their current or future liquidity position, they are required to immediately inform CBoB of same and their plans to address these concerns. Liquidity risk management practices by SFIs may also reviewed during an on-site examination, if determined to be warranted through the risk assessment process. An on-site examination would typically review a bank’s liquidity management strategy, including: (1) The institution’s stock of liquid assets and their quality; (2) The volatility and diversity of deposits; (3) The quality and diversity of the loan book; (4) Contingent liabilities and loan commitments; (5) The availability and reliability of undrawn standby facilities; (6) The extent to which liquidity is managed, and supervised, on an integrated global basis; (7) The ability and willingness of the parent/head office to provide liquidity; and (8) The institution’s market standing and the quality of its treasury management. The on-site examination would typically determine whether the Board has established a level of tolerance for liquidity risk, the Board has a full understanding of the risks, contingency plans are adequate in relation to the size and complexity of bank operations and if management information systems provide concise, timely and relevant information for monitoring liquidity needs. |
| EC5 | The supervisor requires banks to establish, and regularly review, funding strategies and policies and processes for the ongoing measurement and monitoring of funding requirements and the effective management of funding risk. The policies and processes include consideration of how other risks (e.g. credit, market, operational and reputation risk) may impact the bank’s overall liquidity strategy, and include:
|
| Description and findings re EC5 | The Liquidity Risk Guideline address the following:
|
| EC6 | The supervisor determines that banks have robust liquidity contingency funding plans to handle liquidity problems. The supervisor determines that the bank’s contingency funding plan is formally articulated, adequately documented and sets out the bank’s strategy for addressing liquidity shortfalls in a range of stress environments without placing reliance on lender of last resort support. The supervisor also determines that the bank’s contingency funding plan establishes clear lines of responsibility, includes clear communication plans (including communication with the supervisor) and is regularly tested and updated to ensure it is operationally robust. The supervisor assesses whether, in the light of the bank’s risk profile and systemic importance, the bank’s contingency funding plan is feasible and requires the bank to address any deficiencies. |
| Description and findings re EC6 | The LRMR requires SFI to maintain liquidity contingency plans. CBoB examiner guidance on the review of contingency planning is detailed and addresses written policy requirements, defining alternative funding sources, ranking of customers in importance and volatility and media communication plans for emergency situations. The LRMR require contingency planning and informing the CBoB of any liquidity concerns (referred to in S. 5.1viii and S. 6.17 vi of the LRMR) The on-site examination team may review the strength of SFI’s liquidity contingency plans during an on-site liquidity risk management review if determined to be warranted through the risk assessment process. |
| EC7 | The supervisor requires banks to include a variety of short-term and protracted bank-specific and market-wide liquidity stress scenarios (individually and in combination), using conservative and regularly reviewed assumptions, into their stress testing programs for risk management purposes. The supervisor determines that the results of the stress tests are used by the bank to adjust its liquidity risk management strategies, policies and positions and to develop effective contingency funding plans. |
| Description and findings re EC7 | S.7.21 of the Guideline require SFIs to conduct stress tests on a regular basis for a variety of short term and protracted institution-specific and market-wide events across multiple time-zones, including on an intra-day basis. CBoB expects the results from such stress tests to be utilized by senior management to ensure current exposures are adequately managed with liquidity risk tolerance limits. The Guideline also requires an independent review (internal/external auditor) on the adequacy and effectiveness of the operations of an SFI’s stress testing program. CBoB reviews both the results of the stress testing and the independent reviews. The Guideline indicates that the Board has ultimate responsibility for the overall stress testing programme and should be aware of any key findings from the liquidity stress tests. The CBoB also conducts its own liquidity stress tests on an aggregate basis and encourages the commercial banks to integrate stress testing models that incorporates liquidity shocks as a part of their ICAAPs. |
| EC8 | The supervisor identifies those banks carrying out significant foreign currency liquidity transformation. Where a bank’s foreign currency business is significant, or the bank has significant exposure in a given currency, the supervisor requires the bank to undertake separate analysis of its strategy and monitor its liquidity needs separately for each such significant currency. This includes the use of stress testing to determine the appropriateness of mismatches in that currency and, where appropriate, the setting and regular review of limits on the size of its cash flow mismatches for foreign currencies in aggregate and for each significant currency individually. In such cases, the supervisor also monitors the bank’s liquidity needs in each significant currency, and evaluates the bank’s ability to transfer liquidity from one currency to another across jurisdictions and legal entities. |
| Description and findings re EC8 | SFI’s currency exposure is monitored quarterly by the off-site supervision surveillance team. However, banks are subject to a net open B$ position limit of up to $5,000,000, which is monitored daily by the SFIs. An on-site examination/review of an SFI’s currency exposures would include a of an SFI’s foreign currency liquidity management policies. exposures in a number of different segments (e.g., currency, geographic, industry), banks’ compliance with Exchange Control Regulations Act and self- imposed limits; as well as a detailed analysis of financial statements and accompanying notes. Currency Exposures reviews could occur during an on-site liquidity risk management review if determined to be warranted through the risk assessment. |
| Additional criteria | |
| AC1 | The supervisor determines that banks’ levels of encumbered balance-sheet assets are managed within acceptable limits to mitigate the risks posed by excessive levels of encumbrance in terms of the impact on the banks’ cost of funding and the implications for the sustainability of their long-term liquidity position. The supervisor requires banks to commit to adequate disclosure and to set appropriate limits to mitigate identified risks. |
| Description and findings re AC1 | |
| Assessment of Principle 24 | Compliant |
| Comments | CBoB’s LRMR, together with the Liquidity Risk Guideline, provide provides a thorough set of requirements and guidance in relation to SFI’s liquidity risk management. CBoB’s off-site surveillance team review and actively monitor SFI’s liquidity risk management and conditions (weekly for DSIB’s). CBoB recently released, for consultation with the industry, proposals regarding Basel III Liquidity Reforms on implementing a liquidity coverage ratio (LCR) and net stable funding ratio (NSFR) in The Bahamas. All SFIs would convert to these liquidity requirements when the reforms are implemented. |
| Principle 25 | Operational risk. The supervisor determines that banks have an adequate operational risk management framework that takes into account their risk appetite, risk profile and market and macroeconomic conditions. This includes prudent policies and processes to identify, assess, evaluate, monitor, report, and control or mitigate operational risk63 on a timely basis. |
| Essential criteria | |
| EC1 | Law, regulations or the supervisor require banks to have appropriate operational risk management strategies, policies and processes to identify, assess, evaluate, monitor, report and control or mitigate operational risk. The supervisor determines that the bank’s strategy, policies and processes are consistent with the bank’s risk profile, systemic importance, risk appetite and capital strength, take into account market and macroeconomic conditions, and address all major aspects of operational risk prevalent in the businesses of the bank on a bank-wide basis (including periods when operational risk could increase). |
| Description and findings re EC1 | CBoB’s Corporate Governance Guidelines outline the responsibility of the bank’s management and board in managing all types of risks to which the SFI is exposed, including operational risk. As noted elsewhere in this report, under the Guidelines on Corporate Governance SFIs’ Boards are required to annually certify to CBoB that the appropriate risk management systems are in place and sustainable. In addition, external auditors are required to inform CBoB if they become aware of anything that could interfere with the supervisors carrying out their responsibilities, such as materially inadequate controls that could threaten the SFI’s financial soundness. CBoBs Guidance Note on Accounting and Other Records and Internal Control Systems and Reporting Accountants’ Reports Thereon (1998) provides guidance on basic accounting and internal control systems and expectations. CBoB’s Business Continuity Guidelines require SFIs to have BCPs that are proportionate to the institution’s operational risk. CBoB also recently released Technology Risk Guidelines (2016) to address the potential impact technology issues can have on an organization’s ability to meet overall business objectives (including regulatory and prudential issues). CBoB’s Operational Risk Guidelines (issued in November 2013) require SFIs to have risk management frameworks that identify, assess, evaluate, monitor, report and control or mitigate operational risk. With respect to IT, the Guidelines require SFIs to ensure that IT systems are appropriately developed and maintained; and
Additionally, banks are required to: “Notify the Central Bank of any operational risk matter that may/has adversely impact the institution. This requirement includes, but is not limited to, notification of:
SFIs operational risk policies and processes could be assessed and tested by the onsite examination team if the Risk Assessment process deems a review of this area is warranted. The assessors noted that operational risks is an area where there has been significant onsite examination focus over the past four years, including an emphasis on outsourcing risk. In addition to using the basic indicator approach to assess regulatory capital for operational risk, CBoB also requires operational risk to be captured in an SFI’s ICAAP. |
| EC2 | The supervisor requires banks’ strategies, policies and processes for the management of operational risk (including the banks’ risk appetite for operational risk) to be approved and regularly reviewed by the banks’ Boards. The supervisor also requires that the Board oversees management in ensuring that these policies and processes are implemented effectively. |
| Description and findings re EC2 | As per EC 1 above, the Corporate Governance Guidelines outline the key responsibilities of the board and the management team. The board must certify annually that appropriate risk management systems have been put in place by management and are sustainable. Operational Risk Guidelines require SFIs’ boards of directors to “approve, and review on a regular basis, the risk appetite and tolerance statement that articulates the nature, types and levels of operational risk that the licensee is willing to assume. When approving and reviewing the risk appetite and tolerance statement, the Board should consider all relevant risks, the licensee’s risk aversion, its current financial condition and its strategic direction. The Board should also approve the appropriate thresholds/limits for specific operational risks and an overall operational risk appetite and tolerance. This review should consider changes in the external environment, material increases in business or activity volumes, the quality of the control environment, the effectiveness of risk management or mitigation strategies, loss experience and the frequency, volume, or nature of limit breaches. The Board should monitor management adherence to the risk appetite and tolerance statement and provide timely detection and remediation of breaches”. Additionally, the Guidelines state that “To ensure effective operational risk management, the Central Bank requires that the senior management of each of its licensees, under the approval of the board of directors, develop and implement an operational risk management framework (the framework) that explicitly recognizes operational risk as a distinct risk to the institution and aims to efficiently manage it”. |
| EC3 | The supervisor determines that the approved strategy and significant policies and processes for the management of operational risk are implemented effectively by management and fully integrated into the bank’s overall risk management process. |
| Description and findings re EC3 | CBoB obtains information on risk management programs and uses that information off-site to supervise SFIs’ risk identification, monitoring, and controlling processes. To assist in this process, CBoB review banks’ internal audit reports. In early 2010, the CBoB implemented its RBSF, which involves assessing all aspects of a licensee’s inherent business risks and its controls over those risks (including operational risks and operational control areas). As part of this exercise, the CBoB engages in structured meetings with banks to discuss their risk management techniques, including the management of operational risk. The following areas are discussed at these meetings:
The assessment of risk management techniques and practices is complemented by substantive on-site compliance tests, using a process of selective sampling as described in the examination modules. When evaluating the quality of risk management/corporate governance, emphasisis placed on the following elements: (1) active board and senior management oversight, (2) adequate policies, procedures, and limits (3) adequate risk-measurement and-monitoring supported by the appropriate management information systems, (4) a comprehensive process of control, and (5) appropriateness of human resource management system, including training programs. When an onsite examination is deemed warranted through the Risk Assessment process, an examination could review the existence, application and sustainability of the SFI’s policies and procedures. The onsite examination process would places significant emphasis on control processes. CBoB examiners can use a range of audit programs (designed specifically for examiners), depending upon the size and complexity of the bank. This process includes reviewing the quality and timeliness of information that is provided to senior management and the board. Assessors noted that among the onsite examinations carried out over the prior four years operational risk was a regular area of focus, particularly with respect to assessing an SFI’s outsourcing arrangements. |
| EC4 | The supervisor reviews the quality and comprehensiveness of the bank’s disaster recovery and business continuity plans to assess their feasibility in scenarios of severe business disruption which might plausibly affect the bank. In so doing, the supervisor determines that the bank is able to operate as a going concern and minimize losses, including those that may arise from disturbances to payment and settlement systems, in the event of severe business disruption. |
