Supervisory Powers, Responsibilities, and Functions

Principle 1

Responsibilities, Objectives, and Powers

An effective system of banking supervision has clear responsibilities and objectives for each authority involved in the supervision of banks and banking groups.²⁶ A suitable legal framework for banking supervision is in place to provide each responsible authority with the necessary legal powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address safety and soundness concerns.²⁷

Essential Criteria

EC1

The responsibilities and objectives of each of the authorities involved in banking supervision²⁸ are clearly defined in legislation and publicly disclosed. Where more than one authority is responsible for supervising the banking system, a credible and publicly available framework is in place to avoid regulatory and supervisory gaps.

Description and Findings re EC1

CBI of Iceland (CBI) is the primary banking supervisory authority in Iceland. CBI is an independent institution owned by the State and operating under the auspices of the Prime Minister. Further, two of the three areas of responsibility of the CBI, financial supervision and financial stability are administrative matters of the MoFEA according to the presidential decree.

Act No. 92/2019 on CBI of Iceland (Act No. 92/2019) Article 2 states that CBI shall promote price stability, financial stability and sound and secure financial activities. CBI shall also undertake such tasks as are consistent with its role as a Central Bank, such as maintaining international reserves and promoting a safe, effective financial system, including domestic and cross-border payment intermediation.

The Financial Supervisory Authority (previously known as the FME) was merged with CBI beginning 2020, now referred to as “The Financial Supervisory Authority of CBI of Iceland” (CBI/FSA) wherein CBI administers all functions previously entrusted to the FME by law and Governmental directive. CBI/FSA is an integrated supervisor with both a prudential and a regulatory role overseeing supervisory activities, including banking. CBI/FSA ensures that the activities of supervised entities are in compliance with the laws, regulations, rules, or company statutes governing such activities, including banking.

The application of CBI’s policy instruments and powers are in the hands of three committees: Monetary Policy Committee, FSN and FMEN. The Central Office of CBI oversees all activities of the bank and support the functioning of the three main committees. See more details on the two Committees pertinent to banking in CP2 EC1.

Article 2(4) of the Act No. 92/2019 states that CBI shall undertake those tasks that are entrusted by law and Governmental directives to the FSA, and the FSA shall be part of CBI. The Bank shall monitor supervised entities to ensure that their activities are in compliance with the law and with Governmental directives, and that they are in other respects consistent with sound and appropriate business practice; the Act No. 87/1998 on the Official Supervision of Financial Activities (Act No. 87/1998).

Description of the Resolution Authority

With the adoption of Act no. 70/2020 on Resolution of Credit Institutions and Investment Firms (the Resolution Act), the Resolution Authority within CBI was entrusted with powers of resolution. This provides the Governor/CBI with the authorization to take decisions on resolution procedures and apply resolution measures in the case of credit institutions and investment firms that are failing or likely to fail (i.e., those that are unable to service their liabilities or are highly likely to be unable to do so). According to Article 4 of the Act, CBI’s Resolution Authority shall be separate from other activities within the Bank’s organizational structure. CBI’s Resolution Authority formally commenced operation in November 2020, and it has issued rules on the practice of the Resolution Authority no. 1733/2021 in accordance with Article 4 of the Resolution Act. The rules outline the requirements for the separation of the Resolution Authority from the other activities of CBI and the decision-making regarding resolution. According to the first paragraph of the rules the office of the Resolution Authority reports directly to the Governor.

Role of the Ministry of Finance and Economic Affairs (MoFEA)

The MoFEA administers matters relating to financial stability and financial markets. It has regulatory but no direct supervisory powers with regard to the supervision of banks. The MoFEA oversees the enacting of the banking legislative process, based on recommendations from CBI/FSA where applicable. In addition, the Prime Minister appoints members to the FMEN and the FSN, of which has government representatives on each of the Committees (see CP2 EC1 for more detail). The MoFEA appoints the external members of the FMEN and FSN. The Prime Minister appoints the DGs of Financial Stability and Financial Supervision based on nominations from the MoFEA (DGs are members of the FMEN and FSN). For the FMEN the Prime Minister chooses which official to appoint from the MoFEA to the FMEN (this is not mandated by law). Moreover, as prescribed in the CBI Act, the MoFEA representative on the FSN is only an observer.

The MoFEA implements regulations regarding various matters, for example, among other things:

• the implementation of EU regulation, delegated regulations and regulations on technical standards (level 2 acts) which are implemented by either domestic regulations issued by the MoFEA, or rules issued by CBI;

• issuing regulations regarding the qualifications of Committee members. For example, although the Prime Minister appoints members to the various CBI committees, Articles 9, 12 and 15 of Act no. 92/2019 states that the MoFEA is granted the authority to issue regulation to set more detailed provisions on the qualification of the Monetary Policy Committee members, FSN members and the FMEN members; and

• according to Article 44 of the same Act issue regulations on the determination and collection of per diem fines.

EC 2

The primary objective of banking supervision is to promote the safety and soundness of banks and the banking system. If the banking supervisor is assigned broader responsibilities, these are subordinate to the primary objective and do not conflict with it.

Description and Findings re EC2

CBI has separate objectives, but they do not conflict with its primary banking supervisory role. These separate objectives are: to promote price stability, financial stability and sound and secure financial activities. CBI shall also undertake such tasks as are consistent with its role as a Central Bank, such as maintaining international reserves and promoting a safe, effective financial system, including domestic and cross-border payment intermediation. CBI/FSA, as an integrated supervisor, is also responsible for conduct of business supervision, insurance companies, other credit undertakings and payment services entities.

The relevant sections of Article 1(1) and (2) of Act 87/1998 states that the aim of this Act is that regulated entities act in accordance with laws and rules and that the activities are in accordance with sound and proper business practices...and that the aim of the supervision of financial activities is to promote a sound and safe financial market and to reduce the likelihood that the activities of regulated entities will lead to damage to the public.

Article 8 of the same Act specifies that the FSA “shall monitor the compliance of the activities of the regulated entities with laws, regulations, rules or resolutions concerning such activities, and their consistency in other respects with sound and proper business practices.”

Article 1 of Act 161/2002 establishes that the purpose of the law is to ensure that financial undertakings are operated in a sound and normal manner in the interests of customers, shareholders, guarantee capital owners and the entire economy.

EC3

Laws and regulations provide a framework for the supervisor to set and enforce minimum prudential standards for banks and banking groups. The supervisor has the power to increase the prudential requirements for individual banks and banking groups based on their risk profile²⁹ and systemic importance.³⁰

Description and Findings re EC3

As part of SREP, CBI/FSA regularly assesses D-SIB’s total capital adequacy based on the ICAAP submitted to CBI. In practice, CBI has raised prudential requirements on a bank for individual banks and banking groups when a risk is assessed throughout the supervisory cycle.

Further, CBI/FSA uses the provisions of Article 107 (a) of Act 161/2002 which establishes that the supervisor shall demand that a financial undertaking take the necessary corrective measures in a timely manner if the undertaking does not comply with the provisions of this Act, as well as the regulations and rules adopted by virtue of it. The FSA is authorized to prescribe: 1) a higher total capital ratio, 2) better internal processes, 3) that a financial undertaking present a special plan on how the undertaking will fulfil the requirements and set deadlines for improvements, 4) write-down of assets, 5) restrictions or limits to activities, 6) reduction of the risk, 7) limit bonuses, 8) use of net profit to strengthen the own funds, 9) limit or prohibit dividend, 10) impose special liquidity requirements, 11) increase data submission and 12) special disclosure to the market.

The FSA has imposed Pillar 2 add-ons according to results of Supervisory Review and Evaluation process (SREP) and the new individual capital adequacy ratio (CAR) is then considered the regulatory minimum for that bank. The CBI has effectively and actively used the Article to impose Pillar 2 requirements to banks according to their risk profile and systemic importance. Assessors were able to verify evidence of this type of action.

EC4

Banking laws, regulations and prudential standards are updated as necessary to ensure that they remain effective and relevant to changing industry and regulatory practices. These are subject to public consultation, as appropriate.

Description and Findings re EC4

Acts No. 87/1998 and No. 161/2002 have been amended several times, mostly to reflect EU legislation and after 2008 to allow for crisis-related measures. As a member of the European Economic Area (EEA), Iceland has the obligation to transpose into national legislation the EU Directives and Regulation regarding prudential requirements for banks that have been incorporated into the EEA Agreement. Extensive changes were also made to Act No. 161/2002 due to the merger of CBI and the FSA and finalized implementation of the CRD IV package (CRD IV, CRD V and CRR I and CRR II).

Assessors recommend that CBI/FSA implement in prudential guidance in the material risk areas to ensure that banks know and understand all the recently transposed EU legislation and that the guidance is tailored to the Icelandic jurisdiction.

It is noted that CBI participates in the working groups responsible for drafting legislation, but it does not have the power to initiate and propose legislation regarding banking supervision, that power lies with the MoFEA. CBI can issue rules (called “rules”) when explicitly authorized to do so by legislation, and on a specific topic (Article 78(a-i) of Act 161/2002). CBI is generally authorized to issue and publish guidelines on the activities of regulated entities, if their substance concerns a group of regulated entities, according to Article 8 (2) of Act 87/1998. These are called “Guidelines,” and they generally reflect CBI/FSA’s interpretation of laws and regulations and are not legally binding.

All changes to or introduction of legislation or guidelines is subject to public consultation.

EC5

The supervisor has the power to:

• (a) have full access to banks’ and banking groups’ Boards, management, staff and records in order to review compliance with internal rules and limits as well as external laws and regulations;

• (b) review the overall activities of a banking group, both domestic and cross-border; and

• (c) Supervise the activities of foreign banks incorporated in its jurisdiction.

Description and Findings re EC5

A) CBI has full access to banks and banking group board, management, staff and records in order to review compliance with internal and external rules. According to Paragraph one of Article 9 of Act No. 87/1998 on Act on Official Supervision of Financial Activities supervised entities are required to grant CBI access to all their accounts, minutes, documents and other material in their possession regarding their activities, which CBI considers necessary.

According to Paragraph three CBI can in connection with its supervision and investigations under the provisions of special legislation e.g., Act No. 161/2002 on financial undertaking, require natural and legal persons to supply the FSA with any information and material the Authority considers necessary. In this context it is of no relevance whether the information concerns the party to which the request is directed or transactions with other parties on which the party is able to supply information which concerns the investigation and supervision of the FSA.

In addition, CBI has extensive powers to request information based on Article 107 of Act no. 161/2002.

FSA can impose a sanction, according to Article 11 of Act No. 87/1198, if obliged entity doesn’t deliver requested data.

B) CBI can review the overall activities of a banking group, both domestic and crossborder, cf. Article 107 of Act No.161/2002. If the activities are cross-border CBI would contact relevant authorities for cooperation.

C) There are no foreign banks incorporated in Iceland.