| Description and findings re EC4 | The CBoB has issued detailed business continuity planning guidance and reviews the banks’ plans and independent reviews that may be performed by third parties. CBoB requires an annual certification from an SFI’s board that the business continuity plans are still valid, and that the SFI’s BCP management team and/or an independent party have properly tested the BCP during the period. CBoB’s Business Continuity Guidelines (revised in October 2008) outline the key principles supervisors use to assess the adequacy of its licensees’ Business Continuity Plans (BCPs). CBoB expects all licensees to develop and implement workable and effective BCPs to ensure that specified operations can be maintained or recovered in a timely manner in the event of a disruption, consistent with the nature, size, and scope of their operations and complexity of their business. BCPs are expected to involve the following: business impact analyses, business recovery strategies, testing, training programs, communications and crisis management. SFIs are also expected to inform the CBoB Inspector as soon as possible after activation of its BCP. Further, the Board is required to include a statement in the Annual Corporate Governance Certificate confirming that the Board is satisfied that the recovery strategies adopted in the BCP are still valid, and that the licensee’s BCP management team and/or an independent party have properly tested the BCP during the period. CBoB will, in the course of its on-site examinations, review the BCP implemented, taking into consideration the extent to which a licensee has observed the guidelines and its risk profile. If the BCP is in the scope of an on-site examination, the onsite team will verify that:
Assessors noted a number of operational risk onsite reviews, including some that included BCP in the scope. |
| EC5 | The supervisor determines that banks have established appropriate information technology policies and processes to identify, assess, monitor, and manage technology risks. The supervisor also determines that banks have appropriate and sound information technology infrastructure to meet their current and projected business requirements (under normal circumstances and in periods of stress), which ensures data and system integrity, security and availability and supports integrated and comprehensive risk management. |
| Description and findings re EC5 | Typically, CBoB has relied on independent reports assessing the banks’ IT systems, often carried out by external auditors hired by the bank. Reports are reviewed for timeliness and content. Verification of the adequacy of banks’ IT systems is increasingly expected to be performed during onsite examinations. Since the prior FSAP, CBoB now has specialized IT examiners in place to assess information systems. In addition to reviewing the adequacy of the IT environment, examiners also assess data aggregation and reporting. This includes assessing the infrastructure for reporting key information, the decision-making process, management of information across branches and the speed at which information is available for decisions to be made. CBoB developed and issued Technology Risk Management Guidelines in January 2016. The Guidelines provide firms with general guidance for addressing risks associated with managing the technology used in their operations. The aim of the guidelines is to highlight risks inherent to the deployment and management of technology as well as to provide broad guidance for firms on risk management principles and security practices which may assist the financial sector with establishing a robust technology risk management framework; strengthening IT system security, reliability, availability and recoverability; and emphasizing the benefit of using appropriate technologies and control mechanisms that protect customer data and transactions. |
| EC6 | The supervisor determines that banks have appropriate and effective information systems to:
|
| Description and findings re EC6 | If deemed warranted through the Risk Assessment process, CBoB supervisors would conduct examinations of licensees’ operational risk information systems. Assessors noted that there have been several examinations focused on IT risks since 2015. |
| EC7 | The supervisor requires that banks have appropriate reporting mechanisms to keep the supervisor apprised of developments affecting operational risk at banks in their jurisdictions. |
| Description and findings re EC7 | CBoB Guidelines require SFIs to have communication plans to inform the regulators and other interested parties in the event of operational issues. In addition, the Technology Risk Guidelines require SFIs to have procedures in place to communicate with the central bank in the event that critical systems failure. |
| EC8 | The supervisor determines that banks have established appropriate policies and processes to assess, manage and monitor outsourced activities. The outsourcing risk management program covers:
Outsourcing policies and processes require the bank to have comprehensive contracts and/or service level agreements with a clear allocation of responsibilities between the outsourcing provider and the bank. |
| Description and findings re EC8 | Operational Risk Guidelines state: “Licensees’ outsourcing policies and risk management activities should encompass: (a) procedures for determining whether and how activities can be outsourced; (b) processes for conducting due diligence in the selection of potential service providers; (c) sound structuring of the outsourcing arrangement, including ownership and confidentiality of data, as well as termination rights; (d) programs for managing and monitoring the risks associated with the outsourcing arrangement, including the financial condition of the service provider; (e) establishment of an effective control environment at the licensee and the service provider; (f) development of viable contingency plans; and (g) execution of comprehensive service level agreements with a clear allocation of responsibilities between the outsourcing provider and the licensee”. CBoB has issued detailed Guidelines on the Minimum Standards for the Outsourcing of Material Functions (the Outsourcing Guidelines). The Guidelines state that: The bank’s management must satisfy the central bank that adequate procedures are in place and that it has the ability to monitor and control the outsourced function on an ongoing basis. The central bank will hold the bank’s board and management responsible for ensuring that the outsourced functions are carried out to an appropriate standard and that the integrity of the bank’s systems and controls is maintained. The guidelines reflect international practice and the Joint Forum guidelines. Proposals to outsource material functions are reviewed by the CBoB. The CBoB considers and examines the effects of the outsourced activity on the operational risk of the bank. |
| Additional criteria | |
| AC1 | The supervisor regularly identifies any common points of exposure to operational risk or potential vulnerability (e.g. outsourcing of key operations by many banks to a common service provider or disruption to outsourcing providers of payment and settlement activities). |
| Description and findings re AC1 | CBoB does not collect information on this area. |
| Assessment of Principle 25 | Compliant |
| Comments | Since the prior BCP assessment, CBoB has issued guidelines for operational risk management supervision and hired staff with IT expertise, addressing recommendations from that assessment. Assessors observed that operational (and IT) risks have been an area of focus for CBoB, including through a number of onsite examinations. Operational risk management supervision is assessed as sufficient for the jurisdiction. |
| Principle 26 | Internal control and audit. The supervisor determines that banks have adequate internal control frameworks to establish and maintain a properly controlled operating environment for the conduct of their business taking into account their risk profile. These include clear arrangements for delegating authority and responsibility; separation of the functions that involve committing the bank, paying away its funds, and accounting for its assets and liabilities; reconciliation of these processes; safeguarding the bank’s assets; and appropriate independent64 internal audit and compliance functions to test adherence to these controls as well as applicable laws and regulations. |
| Essential criteria | |
| EC1 | Laws, regulations, or the supervisor require banks to have internal control frameworks that are adequate to establish a properly controlled operating environment for the conduct of their business, taking into account their risk profile. These controls are the responsibility of the bank’s Board and/or senior management and deal with organizational structure, accounting policies and processes, checks and balances, and the safeguarding of assets and investments (including measures for the prevention and early detection and reporting of misuse such as fraud, embezzlement, unauthorized trading and computer intrusion). More specifically, these controls address:
|
| Description and findings re EC1 | The Guidelines for the Corporate Governance of Banks and Trust Companies Licensed to do Business within and from within The Bahamas (Section 4.3) specify that the Board is ultimately responsible for ensuring that an adequate, effective, comprehensive and transparent process of corporate governance, which is consistent with the unique character of the bank and the nature, complexity and risks inherent in the bank’s business activities, and is able to respond to the changes in the bank’s business environment, is maintained and implemented. Section 4.4 states the Board is ultimately responsible for setting and confirming the organization’s strategic direction, business focus and corporate values. Section 4.5 provides that the bank’s senior management is responsible for the day-to-day operations of the business, serving as a link between the Board and staff. The senior management responsibilities include: (a) implementing the bank’s strategic plan; (b) keeping the board adequately informed about the performance of the bank through financial and management reports and the reports prepared by internal auditors, external auditors, the compliance officer and regulators; (c) advising the board on the appropriate structure, and ensuring that the quantity and quality of staff resources are available to carry out all tasks, including internal and external audit and compliance; (d) implementing and maintaining risk management systems appropriate to the scale, nature and complexity of the bank; and (e) overseeing management information systems to enable timely and accurate dissemination of information to the Board and regulators. Section 4.7 stipulates that management, under the general direction of and oversight of the Board, should develop and implement a comprehensive risk management system commensurate with the scope of the bank’s activities, incorporating continuous identification, measurement, monitoring and control of risk. The Board itself should specifically address significant issues in the system’s development and implementation, as well as implement an effective process to independently determine that the risk management system is appropriate and ensure that its effectiveness is regularly assessed. The Guidelines require the Board to provide a certification to CBoB as to the bank’s compliance or non-compliance with the expectations detailed in the Guidelines. Additionally, the certification requires the Board, with advice and assistance from management, to attest it has independently assessed and documented whether the bank’s corporate governance process is effective and whether it has successfully achieved its objectives. The Board must report to CBoB any materially deficiencies and problems that are identified within the bank, along with plans and timetables for their correction. The Guidelines requires Boards of SFIs to determine that the entity’s internal controls:
The Guidance Note On Accounting and Other Records and Internal Control Systems and Reporting Accountants’ Report Thereon provides (Section 3) that the scope and nature of the specific control objectives which are required for the business to be conducted in a prudent manner should be commensurate with the bank’s needs and particular circumstances. They are also expected to be appropriate given the manner in which the business is structured, organized and managed, its size and the nature, volume and complexity of its transactions and commitments. Subject to this each SFI should address the following control objectives:
Accountants appointed by the bank and not objected to by CBoB must form an opinion on whether the SFI’s accounting and other records and internal control systems have been maintained by management during the period examined (generally the SFI’s financial year) in accordance with the Guidelines. In forming this opinion, the Reporting Accountants are expected to view effectiveness with regard to the nature and scale of the business undertaken by the SFI. The report should be completed, dated and submitted to the SFI not more than three months after the end of the period examined. The SFI then submits the report to CBoB with such comments as management sees fit to make, not more than one month after the date of the report. |
| EC2 | The supervisor determines that there is an appropriate balance in the skills and resources of the back office, control functions and operational management relative to the business origination units. The supervisor also determines that the staff of the back office and control functions have sufficient expertise and authority within the organization (and, where appropriate, in the case of control functions, sufficient access to the bank’s Board) to be an effective check and balance to the business origination units. |
| Description and findings re EC2 | When a risk area or operating activity is deemed through the Risk Assessment Process to warrant an onsite review, the on-site examination process may place emphasis on the controls at the SFI, using a range of audit programs designed to assist supervisors. This could include a review of skills and resources and an assessment of the control functions relative to front and back activities. In addition, as indicated in EC 3, the directors, in their annual certification, must identify any material deficiencies or problem in their bank. As noted elsewhere in this report, CBoB’s risk-based supervisory approach does much of the control process assessments through offsite supervision—surveillance and monitoring—and with respect to internal controls places particular emphasis on the work of internal and external auditors and the annual certification the SFIs’ boards of directors are required to provide. Assessors did observe assessments of key control processes in the Risk Assessment documents as well as in reports of examination, for areas where onsite reviews have been conducted since 2015. |
| EC3 | The supervisor determines that banks have an adequately staffed, permanent and independent compliance function65 that assists senior management in managing effectively the compliance risks faced by the bank. The supervisor determines that staff within the compliance function are suitably trained, have relevant experience and have sufficient authority within the bank to perform their role effectively. The supervisor determines that the bank’s Board exercises oversight of the management of the compliance function. |
| Description and findings re EC3 | The Guidelines for the Corporate Governance of Banks (and Trust Companies) specify that the Board of a SFI must appoint a Compliance Officer (who may also function as the Money Laundering Reporting Officer (MLRO)), to be responsible, under its guidance, for ensuring that the bank is in full compliance with the laws of The Bahamas. In 90 percent of CBoB SFIs, the MLRO and the CO are the same person. The Compliance Officer should be independent and free from influences that may affect his/her ability to perform his/her duties objectively. He/she should also have direct, unrestricted access to the Board and/or Group Compliance. Assessors note that the 2017–2018 AML/CFT thematic reviews did assess the role of the MLRO and the compliance function; compliance with AML/CFT requirements was the primary area of supervisory focus for 2017–2018. When CBoB carries out reviews of SFI’s Corporate Governance framework, they assess the role and effectiveness of the compliance function throughout the organization. |
| EC4 | The supervisor determines that banks have an independent, permanent and effective internal audit function66 charged with:
|