If a foreign bank that has headquarters outside the EEA CBI can grant the bank special authorization to incorporate in Iceland, cf. requirements stated in Article 33 of Act. 161/2002. The process for passport notification for banks within the EEA is a specific dialogue between the home and host supervisors according to Articles in the Banking Directive (CRD IV). CBI has extensive powers to supervise foreign bank incorporated in Iceland according to Article 34 of Act. 161/2002.

EC6

When, in a supervisor’s judgment, a bank is not complying with laws or regulations, or it is or is likely to be engaging in unsafe or unsound practices or actions that have the potential to jeopardize the bank or the banking system, the supervisor has the power to:

• (a) take (and/or require a bank to take) timely corrective action;

• (b) impose a range of sanctions;

• (c) revoke the bank’s license; and

• (d) cooperate and collaborate with relevant authorities to achieve an orderly resolution of the bank, including triggering resolution where appropriate.

Description and Findings re EC6

A) According to Article 10 of Act No. 87/1998 CBI can take action if a supervised entity is not complying with law or other rules governing their activities as well as require corrective actions.

According to Paragraph one and two of Article 107 a of Act No. 161/2002 CBI can insist that supervised entity takes corrective actions if it does not comply, or it is likely that the bank will not comply with Act No. 161/2002 or regulations based on the Act. The timely corrective actions, but limited to, that CBI can:

• Require banks to hold own funds in excess of requirements in CRR

• to require institutions to present a plan to restore compliance with supervisory requirements

• restrict or limit the business, operations or network of institutions

• require the reduction of the risk inherent in the activities, products and systems of institutions

• require institutions to use net profits to strengthen own funds

Furthermore, according to Article 107 (c) of Act No. 161/2002 CBI can use early intervention measures if the supervised entity is not complying with law and rules or it is likely that the entity will not comply with law and rules, including CRR. The early intervention measures, but not limited to, stipulate that CBI can:

• require changes to the institution’s business strategy;

• require the management body of the institution to draw up a plan for negotiation on restructuring of debt with some or all of its creditors according to the recovery plan, where applicable.

Finally, Article 107 (g) and (h) state that when supervised entities operate cross border within the EEA the supervisory authorities shall cooperate in their supervisory measures.

B) CBI can impose a range of sanctions e.g.:

• Administrative sanctions according to Article 110 of Act No. 161/2002 on financial undertakings

• Comments and corrective actions, cf. Article 10 of Act 87/1998

• Fines, cf. Paragraph three of Article 11 of Act No 87/1998

• Periodic penalty payments, cf. Paragraph One of Article 11 of Act No. 87/1998

• Dismissal of a board members or CEO based on the board member or the CEO not fulfilling suitability requirement because of breaches of law and rules, cf. Article 52 of Act No. 16172002 and Paragraph four of Article 10 of Act No. 87/1998.

C) Article 9 of Act No. 161/2002 on financial undertakings indicates that CBI can revoke a banking license.

D) According to Article 107 a in Act No. 161/2002 the FSA shall demand that a financial undertaking take the necessary corrective measures in a timely manner if the undertaking does not comply with the provisions of this Act, as well as the regulations and rules adopted by virtue of it, or if data or information in its possession, the FSA considers it likely that a financial undertaking will not be able to comply with the provisions of this Act within the next 12 months.

According to Article 107 c in Act No. 161/2002 The FSA can apply early interventions against a credit institution or investment firm with guarantee capital. In the circumstances referred to in point (a) or (b) of the first paragraph of Article 107 c, a credit institution or investment firm is obliged to provide the Financial Supervisory Authority with all the information deemed necessary to be able to update the resolution plan and assess the assets and liabilities of the relevant undertaking and its possible resolution procedure according to the Act on Resolution of Credit Institutions and Investment Firms. The resolution authority shall have access to that information. The FSA shall immediately inform the resolution authority of a credit institution or investment firm if the circumstances are such that an early intervention is permitted pursuant to the first paragraph.

According to Article 34 in Act No. 70/2020 on Resolution of Credit Institutions and Investment Firms the FSA decides, after consultation with the resolution authority, whether an undertaking or entity pursuant to points (b) to (d) of the first paragraph of Article 2 is failing or likely to fail and the relevant parties shall be notified of the result without delay. According to Article 34 of the same Act The FMEN decides upon receipt of a notification of a failing bank whether it is necessary to take resolution actions against it in order to achieve the objectives of Act No. 70/2020.

EC7

The supervisor has the power to review the activities of parent companies and of companies affiliated with parent companies to determine their impact on the safety and soundness of the bank and the banking group.

Description and Findings re EC7

The supervisor has the power to review the activities of parent companies and of companies affiliated with parent companies to determine their impact on the safety and soundness of the bank and the banking group according to Paragraph 2 in Article 107 in Act No. 161/2002. CBI/FSA supervises the activities of financial holding companies, mixed holding companies and mixed financial holding companies that are established or operate in Iceland. The supervision of the FSA as a supervisory body on a consolidated basis covers the activities of financial holding companies, mixed holding companies and mixed financial holding companies, the parent company of such companies and their subsidiaries, when they are located in another country, and the supervision can therefore be conducted in cooperation and consultation [with the competent authorities in the relevant Member State in accordance with Section C in the chapter.

According to paragraph 4 in Article 107 in Act 161/2002 the FSA may demand any sort of data or information from [the financial holding companies, mixed holding companies and subsidiaries of such companies] provided the FSA deems such information to be necessary for its supervision of financial undertakings which are subsidiaries of these holding companies.

Article 107(c) outlines early interventions by the Financial Supervisory Authority. Article 107 (g) states the same for with respect to a parent company.

Article 109 outlines the Prudential requirements on a consolidated basis. The provisions of Chapters VII, IX and IX A of the Act shall apply to groups where the parent company is a financial undertaking, mixed financial holding company or financial holding company. The parent company shall be responsible for implementation of this provision within the group. The provisions of Article 52 and 52(a) on the eligibility requirements of board members and managing directors and other duties of board members and provisions Chapter VII Section C on remuneration also apply to financial holding companies. According to paragraph 4 of the Article the Financial Supervisory Authority may decide that the provisions of the first paragraph of this Article and [the ninth and tenth paragraphs of Art.97]3) shall also apply in other instances involving a financial undertaking which alone or jointly with another party has such ownership links to an undertaking that it is deemed necessary to apply these provisions.

According to paragraph 5 the FSA may decide that an undertaking shall be considered part of a consolidated financial undertaking when the financial undertaking has a decisive influence on the company.

In addition, FSA also assesses the suitability of qualified holders, both when they become qualified holders and also on an ongoing basis, cf. Article 49 of the Act.

Assessment of Principle 1

Largely Compliant

Comments

CBI is the primary regulator of the banks, which came into effect when it merged with the FSA beginning of 2020. Although CBI has separate objectives (e.g., to promote price stability, financial stability and sound and secure financial activities), they do not conflict with its primary banking supervisory role.

Iceland has a suitable legal framework for banking supervision wherein the supervisory authority has the necessary powers to conduct ongoing supervision, including the use of corrective actions on a timely basis. The EU regulatory framework for banks has been transposed into law over several years (CRDIV package (with CRDV and CRR II amendments completed last year); however, CBI has not issued guidelines to banks in the key risks that would provide clarity of CBI’s expectations to the banking industry and to ensure the EU rules are tailored to the Icelandic environment.

Principle 2

Independence, accountability, resourcing, and legal protection for supervisors

The supervisor possesses operational independence, transparent processes, sound governance, budgetary processes that do not undermine autonomy and adequate resources, and is accountable for the discharge of its duties and use of its resources. The legal framework for banking supervision includes legal protection for the supervisor.

Essential Criteria

EC1

The operational independence, accountability and governance of the supervisor are prescribed in legislation and publicly disclosed. There is no government or industry interference that compromises the operational independence of the supervisor. The supervisor has full discretion to take any supervisory actions or decisions on banks and banking groups under its supervision.

Description and Findings re EC1

There are several factors discussed below that speak to CBI’s operational independence, accountability and governance as a supervisor of banks. CBI’s independence may be compromised with government (MoFEA) representation sitting on the FMEN as this Committee makes decisions on micro prudential banking supervisory matters. Further, there is an issue with both accountabilities, but also with operational effectiveness (see EC4) given the lack of a formal legal delegation framework in place from the Governor to others. Please see assessors’ comments at the end of EC4.

CBI is an independent institution owned by the State and operates under the auspices of the Prime Minister, cf. Art. (1) of Act no. 92/2019 on the Central Bank of Iceland (hereafter “CBI Act”).

The Governor of the Central Bank directs and is responsible for the Bank’s operations and is authorized to take decisions on all matters not entrusted to others by law according to Art. 3 of CBI Act.

Article 8 of CBI Act describes the role of CBI’s Supervisory Board. The Supervisory Board monitors the Bank’s compliance with the statutory provisions applying to its activities. Note that the monitoring by the Supervisory board of CBI does not include case handling or decisions on specific banking supervisory matters.

One Deputy Governor (DG) oversees matters relating to monetary policy, another oversees matters relating to financial stability, and the third oversees matters relating to financial supervision.

The FMEN takes decisions entrusted to the FSA by law or Governmental directives. The Committee may assign to the DG for Financial Supervision its authority to take non-major decisions, cf. A 15(1) of CBI Act.

Article 15(2) of CBI Act states that the FMEN shall comprise the DG for Financial Supervision, the DG for Financial Stability, and three experts in financial market affairs who shall be appointed by the Minister responsible for the financial market, for a term of five years. The composition of the FMEN shall be such that the Committee collectively possesses sufficient expertise, qualifications, and experience to carry out the tasks entrusted to it.

According to Article 4 of CBI Act, the Prime Minister appoints the Governor for a term of five years. The three Deputy Governors are also appointed by the Prime Minister (nominated by MoFEA) for a term of five years.

For further information on the appointment of the Governor, Deputy Governors, and the members of the Financial Supervision Committees, we refer to CP2-EC2.

Representation on the FMEN:

The composition of the FMEN shall be such that the Committee collectively possesses sufficient expertise, qualifications, and experience to carry out the tasks entrusted to it, cf. Article 15(2) of CBI Act states that the Minister may only appoint the same person to the FMEN twice. The DG for Financial Supervision shall chair the FMEN, and the DG for Financial Stability shall be vice-chair. When decisions are taken on the adoption of rules of procedure pursuant to Article (16)(2) and on entrusting the DG for Financial Supervision with taking non-major decisions and decisions concerning systemically important financial institutions’ equity, liquidity, and funding; the Governor shall take a seat on the FMEN as its Chairman, and the DG for Financial Supervision shall be vicechair.

FMEN members appointed by the Minister shall appear before the Parliamentary committee of the Speaker’s choosing before the appointment takes effect, or as soon as possible. They shall be legally competent to manage their own affairs and shall have no record of deprivation of control of their estate. They must have a good reputation and may not, in connection with business operations, have been convicted of a punishable offence under the General Penal Code; acts of law on public limited companies, private limited companies, accounting, financial statements, or bankruptcy; or other special legislation applying to regulated entities. Furthermore, they may not undertake work outside the Bank that could cast doubt on their impartiality. Should a dispute arise concerning the application of this provision, the Minister shall decide the issue. The Minister may, in a Regulation, set more detailed provisions on the qualifications of FMEN members, cf. A 15(3) of CBI Act. The Minister has not issued such a Regulation. Currently the FMEN has a MoFEA representative on the Committee (DG, Department of Financial Services)..