| Description and findings re EC4 | The ‘Guidance Note on Accounting and Other Records and Internal Controls Systems and Reporting Accountants’ Reports Thereon’ requires that an internal audit function be established and maintained by management and should be distinct from the primary control functions. Not all SFIs are required to have an internal audit function, at the discretion of the CBoB Inspector. Smaller trust companies are more likely to outsource to an external auditor than banks and almost all banks have an internal audit function, either within the institution or as part of the international group’s wider internal audit function, where relevant. The following are expected of an internal audit function:
Internal audit work papers and reports are reviewed periodically offsite in association with tracking of firms’ progress against required remedial actions. Internal audit can also be reviewed during an onsite examination where that is deemed warranted by the risk assessment process. Assessors noted some coverage of internal audit both in risk assessments and onsite reviews, which largely consisted of reviewing the work of internal audit in the area being examined and discussing issues with auditors. Where a full onsite review of internal would be undertaken, if deemed warranted through the Risk Assessment process, the examination could cover verifying the independence of the IA function through the following supervision procedures:
Additionally, during the onsite examination, the examiners would:
|
| EC5 | The supervisor determines that the internal audit function:
|
| Description and findings re EC5 | The First Schedule of the BTCRA—Rules of Inspection and Supervision of Banks—specifies that CBoB shall ensure that banks have in place internal controls adequate to the nature and scale of their operations, and adequate policies, practices and procedures. In addition, the Guidelines for the Corporate Governance of Banks (and Trust Companies) specifies that it is the responsibility of senior management in a bank to advise the Board on the appropriate organizational structure, and ensure that the quantity and quality of staff resources are available to carry out all tasks, including internal audit and compliance. If an onsite review of IA is deemed warranted through the Risk Assessment process, the onsite examination would be expected to assess the following:
The examination team also reviews the IA Charter/Governance documents, policies or procedures to ensure IA has the authority to assess outsourced functions. Additionally, the team ensures the audit plan includes an assessment of the outsourced function and its inclusion in the audit plan. |
| Assessment of Principle 26 | Largely Compliant |
| Comments | Typically, the quality of internal audit is assessed through offsite reviews of their reports and their work on following up on issues supervisors have required the SFIs to address. Internal audit is specifically discussed/considered in the Risk Assessment Process as it is a part of the required assessment of governance and oversight and is seen as serving as a mitigant to inherent risks. Independence is assessed as described in the ECs above with a primary focus on reviewing the organizational structure and reporting lines therein. In addition, in the course of most onsite exams there would be review of the work of audit in the specific area being examined and discussions with the auditor about its work, which primarily allows for an understanding of the general competence of IA in the context of the specific area being reviewed. Broader coverage of internal audit effectiveness would typically occur during an operational risk examination under CBoB’s current procedures. The assessors were able to ascertain that CBoB supervisors did have an informed view of the effectiveness of internal audit at SFIs through a combination of the activities noted above. However, a broader holistic view of internal audit as a critical contributing element to an effective corporate governance regime did not appear to be an area of focus. Assessors recommend considering this approach as it would enhance the ability to assess overall internal audit effectiveness as a third line of defense on a firm-wide basis and to assess corporate governance and the effectiveness of the board and senior management with respect to the responsibilities outlined in the Guidelines for Corporate Governance. |
| Principle 27 | Financial reporting and external audit. The supervisor determines that banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance with accounting policies and practices that are widely accepted internationally and annually publish information that fairly reflects their financial condition and performance and bears an independent external auditor’s opinion. The supervisor also determines that banks and parent companies of banking groups have adequate governance and oversight of the external audit function. |
| Essential criteria | |
| EC1 | The supervisor67 holds the bank’s Board and management responsible for ensuring that financial statements are prepared in accordance with accounting policies and practices that are widely accepted internationally and that these are supported by recordkeeping systems in order to produce adequate and reliable data. |
| Description and findings re EC1 | CBoB Guidelines specify that it is the responsibility of a SFI’s board of directors and management to ensure that adequate records and systems are maintained. Under the BTCRA, every SFI must publish a statement of its accounts and the external auditor must certify that the statement of accounts provides a true and correct view of the state of the bank’s affairs as evidenced by the books and records of the bank. Financial statements are not accepted as audited unless signed by the external auditor and a manager or anyone duly authorized to sign on behalf of the bank. Such statements shall be published in such form and manner and shall contain such particulars as the CBoB may direct. The annual audited statement of accounts must be prepared in accordance with IFRSs. Exceptions are made for subsidiaries and branches of United States banks, which may report using U.S. GAAP. BICA has adopted and implemented best international audit practice in The Bahamas. |
| EC2 | The supervisor holds the bank’s Board and management responsible for ensuring that the financial statements issued annually to the public bear an independent external auditor’s opinion as a result of an audit conducted in accordance with internationally accepted auditing practices and standards. |
| Description and findings re EC2 | SFI’s must include an external auditor’s opinion in the publication of its financial statements. The annual audited statement of accounts must be prepared in accordance with IFRS. |
| EC3 | The supervisor determines that banks use valuation practices consistent with accounting standards widely accepted internationally. The supervisor also determines that the framework, structure and processes for fair value estimation are subject to independent verification and validation, and that banks document any significant differences between the valuations used for financial reporting purposes and for regulatory purposes. |
| Description and findings re EC3 | CBoB requires banks to be compliant with international accounting standards. The BTCRA provides that the CBoB Inspector shall ensure that banks establish and adhere to practices and procedures for evaluating the quality of assets and the adequacy of loan loss provisions and loan loss reserves. CBoB places reliance on the external auditor to serve as an independent source for valuation and to ensure accurate valuations and associated books and records. Where an external auditor is found to be ineffective, CBoB can replace the external auditor. |
| EC4 | Laws or regulations set, or the supervisor has the power to establish the scope of external audits of banks and the standards to be followed in performing such audits. These require the use of a risk and materiality based approach in planning and performing the external audit. |
| Description and findings re EC4 | The BICA is the body statutorily charged with the oversight of accounting and auditing in The Bahamas. BICA has adopted and implemented International Accounting Reporting Standards (IFRS) and best international auditing practices in The Bahamas. The BTCRA gives CBoB the authority to require that the auditor of a bank report to CBoB on the extent of the procedures of the auditor in the examination of the annual financial statements and may require that the auditors enlarge the scope of that examination or direct that any other particular procedure be performed in any particular case. CBoB can also require that the auditor make a particular examination relating to the adequacy of the procedures adopted by the bank for the safety of its creditors and shareholders, or any other examination as considered necessary by CBoB. Under Section 13 of BTCRA, CBoB can request an external auditor to undertake a specific review of a bank’s operations or risk management system and CBoB has used external auditors for ‘special reviews’ of certain areas. |
| EC5 | Supervisory guidelines or local auditing standards determine that audits cover areas such as the loan portfolio, loan loss provisions, non-performing assets, asset valuations, trading and other securities activities, derivatives, asset securitizations, consolidation of and other involvement with off-balance sheet vehicles and the adequacy of internal controls over financial reporting. |
| Description and findings re EC5 | Local auditing standards, which are in line with international practices, covers all the areas referred to in EC 5 to allow for the auditor to form an opinion on the true and fair position of a SFI. External auditors provide an opinion on the financial statements of the SFIs though they do not sign off on the adequacy of specific internal control processes of the SFI with respect to supervisory expectations for these practices. Their opinion is on the true and fair statement of the financials. |
| EC6 | The supervisor has the power to reject and rescind the appointment of an external auditor who is deemed to have inadequate expertise or independence, or is not subject to or does not adhere to established professional standards. |
| Description and findings re EC6 | Section 12 of the BTCRA provides that CBoB may at any time require the replacement of a SFI’s external auditor. |
| EC7 | The supervisor determines that banks rotate their external auditors (either the firm or individuals within the firm) from time to time. |
| Description and findings re EC7 | There is no formal requirement for external auditors to rotate. It is industry practice to rotate periodically and the assessors were told that CBoB does check to see if there is appropriate rotation. CBoB meets periodically with external auditors and can replace them if it feels that is warranted. |
| EC8 | The supervisor meets periodically with external audit firms to discuss issues of common interest relating to bank operations. |
| Description and findings re EC8 | Meetings between the Bank and the auditors are held as required (e.g., where the central bank would want the auditors to include a specific test or to confirm a control or internal procedure or to sensitize the auditors to issues which may have a bearing on the audit or where the auditor proposes to vary the scope of the audit). CBoB also chairs an auditors’ Advisory Committee (which comprises members of the main accounting firms) that meets on a semi-annual basis to discuss issues of common interest. |
| EC9 | The supervisor requires the external auditor, directly or through the bank, to report to the supervisor matters of material significance, for example failure to comply with the licensing criteria or breaches of banking or other laws, significant deficiencies and control weaknesses in the bank’s financial reporting process or other matters that they believe are likely to be of material significance to the functions of the supervisor. Laws or regulations provide that auditors who make any such reports in good faith cannot be held liable for breach of a duty of confidentiality. |
| Description and findings re EC9 | The BTCRA requires the external auditor—and in some instances a former external auditor—to inform the CBoB Inspector in writing of any matter of which the auditor has or had become aware and which is, or is likely to be, of material significance for the Inspector in relation to the discharge of his duties. Section 13(5) of the BTCRA states that, “no duty of confidentiality to which an auditor or former auditor of a licensee may be subject shall be regarded as having been breached by reason of his communicating in good faith to the Inspector any information or opinion which is relevant to the functions and responsibilities of the Inspector under this Act, whether or not such information or opinion is provided in response to a request made by the Inspector.” |
| Additional criteria | |
| AC1 | The supervisor has the power to access external auditors’ working papers, where necessary. |
| Description and findings re AC1 | Under the BTCRA, the CBoB Inspector can call upon the external auditor to produce working papers, information or explanation. |
| Assessment of Principle 27 | Compliant |
| Comments | Industry practice in The Bahamas is for audit firms to rotate as external auditors every 7– 10 years. Assessors recommend that CBoB put in place a requirement that they rotate on a reasonable cycle to promote independence, require a ‘fresh set of eyes’ periodically, and reduce the potential for conflicts of interest to develop. |
| Principle 28 | Disclosure and transparency. The supervisor determines that banks and banking groups regularly publish information on a consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects their financial condition, performance, risk exposures, risk management strategies and corporate governance policies and processes. |
| Essential criteria | |
| EC1 | Laws, regulations or the supervisor require periodic public disclosures68 of information by banks on a consolidated and, where appropriate, solo basis that adequately reflect the bank’s true financial condition and performance, and adhere to standards promoting comparability, relevance, reliability and timeliness of the information disclosed. |
| Description and findings re EC1 | Section 8 of BTCRA requires that a SFI, within four months of the end of its financial year, publish a true and full yearly statement of its accounts. The external auditor of the bank shall certify that such statement is a true and correct view of the state of the SFI’s affairs as shown by the books and records of the bank. All audited financial statements must be posted in the Official Gazette or on the bank’s website. If a bank opts for the posting of an abridged version, it must indicate in a footnote to the abridged version that the public may obtain a copy of the full set of the audited financial statements at its registered office in The Bahamas. Banks that take deposits from the Bahamian public (i.e., commercial banks/domestic banks) are required to publish their financial statements in the local newspapers. International SFIs are not required to publish their profit and loss statements. The lack of a standardized and consistent asset classification regime could lead to inconsistency across firms with respect to provisioning and loan loss reserves as each can define its own classification scheme for problem loans. |
| EC2 | The supervisor determines that the required disclosures include both qualitative and quantitative information on a bank’s financial performance, financial position, risk management strategies and practices, risk exposures, aggregate exposures to related parties, transactions with related parties, accounting policies, and basic business, management, governance and remuneration. The scope and content of information provided and the level of disaggregation and detail is commensurate with the risk profile and systemic importance of the bank. |
| Description and findings re EC2 | All banks must prepare their accounts in line with IFRS requirements and include the disclosures required by that regime. There are currently no specific requirements for the disclosure of qualitative information put in place by CBoB. |
| EC3 | Laws, regulations or the supervisor require banks to disclose all material entities in the group structure. |
| Description and findings re EC3 | There are currently no specific CBoB requirements to disclose all material entities in the group structure. |
| EC4 | The supervisor or another government agency effectively reviews and enforces compliance with disclosure standards. |
| Description and findings re EC4 | The BICA—the statutory body charged with the oversight of accounting and auditing—monitors requirements re IFRS disclosure standards. |
| EC5 | The supervisor or other relevant bodies regularly publishes information on the banking system in aggregate to facilitate public understanding of the banking system and the exercise of market discipline. Such information includes aggregate data on balance sheet indicators and statistical parameters that reflect the principal aspects of banks’ operations (balance sheet structure, capital ratios, income earning capacity, and risk profiles). |
| Description and findings re EC5 | The CBoB publishes aggregate information in its Quarterly Statistical Digests on the domestic banking sector. It has recently begun to publish aggregate data for the international/offshore SFIs. |
| Additional criteria | |
| AC1 | The disclosure requirements imposed promote disclosure of information that will help in understanding a bank’s risk exposures during a financial reporting period, for example on average exposures or turnover during the reporting period. |
| Description and findings re AC1 | There are no requirements for disclosing intra-period balances. |
| Assessment of Principle 28 | Largely Compliant |
| Comments | CBoB issued Minimum Disclosure Guidelines in December 2016 for all public licensees that are subject to Basel II reporting. Due to feedback received from industry, however, CBoB withdrew this Guideline in March of 2017 in order to reconsider the intended balance between the costs and benefits of public disclosure and the burdens placed on the SFIs. In August 2018, CBoB released its proposed approach for minimum disclosures in a Discussion Paper for industry feedback. The proposal includes the disclosure of all necessary bank data at a dedicated and publicly accessible location on CBoB’s website, which will optimize accessibility, consistency and comparability of bank’s financial information, without imposing any additional regulatory burden or costs. Assessors encourage CBoB to set disclosure requirements such that the public can gain a full picture of key practices, exposures and condition of SFIs in a manner that allows for a clear assessment of the firms in a comparable manner. It is important that requirements cover qualitative information on practices as well as quantitative information. The balance of costs versus benefits in this area can be hard to gauge as the specific benefits to all potential users of the information can be particularly hard to value. CBoB should proceed with caution with respect to taking on the responsibility for ensuring disclosure of accurate information about the firms. This may be a costly endeavor and could place CBoB in a role of information and data verification that could require substantial resources. Where information is being provided by the SFIs with only a limited (internal consistency) verification process by CBoB, care should be taken to clarify that CBoB does not attest to the veracity of all the information. Even with such clarification, CBoB will increase its reputational risk with this proposal as it is likely to be the case that even if CBoB is not held directly accountable if/when inaccurate data/information is published, it will raise questions as to why, as the SFIs supervisor, they are not taking stronger actions to ensure the integrity of this information in the first place. |
| Principle 29 | Abuse of financial services. The supervisor determines that banks have adequate policies and processes, including strict customer due diligence (CDD) rules to promote high ethical and professional standards in the financial sector and prevent the bank from being used, intentionally or unintentionally, for criminal activities.69 |
| Essential criteria | |
| EC1 | Laws or regulations establish the duties, responsibilities and powers of the supervisor related to the supervision of banks’ internal controls and enforcement of the relevant laws and regulations regarding criminal activities. |
| Description and findings re EC1 | S. 17 (h) (First Schedule) of the BTCRA states that the Inspector of CBoB shall ensure that banks and trust companies have in place internal controls adequate to the nature and scale of their operations, and adequate policies, practices and procedures, including strict know-your-customer rules that promote high ethical standards, and so prevent the use of the bank for criminal purposes. Part II of the Guidelines For Supervised Financial Institutions on the Prevention of Money Laundering, Countering The Financing of Terrorism & Proliferation Financing (Revised 29 August 2018) (AML/CFT/PF Guidelines) provide guidance to SFIs (including credit unions) on internal Controls, policies and procedures, including the requirement for SFIs to conduct risk self-assessment, identification and assessment of inherent risk, establish risk tolerance, risk mitigation, evaluate residual risk and monitor and review risks pertaining to criminal activities. Further, the Financial Transaction Reporting Act, 2018 (FTRA) provides additional guidance on customer due diligence requirements (S. 6–14) and internal controls requirements (S. 19–24). Enforcement provisions, including fines, penalties and criminal convictions, that banks, including credit unions are subject to for the failure of ensuring adequate policy, procedures for the prevention, detection and reporting of such criminal activity is included in the following relevant provisions of legislation:
CBoB issued a guidance note (effective 14 December 2018) which applied to entities supervised pursuant to BTCRA and the Regulations as well as COCUA on AML Administrative Monetary Penalties (AML AMP) in accordance with the provisions of the FTRA, 2018. Pursuant to section 57 of the FTRA, the CBoB as a Supervisory Authority is empowered to impose AMPs against any SFI or person (employees, director or senior managers of an SFI), in respect of their contravention of provisions of FTRA. The schedule to the guidance note outlined all AMPs that can be administered promptly. S. 22 of the AML/CFT/PF Guidelines states that the CBoB has informed all of its Licensees that failure to implement or maintain adequate policies and procedures relating to money laundering and terrorist financing would be taken into account in determining if the licensee continues to satisfy the criteria for licensing laid down in BTCRA. In addition, it has advised all licensees that these Guidelines would be used as part of the criteria against which it will assess the adequacy of a licensee’s systems to prevent money laundering and terrorist financing |
| EC2 | The supervisor determines that banks have adequate policies and processes that promote high ethical and professional standards and prevent the bank from being used, intentionally or unintentionally, for criminal activities. This includes the prevention and detection of criminal activity, and reporting of such suspected activities to the appropriate authorities. |
| Description and findings re EC2 | The CBB issued revised AML/CFT/CPF Guidelines on August 29, 2018, to reflect the changes resulting from the enactment of the ATA 2018, FTRA 2018 (and its regulations), and POCA 2018. S. 22 of the AML/CFT/PF Guidelines stipulates that SFIs are required to establish clear responsibilities and accountabilities to ensure that policies, procedures, and controls which deter criminals from using their facilities for money laundering or the financing of terrorism, are implemented and maintained, thus ensuring that they comply with their obligations under the law. SFIs should have in place sufficient controls and monitoring systems for timely detection and reporting of suspicious transactions. S. 13(2) of the BTCRA empowers the Inspector to conduct on-site examinations and off-site supervision of the business of the licensee for the purpose of satisfying himself that the provisions of the FTRA are being complied with. In the cases where the Inspector is unable to conduct such examination or supervision, to appoint an auditor to conduct such examination or supervision and to report to the Governor. As indicated in the press release dated December 2017 of the summary results of the National Risk Assessment of The Bahamas, CBoB created an AML Analytics Unit on November 1, 2017 that undertook the enhancement of the AML supervisory framework and risk model. CBoB also conducted focused AML/CFT risk assessments during 2018 of all public and active Banks, Bank and Trusts, Trust Companies and Credit Unions as well as carrying out targeted on-site examinations of SFIs compliance programs. As a result, CBoB has undertaken increased monitoring and supervision for higher risk SFIs. |
| EC3 | In addition to reporting to the financial intelligence unit or other designated authorities, banks report to the banking supervisor suspicious activities and incidents of fraud when such activities/incidents are material to the safety, soundness or reputation of the bank.70 |
| Description and findings re EC3 | Licensees are required to notify CBoB immediately if they become aware that a material event (for example, suspicious activity, incidence of fraud or regulatory infringement actions) could have a significant impact on the banks’ safety and soundness or reputation. |
| EC4 | If the supervisor becomes aware of any additional suspicious transactions, it informs the financial intelligence unit and, if applicable, other designated authority of such transactions. In addition, the supervisor, directly or indirectly, shares information related to suspected or actual criminal activities with relevant authorities. |
| Description and findings re EC4 | The PCA requires CBoB to report any information it obtains which in its opinion indicates that any person has or may have been engaged in money laundering or terrorist financing and to disclose that information to the Financial Intelligence Unit (FIU) or the law enforcement authorities. S. 27.1 of the AML/CFT/PF Guidelines stipulates that all licensees are required to establish a point of contact with the Financial Intelligence Unit (FIU) in order to handle the reported suspicions of their staff regarding money laundering or terrorist financing. SFIs are required to appoint a MLRO/CO to undertake this role, and such officer is not only required to be registered with the FIU, but to report suspicious transactions directly to the FIU. Section 38 (9) of the CBBA allows CBoB to cooperate and exchange information with any other regulatory authority in The Bahamas where it is considered by the Governor that such cooperation or information may be relevant to the functions of such other regulatory authority or as a necessary part of a framework for consolidated supervision, oversight or regulation of the financial services sector. S. 38 (3) of the CBBA provides that CBoB may disclose to an overseas regulatory authority information necessary to enable that authority to exercise regulatory functions including the conduct of civil or administrative investigations and proceedings to enforce laws, regulations and rules administered by that authority. |
| EC5 | The supervisor determines that banks establish CDD policies and processes that are well documented and communicated to all relevant staff. The supervisor also determines that such policies and processes are integrated into the bank’s overall risk management and there are appropriate steps to identify, assess, monitor, manage and mitigate risks of money laundering and the financing of terrorism with respect to customers, countries and regions, as well as to products, services, transactions and delivery channels on an ongoing basis. The CDD management program, on a group-wide basis, has as its essential elements:
|
| Description and findings re EC5 | S. 25 of the AML/CFT/PF Guidelines stipulates that every licensee is required to develop and implement a risk rating framework which is approved by its Board of Directors as being appropriate for the type of products offered by the Licensee, and capable of assessing the level of potential risk each client relationship poses to the Licensee. At a minimum, the risk rating framework should include: (a) differentiation of client relationships by risk categories (Such as high, moderate or low); (b) differentiation of client relationships by risk factors (e.g., client type/profession, country of domicile, etc.); (c) the KYC documentation and due diligence information requirements appropriate for each risk category and risk factor; and (d) a process for the approval of the downgrading/upgrading of risk ratings through the periodic review of the customer relationship.
CBoB’s AML Analytics Unit, along with the Supervisory teams, carried out a targeted off-site review of all SFI’s AML/CFT policies and procedures in 2018, together with collecting information on SFI’s self-assessment against AML/CFT requirements through a survey. After this review was carried out, CBoB conducted targeted AML on-site examinations during 2018 to include the review of most of these components regarding SFI’s compliance with their own CDD policies and procedures. SFI’s received post-examination letters outlining CBoB’s expectations in addressing any deficiencies found as a result of the on-site review. CBoB is in the process of sending each SFI a letter outlining the results of its off-site and on-site AML/CFT review where in SFI’s are expected to address any gaps in compliance on a timely basis. |
| EC6 | The supervisor determines that banks have in addition to normal due diligence, specific policies and processes regarding correspondent banking. Such policies and processes include:
|
| Description and findings re EC6 | S. 150 of the AML/CFT/PF Guidelines provides that licensees should obtain senior management approval before establishing new correspondent relationships and a review of the correspondent banking relationship should be conducted at least annually to ensure AML/CFT requirements are met. S. 151 provides that transactions conducted through correspondent relationships need to be monitored according to perceived risk. Where the respondent bank or counterparty is not regulated by a country listed in the First Schedule of the FTRA (i.e., OECD- type countries), additional due diligence should be carried out to ascertain and assess whether the AML/CTF controls are in accordance with standards which are at least equivalent to those required under Bahamian law. Correspondent relationships could be reviewed during an onsite AML review, if determined to be warranted through the risk assessment process. |
| EC7 | The supervisor determines that banks have sufficient controls and systems to prevent, identify and report potential abuses of financial services, including money laundering and the financing of terrorism. |
| Description and findings re EC7 | S. 13 (2) (b) of the BTCRA provides that the CBoB shall conduct on-site examinations and off-site supervision of the business of licensees for the purpose of satisfying itself that the provisions of the BTCRA and the FTRA (which requires financial institutions to identify their customers) are being complied with and that the bank is in sound financial condition. The on-site examination program pertaining to AML reviews examines SFI’s controls and systems to prevent, identify and report potential abuses of financial services pertaining to AML/CFT. In addition, annually, within 120 days of the end of each calendar year, the Board will be required to provide a certification to CBoB as to the bank’s compliance or otherwise with the contents of the Guidelines. Additionally, the certification should also state that, using the advice and assistance of management, the Board has independently assessed and documented whether the bank’s corporate governance process is effective and whether it has successfully achieved its objectives. The Board must report any material deficiencies and problems that are identified within the bank, along with plans and timetables for their correction. The off-site surveillance team examines these annual Board certifications for self-identified gaps pertaining to AML/CFT related issues. |
| EC8 | The supervisor has adequate powers to take action against a bank that does not comply with its obligations related to relevant laws and regulations regarding criminal activities. |