The Governor and DGs may not sit on the board of directors of an institution or commercial enterprise outside the Bank, nor otherwise participate in commercial operations except as required by law or in the case of an institution or commercial enterprise in which the Bank is involved. Should a dispute arise concerning the application of this provision, the Minister shall decide the issue. Employees of CBI of Iceland may not serve as executives, employees, auditors, attorneys, or actuaries of regulated entities. Provisions on Central Bank employees’ participation in the boards of directors of institutions and commercial enterprises shall be laid down in rules on the Bank’s activities set by the Governor and DGs. The Minister shall set rules on business transactions conducted with supervised entities by the Governor; DGs; external members of the Monetary Policy Committee, FSN, and FMEN; and Bank employees. These rules shall, among other things, provide for restrictions on their authorization to undertake financial obligations towards regulated entities or to own holdings in them, cf. Article. 5(4-6) of CBI Act.

The FMEN shall meet ten times a year on average.

According to the Committee’s Rules of Procedure, Art. 3.4., when decisions are taken in major matters pursuant to Articles 5.1 and 5.2 of the Rules of Procedure, a memorandum describing the circumstances of the case, the case handling, and a reasoned proposal for a decision shall be made available, together with relevant documentation. The secretary of the FMEN prepares the agenda for each meeting, upon prior consultation with the DG for Financial Supervision or, in those instances when the Governor chairs the Committee, with the Governor. In general, the agenda and other materials necessary for the meeting shall be sent to Committee members or made accessible to them at least five days before the meeting. Decisions by the FMEN shall be taken by a simple majority of votes; in the case of a tie, the chair shall cast the deciding vote. A record of minutes shall be maintained, containing all that transpires at meetings of the FMEN, and shall be signed by those in attendance.

CBI has no input into the matter of who is appointed as an external expert on the Committee.

EC2

The process for the appointment and removal of the head(s) of the supervisory authority and members of its governing body is transparent. The head(s) of the supervisory authority is (are) appointed for a minimum term and is removed from office during his/her term only for reasons specified in law or if (s)he is not physically or mentally capable of carrying out the role or has been found guilty of misconduct. The reason(s) for removal is publicly disclosed.

Description and Findings re EC2

The process and minimum term of appointment for the Governor and DGs is clearly outlined in Article 4 of Act no. 92/2019 as follows (please note “Minister” refers to the Prime Minister):

• The Minister shall appoint the Governor for a term of five years. The Prime Minister also appoints three Deputy Governors for a term of five years. One Deputy Governor oversees matters relating to monetary policy, another oversees matters relating to financial stability, and the third oversees matters relating to financial supervision. The Deputy Governor for Financial Stability and the Deputy Governor for Financial Supervision shall be appointed upon nomination by the Minister responsible for matters relating to the economy and financial markets.

• The same person may only be appointed Governor or Deputy Governor twice.

• The Governor and the Deputy Governor for Monetary Policy shall have completed a university degree in economics or a related subject and possess extensive experience and expertise in financial activities and in economic and monetary affairs. The Deputy Governor for Financial Stability and the Deputy Governor for Financial Supervision shall have completed a university degree in a field relevant to the position and shall possess extensive experience and expertise in financial The Governor and Deputy Governors shall be legally competent to manage their own affairs and shall have no record of deprivation of control of their estate. They must have a good reputation and may not, in connection with business operations, have been convicted of a punishable offence under the General Penal Code; acts of law on public limited companies, private limited companies, accounting, financial statements, or bankruptcy; or other special legislation applying to regulated entities.

• The Minister shall advertise available positions for the Governor and Deputy Governors in accordance with the Act on the Rights and Obligations of State Employees.

• The Minister shall appoint a three-member committee to consider the qualifications of applicants for the positions of Governor and Deputy Governor for Monetary Policy. One member shall be appointed pursuant to nomination by the Icelandic Rectors’ Conference, one shall be appointed pursuant to nomination by the Central Bank of Iceland Supervisory Board, and one, who shall chair the committee, shall be appointed without nomination.

• The Minister responsible for the economy and financial markets shall appoint a three-member committee to consider the qualifications of applicants for the positions of Deputy Governor for Financial Stability and Deputy Governor for Financial Supervision. One member shall be appointed pursuant to nomination by the Icelandic Rectors’ Conference, one shall be appointed pursuant to nomination by the Central Bank of Iceland Supervisory Board, and one, who shall chair the committee, shall be appointed without nomination.

• The Minister shall set rules on the qualifications of the committees’ members as specified in Paragraphs 6 and 7, and on the committees’ procedures.

According to work processes of CBI, an announcement is published on CBI’s website when Governors or DGs are appointed, or their appointed time is over. The same applies when managers are recruited, or they do resign.

Process for the appointment of a member of the Supervisory Board is as follows:

According to Article 6 of the CBI Act and Article 1.1 of the Rules of Procedure pertaining to the CBI Supervisory Board state that: “The Supervisory Board is elected following Parliamentary elections. The Board comprises seven representatives and an equal number of alternates who are elected by proportional vote in Parliament. It is prohibited to elect board members or employees of supervised entities, or owners of qualifying holdings in supervised entities, to sit on the Supervisory Board. The same applies to members of Parliament, alternate members of Parliament, and Cabinet ministers. Supervisory Board members shall possess sound knowledge of administration and of the statutory and regulatory instruments that apply to the Central Bank. The aim shall be to ensure that Supervisory Board members have broadbased knowledge of the Icelandic economy, the financial market, management, and commercial operations. The mandate of the Supervisory Board remains in place until a new Board is elected. If a principal member of the Supervisory Board vacates the position, an alternate shall assume this seat until Parliament has elected a new principal member for the remainder of the term of the Supervisory Board.”

The process and reasons for appointment of both the governing head (e.g., the Governor of CBI) and members of the governing body (e.g., the Supervisory Board) is clear in Act 92/2019 (as indicated above). However, the process and reasons for dismissal for the Governor or a member of the Supervisory Board is not clear in this same legislation. Other Icelandic legislation from an administrative perspective is utilized, if needed, as follows:

• Article 31(1) of the Government Employees Act no. 70/1996, states that the government authority that appoints a person to a post also relieves from such a post unless specifically stated otherwise in law. Therefore, the same Prime Minister that appoints the Governor of CBI also relieves him from his post. The Prime Minister would then have to assess whether according to the Act no. 37/1993 on Administrative Procedures, e.g., Article 41 (2) and 42, the relieve of the Governor from his post is made public.

• The Articles state that confidentiality does not include information about violations of the law or other reprehensible behavior of government employees and that anyone who works on behalf of the state is bound by a duty of confidentiality regarding information that is classified as confidential on the basis of law or other rules, or when it is otherwise necessary to keep it secret in order to protect significant public or private interests.

Assessors note that CBI or the Prime Minister would not necessarily publicly disclose the reasons for removal of the head of the banking supervisor. Although the alternative legislation (as listed above) does outline the person responsible for dismissal of a government employee, the process and reasons for dismissal of both the Governor and supervisory board members are not explicitly outlined in Act 92/2019. Assessors therefore recommend that Act 92/2019 be amended to ensure the transparency of the process and reasons for dismissal for both the Governor and members of the Supervisory Board. It is important for the public to made aware, on a timely basis, if the Governor and or member of the supervisory board has been removed from office.

EC3

The supervisor publishes its objectives and is accountable through a transparent framework for the discharge of its duties in relation to those objectives.³¹

Description and Findings re EC3

There is an annual Financial Supervision report published with the following purpose:

• to explain how FSA Iceland performs the tasks entrusted to it by law and how it followed its supervisory policy and project timetable in the previous year;

• to provide information on key priorities in FSA Iceland’s timetable for the current year;

• to explain recent and forthcoming changes in the regulatory framework for the financial market.

In publishing this report, CBI also attempts to ensure an appropriate level of transparency about FSA Iceland’s work and priorities and to foster informed discourse about the financial system.

The last Report is available here: Financial supervision_2022__.pdf (cb.is)

CBI’s accountability is demonstrated in its extensive publishing activities and reports, the statements and minutes of meetings of standing committees and regular communications with parliamentary committees, CBI’s Supervisory Board, ministers, supervisory institutions, the media and others whom CBI’s matters concern. CBI strives to be transparent, credible and responsible in its relations with all stakeholders.

For instance, the decisions of the FSA/CBI maybe made public as provided for by law (Article 9(a) of Act No. 87/1998 for example SREP results), together with explanations of their assumptions and assessment of the situation. Decisions of the FMEN are published as provided for by law and CBI’s policy on the publication of case results.

The FSN and FMEN submit a report on their work to Parliament (Althingi) once a year as provided for by law. Their reports are discussed in the parliamentary committee decided on by the Speaker of the parliament.

CBI also interacts with and has obligations towards foreign supervisory bodies, particularly in connection with EEA internal market co-operation, in which Iceland participates. Most significant among them are the European supervisory bodies in the financial market.

EC4

The supervisor has effective internal governance and communication processes that enable supervisory decisions to be taken at a level appropriate to the significance of the issue and timely decisions to be taken in the case of an emergency. The governing body is structured to avoid any real or perceived conflicts of interest.

Description and Findings re EC4

Central Bank of Iceland — organisational chart

Please see the organization structure of CBI above³².

There are several factors that could impact CBI’s internal governance and supervisory decision making processes pertaining to banking supervision and regulation. For example, the role of the FMEN in CBI/FSA’s decision making processes for the prudential supervision of banks and whether or not there is a need to deal with perceived or real conflicts of interest with government representation on FMEN and last, to ensure ongoing clarity of roles and responsibilities with CBI, a formal delegation of authority should be considered to ensure greater operational effectiveness.

Article 3 of the Act No. 92/2019 states that the Governor of CBI directs and is responsible for the Bank’s operations and is authorized to take decisions on all matters not entrusted to others by law. Furthermore, decisions entrusted to the FSA by law or Governmental directives shall be under the auspices of the FMEN (Article 15).

The Rules of Procedure of the FMEN are published on CBI’s website³³, govern the decision making process.

There are weekly meetings with the Governor of CBI, the DG of Financial Supervision as well as the directors of the supervisory divisions and the director of the General Secretariat, where matters of supervision are discussed, and decisions taken regarding the procedure. Following that (e.g., both the DG of Financial Supervision and the General Secretariat sign off on all material prior to be provided to the FMEN) the case is placed before the FMEN for a final decision, if it is a decision that is to be taken by the Committee. See organizational chart about for post-merger structure of CBI.

Please see EC2 for greater detail on the operational set up of the FMEN.