| Description and findings re EC8 | S. 18 of the BTCRA and S. 14 of the CUA speak to a wide range of sanctions for non-compliance with AML/CFT requirements including the power to issue directions, impose, amend or vary conditions upon the licence, requiring the substitution of directors and officers, restricting, suspending or revoking licences, or suspending and cancelling registrations. CBoB issued a guidance note (effective 14 December 2018) which applied to entities supervised pursuant to BTCRA and the Regulations as well as COCUA on AML Administrative Monetary Penalties (AML AMP) in accordance with the provisions of the FTRA, 2018. In general, failure to comply with the AML/CFT/PF Guidelines is an offense, punishable by maximum fines of $10,000 (on summary conviction); $50,000 (for a first offence on conviction in the Supreme Court); and $100,000 for any subsequent offence on conviction in the Supreme Court. Under the Financial Transactions Reporting (Wire Transfers) Regulations, a maximum fine of $2,000 (civil penalty) applies. To date no SFI has been fined or been issued a direction by the CBoB related to AML/CFT issues, as these issues are typically dealt with through the normal supervisory interaction between CBoB and the SFI. |
| EC9 | The supervisor determines that banks have:
|
| Description and findings re EC9 | Section 3.5 of the Guidance Note on Accounting and Other Records and Internal Control Systems and Reporting Accountants’ Reports require that, in general, the internal auditor must undertake a review of the appropriate scope, efficiency and effectiveness of internal control systems, a detailed testing of transactions and balances and the operation of individual internal controls to ensure that specific control objectives have been met and a review of the implementation of management policies has been undertaken. CBoB has access to any such reports. Section 213 of the AML/CFT/PF Guidelines stipulates that banks should appoint a Money Laundering Reporting Officer (MLRO) (this function can be combined with the Compliance Officer (CO) depending on the size of the SFI’s operations, to whom employees must report their knowledge or suspicions of customers who are engaged in money laundering or the financing of terrorism. The MLRO is required to establish a point of contact with the FIU in order to deal with staff reports. S. 28 of the AML/CFT/PF Guidelines state that SFIs must establish and implement appropriate policies and procedures to ensure high standards are being followed when hiring employees. To this end, SFIs must deploy screening procedures which effect diligent and appropriate enquiries about the personal history and probity of the potential employee, and obtaining the appropriate references. S. 217 of the AML/CFT/PF Guidelines—Education and Training sets down requirements for the education of staff at entry level and on a continuous basis. The Financial Intelligence (Transactions Reporting) Regulations provide that, at least once a year, financial institutions shall provide relevant employees with appropriate training in the recognition and handling of transactions carried out by persons who may be engaged in money laundering. |
| EC10 | The supervisor determines that banks have and follow clear policies and processes for staff to report any problems related to the abuse of the banks’ financial services to either local management or the relevant dedicated officer or to both. The supervisor also determines that banks have and utilize adequate management information systems to provide the banks’ Boards, management and the dedicated officers with timely and appropriate information on such activities. |
| Description and findings re EC10 | S. 27 of the AML/CFT/PF Guidelines provides that banks appoint a Money Laundering Reporting Officer (MLRO) or combine this role with the Compliance Officer (CO) if a smaller SFI, to whom employees must report their knowledge or suspicions of customers who are engaged in money laundering or the financing of terrorism. The MLRO/CO has in place appropriate procedures, controls and monitoring systems for timely detection and prompt investigation of suspicious activity and if appropriate, subsequent reporting to the FIU and to the CBoB. The MLRO/CO must not be restricted from reporting and findings on a timely basis to the SFI Board, FIU or CBoB. |
| EC11 | Laws provide that a member of a bank’s staff who reports suspicious activity in good faith either internally or directly to the relevant authority cannot be held liable. |
| Description and findings re EC11 | S. 19 of the AML/CFT/PF Guidelines refers to S. 26 of the FTRA which states that “Where any information is disclosed or supplied in any suspicious transaction report made, pursuant to Section 14, no civil, criminal or disciplinary proceedings shall lie against that person (a) in respect of the disclosure or supply, or the manner of the disclosure or supply, of that person, or (b) for any consequences that follow from the disclosure or supply of that information.” |
| EC12 | The supervisor, directly or indirectly, cooperates with the relevant domestic and foreign financial sector supervisory authorities or shares with them information related to suspected or actual criminal activities where this information is for supervisory purposes. |
| Description and findings re EC12 | S. 38 (3) of the CBOBA provides that CBoB may disclose to an overseas regulatory authority information necessary to enable that authority to exercise regulatory functions including the conduct of civil or administrative investigations and proceedings to enforce laws, regulations and rules administered by that authority. S. 38 (9) of the CBOBA allows CBoB to cooperate and exchange information with any other regulatory authority in the Bahamas where it is considered by the Governor that such cooperation or information may be relevant to the functions of such other regulatory authority or as a necessary part of a framework for consolidated supervision, oversight or regulation of the financial services sector. S. 19 (7) (c) of the BTRA requires the CBoB to share pertinent information with the FUI as specified in the FTRA. The FUI as well as the National Steering Committee however does not have the same legal powers to share information with related authorities. CBoB, as a member of the GFSR shares information with the other domestic regulatory agencies. |
| EC13 | Unless done by another authority, the supervisor has in-house resources with specialist expertise for addressing criminal activities. In this case, the supervisor regularly provides information on risks of money laundering and the financing of terrorism to the banks. |
| Description and findings re EC13 | Anti-Terrorism Act, 2018 (ATA), s. 47 of ATA provides that the Commissioner of Police, upon instruction from the Auditor General, to investigate and place charges against a financial institution. |
| Assessment of Principle 29 | Largely Compliant |
| Comments | CBoB created the AML Analytics Unit to undertake an enhanced off-site surveillance function to review each SFI’s AML/CFT’s board approved policies. The AML Analytics Unit, together with the supervisory teams, conducted and reviewed a survey that the SFI’s self-assessed for compliance to AML/CFT regulatory compliance requirements early in 2018. CBoB also conducted 22 targeted on-site examinations of SFI’s requiring a deep-dive review for AML compliance. Further, CBoB updated its risk-based supervisory tools to specifically address AML inherent risks which was tested during its 2018 on-site examinations. CBoB was in the process of sending out letters to each SFI with the results of the AML/CFT review. Given that several pieces of new or revised legislation (namely FTRA and Regulations, ATA, PCA, ATA and the Registrar of BO), and supervisory guidance (AML/CFT/PF Guidelines, the Corrigendum to the AML/CFT/PF Guideline, as well as AML AMP) were recently updated or released in 2018, CBoB will need to continue its supervisory oversight to ensure that all SFI’s (including banks, credit unions and money transfer business’) are administering these various legislative requirements on a consistent and effective basis. Where CBoB is discovering gaps in AML requirements, it should take additional courses of actions (making use of the AMP regime) to ensure SFI’s are brought into compliance on a timely basis. CBoB should contemplate have one or two individuals who are considered AML/CFT risk specialists that supervision can call upon when needed. These individuals require additional in-depth training (beyond certification). CBoB should create a supervision manual to reflect its risk-based supervisory AML assessment |
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
- Download Figure
Summary Compliance with the Basel Core Principles
| Core Principle | Grade | Comments |
|---|---|---|
| 1. Responsibilities, objectives and powers | C | CBoB has broad powers and clear responsibilities underpinned mainly in the CBBA, BTCRA and CUA. CBoB’s primary objective is to promote financial system stability in The Bahamas. CBoB has broad corrective action and sanction powers. Laws and regulations provide CBoB with broad power to set and enforce prudential regulations to support delivery of its statutory mandate. |
| 2. Independence, accountability, resourcing and legal protection for supervisors | LC | BSD overall complement of supervisory resources should be augmented to bolster the on-site supervision program for the DSIBs and to deal with proposed regulatory reforms (Basel II/III, IFRS, AML). The reasons for the removal of a CBoB board member or the Governor should be required to be publicly disclosed. |
| 3. Cooperation and collaboration | LC | CBoB has MoU’s in place to support information sharing as well as co-operation and co-ordination between both domestic and foreign regulatory authorities in dealing with a crisis. The introduction of the resolution regime will help bolster CBoB’s power to undertake recovery and resolution actions on a timely basis. |
| 4. Permissible activities | C | The BTCRA clearly defines the “banking business” and restricts deposit taking activities to banks and credit unions only. |
| 5. Licensing criteria | C | CBoB has a thorough licensing framework and processes in place to assess licensing applications, CBoB follows criteria explicit criteria pertaining to financial strengthen of investors, fit and proper guidance for the appointment of senior management and Board members, analysis of proposed business strategy, and minimum capital adequacy requirements. |
| 6. Transfer of significant ownership | C | CBoB has the power to review, reject, and impose prudential conditions on proposals to transfer significant ownership or controlling interests in SFIs. |
| 7. Major acquisitions | C | The BTCRA empowers CBoB to establishes clear provisions on acquisitions and investments that require prior supervisory approval or prior notification to CBoB. |
| 8. Supervisory approach | LC | CBoB has a strong off-site surveillance program that entails direct interaction with the DSIBs on a semi-annual basis, international firms annually, that entails discussions around periodic reporting, discussion of emerging prudential risks (credit) that could impact the firm. The on-site examination program needs to be augmented for more regular and in-depth assessments of DSIB’s key governance, risk management, control practices as well as material risks to assess firms’ effectiveness in these areas. A supervisory regime for the assessment of resolvability is still a work in progress. |
| 9. Supervisory techniques and tools | LC | CBoB has a good set of supervisory tools to allow for effective execution of its supervisory activities. Staff are knowledgeable and assessors observed the work done by both the off-site supervisors and the on-site examiners. Written communications clearly articulate issues and through frequent engagement CBoB provides clarity to the firms on the issues raised and the general high-level expectations for addressing them. More direct engagement with SFI Boards, particularly with the DSIBs, will enhance CBoB’s supervisory processes. |
| 10. Supervisory reporting | C | CBoB has appropriate authority to collect the data that it needs to carry out its supervisory responsibilities. Prudential and statistical reporting by the SFIs provide information on supervised firms’ risk exposures, operating performance and financial condition. CBoB is committed to refining its data gathering efforts as well as working towards full implementation of an electronic ever greening risk assessment tool. CBoB’s strategy includes continuing to increase the use of quantitative analyses (evidenced by the creation of an analytics unit). |
| 11. Corrective and sanctioning powers of supervisors | LC | CBoB has a broad range of tools and authorities across the spectrum to address problems at SFIs ranging from the requirement to increase capital, liquidity and provisioning levels to the removal of board and senior management, restrictions on dividends, payment of bonus to revoking a banking license. These powers are not explicitly stated in the BTCRA, although the proposed draft amendments, which will not only introduce added powers to assist CBoB with the resolution of bank, but it will specifically state the regulatory tools described above. CBoB’s preferred approach is to identify potential concerns on an ongoing basis and work with SFIs to address them before a firm is in danger of breaching a prudential standard or requirement (e.g. encouraging Board to remove incompetent senior management), rather than taking formal action. The supervision process provides for early intervention in the form of staging requiring enhanced supervisory oversight. |
| 12. Consolidated supervision | LC | CBoB is currently working on drafting guidelines for consolidated supervision. On balance the approach is generally adequate for the consolidated supervision issues they face. CBoB would benefit from the issuance of formal expectations articulated in guidelines. In addition, the creation of powers that would allow CBoB to directly assess the strength of support provided by the parent entity and hold accountable the non-bank parent of a SFI if its actions and/or practices negatively affect bank soundness and prudential management. |
| 13. Home-host relationships | LC | With respect to banks with cross-border activities, CBoB is largely a host country supervisor with only limited activities of Bahamian SFIs outside of the country. Appropriate information sharing arrangements are in place with home country supervisors and CBoB participates where needed in supervisory colleges and in other coordination. Resolution plans need to be put in place for systemic SFIs. |
| 14. Corporate governance | LC | CBoB’s Corporate Governance Guidelines are comprehensive, with appropriate expectations and articulated requirements for boards, senior management, internal audit, etc. While expectations cover all the key areas of corporate governance, given the infrequency of comprehensive onsite exams it is not clear that supervisors have the opportunity to directly assess all key aspects of corporate governance on a regular basis. Moreover, while the Risk Assessment Process does include a section on oversight and governance for each inherent risk area, as well as a composite governance rating, assessors noted it does not specifically cover board and senior management effectiveness with respect to the broad set of expectations in the Corporate Governance Guidelines, including the board’s responsibility to ensure there is an effective internal audit function and its oversight of senior management. The value of the practice of requiring annual certifications of compliance from boards of directors could be enhanced by 1) undertaking periodic reviews of all aspects of the certification process at the SFIs and 2) a formal policy of rapid escalation of expectations in this area when it is found that a certification was materially incorrect. For example, requiring an SFI to retain the services of an independent third party to provide a ‘reasonable assurance’ level assessment across all key areas covered in the certification. |