As previously stated, The FMEN takes decisions entrusted to CBI/FSA by law or Governmental directives. The Committee, if deemed appropriate, may assign to the DG for Financial Supervision its authority to take non-major decisions. The FMEN has adopted Rules of Procedure which are published on the FSA website, and they lay out which decisions are to be taken by the Committee.

Decisions of the FMEN vs. the DG for Financial Supervision.

The FMEN’s Rules of Procedure outlines what decisions the Committee can/will take. Regarding all other decisions, the authority to take decisions has been assigned to the DG for Financial Supervision. CBI/FSA has adopted Rules of Signature which accompany its Rules of Procedures that outline what decisions have been assigned to the Directors by the DG for the implementation of financial supervision of banks. The following are examples of decisions that the DG signs:

• guidelines that have been approved by the FMEN;

• decisions on periodic penalty payments in connection with regular data submission by regulated entities, as provided for in Article 11 of Act no. 87/1998 on Official Supervision of Financial Activities;

• granting of licenses to operate, other than those on which the FMEN takes decisions;

• a decision on a trading halt, prohibiting short positions, offerings or conduct that is contrary to law;

• a decision to refer to the police an indication of possible violations of laws other than those where a complaint from the FMEN is a prerequisite for an investigation;

• the results of a Supervisory Review and Evaluation Process (SREP), as provided for in Article 80 of Act no. 161/2002, on Financial Undertakings, for other than systemically important financial undertakings

The Directors, each in their respective areas of responsibility, sign, apart from the abovementioned decisions, the following decisions:

• notification of the opening of a case, such as an on-site inspection or audit;

• granting the right to object to a proposed administrative decision;

• denying parties to a case access to case data;

• notification of a conclusion of a case which includes comments and corrective actions;

• a refusal to approve rules, marketing and the like;

• approval of a prospectus;

• offers of settlement;

• notifications in connection with regular data submission, such as an annual circular;

• granting parties to a case access to case data.

In the rules there is also an article on what the Heads of units may sign, however there is lacking a formal delegation of authority with respect to which levels within the CBI may approve certain decisions, beyond the Governor’s authority and that decisions that are assigned to the FMEN with respect to banking supervision. This current structure is up for discussion/potential change (see draft bill of legislation below).

Draft Bill of Legislation

The Prime Minister’s office put forth a draft bill of legislation on the “on-line public consultation portal” ³⁴for consideration regarding the amendments on CBI Act No. 92/219 regarding FMEN. The draft bill of legislation proposes to make the following changes:

• Decisions under that Act can be made by either the Governor or FMEN

• FMEN’s decision making powers be limited to certain administrative decisions and onerous administrative decisions; Governor to make all other decisions.

• Governor will be become chair of FMEN; DG Financial Supervision will be the Vice Chair; tenor of members will be shorter, with maximum terms

Reasons provided by the Prime Minister’s office indicated that the assessment committee pointed out that CBI itself should be taking decisions in the field of financial supervision in a manner similar to other authorities, leaving FMEN to deal with the remaining tasks of an administrative nature pertaining to financial supervision, such as decisions that would principally include the application of administrative sanctions and coercive measures, such as the application of per diem fines to press for improvements and the revocation of operating licenses and registering of violations and the FSN to deal with financial stability matters.

Assessor’s Comments:

Since the merger, CBI/FSA’s operational effectiveness and overall accountability framework is somewhat weak as it has yet to develop and implement a legal delegation of authority framework which would set out what powers, duties and functions for the administration of the various banking supervision legislation, regulations, guidelines, etc. have been or should be delegated by the head of the institution (e.g., in this case the Governor) and to whom (DG, Directors, FMEN, etc.). It is noted that FMEN’s “Rules of Procedures list out certain decisions that will be passed or delegated from the FMEN and to whom. It is critical that CBI put in place, its own internal delegation of authority, beyond its internal “signatory document”, to ensure operational effectiveness is clear as decisions pertaining to prudential supervision of banks should not be unnecessarily impeded nor the level of sign off be questioned legally, especially when issues and timely decisions need to be taken in case of an emergency situation or the prompt corrective measures being utilized (e.g., dealing with a problem bank).

Further, as some members of the FMEN represent the MoFEA, and cases where their impartiality may be doubted are to be decided by the Minister, there is the potential of a real and/or perceived conflict of interest for the members that represent the MoFEA to be overseeing prudential decisions on the D-SIB, in particular when two of the D-SIBs are either state owned or have a substantial government interest in the bank. Although the MoFEA representatives have adequate qualifications to fulfill their roles, as well as appearing before a Parliamentary committee prior to appointment, having MoFEA representatives makes micro-prudential decisions from a bank “regulator” viewpoint with respect to banks lacks the necessary “independence” that a bank regulator is requ ired to have when making prudential and at times necessary decisions pertaining to safe and sound banking system. Assessors recommend that CBI, MoFEA and the Prime Minister ensure the independence of representatives to fulfill the respective roles on the FMEN.

It is acknowledged that the Minister of Finance sits on the Financial Stability Council, which is appropriate and necessary, especially in dealing with banking sector wide/ financial stability issues.

Assessors acknowledge that some of these suggested amendments would require legislative amendments to put in place. It is noted that the FMEN also currently oversees all decisions regarding all supervised entities inherited from the FME. This makes the FMEN quit laborious³⁵ (e.g., decisions pertaining to the prudential regulation of banks is carried out by a committee of peers rather than simply the bank regulator) resulting in decisions regarding banking supervision taking longer than expected resulting in delayed communication with the banks on key issues (requirements banks need to address). Further, Basel Standards require the banking supervisor to demonstrate independence when making decisions that are free from real or perceived conflicts of interest. “The supervisor has full discretion to take any supervisory actions or decisions on banks and banking groups under its supervision” (as stated in EC1 criteria). The current structure of the FMEN, CBI does not have the full discretion to take any supervisory actions or decisions on banks and banking groups under its supervision as all micro prudential decisions are taken by a majority vote of the FMEN (a group of external representatives (three members) versus CBI as the bank regulator (two members or if the Governor joins three members). CBI, as the primary regulator of banks/banking groups, should have the full (e.g., “sole”) discretion to make micro-prudential supervisory decisions on a timely basis, without consulting a committee with external representatives, as this lacks the necessary independence if such decisions are to be taken by “vote” on the FMEN.

Given the Draft Bill of Legislation has not passed Parliament, assessors comments are with respect to the current operational structure. However, if such an amendment is enacted, with the substantial shift of power, duties and responsibilities to the Governor, a formal delegation of power and decision making from the Governor to other individuals or to the Committee would be considered critical to put in place. This delegation of authorities should have been put in place beginning 2020 at the time of the merger with CBI and the former FME to ensure on-going clarity of roles and responsibilities.

EC5

The supervisor and its staff have credibility based on their professionalism and integrity. There are rules on how to avoid conflicts of interest and on the appropriate use of information obtained through work, with sanctions in place if these are not followed.

Description and Findings re EC5

Rules No. 303/2020 on Business Transactions conducted by the Governor, DGs, External Committee Members, and Employees of CBI with Supervised Entities provide appropriate measures to identify and prevent, or to address, conflicts of interest in connection with CBI employees’ business transactions with supervised entities. These rules are issued on the basis of A 5(6) of CBI Act.

CBI also has a Code of Ethics that applies to all staff. The Code of Ethics of CBI of Iceland is based on the Bank’s core values and lays down in detail the ethical principles which its employees are to adopt and be guided by in their work. Article 4 of the Code of Ethics further lays down rules on conflicts of interests.

Additionally, A 41 of CBI Act regards confidentiality requirements of CBI’s employees. The Article states that supervisory Board members; the Governor; Deputy Governors; members of the Monetary Policy Committee, FSN, and FMEN; and other employees of CBI of Iceland are obliged to observe confidentiality concerning the affairs of the Bank’s customers; transactions and operations of supervised entities, related parties, or others; and the affairs of the Bank itself; as well as other matters of which they may become aware in the course of their work and which should remain secret in accordance with law or the nature of the case, unless a judge rules that information must be disclosed in court or to law enforcement officers, or there is a legal obligation to provide the information. The same applies to experts, contractors, and others who work for or on behalf of the Bank. The obligation to observe confidentiality remains in effect after employment ceases.

According to A 41 (2) of CBI Act, prohibits Supervisory Board members; the Governor; Deputy Governors; members of the Monetary Policy Committee, FSN, and FMEN; and other employees of CBI to use, confidential information that they acquire through their employment with the Bank, including using it for financial gain or to avoid financial loss in business transactions.

A violation of CBI Act shall be punishable by fines or imprisonment for up to one year unless more severe penalties are provided for under other legislation. Attempted violations of this Act or participation in such violations shall be punishable according to the General Penal Code of Iceland, No. 19/1940.

Finally, Act No. 70/1996 on Government Employees, states the appropriate procedures for a termination of employment and other disciplinary actions applicable when a government employee violates his duties.

EC6

The supervisor has adequate resources for the conduct of effective supervision and oversight. It is financed in a manner that does not undermine its autonomy or operational independence. This includes:

• (a) a budget that provides for staff in sufficient numbers and with skills commensurate with the risk profile and systemic importance of the banks and banking groups supervised;

• (b) salary scales that allow it to attract and retain qualified staff;

• (c) the ability to commission external experts with the necessary professional skills and independence, and subject to necessary confidentiality restrictions to conduct supervisory tasks;

• (d) a budget and program for the regular training of staff;

• (e) a technology budget sufficient to equip its staff with the tools needed to supervise the banking industry and assess individual banks and banking groups; and

• (f) a travel budget that allows appropriate on-site work, effective cross-border cooperation and participation in domestic and international meetings of significant relevance (e.g., supervisory colleges).

Description and Findings re EC6

• (a) a budget that provides for staff in sufficient numbers and with skills commensurate with the risk profile and systemic importance of the banks and banking groups supervised:

CBI’s funding mechanism for the portion of budget needed to fund banking supervision for the FSA, is overly complicated (suitable for when FME operated as a separate entity), dependent upon the MoFEA to submit request for Parliamentary approval (Part A -involves remitting bank supervisory fees to the Treasury), and differs substantially from the funding of CBI (Part C not subject to a fiscal authority or for example, CBI’s income and expenses are excluded from government revenue and expenditure.). This current funding mechanism could undermine CBI’s ability to adequate fund banking resources on a timely basis. A remedy (e.g., change the funding mechanism of banking supervision to Part C to align with CBI’s overall funding mechanism) is needed to ensure CBI, as the banking supervisory authority, has the necessary operational independence and autonomy to ensure it has adequate resourcing to deliver on its mandate as the banking supervisory authority. See comments by the Assessors at the end of this EC for additional information.