| 15. Risk management process | LC | CBoB has a quite comprehensive Risk Assessment Process that places substantial emphasis on reviews of required regulatory reports on financial condition and risk exposures, internal risk reports of the firms, internal audit reports, required annual certifications of compliance from SFIs’ boards and external7 audit coverage of financial statements and related controls. This is complemented by regular meetings with the firms and onsite examinations where deemed warranted by the risk assessment process. Risk management supervision would benefit from a better balance between onsite and offsite supervisory efforts. For example, assessors noted that in some areas (e.g., credit risk management) it has been quite some time since a comprehensive review was carried out across all DSIBs and other large firms. Greater emphasis should be put on firms’ stress testing practices (especially for DSIBs) would help promote financial resilience and would provide for an opportunity to assess the variety of important practices that inform and support stress testing. Recovery planning is not currently required. |
| 16. Capital adequacy | C | CBoB has implemented Pillars I and II of the Basel II framework, is actively working on Pillar 3 requirements and towards implementing phased-in arrangements under the Basel III. Capital requirements are in line with or stronger than the Basel regime and the largest SFIs have CET 1 capital well above required minimums. Triggers requiring further attention and possible requirements to increase capital are currently in place, and set at 14 percent for the DSIBs. CBoB has the authority to require firms to hold capital in relation to their risk profiles and well above required Basel minimums. ICAAP is not yet a well-established practice, and is a key area for the supervision of both risk management and capital adequacy. The assessors have taken that into consideration in assessing BCP 16, Risk Management, wherein it is noted that CBoB must enhance its processes for reviewing all material aspects of the ICAAP and capital planning practices at the DSIBs. |
| 17. Credit risk | LC | CBoB’s credit risk guidance is somewhat outdated requiring a renewed focus of the off-site supervisors and the on-site examination team to conduct in-depth reviews of DSIBs loan portfolios (only 5 in-depth reviews carried out since 2015). In general, CBoB has spent a great amount of time focusing on the strength of credit risk management policies, procedures and practices at one particular DSIB. The credit risk specialists at CBoB have adequate knowledge to conduct deep dive reviews, however, with the additional needed focus on AML issues during 2018 for the on-site examination team, the amount of deep dive credit risk reviews on the remaining DSIBs has not been able to take place. CBoB may contemplate a periodic thematic credit review of DSIB on the effectiveness of credit risk management practices. Under estimation of potential credit losses together with an over estimation of the level of provisioning could lead to an inaccurate view of the credit risk cycle for the overall banking sector. CBoB’s supervisors need to continue with their efforts of ensuring a proper oversight by the banks’ board over the banks’ credit risk profile. |
| 18. Problem assets, provisions, and reserves | LC | CBoB’s Impaired Assets Guidelines are somewhat outdated with evidence of industry practice varying on agreed definitions for the valuation of collateral and timing of loan loss provisioning. Although some of these practices do not align with Basel Guidelines on prudential treatment of problem assets, with the implementation of IFRS 9 (effective January 1, 2018), the requirement for SFIs to report expected losses will some come into effect. It will be important for the CBoB to update its guidance to industry with respect to its expectations and discretion as it pertains to the validation of credit risk models used to assess and measure expected credit losses. CBoB has been meeting regularly with DSIBs to discuss prudential concerns surrounding the level of non-performing loans, progress to decrease the overall levels and some general advice to DSIBs regarding the use of market sales prices for regarding valuation practices of SFIs for their real estate back loans. CBoB off-site surveillance team regularly monitors the top 20 largest exposures as well as the top NPLs, together with the level of provisioning for NPLs on a regular basis. |
| 19. Concentration risk and large exposure limits | C | CBoB closely monitors large exposures, including against internal and regulatory requirements. CBoB requires monthly reporting on large exposures from DSIBs (quarterly for others) and engages in periodic discussions with firms on their large exposures. While formal stress testing guidelines have not been developed and ICAAP reviews should be expanded and enhanced, these are addressed in BCP 15, Risk Management. |
| 20. Transactions with related parties | LC | The monitoring process is effective with respect to reviewing related party exposures relative to large exposure limits, but only captures related party exposures that would also appear in the large exposure reporting. Comprehensive coverage of compliance with requirements for related party lending and risk management would be expected to be carried out through onsite credit examinations, of which there have been only a limited number since 2015. |
| 21. Country and transfer risks | C | Assessors found that country and transfer risk were sufficiently covered through the processes described in BCP 21 detailed assessment. |
| 22. Market risk | C | CBoB supervisory activities in market risk management are sufficient for the scale and scope of market risks in the SFIs in its jurisdiction. |
| 23. Interest rate risk in the banking book | C | IRRB is a clear focus of CBoB supervisors and is looked at through required reporting of the economic value of sensitivities, reviews of SFIs’ ICAAP reports, liquidity/treasury management assessments or onsite exams and most typically, the Risk Assessment Process and semi-annual offsite assessments of the condition of the firms. Assessors view the approach as sufficient for the size, complexity and risk profiles of SFIs. |
| 24. Liquidity risk | C | CBoB’s LRMR, together with the Liquidity Risk Management Guideline, provides a thorough set of requirements and guidance in relation to liquidity risk management. CBoB’s off-site surveillance team review and actively monitor SFI’s liquidity risk management and conditions (weekly for DSIB’s). CBoB recently released, for consultation with the industry, proposals regarding Basel III Liquidity Reforms on implementing a liquidity coverage ratio (LCR) and net stable funding ratio (NSFR) in The Bahamas. All SFIs would convert to these liquidity requirements when the reforms are implemented. |
| 25. Operational risk | C | Assessors observed operational risk supervision to be a consistent area of focus, including through on-site reviews. Assessors found operational risk management supervision to be sufficient for the jurisdiction. |
| 26. Internal control and audit | LC | The assessors were able to ascertain that CBoB supervisors did have a generally well-informed view of the effectiveness of internal audit with respect to specific risk management areas at SFIs through a combination of activities noted in the detailed assessment of BCP 26. However, a broader holistic view of internal audit as a critical contributing element to an effective corporate governance regime did not appear to be an area of focus and is needed. |
| 27. Financial reporting and external audit | C | Assessors found CBoB compliant in this area with a range of guidelines/requirements in place to promote accurate financial reporting and appropriate (and significant) powers with respect to external auditors. Industry practice in The Bahamas is for audit firms to rotate as financial auditors every 7–10 years. Assessors recommend that CBoB put in place a requirement that they rotate on a shorter cycle to promote independence, require a ‘fresh set of eyes’ periodically, and reduce the potential for conflicts of interest to develop. |
| 28. Disclosure and transparency | LC | CBoB needs to finalize Pillar 3 standards and ensure that disclosure requirements allow the public to gain a full picture of key practices, exposures and conditions of SFIs in a manner that allows for a clear assessment of the firms in a comparable manner. Requirements should cover qualitative information on practices as well as quantitative information. While assessors understand the desire to minimize undue burden on SFIs, the balance of costs versus benefits in this area can be hard to gauge as the specific benefits to all potential users of the information can be particularly hard to value. It is best to err on the side of requiring too much rather than too little. |
| 29. Abuse of financial services | LC | CBoB created the AML Analytics Unit to undertake an enhanced off-site surveillance function to review each SFI’s AML/CFT’s board approved policies, along with the supervisory teams, and enhance the AML supervisory framework and risk model, as well as conducting a survey that the SFI’s self-assessed for compliance to AML/CFT regulatory compliance requirements early in 2018. CBoB also conducted 22 targeted on-site examinations of SFI’s requiring a deep-dive review for AML compliance. Further, CBoB updated its risk-based supervisory tools to specifically address AML inherent risks which was tested during its 2018 on-site examinations. CBoB was in the process of sending out letters to each SFI with the results of the AML/CFT review. Given that several pieces of new or revised legislation (namely FTRA and Regulations, ATA, PCA, ATA and the Registrar of BO), and supervisory guidance (AML/CFT/PF Guidelines, the Corrigendum to the AML/CFT/PF Guideline, as well as AML AMP) were recently updated or released in 2018, CBoB will need to continue its supervisory oversight to ensure that all SFI’s (including banks, credit unions and money transfer business’) are administering these various legislative requirements on a consistent and effective basis. Where CBoB is discovering gaps in AML requirements, it should take additional courses of actions (making use of the AMP regime) to ensure SFI’s are brought into compliance on a timely basis. CBoB should contemplate the addition of one or two individuals who are considered AML/CFT risk specialists that supervision can call upon when needed. These individuals require additional in-depth training (beyond certification). CBoB should create a supervision manual to reflect its risk-based supervisory AML assessment. |
| Core Principle | Grade | Comments |
|---|---|---|
| 1. Responsibilities, objectives and powers | C | CBoB has broad powers and clear responsibilities underpinned mainly in the CBBA, BTCRA and CUA. CBoB’s primary objective is to promote financial system stability in The Bahamas. CBoB has broad corrective action and sanction powers. Laws and regulations provide CBoB with broad power to set and enforce prudential regulations to support delivery of its statutory mandate. |
| 2. Independence, accountability, resourcing and legal protection for supervisors | LC | BSD overall complement of supervisory resources should be augmented to bolster the on-site supervision program for the DSIBs and to deal with proposed regulatory reforms (Basel II/III, IFRS, AML). The reasons for the removal of a CBoB board member or the Governor should be required to be publicly disclosed. |
| 3. Cooperation and collaboration | LC | CBoB has MoU’s in place to support information sharing as well as co-operation and co-ordination between both domestic and foreign regulatory authorities in dealing with a crisis. The introduction of the resolution regime will help bolster CBoB’s power to undertake recovery and resolution actions on a timely basis. |
| 4. Permissible activities | C | The BTCRA clearly defines the “banking business” and restricts deposit taking activities to banks and credit unions only. |
| 5. Licensing criteria | C | CBoB has a thorough licensing framework and processes in place to assess licensing applications, CBoB follows criteria explicit criteria pertaining to financial strengthen of investors, fit and proper guidance for the appointment of senior management and Board members, analysis of proposed business strategy, and minimum capital adequacy requirements. |
| 6. Transfer of significant ownership | C | CBoB has the power to review, reject, and impose prudential conditions on proposals to transfer significant ownership or controlling interests in SFIs. |
| 7. Major acquisitions | C | The BTCRA empowers CBoB to establishes clear provisions on acquisitions and investments that require prior supervisory approval or prior notification to CBoB. |
| 8. Supervisory approach | LC | CBoB has a strong off-site surveillance program that entails direct interaction with the DSIBs on a semi-annual basis, international firms annually, that entails discussions around periodic reporting, discussion of emerging prudential risks (credit) that could impact the firm. The on-site examination program needs to be augmented for more regular and in-depth assessments of DSIB’s key governance, risk management, control practices as well as material risks to assess firms’ effectiveness in these areas. A supervisory regime for the assessment of resolvability is still a work in progress. |
| 9. Supervisory techniques and tools | LC | CBoB has a good set of supervisory tools to allow for effective execution of its supervisory activities. Staff are knowledgeable and assessors observed the work done by both the off-site supervisors and the on-site examiners. Written communications clearly articulate issues and through frequent engagement CBoB provides clarity to the firms on the issues raised and the general high-level expectations for addressing them. More direct engagement with SFI Boards, particularly with the DSIBs, will enhance CBoB’s supervisory processes. |
| 10. Supervisory reporting | C | CBoB has appropriate authority to collect the data that it needs to carry out its supervisory responsibilities. Prudential and statistical reporting by the SFIs provide information on supervised firms’ risk exposures, operating performance and financial condition. CBoB is committed to refining its data gathering efforts as well as working towards full implementation of an electronic ever greening risk assessment tool. CBoB’s strategy includes continuing to increase the use of quantitative analyses (evidenced by the creation of an analytics unit). |
| 11. Corrective and sanctioning powers of supervisors | LC | CBoB has a broad range of tools and authorities across the spectrum to address problems at SFIs ranging from the requirement to increase capital, liquidity and provisioning levels to the removal of board and senior management, restrictions on dividends, payment of bonus to revoking a banking license. These powers are not explicitly stated in the BTCRA, although the proposed draft amendments, which will not only introduce added powers to assist CBoB with the resolution of bank, but it will specifically state the regulatory tools described above. CBoB’s preferred approach is to identify potential concerns on an ongoing basis and work with SFIs to address them before a firm is in danger of breaching a prudential standard or requirement (e.g. encouraging Board to remove incompetent senior management), rather than taking formal action. The supervision process provides for early intervention in the form of staging requiring enhanced supervisory oversight. |
| 12. Consolidated supervision | LC | CBoB is currently working on drafting guidelines for consolidated supervision. On balance the approach is generally adequate for the consolidated supervision issues they face. CBoB would benefit from the issuance of formal expectations articulated in guidelines. In addition, the creation of powers that would allow CBoB to directly assess the strength of support provided by the parent entity and hold accountable the non-bank parent of a SFI if its actions and/or practices negatively affect bank soundness and prudential management. |
| 13. Home-host relationships | LC | With respect to banks with cross-border activities, CBoB is largely a host country supervisor with only limited activities of Bahamian SFIs outside of the country. Appropriate information sharing arrangements are in place with home country supervisors and CBoB participates where needed in supervisory colleges and in other coordination. Resolution plans need to be put in place for systemic SFIs. |
| 14. Corporate governance | LC | CBoB’s Corporate Governance Guidelines are comprehensive, with appropriate expectations and articulated requirements for boards, senior management, internal audit, etc. While expectations cover all the key areas of corporate governance, given the infrequency of comprehensive onsite exams it is not clear that supervisors have the opportunity to directly assess all key aspects of corporate governance on a regular basis. Moreover, while the Risk Assessment Process does include a section on oversight and governance for each inherent risk area, as well as a composite governance rating, assessors noted it does not specifically cover board and senior management effectiveness with respect to the broad set of expectations in the Corporate Governance Guidelines, including the board’s responsibility to ensure there is an effective internal audit function and its oversight of senior management. The value of the practice of requiring annual certifications of compliance from boards of directors could be enhanced by 1) undertaking periodic reviews of all aspects of the certification process at the SFIs and 2) a formal policy of rapid escalation of expectations in this area when it is found that a certification was materially incorrect. For example, requiring an SFI to retain the services of an independent third party to provide a ‘reasonable assurance’ level assessment across all key areas covered in the certification. |
| 15. Risk management process | LC | CBoB has a quite comprehensive Risk Assessment Process that places substantial emphasis on reviews of required regulatory reports on financial condition and risk exposures, internal risk reports of the firms, internal audit reports, required annual certifications of compliance from SFIs’ boards and external7 audit coverage of financial statements and related controls. This is complemented by regular meetings with the firms and onsite examinations where deemed warranted by the risk assessment process. Risk management supervision would benefit from a better balance between onsite and offsite supervisory efforts. For example, assessors noted that in some areas (e.g., credit risk management) it has been quite some time since a comprehensive review was carried out across all DSIBs and other large firms. Greater emphasis should be put on firms’ stress testing practices (especially for DSIBs) would help promote financial resilience and would provide for an opportunity to assess the variety of important practices that inform and support stress testing. Recovery planning is not currently required. |
| 16. Capital adequacy | C | CBoB has implemented Pillars I and II of the Basel II framework, is actively working on Pillar 3 requirements and towards implementing phased-in arrangements under the Basel III. Capital requirements are in line with or stronger than the Basel regime and the largest SFIs have CET 1 capital well above required minimums. Triggers requiring further attention and possible requirements to increase capital are currently in place, and set at 14 percent for the DSIBs. CBoB has the authority to require firms to hold capital in relation to their risk profiles and well above required Basel minimums. ICAAP is not yet a well-established practice, and is a key area for the supervision of both risk management and capital adequacy. The assessors have taken that into consideration in assessing BCP 16, Risk Management, wherein it is noted that CBoB must enhance its processes for reviewing all material aspects of the ICAAP and capital planning practices at the DSIBs. |
| 17. Credit risk | LC | CBoB’s credit risk guidance is somewhat outdated requiring a renewed focus of the off-site supervisors and the on-site examination team to conduct in-depth reviews of DSIBs loan portfolios (only 5 in-depth reviews carried out since 2015). In general, CBoB has spent a great amount of time focusing on the strength of credit risk management policies, procedures and practices at one particular DSIB. The credit risk specialists at CBoB have adequate knowledge to conduct deep dive reviews, however, with the additional needed focus on AML issues during 2018 for the on-site examination team, the amount of deep dive credit risk reviews on the remaining DSIBs has not been able to take place. CBoB may contemplate a periodic thematic credit review of DSIB on the effectiveness of credit risk management practices. Under estimation of potential credit losses together with an over estimation of the level of provisioning could lead to an inaccurate view of the credit risk cycle for the overall banking sector. CBoB’s supervisors need to continue with their efforts of ensuring a proper oversight by the banks’ board over the banks’ credit risk profile. |
| 18. Problem assets, provisions, and reserves | LC | CBoB’s Impaired Assets Guidelines are somewhat outdated with evidence of industry practice varying on agreed definitions for the valuation of collateral and timing of loan loss provisioning. Although some of these practices do not align with Basel Guidelines on prudential treatment of problem assets, with the implementation of IFRS 9 (effective January 1, 2018), the requirement for SFIs to report expected losses will some come into effect. It will be important for the CBoB to update its guidance to industry with respect to its expectations and discretion as it pertains to the validation of credit risk models used to assess and measure expected credit losses. CBoB has been meeting regularly with DSIBs to discuss prudential concerns surrounding the level of non-performing loans, progress to decrease the overall levels and some general advice to DSIBs regarding the use of market sales prices for regarding valuation practices of SFIs for their real estate back loans. CBoB off-site surveillance team regularly monitors the top 20 largest exposures as well as the top NPLs, together with the level of provisioning for NPLs on a regular basis. |
| 19. Concentration risk and large exposure limits | C | CBoB closely monitors large exposures, including against internal and regulatory requirements. CBoB requires monthly reporting on large exposures from DSIBs (quarterly for others) and engages in periodic discussions with firms on their large exposures. While formal stress testing guidelines have not been developed and ICAAP reviews should be expanded and enhanced, these are addressed in BCP 15, Risk Management. |
| 20. Transactions with related parties | LC | The monitoring process is effective with respect to reviewing related party exposures relative to large exposure limits, but only captures related party exposures that would also appear in the large exposure reporting. Comprehensive coverage of compliance with requirements for related party lending and risk management would be expected to be carried out through onsite credit examinations, of which there have been only a limited number since 2015. |
| 21. Country and transfer risks | C | Assessors found that country and transfer risk were sufficiently covered through the processes described in BCP 21 detailed assessment. |
| 22. Market risk | C | CBoB supervisory activities in market risk management are sufficient for the scale and scope of market risks in the SFIs in its jurisdiction. |
| 23. Interest rate risk in the banking book | C | IRRB is a clear focus of CBoB supervisors and is looked at through required reporting of the economic value of sensitivities, reviews of SFIs’ ICAAP reports, liquidity/treasury management assessments or onsite exams and most typically, the Risk Assessment Process and semi-annual offsite assessments of the condition of the firms. Assessors view the approach as sufficient for the size, complexity and risk profiles of SFIs. |
| 24. Liquidity risk | C | CBoB’s LRMR, together with the Liquidity Risk Management Guideline, provides a thorough set of requirements and guidance in relation to liquidity risk management. CBoB’s off-site surveillance team review and actively monitor SFI’s liquidity risk management and conditions (weekly for DSIB’s). CBoB recently released, for consultation with the industry, proposals regarding Basel III Liquidity Reforms on implementing a liquidity coverage ratio (LCR) and net stable funding ratio (NSFR) in The Bahamas. All SFIs would convert to these liquidity requirements when the reforms are implemented. |
| 25. Operational risk | C | Assessors observed operational risk supervision to be a consistent area of focus, including through on-site reviews. Assessors found operational risk management supervision to be sufficient for the jurisdiction. |
| 26. Internal control and audit | LC | The assessors were able to ascertain that CBoB supervisors did have a generally well-informed view of the effectiveness of internal audit with respect to specific risk management areas at SFIs through a combination of activities noted in the detailed assessment of BCP 26. However, a broader holistic view of internal audit as a critical contributing element to an effective corporate governance regime did not appear to be an area of focus and is needed. |
| 27. Financial reporting and external audit | C | Assessors found CBoB compliant in this area with a range of guidelines/requirements in place to promote accurate financial reporting and appropriate (and significant) powers with respect to external auditors. Industry practice in The Bahamas is for audit firms to rotate as financial auditors every 7–10 years. Assessors recommend that CBoB put in place a requirement that they rotate on a shorter cycle to promote independence, require a ‘fresh set of eyes’ periodically, and reduce the potential for conflicts of interest to develop. |
| 28. Disclosure and transparency | LC | CBoB needs to finalize Pillar 3 standards and ensure that disclosure requirements allow the public to gain a full picture of key practices, exposures and conditions of SFIs in a manner that allows for a clear assessment of the firms in a comparable manner. Requirements should cover qualitative information on practices as well as quantitative information. While assessors understand the desire to minimize undue burden on SFIs, the balance of costs versus benefits in this area can be hard to gauge as the specific benefits to all potential users of the information can be particularly hard to value. It is best to err on the side of requiring too much rather than too little. |
| 29. Abuse of financial services | LC | CBoB created the AML Analytics Unit to undertake an enhanced off-site surveillance function to review each SFI’s AML/CFT’s board approved policies, along with the supervisory teams, and enhance the AML supervisory framework and risk model, as well as conducting a survey that the SFI’s self-assessed for compliance to AML/CFT regulatory compliance requirements early in 2018. CBoB also conducted 22 targeted on-site examinations of SFI’s requiring a deep-dive review for AML compliance. Further, CBoB updated its risk-based supervisory tools to specifically address AML inherent risks which was tested during its 2018 on-site examinations. CBoB was in the process of sending out letters to each SFI with the results of the AML/CFT review. Given that several pieces of new or revised legislation (namely FTRA and Regulations, ATA, PCA, ATA and the Registrar of BO), and supervisory guidance (AML/CFT/PF Guidelines, the Corrigendum to the AML/CFT/PF Guideline, as well as AML AMP) were recently updated or released in 2018, CBoB will need to continue its supervisory oversight to ensure that all SFI’s (including banks, credit unions and money transfer business’) are administering these various legislative requirements on a consistent and effective basis. Where CBoB is discovering gaps in AML requirements, it should take additional courses of actions (making use of the AMP regime) to ensure SFI’s are brought into compliance on a timely basis. CBoB should contemplate the addition of one or two individuals who are considered AML/CFT risk specialists that supervision can call upon when needed. These individuals require additional in-depth training (beyond certification). CBoB should create a supervision manual to reflect its risk-based supervisory AML assessment. |
Recommended Actions and Authorities Comments
Recommended Actions to Improve Compliance with the Basel Core Principles and the Effectiveness of Regulatory and Supervisory Frameworks
Recommended Actions to Improve Compliance with the Basel Core Principles and the Effectiveness of Regulatory and Supervisory Frameworks
| Reference Principle | Recommended Action |
|---|---|
| Principle 2 |
|
| Principle 3 |
|
| Principle 5 |
|
| Principle 8 |
|
| Principle 9 |
|
| Principle 10 |
|
| Principle 11 |
|
| Principle 12 |
|
| Principle 14 |
|
| Principle 15 |
|
| Principle 17 |
|
| Principle 18 |
|
| Principle 20 |
|
| Principle 22 |
|
| Principle 26 |
|
| Principle 28 |
|
| Principle 29 |
|
Recommended Actions to Improve Compliance with the Basel Core Principles and the Effectiveness of Regulatory and Supervisory Frameworks
| Reference Principle | Recommended Action |
|---|---|
| Principle 2 |
|
| Principle 3 |
|
| Principle 5 |
|
| Principle 8 |
|
| Principle 9 |
|
| Principle 10 |
|
| Principle 11 |
|
| Principle 12 |
|
| Principle 14 |
|
| Principle 15 |
|
| Principle 17 |
|
| Principle 18 |
|
| Principle 20 |
|
| Principle 22 |
|
| Principle 26 |
|
| Principle 28 |
|
| Principle 29 |
|
Authorities’ Response to the Assessment
The CBoB expresses its appreciation to the IMF FSAP Mission for providing a thorough and fair assessment of The Bahamas’ compliance with the Basel Core Principles for Effective Supervision. The current FSAP represents this jurisdiction first assessment against the revised 2012 methodology. Over the years, the CBoB has been focused on imposing strengthening measures to its supervisory and regulatory regime to become fully aligned with evolving international standards. In the past two years, the CBoB along with other domestic financial services regulators and the various government stakeholders led by the Attorney General’s Office moved aggressively to introduce legislative/regulatory reforms aimed at closing deficiencies identified by the Caribbean Financial Action Taskforce in its recent mutual evaluation exercise. In the broader context of financial stability, the CBoB has drafted amendments to the Central Bank Act, 2000, the Banks and Trust Companies Regulation Act, 2000 and the Protection of Depositors Act, 1999 to introduce a transparent bank resolution framework. The CBoB will continue to collaborate with the appropriate government stakeholders on Crisis Management as well as other key priorities requiring legislative reform or some formal protocols.
Overall, the results of the FSAP signals that the CBoB is moving in the right direction. In most cases, identified gaps were already targeted in terms of legislative and policy reforms and/or process improvements. The CBoB is committed to executing a regime that is not only aligned with international standards but “fit for purpose” and one that can demonstrate effectiveness against international scrutiny. Against this backdrop, the CBoB will take proactive steps to execute a work plan that will address the FSAP’s key recommendations in a timely and orderly manner. The CBoB is currently in an advance stage of its full Basel III implementation, aimed at taking a more proportional approach in the context of small nation states with a conservative financial system. The Basel III capital rules will be set out in a detailed Capital Regulation which will be issued for consultation in the latter part of 2019.
The CBoB will strategically augment its supervision complement and where necessary will continue to reorganize and redefine roles to ensure adequate coverage of our supervisory mandate for safety and soundness as well as reputational risks. The CBoB is committed to introducing and leveraging technology solutions to enhance its ongoing monitoring and detection of emerging risks to ensure timely supervisory intervention.
1
This Detailed Assessment Report has been prepared by Tim Clark and Geraldine Low, IMF external experts.
2
Sources: Central Bank of The Bahamas, and IMF staff calculations.
3
The Bahamian dollar is pegged to the U.S. dollar at parity.
4
The Bahamas international financial sector is made up of 208 Banks and Trusts (B$168.2Bn on balance sheet assets); 783 Investment Funds (B$86.3Bn) and 20 External Insurers (B$1Bn – approximately).
5
This section draws from other documents produced for the FSAP, some of which at the time of this assessment were not yet finalized. A complete analysis of the macroeconomic framework is contained in Article IV reports.