Further background information includes:

According to Art. 1-3 of Act No. 99/1999 on Payment of Cost for Official Supervision of Financial Activities and Resolution Authority, supervised entities and other parties subject to fees shall pay the cost for Official Supervision of Financial Activities in accordance with the provisions of the Act. CBI collects the supervision fee from the supervised entities. The supervision fee is defined as state revenue and is returned to the Treasury. The MoFEA shall, based on a fund appropriation in the budget, determine the allocation of funds for the operation of the FSA which amounts to at least the budget’s estimate of revenue from supervisory fees and payments for special measures under the Act. CBI shall, in its accounting, ensure the financial separation of the official supervision of financial activities from other activities of the Bank and revenues from financial supervision shall only be used to finance the official supervision of financial activities.

The Act states also that CBI shall, no later than 1 February each year, submit a report to the MFEA on the estimated operational cost of the FSA for the next year. The report shall, furthermore, assess the development of the FSA’s operations over the next three years, having regard for the time which can be estimated to have been spent on the different classes of parties subject to Article 5. The report of CBI shall be accompanied by an opinion from the Consultative Committee of supervised entities concerning the estimated scope of the operations of the FSA for the coming year together with the reaction of the FMEN (the FMEN also discusses the report itself) on the opinion. If the conclusion of the report gives reason to change the percentage rate of the supervision fee, the MoFEA shall submit a bill there upon to the Althingi (Parliament).

If the FSA appears likely to have an operating surplus or loss for the current year, when the report for the next year is prepared, it shall be taken into consideration in determining the supervision fee for the following year.

CBI Act provides for the Bank’s independence in Article 1 of the Act. Act on Public Finances no. 123/2015 (point 3. Para. 1 Art. 50) that states that the activities of CBI shall be included in Part C of the State budget together with companies’ majority owned by the state. This classification in the State budget means that CBI is not subject to the state’s fiscal authority, e.g., the bank’s income and expenses are excluded from government revenue and expenditure.

CBI/FSA, however, falls under Part A of the State budget where the supervision fee is defined as state revenue and the fee is returned to the Treasury and its disposal is subject to the Minister’s budget based on budget appropriations. CBI stated that it may not maintain its status as an independent entity in accordance with CBI Act given the Part A funding for the FSA. Further, CBI has also stated that its financial independence may have been reduced as CBI does not have the legal authority, according to Act No. 99/1999, to reserve funds for the operation of FSA functions, including banking, should there be a sudden need for an increase in banking supervisory resources occur (e.g., before the parliamentary budget cycle). In this regard it should be noted that CBI is not allowed to lend money to the “state” according to Article 26 of CBI Act and can therefore not assist its own operations of CBI/FSA run out of funding for supervision mid cycle.

If a state entity, like the CBI, does exceed its spending caps defined by the Parliament to fund expenditures that are temporary, unforeseeable and unavoidable, the MoFEA has indicated that the Organic Budget Law does provide for different options for securing the necessary appropriation, such as: a) the Minister of MoFEA can authorize a transfer of necessary appropriations from the General Contingency Reserve or b) necessary appropriations can be authorized by Parliament in the Supplementary Budget.

Further, it is possible that remaining deficit can be deducted from the following year’s budget appropriation. If necessary, the following year’s appropriation can be adjusted to cover any such deficit through the adjustment of the Supervision Fee charged to banks for the subsequent year.

Assessors however are of the view that although there is an ability to adjust the “budget appropriation” mechanism and that this process has been in place for the past 20 years regarding the operation of the FSA, that it is important for the CBI to have the ability to fund/finance banking supervision resources in a manner that does not undermine its autonomy (e.g., self-sufficiency) or operational independence. This suggestion is related to the “funding” of banking supervision, not additional liquidity needs or the “printing of money” (as per Article 29 of the CBI Act). The current process to finance banking supervision is cumbersome and overly complicated and not unlike other Central Banks, who also have the responsibility of banking supervision, the funding of the resources for banking supervision should form part of the overall budget for the Central Bank (e.g., in this case Part C for CBI). This suggestion comes with the obvious accountabilities that CBI should have in reporting to parliament against its funding/resource objectives/responsibilities.

(b) salary scales that allow it to attract and retain qualified staff;

CBI participates regularly in a market comparison for salaries. The findings show that specialists undertaking FSA tasks receive salaries that are comparable to the financial market. Managers of the FSA, however, receive comparably lower salaries than managers at the same level in the financial market.

Article 5 (1-3) of Act No. 92/2019 states the Governor’s and the DG’s remuneration. The Governor’s salary shall be 1,936,202 ISK. per month and the DG’s salary shall be 1,742,581 ISK. per month. The salaries shall change each year on 1 July. Before 1 June, Statistics Iceland calculates and publishes the percentage change in Government employees’ average regular salary for the following calendar year.

CBI adheres to an equal rights policy in accordance with the Act on Gender Equality, no. 150/2020, and the Act on Equal Treatment in the Labor Market, no. 86/2018. In March 2021, the Bank renewed its equal rights policy, which states, among other things, that employees shall be treated equally in terms of hiring and professional advancement. CBI’s equal pay policy was approved during the year 2021. According to the policy, all employees shall receive equal pay and enjoy equal terms of employment and rights for the same jobs or jobs of equal value, so that there is no gender-based pay gap within the Bank. The Bank’s equal pay certification was renewed in the autumn. For the second year in a row, an equal pay analysis showed that there was no unexplained wage gap between the sexes at the time.

In addition, the Bank adheres to a special transportation policy that encourages employees to use eco-friendly, economical, and healthy modes of transport and supports them in that endeavor. At the end of 2021, a total of 86 transportation agreements between employees and the Bank were in effect.

• (c) the ability to commission external experts with the necessary professional skills and independence, and subject to necessary confidentiality restrictions to conduct supervisory tasks;

CBI can hire outside experts to work on extraordinary projects, or to deal with special situations and has done so in various project in recent years.

According to Article 9 (2) of Act no. 89/1998 the FSA may appoint an expert to investigate certain aspects of the activities or operations of a supervised entity, or to undertake other specific supervision of such an entity. The expert shall be appointed for a specified period of no longer than four weeks at a time. The expert shall be provided with working facilities on the premises of the supervised entity and given access to all requested accounts, minutes, documents and other material kept by the supervised entity. The expert shall be entitled to attend meetings of the Board of the supervised entity as an observer with the right to speak. The expert’s obligation of confidentiality shall be as provided for in Chapter IV of the Act.

(d) a budget and program for the regular training of staff:

CBI annually uses about 3.5 percent of salary and salary-related expenditure, for educational purposes. The Bank has issued a strategy on staff training. The training includes different methods for regular training such as in-house knowledge sharing, training opportunities both locally and abroad. Furthermore, the use of on-line training has increased. A career plan is discussed for each employee in an annual performance interview, however there is no structured general career path for supervisors.

During the year 2021, the Bank’s senior officers received management training aimed at strengthening the management team and formulating the Bank’s vision and values in the wake of the merger between the Bank and the FSA in 2020.

All supervisors have access to the BIS’s e-learning platform, FSI connect. New supervisors follow defined learning paths for bank risks, BCP, risk-based supervision etc., others use the platform and specific modules when needed and for revision. However, given the extensive roll-out of the EU legislation, financial supervisors as well as risk specialists should be afforded specialized training to ensure adequate transfer of knowledge.

Regular performance reviews and feedback conversations aim to capture specific learning needs for each individual, based on their supervision and project plan. It can be challenging to find appropriate learning opportunities for such specific training, but conferences and events organized by EBA, Bank of England, BIS, ECB, Florence School of Banking and Finance etc. have been useful. During Covid-19, most events were also available on-line, allowing more supervisors to attend since on-line events are both cheaper and less time consuming than on-site ones.

Each manager has an ample budget for employees training and makes decisions about what events or conferences supervisors attend according to their training needs and the FSA’s supervision plan.

• (e) a technology budget sufficient to equip its staff with the tools needed to supervise the banking industry and assess individual banks and banking groups; and

CBI is equipped internally with hardware (servers, clients, and network infrastructure) for all daily operations of Financial Supervision and the budget is sufficient to maintain necessary databases and analysis tools for the supervision.

• (f) a travel budget that allows appropriate on-site work, effective cross-border cooperation and participation in domestic and international meetings of significant relevance (e.g., supervisory colleges).

Most supervised entities are located in the capital area. The required travelling budget for on-site work in Iceland is therefore low. Cross-border cooperation for overseas operations of supervised entities is very limited. CBI participates in international meetings, especially within the EEA i.e., EBA, ESMA and EIOPA meetings. The travel budget covers the cost for all domestic and international cooperation and meetings.

Assessor’s Comments:

The function of banking supervision is complicated somewhat as it is spread out amongst three departments as follows (see table below). Assessors noted areas of key person risk (Op Risk (ICT/Cyber); Market Risk/IRRB) wherein additional risk expertise is needed. Further, although the Banking Department is approved for 23 FTEs, it was noted that only 18 are currently staffed. There was discussion of turnover regarding banking financial supervisors overseeing the DSIBs further to the merger of the FSA/CBI leaving the largest DBIS without a lead supervisor. CBI needs to assess whether overall banking structure as well as key risk areas are adequate to support its mandate.

EC7

As part of their annual resource planning exercise, supervisors regularly take stock of existing skills and projected requirements over the short- and medium-term, taking into account relevant emerging supervisory practices. Supervisor’s review and implement measures to bridge any gaps in numbers and/or skill sets identified.

Description and Findings re EC7

As a part of the annual supervisory planning process, particularly when deciding on onsite and off-site inspections, directors allocate their resources based on the skillset of current employees. If a need for a specific skillset or extra resources emerges during the planning process action is taken to address the issue involving the human resources department and the Governor.

As a part of the annual budget planning directors are asked to plan resources for the next 3-5 years. This resource planning is based on the medium-term supervisory strategy and priorities in addition to the regular on-going supervisory tasks. The largest part of the budget cost is staffing. Directors are involved in the budget planning. Budget planning is thus closely tied with changes in legislation and needed staff, based on risk assessment and supervisory priorities. If Directors believe they need more staff, they need to have a bilateral discussion with the Governor and send a memo to him and the Director of Human Resources. The Governor takes a decision on new hires.

Further, HR and finance meet with every manager annually, to re-evaluate the resources needed (e.g., manpower, training budget and IT) to fulfil the supervisory planning. The HR manager and manager of operations then meets with the DG of Financial Supervision in October/November each year to go through and discuss the whole budget plan. The budget plan is then introduced to the Supervisory Board of CBI and accepted if there are no comments. The basic rule for the 3-5 years plan is to estimate 5 to7 percent budget increase. If annual meetings with managers reveal change in projects or plan, the plan is updated accordingly.

Assessors recommend that the overall supervisory plan, should first be established to ensure that adequate coverage, especially for the DSIBs, of the material or key risks are covered/assessed on a multi-year risk-based cycle. Given that the supervisory function is spread out between three different departments within CBI, it is critical that the managers work together and present a joint request to the Governor and not necessarily on a bilateral basis. Then resource needs should be discussed and agreed. Added considerations such as how the supervision program should be tweaked/changed based on emerging risk issues is best discussion first with the three department managers together.

Given the extensive roll-out of the EU legislation, financial supervisors as well as risk specialists should be afforded specialized training. In addition, the Supervisory Handbook needs to be updated to reflect these new and extensive set of guidelines.

See EC 6 for a deeper discussion on key person risk issues, level of vacancies and turnover that has occurred since the merger of CBI/FSA. Assessors recommend a more holistic approach is needed by the managers as a group, working with the HR specialists, to ensure resourcing, skills development and overall supervisory planning is effective to deliver on the mandate of banking supervision.

EC8

In determining supervisory programmes and allocating resources, supervisors take into account the risk profile and systemic importance of individual banks and banking groups, and the different mitigation approaches available.

Description and Findings re EC8

In line with the EBA SREP guidelines and CBI/FSA’s supervisory methodology for a high impact bank (categorized as a DSIB), and according to the Minimum Engagement Model, CBI/FSA, substantially more resources are allocated to the DSIBs rather than to the low or medium low impact banks (e.g., 4^th Commercial bank and the 4 savings banks).

For high impact banks (D-SIBs), CBI/FSA undertakes an annual SREP assessment, with a deep dive on ICAAP/ILAAP, Business Model Analysis (BMA) together with several on-site examinations covering various topics of concern. There are two financial supervisors assigned to each of the DSIBs and two financial supervisors who oversee 5 savings banks (one of these banks has an issued license but it is not operational yet). DSIB banks had approximately eight on-site examinations over the past 5 years; savings banks had one.

The low to medium low impact banks are allocated less supervisory time and resources as the minimum engagement model does not call for the same depth of supervisory assessment (e.g., ICAAP/ILAAP carried out every two years) and are not afforded the same kind of attention or review based on the minimum engagement model that is in place.

For example, CBI/FSA does not necessarily have to engage key control function representatives of the banks along the same frequency).

Supervisory tasks based on the outcome of the risk assessment are scheduled to mitigate the risk identified using the most appropriate measures available (off-site or on-site inspections, follow-up meetings etc.) Note that banks with higher risk profiles are allocated additional resources when needed in accordance with CBI/FSA’s SREP methodology.

See CP8 EC1 for more details on the overview of CBI/FSA’s SREP program.

EC9

Laws provide protection to the supervisor and its staff against lawsuits for actions taken and/or omissions made while discharging their duties in good faith. The supervisor and its staff are adequately protected against the costs of defending their actions and/or omissions made while discharging their duties in good faith.

Description and Findings re EC9

The legal protection for supervisors is not addressed in legislation. In Iceland, there is a well-established “rule of employers’ liability” based on case law by the Icelandic Supreme Court in the mid-1930s. The rule provides that an employer can be liable for damage caused by his employee’s negligent action in the course of the employment. Such strict liability for the employer means that his liability is independent from any culpa on his behalf. If the employee has acted outside his normal scope of conduct, the employer may not be liable for the employee’s actions.

A contract for employment is a prerequisite for the application of the employers’ liability rule and that the employee is acting under the actual instruction, supervision and control of the employer. According to Article 23 of the Tort Act, an employer’s claim for recourse for damages paid as a result of the employee’s negligent conduct is limited to what is considered reasonable, taking account of the employee’s position and degree of negligence, based upon the circumstances of the case. The same rule applies for claims against an employee for loss caused by him in the course of his employment. Further, an employee may benefit from the general rule of reduction or exemption from liability in cases where it is deemed reasonable depending on the circumstances, taking account of the interests of the claimant. The rule of employer’s liability for the employees’ negligence can be applied to the public sector as well as the private sector. It covers liability for loss or damage caused by negligent conduct of employees of the state, municipalities and public institutions in the course of their employment.

Assessors recommend that the legislation be changed to provide protection to the supervisor and its staff against lawsuits for actions taken and/or omissions made while discharging their duties in good faith. The supervisor and its staff need to have adequate protection against the costs of defending their actions and/or omissions made while discharging their duties in good faith.

Assessment of Principle 2

Materially Non-Compliant

Comments

Basel requires that “The supervisor has full discretion to take any supervisory actions or decisions on banks and banking groups under its supervision”. The workings of the FMEN appear very laborious resulting in decisions regarding banking supervision taking longer than expected resulting in delayed communication with the banks on key issues (requirements banks need to address). With the current structure of the FMEN, CBI does not have the full discretion to take supervisory actions or decisions on banks and banking groups under its supervision on a timely basis and without the interference/vote of the FMEN.

Further, as the FMEN has representatives from the MoFEA, there is the potential of a real and/or perceived conflict of interest for the members that represent the MoFEA to be overseeing prudential decisions on banks, in particular when three of the D-SIBs are either state owned or have a substantial government interest. Assessors recommend the independence of FMEN members should be ensured as there should be no government or industry interference that compromises the operational independence of the supervisor.

Since the merger, CBI/FSA’s operational effectiveness and overall accountability framework is somewhat weak as it has yet to develop and implement a legal delegation of authority framework which would set out what powers, duties and functions for the administration of the various banking supervision legislation, regulations, guidelines, etc. have been or should be delegated by the head of the institution (e.g., in this case the Governor) and to whom (DG, Directors, FMEN, etc.). Therefore, it is critical that CBI put in place its own internal formal delegation of authority to ensure operational effectiveness is clear, as decisions pertaining to the prudential supervision of banks should not be unnecessarily impeded nor the level of sign off be questioned legally, especially when issues and timely decisions need to be taken in case of an emergency situation or the prompt corrective measures being utilized (e.g., dealing with a problem bank).

The CBI Act needs to be amended to clearly indicate the process and reasons for dismissal of the Governor and/or a member of the supervisory Board as there is a lack of clarity/transparency in the alternative legislation for the dismissal of a government employee. Further, the Act should be amended to provide protection to the supervisor and its staff against lawsuits for actions taken and/or omissions made while discharging their duties in good faith.

Last, CBI’s current funding mechanism needs to be changed to ensure that it has an adequate ability to fund banking resources on a timely basis. CBI also needs to reassess its current banking staff complement to ensure that it is adequately staffed to effectively deliver on its mandate of banking supervision.

Principle 3

Cooperation and Collaboration

Laws, regulations or other arrangements provide a framework for cooperation and collaboration with relevant domestic authorities and foreign supervisors. These arrangements reflect the need to protect confidential information.³⁷

Essential Criteria

EC1

Arrangements, formal or informal, are in place for cooperation, including analysis and sharing of information, and undertaking collaborative work, with all domestic authorities with responsibility for the safety and soundness of banks, other financial institutions and/or the stability of the financial system. There is evidence that these arrangements work in practice, where necessary.

Description and Findings re EC1

The cooperation framework with domestic authorities responsible for the safety and soundness of banks has been made more simple to manage since January 1, 2020 when all tasks of the Financial Supervisory Authority (FSA - FME in Icelandic) were transferred to CBI of Iceland (CBI), by Act No. 92/2019 on CBI of Iceland (so-called CBI Act), article 47: https://www.cb.is/library/Skraarsafn---EN/Central-Bank/Central Bank Act 92 2019. The FSA is now embedded into CBI. Though the term “FSA” has been maintained in applicable legislation, the FSA does not legally exist as an official authority in charge of financial supervision anymore. Yet the term “FSA” continues to be used in practice. The CBI (referred to as “CBI/FSA” in this report) is now the prudential supervisor as well as the supervisor of conduct of business.

Based on this institutional framework, internal cooperation and external cooperation are both relevant for CBI.

1°/ Internal cooperation

The merging of the two authorities (CBI and FSA) was effective as of January 1, 2020. It has resulted in increased efficiency of financial supervision, resulting from better and more transparent flows of information, greater possibilities for analytical work, additional synergies, and a clearer division of power internally when it comes to making decisions regarding financial supervision. In all, integration of the FSA into CBI has enhanced internal cooperation on banking supervision.

Internal cooperation within CBI is formally structured around the FSN (FSC) and the FMEN (FMEN). Act No. 92/2019 on CBI defines respective roles and responsibilities of the FSN (Chapter IV) and the FMEN (Chapter V). CBI departments supporting CBI committees (at the time of the mission, they were: Financial Stability Department, Banking Department, Compliance and Inspections Department) cooperate among themselves on a daily basis through regular supervisory processes.

In addition, public rules of procedures are disclosed for each committee: (i) https://www.cb.is/library/Skraarsafn---EN/FinancialStability/FSC/FSC Rules of Procedures.pdf for the FSN; and (ii) https://www.cb.is/library/Skraarsafn---EN/Financial-Supervision-Committee/Rules Of Procedure FinancialSupervision Committee.pdf for the FMEN.

Tasks of the FSN are specified in Act No. 92/2019 (article 13), while tasks of the FMEN are not specified as such in a dedicated article. Yet the mandate of the FMEN is made clear through articles 13 and 15.

Article 13 mentions that:

“The tasks of the FSN are to:

a) Assess the current situation of and outlook for the financial system, systemic risk, and financial stability.

b) Discuss and define the actions deemed necessary at any given time in order to affect the financial system so as to strengthen and preserve financial stability, and to this end, direct comments to the appropriate Governmental authorities when warranted.

c) Approve Governmental directives and take the decisions entrusted to the Committee by law.

d) Decide which supervised entities, infrastructure, and markets shall be considered systemically important and of a nature that their activities could affect financial stability.” Article 15 mentions that:

“The FMEN shall take decisions entrusted to the Financial Supervisory Authority by law or Governmental directives.”

In practice, the FSN has adopted an extensive scope of duties that goes beyond financial stability and covers topics pertaining to microprudential supervision that would intuitively fall into the scope of the FMEN, based on usual practices observed among foreign banking supervision authorities. The rationale of such extensive scope may be explained by the systemic importance of major banks.

The main illustration of joint involvement of both FSN and FMEN is microprudential supervision of liquidity risk of the three domestic systemically important banks (D-SIBs):

• - close monitoring of the liquidity situation and LCR/NSFR prudential ratios of major banks (that is, most of the banking system) is performed directly by macroprudential supervisors within the Financial Stability Department of CBI, reporting to the FSN;

• - besides, the Financial Supervision Department of CBI, reporting to the FMEN, supervises liquidity and funding risks of all banks, including D-SIBs, notably by implementing the supervisory review and evaluation process (SREP). Nonetheless, the FMEN is the main decision-making body on behalf of the FSA on banking supervision matters, with delegations to the Deputy Governor for Financial Supervision (see CP2 for details on the decision-making framework).

Documentation and information provided during the mission have demonstrated a close monitoring of major banks’ liquidity and have not highlighted any evidence of poor internal cooperation nor significant gap resulting from such a segregation of duties within CBI regarding the supervision of liquidity risk. Yet, from an organizational working perspective, it would make sense that microprudential banking supervisors cover the whole range of risk domains and supervisory tasks, including liquidity risk (a major risk domain indeed), to have full control of the implementation of prudential regulations the supervision of which the FSA is legally in charge.