6
In this document, “banking group” includes the holding company, the bank and its offices, subsidiaries, affiliates and joint ventures, both domestic and foreign. Risks from other entities in the wider group, for example non-bank (including non-financial) entities, may also be relevant. This group-wide approach to supervision goes beyond accounting consolidation.
7
The activities of authorising banks, ongoing supervision and corrective actions are elaborated in the subsequent Principles.
8
Such authority is called “the supervisor” throughout this paper, except where the longer form “the banking supervisor” has been necessary for clarification.
9
In this document, “risk profile” refers to the nature and scale of the risk exposures undertaken by a bank.
10
In this document, “systemic importance” is determined by the size, interconnectedness, substitutability, global or cross-jurisdictional activity (if any), and complexity of the bank, as set out in the BCBS paper on Global systemically important banks: assessment methodology and the additional loss absorbency requirement, November 2011.
11
Please refer to Principle 1, Essential Criterion 1.
12
Principle 3 is developed further in the Principles dealing with “Consolidated supervision” (12), “Home-host relationships” (13) and “Abuse of financial services” (29).
13
The Committee recognizes the presence in some countries of non-banking financial institutions that take deposits but may be regulated differently from banks. These institutions should be subject to a form of regulation commensurate to the type and size of their business and, collectively, should not hold a significant proportion of deposits in the financial system.
14
This document refers to a governance structure composed of a board and senior management. The Committee recognizes that there are significant differences in the legislative and regulatory frameworks across countries regarding these functions. Some countries use a two-tier board structure, where the supervisory function of the board is performed by a separate entity known as a supervisory board, which has no executive functions. Other countries, in contrast, use a one-tier board structure in which the board has a broader role. Owing to these differences, this document does not advocate a specific board structure. Consequently, in this document, the terms “board” and “senior management” are only used as a way to refer to the oversight function and the management function in general and should be interpreted throughout the document in accordance with the applicable law within each jurisdiction.
15
Therefore, shell banks shall not be licensed. (Reference document: BCBS paper on shell banks, January 2003.)
16
Please refer to Principle 14, Essential Criterion 8.
17
Please refer to Principle 29.
18
While the term “supervisor” is used throughout Principle 6, the Committee recognizes that in a few countries these issues might be addressed by a separate licensing authority.
19
In the case of major acquisitions, this determination may take into account whether the acquisition or investment creates obstacles to the orderly resolution of the bank.
20
Please refer to Footnote 33 under Principle 7, Essential Criterion 3
21
On-site work is used as a tool to provide independent verification that adequate policies, procedures and controls exist at banks, determine that information reported by banks is reliable, obtain additional information on the bank and its related companies needed for the assessment of the condition of the bank, monitor the bank’s follow-up on supervisory concerns, etc.
22
Off-site work is used as a tool to regularly review and analyze the financial condition of banks, follow up on matters requiring further attention, identify and evaluate developing risks and help identify the priorities, scope of further off-site and on-site work, etc.
23
Please refer to Principle 10.
24
In the context of this Principle, “prudential reports and statistical returns” are distinct from and in addition to required accounting reports. The former are addressed by this Principle, and the latter are addressed in Principle 27.
25
Please refer to Principle 2.
26
Please refer to Principle 1, Essential Criterion 5.
27
Maybe external auditors or other qualified external parties, commissioned with an appropriate mandate, and subject to appropriate confidentiality restrictions.
28
Maybe external auditors or other qualified external parties, commissioned with an appropriate mandate, and subject to appropriate confidentiality restrictions. External experts may conduct reviews used by the supervisor, yet it is ultimately the supervisor that must be satisfied with the results of the reviews conducted by such external experts.
29
Please refer to Principle 1.
30
Please refer to footnote 19 under Principle 1.
31
Please refer to Principle 16, Additional Criterion 2.
32
See Illustrative example of information exchange in colleges of the October 2010 BCBS Good practice principles on supervisory colleges for further information on the extent of information sharing expected.
33
Please refer to footnote 27 under Principle 5.
34
The OECD (OECD glossary of corporate governance-related terms in “Experiences from the Regional Corporate Governance Roundtables”, 2003, www.oecd.org/dataoecd/19/26/23742340.pdf.) defines “duty of care” as “The duty of a board member to act on an informed and prudent basis in decisions with respect to the company. Often interpreted as requiring the board member to approach the affairs of the company in the same way that a ‘prudent man’ would approach their own affairs. Liability under the duty of care is frequently mitigated by the business judgment rule.” The OECD defines “duty of loyalty” as “The duty of the board member to act in the interest of the company and shareholders. The duty of loyalty should prevent individual board members from acting in their own interest, or the interest of another individual or group, at the expense of the company and all shareholders.”
35
“Risk appetite” reflects the level of aggregate risk that the bank’s Board is willing to assume and manage in the pursuit of the bank’s business objectives. Risk appetite may include both quantitative and qualitative elements, as appropriate, and encompass a range of measures. For the purposes of this document, the terms “risk appetite” and “risk tolerance” are treated synonymously.
36
For the purposes of assessing risk management by banks in the context of Principles 15 to 25, a bank’s risk management framework should take an integrated “bank-wide” perspective of the bank’s risk exposure, encompassing the bank’s individual business lines and business units. Where a bank is a member of a group of companies, the risk management framework should in addition cover the risk exposure across and within the “banking group” (see footnote 19 under Principle 1) and should also take account of risks posed to the bank or members of the banking group through other entities in the wider group.
37
To some extent the precise requirements may vary from risk type to risk type (Principles 15 to 25) as reflected by the underlying reference documents.
38
It should be noted that while, in this and other Principles, the supervisor is required to determine that banks’ risk management policies and processes are being adhered to, the responsibility for ensuring adherence remains with a bank’s Board and senior management.
39
New products include those developed by the bank or by a third party and purchased or distributed by the bank.
40
The Core Principles do not require a jurisdiction to comply with the capital adequacy regimes of Basel I, Basel II and/or Basel III. The Committee does not consider implementation of the Basel-based framework a prerequisite for compliance with the Core Principles, and compliance with one of the regimes is only required of those jurisdictions that have declared that they have voluntarily implemented it.
41
The Basel Capital Accord was designed to apply to internationally active banks, which must calculate and apply capital adequacy ratios on a consolidated basis, including subsidiaries undertaking banking and financial business. Jurisdictions adopting the Basel II and Basel III capital adequacy frameworks would apply such ratios on a fully consolidated basis to all internationally active banks and their holding companies; in addition, supervisors must test that banks are adequately capitalized on a stand-alone basis.
42
Reference documents: Enhancements to the Basel II framework, July 2009 and: International convergence of capital measurement and capital standards: a revised framework, comprehensive version, June 2006.
43
In assessing the adequacy of a bank’s capital levels in light of its risk profile, the supervisor critically focuses, among other things, on (a) the potential loss absorbency of the instruments included in the bank’s capital base, (b) the appropriateness of risk weights as a proxy for the risk profile of its exposures, (c) the adequacy of provisions and reserves to cover loss expected on its exposures, and (d) the quality of its risk management and controls. Consequently, capital requirements may vary from bank to bank to ensure that each bank is operating with the appropriate level of capital to support the risks it is running and the risks it poses.
44
“Stress testing” comprises a range of activities from simple sensitivity analysis to more complex scenario analyses and reverses stress testing.
45
Please refer to Principle 12, Essential Criterion 7.
46
Principle 17 covers the evaluation of assets in greater detail; Principle 18 covers the management of problem assets.
47
Credit risk may result from the following: on-balance sheet and off-balance sheet exposures, including loans and advances, investments, inter-bank lending, derivative transactions, securities financing transactions and trading activities.
48
Counterparty credit risk includes credit risk exposures arising from OTC derivative and other financial instruments.
49
“Assuming” includes the assumption of all types of risk that give rise to credit risk, including credit risk or counterparty risk associated with various financial instruments.
50
Principle 17 covers the evaluation of assets in greater detail; Principle 18 covers the management of problem assets.
51
Reserves for the purposes of this Principle are “below the line” non-distributable appropriations of profit required by a supervisor in addition to provisions (“above the line” charges to profit).
52
It is recognized that there are two different types of off-balance sheet exposures: those that can be unilaterally cancelled by the bank (based on contractual arrangements and therefore may not be subject to provisioning), and those that cannot be unilaterally cancelled.
53
Connected counterparties may include natural persons as well as a group of companies related financially or by common ownership, management or any combination thereof.
54
This includes credit concentrations through exposure to: single counterparties and groups of connected counterparties both direct and indirect (such as through exposure to collateral or to credit protection provided by a single counterparty), counterparties in the same industry, economic sector or geographic region and counterparties whose financial performance is dependent on the same activity or commodity as well as off-balance sheet exposures (including guarantees and other commitments) and also market and other risk concentrations where a bank is overly exposed to particular asset classes, products, collateral, or currencies.
55
The measure of credit exposure, in the context of large exposures to single counterparties and groups of connected counterparties, should reflect the maximum possible loss from their failure (i.e. it should encompass actual claims and potential claims as well as contingent liabilities). The risk weighting concept adopted in the Basel capital standards should not be used in measuring credit exposure for this purpose as the relevant risk weights were devised as a measure of credit risk on a basket basis and their use for measuring credit concentrations could significantly underestimate potential losses (see “Measuring and controlling large credit exposures, January 1991).
56
Such requirements should, at least for internationally active banks, reflect the applicable Basel standards. As of September 2012, a new Basel standard on large exposures is still under consideration.
57
Related parties can include, among other things, the bank’s subsidiaries, affiliates, and any party (including their subsidiaries, affiliates and special purpose entities) that the bank exerts control over or that exerts control over the bank, the bank’s major shareholders, Board members, senior management and key staff, their direct and related interests, and their close family members as well as corresponding persons in affiliated companies.
58
Related party transactions include on-balance sheet and off-balance sheet credit exposures and claims, as well as, dealings such as service contracts, asset purchases and sales, construction contracts, lease agreements, derivative transactions, borrowings, and write-offs. The term transaction should be interpreted broadly to incorporate not only transactions that are entered into with related parties but also situations in which an unrelated party (with whom a bank has an existing exposure) subsequently becomes a related party.
59
An exception may be appropriate for beneficial terms that are part of overall remuneration packages (e.g. staff receiving credit at favorable rates).
60
Country risk is the risk of exposure to loss caused by events in a foreign country. The concept is broader than sovereign risk as all forms of lending or investment activity whether to/with individuals, corporates, banks or governments are covered.
61
Transfer risk is the risk that a borrower will not be able to convert local currency into foreign exchange and so will be unable to make debt service payments in foreign currency. The risk normally arises from exchange restrictions imposed by the government in the borrower’s country. (Reference document: IMF paper on External Debt Statistics – Guide for compilers and users, 2003.)
62
Wherever “interest rate risk” is used in this Principle the term refers to interest rate risk in the banking book. Interest rate risk in the trading book is covered under Principle 22.
63
The Committee has defined operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. The definition includes legal risk but excludes strategic and reputational risk.
64
In assessing independence, supervisors give due regard to the control systems designed to avoid conflicts of interest in the performance measurement of staff in the compliance, control and internal audit functions. For example, the remuneration of such staff should be determined independently of the business lines that they oversee.
65
The term “compliance function” does not necessarily denote an organizational unit. Compliance staff may reside in operating business units or local subsidiaries and report up to operating business line management or local management, provided such staff also have a reporting line through to the head of compliance who should be independent from business lines.
66
The term “internal audit function” does not necessarily denote an organizational unit. Some countries allow small banks to implement a system of independent reviews, e.g. conducted by external experts, of key internal controls as an alternative.
67
In this Essential Criterion, the supervisor is not necessarily limited to the banking supervisor. The responsibility for ensuring that financial statements are prepared in accordance with accounting policies and practices may also be vested with securities and market supervisors.
68
For the purposes of this Essential Criterion, the disclosure requirement may be found in applicable accounting, stock exchange listing, or other similar rules, instead of or in addition to directives issued by the supervisor.
69
The Committee is aware that, in some jurisdictions, other authorities, such as a financial intelligence unit (FIU), rather than a banking supervisor, may have primary responsibility for assessing compliance with laws and regulations regarding criminal activities in banks, such as fraud, money laundering and the financing of terrorism. Thus, in the context of this Principle, “the supervisor” might refer to such other authorities, in particular in Essential Criteria 7, 8 and 10. In such jurisdictions, the banking supervisor cooperates with such authorities to achieve adherence with the criteria mentioned in this Principle.
70
Consistent with international standards, banks are to report suspicious activities involving cases of potential money laundering and the financing of terrorism to the relevant national center, established either as an independent governmental authority or within an existing authority or authorities that serves as an FIU.
71
These could be external auditors or other qualified parties, commissioned with an appropriate mandate, and subject to appropriate confidentiality restrictions.