2°/ External cooperation

At national level, CBI is an active member of the Financial Stability Council (FSC): https://www.government.is/topics/economic-affairs-and-public-finances/financial-stability-council/. The FSC assesses the effectiveness of macroprudential policy tools. Based on CBI staff’s propositions, the FSN of CBI has the power to decide macroprudential measures applicable to banks aimed at ensuring financial stability which may impact banking supervision. The FSN is competent for setting the countercyclical capital buffer (CCyB), limits on mortgage loans, and other policy measures including the bank liquidity coverage ratio in national currency (ISK) and foreign currencies, as well as bank funding ratios in foreign currencies.

At national level, CBI is cooperating with the Ministry of Finance and Economic Affairs (MoFEA) on banking supervision matters.

• - CBI has no power to initiate any legislative proposals, but only to issue application regulations or rules that are explicitly authorized by laws, mostly on EBA regulatory technical standards (RTS). CBI cooperates with MoFEA in charge of preparing draft legislation.

• - The MoFEA has usual competence in budget management, which may impact CBI. The MoFEA submits a budget proposal to Parliament in accordance with the Public Finance Act which Parliament can (and usually does) amend. Budgetary allocations to CBI are determined in accordance with the Act on the Payment of Costs for Public Supervision of Financial Activities and are not at the Minister’s discretion.

• - CBI, though “an independent institution”, “is operating under the auspices of the Minister” (Act No. 92/2019 on CBI, article1). According to Icelandic administrative law, if a State institution is declared to be independent by law this entails that the relevant minister is entrusted with monitoring the general operations, finances and assets of the institution, but may not instruct the institution on procedures or decisions relating to individual cases (Article 14, Para 2, of the Act on the Government Offices of Iceland). The phrase “is operating under the auspices of the Minister” in the CBI Act is intended to draw attention to this general duty of the Prime Minister and not to infringe upon the CBI’s independence concerning procedures or decisions relating to individual cases. Comparable phrases are standard in Icelandic laws concerning independent institutions.

• - Cooperation between CBI and the MoFEA on banking supervision matters is made on an informal basis. There is no formal cooperation agreement. Both authorities meet regularly to discuss topics of common interest regarding banking regulation.

A MoU on cooperation regarding actions against money laundering, terrorist financing, and proliferation financing of weapons of mass destruction has been signed between the Ministry for Foreign Affairs, the Iceland Revenue and Customs, and CBI of Iceland in 2020, under review in 2022.

EC2

Arrangements, formal or informal, are in place for cooperation, including analysis and sharing of information, and undertaking collaborative work, with relevant foreign supervisors of banks and banking groups. There is evidence that these arrangements work in practice, where necessary.

Description and Findings re EC2

A structured cooperation framework is in place between CBI and foreign supervisory authorities both (i) on a bilateral basis, and (ii) for multilateral cooperation.

CBI has the legal power to engage into bilateral and multilateral cooperation in banking supervision, notably for the purpose of consolidated supervision of banking groups, as stated by Act No. 87/1998 on Official Supervision of Financial Activities, articles 14 and following (https://www.cb.is/library/Skraarsafn---EN/Laws/Act%20No.%2087%201998%20on%20Official%20Supervision%20of%20Financial%20Activites.pdf), as well as by Act No. 161/2002 on Financial Undertakings (that is, the so-called banking law), inter alia articles 109 and following (https://www.cb.is/library/Skraarsafn---EN/Laws/Act%20No.%20161%202002%20on%20Financial%20Undertakings.pdf). International cooperation of CBI applies within the Euro Economic Area (EEA) which Iceland is a member of, and beyond the EEA.

1°/ Bilateral cooperation

The need is quite low for bilateral cooperation between CBI and foreign banking supervision authorities for the purpose of consolidated supervision of banking groups, because (i) there are no foreign banks operating branches or subsidiaries in Iceland; and (ii) there is a very limited number of Icelandic banks with cross-border establishments (no bank branch is licensed abroad, and only one subsidiary of a non-major bank has recently been licensed in the United Kingdom).

In the past, CBI had signed several of bilateral cooperation agreements with foreign banking supervision authorities, in the form of memoranda of understanding (MoUs), which purpose was mostly to facilitate information sharing on Icelandic banks’ shareholders that were incorporated as legal entities in foreign jurisdictions. These MoUs are still valid, though barely used in practice for banking supervision.

The list of bilateral MoUs is not disclosed on CBI’s website (source: CBI):

• - Within the EEA

  • MoU between FME and Latvia and exchange of confidential information (2001).

  • MoU with Isle of Man, UK (2006).

  • MoU with Jersey Financial Services Commission, UK (2013).

  • Supervisory cooperation MoU between FME, the Bank of England (PRA), and the Financial Conduct Authority (FCA), UK (2019).

• - Out of the EEA

  • MoU between the Financial Supervisory Authority (FME) and the Cayman Island Monetary Authority - CIMA (2017).

  • MoU with the China Banking Regulatory Commission (2007).

  • MoU with the Dubai Financial Services Authority (2007).

  • MoU with British Virgin Islands, UK (2010).

Many jurisdictions of this list are international financial centers, or offshore financial centers, with which international cooperation may potentially be challenging for consolidated banking supervision, supervision of parent companies of regulated banks, or AML/CFT, given the intrinsic nature of these centers. CBI has not reported any issue regarding effective cooperation from such jurisdictions on requests asked by CBI (very low need, in practice).

2°/ Multilateral cooperation

CBI is much more concretely engaged into multilateral cooperation with foreign authorities involved in banking supervision, especially Nordic countries, and EEA/EU countries and institutions.

The list of multilateral MoUs is not disclosed on CBI’s website (source: CBI):

• MoU with Nordic countries (2000).

• EU/EEA MoU on cross-border financial stability (2010).

• Memorandum of Understanding on cooperation between Financial Supervisory Authorities, Central Banks and Finance Ministries of the European Union on cross-border financial stability (2008), with an extension in 2010 to non-EU EEA countries (Iceland, Lichtenstein, and Norway).

• European Central Bank accession to MoU on prudential supervision of significant branches in Sweden, Norway, Denmark, Finland, Iceland, Estonia, Latvia, Lithuania (2017).

• Memorandum of Understanding on cooperation and coordination on crossborder financial stability between relevant Ministries, Central Banks, Financial Supervisory Authorities and Resolution Authorities of Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway, and Sweden (2018).

• Multilateral agreement on the practical modalities for exchange of information pursuant to article 57a (2) of EU directive No. 2015/849 concluded between European Central Bank and Competent Authorities (2019).

• Administrative arrangement for the transfer of personal data between each EEA authority set out in appendix A and each of the non-EEA authorities set out in appendix B (Appendix A signed 2019).

• Memorandum of Understanding of the Nordic-Baltic AML/CFT Working group (2020).

• MoU on cooperation regarding BIS Innovation Hub Nordic Centre between central banks of Denmark, Iceland, Norway, and Sweden (2021).

• Cooperation Agreement for WUPSIL AML College (2022).

• Memorandum of Understanding on cooperation regarding banks with cross-border establishments between central banks of Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway, and Sweden (2022).

Regarding multilateral cooperation, interaction between CBI and foreign regulators mostly focuses on coordinated development of supervisory policies and regulations, and development of best supervisory practices in Iceland.

CBI is an observer in the European Securities and Markets Authority (ESMA), the European Banking Authority (EBA), and the European Insurance and Occupational Pensions Authority (EIOPA). CBI is also a member of a European Free Trade Association (EFTA) working group on financial services. In addition, CBI takes part in regular cooperation with regulators of Nordic countries on various issues concerning developments in financial activities and harmonization of supervision.

Iceland has implemented EU CRD/CRR, and further amendments to them, relating to the taking up and pursuit of the business of credit institutions. The EU Directive lays down rules regarding information requests between competent authorities in member States.

EC3

The supervisor may provide confidential information to another domestic authority or foreign supervisor but must take reasonable steps to determine that any confidential information so released will be used only for bank-specific or system-wide supervisory purposes and will be treated as confidential by the receiving party.

Description and Findings re EC3

Icelandic law ensures explicit protection of confidentiality of sensitive information foreign authorities are provided with by CBI for the purpose of banking supervision.

According to Act No. 87/1998, article 14, CBI of Iceland may disclose information, which is to be treated confidentially in accordance with CBI Act, article 41, to supervisory authorities of other EEA Member States, provided that this constitutes an act of cooperation between those States involving supervision of the activities of parties subject to supervision, and furthermore that such an exchange of information is beneficial for conducting such supervision as prescribed by law. Such information can only be disclosed on the condition that it is subject to the obligation of secrecy in the State concerned.

According to Act No. 87/1998, article 14, agreements may also be made with supervisory authorities in countries outside the EEA for the purpose of exchange of information, under the condition that the obligation to observe secrecy applies.

Also, according to Act No. 87/1998, article 14, CBI may provide regulatory authorities of other EEA member States with confidential information as provided for in CBI Act, article 41, if such disclosure is part of cooperation between States in the supervision of activities of regulated entities and such disclosure is useful in permitting the conduct of the supervision prescribed by law. Such information may only be disclosed on the condition that it is subject to obligation of confidentiality in the State concerned.

On July 1, 2022, a new article was added to Act No. 161/2002 regarding sharing of information and collaboration with other authorities. Article 109(aa) grants CBI permission to provide confidential information to other authorities within the EEA, granted that the receiving authority has equivalent confidentiality rules regarding such information. This new article allows for CBI to provide information (with the forementioned conditions) to institutions of the European Free Trading Area (EFTA) and other financial supervisory authorities within the EEA (EU, plus Iceland, Liechtenstein, and Norway), in charge of supervision of financial undertakings, security trading undertakings, and payment services undertakings. It also allows for information exchange with authorities dealing with monetary policies as well as AML/CFT authorities.

Information subject to obligation of confidentiality in accordance with special legislation or other legislation shall be subject to similar obligation of confidentiality after being delivered to CBI.

MoUs signed by CBI include a clause of protection of confidential information shared with foreign authorities.

EC4

The supervisor receiving confidential information from other supervisors uses the confidential information for bank-specific or system-wide supervisory purposes only. The supervisor does not disclose confidential information received to third parties without the permission of the supervisor providing the information and is able to deny any demand (other than a court order or mandate from a legislative body) for confidential information in its possession. In the event that the supervisor is legally compelled to disclose confidential information it has received from another supervisor, the supervisor promptly notifies the originating supervisor, indicating what information it is compelled to release and the circumstances surrounding the release. Where consent to passing on confidential information is not given, the supervisor uses all reasonable means to resist such a demand or protect the confidentiality of the information.

Description and Findings re EC4

In addition to developments under CP3 EC3, Icelandic law also ensures explicit protection of confidentiality of sensitive information received by CBI from foreign authorities for the purpose of banking supervision, according to Act No. 161/2002, Article 109(aa), Para 5.

The obligation to observe secrecy according to CBI Act, article 41, applies to comparable information received by CBI from supervisory authorities of other EEA member States.

MoUs signed by CBI include a clause of protection of confidential information received.

CBI has not faced any situation in which disclosure of confidential information received from a foreign authority in application of cooperation arrangements was requested by an order of a national court or Parliament.

EC5

Processes are in place for the supervisor to support resolution authorities (e.g., central banks and finance ministries as appropriate) to undertake recovery and resolution planning and actions.

Description and findings re EC5

Cooperation with national authorities in charge of banking resolution has been facilitated by setting up an official resolution authority integrated within CBI in September 2020, using a similar institutional approach as for the Financial Supervisory Authority regarding banking supervision in January 2020 (except that decisions of the RA are made by the CBI Governor while major decisions of the FSA are made by the FMEN). The Resolution Authority has a specific legal framework, that is Act No. 70/2020: https://www.cb.is/library/Skraarsafn---EN/Laws/Act%20No.%2070%202020%20on%20Resolution%20of%20Credit%20Insitutions%20and%20Investment%20Firms.pdf. Leveraging on this integrated institutional framework, CBI legally and operationally ensures coordination between inner authorities in charge of banking supervision (the FSA) and banking resolution (the Resolution Authority).

During the first two years of operation of the Resolution Authority, CBI banking supervisors have supported the Resolution Authority in order to complete resolution plans for banks. The Resolution Authority is provided with information on SREP outcomes and Pillar 2 decisions directly from the Financial Supervision department, which the Resolution Authority uses for making MREL decisions. Both authorities use integrated channels in order to collect data from banks. Processes are in place for this support. Moreover, both the FSA and the Resolution Authority are developing integrated operational guidance serving as a manual for how CBI will deal with the deteriorating financial situation of a bank unto its failure (under progress).

In Iceland, neither the Resolution Authority nor the FSA undertakes recovery planning. Banks make their own recovery plans. However, both the Resolution Authority and the FSA review these plans in order to assess resolvability, to prepare resolution plans (Resolution Authority), and to assess timely intervention (FSA).

Assessment of Principle 3

Compliant

Comments

Cooperation and collaboration are not critical for Iceland, given that the banking system is largely domestic-oriented, and cross-border banking activities through entities are very limited in both ways.

Even so, cooperation arrangements have been developed by CBI of Iceland for banking supervision. CBI has signed bilateral MoUs, which are not much used in practice, because there is no need.

CBI is quite more engaged into multilateral cooperation; notably with Nordic countries, to share global information and best practices.

At domestic level, CBI is part of a national cooperation arrangement for AML/CFT, and it maintains continuous interaction with the Ministry of Finance and Economic Affairs (MoFEA) informally.

Confidentiality of information shared through cooperation arrangements is ensured.

No main finding has been identified.

Principle 4

Permissible activities

The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined and the use of the word “bank” in names is controlled.

Essential Criteria

EC1

The term “bank” is clearly defined in laws or regulations.

Description and Findings re EC1

The term “credit institution” is defined in Act No. 161/2002 on Financial Undertakings, article 1(b) item 2 (glossary), as “an undertaking that operates by accepting deposits or other repayable funds from the public and provides loans for its own account”. The term “credit institution” is used in the Icelandic law referring to the EU framework (CRD) which uses this definition of “credit institution” that is broader than “bank”.

Thus, the term “bank” is not explicitly defined in the glossary of the law. Yet that does not create any ambiguity, because a definition of a “bank” may indirectly result from Act No. 161/2002, article 12: “Only credit institutions may use in their firm name or as clarification of their activities the words “credit institution”, “bank”, “commercial bank”, “investment bank”, “savings bank” and “credit undertaking” either alone or linked to other words, in accordance with their operating license.” In addition, article 4 specifies the various kinds of financial undertakings that are included in the legal definition of “credit institution”: “A credit institution can obtain an operating license as a commercial bank, savings bank or credit undertaking.” Therefore, banks are a category of credit institutions, including two sub-categories: commercial banks (to which major banks belong), and savings banks.

Ideally, the law should explicitly and directly define the term “bank”, as well as “commercial bank” and “savings bank”, for example in article 1(b) on definitions. But it is clear in the law that banks are credit institutions which are regulated and supervised as such by CBI.

EC2

The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined either by supervisors, or in laws or regulations.

Description and Findings re EC2

The definition of permissible activities of credit institutions (among which “banks”, as derived from CP4 EC1) is mentioned in Act No. 161/2002, article 3 on activities subject to operating licenses, and Chapter IV on authorized activities. The Icelandic definition of permissible activities refers to the EU framework (CRD).

Article 3 states that:

“Only legal entities that are licensed as credit institutions may operate by collecting deposits or other repayable funds from the public.”

Chapter IV (mostly article 20) mainly states that:

“The activities of commercial banks and savings banks may include the following:

1. Acceptance of deposits and other repayable funds from the public.

2. Lending activities, including:

a. consumer credit,

b. mortgages,

c. factoring and purchase of debt instruments and

d. commercial credit.

3. Financial leasing.

4. The provision of payment services as provided for in the Act on Payment Services.

5. Issuing and administering payment documents such as travelers’ cheques and bills of exchange.

6. Providing guarantees and commitments.

7. Trading for own account or for the accounts of customers in:

a. money market instruments (cheques, bills, other comparable payment instruments etc.),

b. foreign exchange,

c. standard forward contracts and swaps (options),

d. exchange rate and interest rate instruments and

e. securities.

8. Participation in securities issues and provision of services related to such issues.

9. Providing advice to undertakings on financial organization, strategy and related issues, and advice as well as services related to mergers and acquisitions.

10. Money brokering.

11. Asset management and advisory.

12. Custody and administration of securities.

13. Credit reference (credit rating) services.

14. Rental of safety deposit boxes.

15. Issue of electronic money.”

Consequently, the definition of permissible activities for banks in Iceland is quite large, referring to the EU extensive approach of bank licensing, including financial activities that may be left out of the scope of licensing in some non-EU jurisdictions, for instance factoring, consumer credit, or financial leasing. Such extensive approach of permitted activities is consistent with the universal banking model of major banks in Iceland, which enables large coverage of banking regulation and supervision by CBI.

It should be noted that prior approval of CBI is requested for each single activity listed in above-mentioned article 20, in case an existing bank would envisage extending the scope of activities beyond the existing list of activities for which a license has been granted by CBI. Such activity-by-activity approach of licensing enables CBI to have close scrutiny of development strategies of banks extending beyond their usual business model into new kinds of financial services.

In addition, the definition of other services and ancillary activities that are permitted to credit institutions (among which “banks”) is developed in Act No. 161/2002, article 21. Ancillary activities are permitted to banks, provided that they are a normal extension of their financial services, subject to prior approval of CBI. There is no list of ancillary activities, approval being examined on a case-by-case basis.

EC3

The use of the word “bank” and any derivations such as “banking” in a name, including domain names, is limited to licensed and supervised institutions in all circumstances where the general public might otherwise be misled.

Description and Findings re EC3

The use of the term “bank” is restricted in Act No. 161/2002, article 12: “Only credit institutions may use in their firm name or as clarification of their activities the words “credit institution”, “bank”, “commercial bank”, “investment bank”, “savings bank” and “credit undertaking” either alone or linked to other words, in accordance with their operating license.”

EC4

The taking of deposits from the public is reserved for institutions that are licensed and subject to supervision as banks.³⁸

Description and Findings re EC4

Act No. 161/2002 on Financial Undertakings indirectly states that only banks (commercial banks, and savings banks) can collect deposits:

• - Article 3 states that: “only legal entities that are licensed as credit institutions may operate by collecting deposits or other repayable funds from the public.”

• - Article 1(b), item 2 states that a credit institution is “an undertaking that operates by accepting deposits or other repayable funds from the public and provides loans for its own account”. This legal definition does not mention “banks” (see CP4 EC1).

• - Article 12 states that: “only credit institutions may use in their firm name or as clarification of their activities the words “credit institution”, “bank”, “commercial bank”, “investment bank”, “savings bank” and “credit undertaking” either alone or linked to other words, in accordance with their operating license.” Thus, banks being credit institutions, they can collect deposits.

• - Credit undertakings are credit institutions too, but they cannot collect deposits, because article 20, paragraph 3, states that: “Activities of credit undertakings may include points 1 to 15 of the first paragraph, with the exception that credit undertakings may not accept deposits.” Thus, only banks may collect deposits.

EC5

The supervisor or licensing authority publishes or otherwise makes available a current list of licensed banks, including branches of foreign banks, operating within its jurisdiction in a way that is easily accessible to the public.

Description and Findings re EC5

Act No. 161/2002, article 8, states that: “The Financial Supervisory Authority shall keep a register of credit institutions and their branches, including all the principal details of the undertakings concerned.”

CBI discloses and updates a nominative list of licensed banks on its official website: https://en.fme.is/supervision/supervised-entities/. Regulated financial institutions, including banks, are dispatched by categories. Last update before the BCP assessment mission was done on October 24, 2022.

Assessment of Principle 4

Compliant

Comments

The Icelandic legal and regulatory framework is aligned with the extensive EU definition of the scope of permitted activities, covering a large range of banking and payment services.

The legal definition of banks is included into the broader category of credit institutions, derived from EU rules. There are two categories of banks in Iceland: commercial banks, and savings banks. Only banks may collect deposits.

Such large scope of regulation and supervision provides CBI with strong legal capacity to effectively control banks, and credit institutions more globally. This approach is relevant for Iceland, since major banks have adopted a so-called universal banking business model, requiring close supervisory scrutiny from CBI

No main finding has been identified.

Principle 5

Licensing Criteria

The licensing authority has the power to set criteria and reject applications for establishments that do not meet the criteria. At a minimum, the licensing process consists of an assessment of the ownership structure and governance (including the fitness and propriety of Board members and senior management)³⁹ of the bank and its wider group, and its strategic and operating plan, internal controls, risk management and projected financial condition-(including capital base). Where the proposed owner or parent organization is a foreign bank, the prior consent of its home supervisor is obtained.

Essential Criteria

EC1

The law identifies the authority responsible for granting and withdrawing a banking license. The licensing authority could be the banking supervisor or another competent authority. If the licensing authority and the supervisor are not the same, the supervisor has the right to have its views on each application considered, and its concerns addressed. In addition, the licensing authority provides the supervisor with any information that may be material to the supervision of the licensed bank. The supervisor imposes prudential conditions or limitations on the newly licensed bank, where appropriate.

Description and Findings re EC1

CBI, acting in its official capacity as the Financial Supervisory Authority (FSA, FME in Icelandic), has the legal power to review applications for a license as a credit institution (therefore, as a bank), and to issue banking licenses (as a commercial bank, or a savings bank). CBI’s legal mandate for licensing banks is laid down in Act No. 161/2002 on Financial Undertakings, Chapter II, articles 2 and following.

CBI can impose prudential conditions or limitations on a newly licensed bank. Article 10(a) states that: “The Financial Supervisory Authority may restrict the activities of individual establishments [credit institutions] if it sees specific reason to do so.” This Article 10(a) has general application beyond the licensing stage.

CBI applies EBA Guidelines EBA/GL/2021/12 on a common assessment methodology for granting authorization as a credit institution under Article 8(5) of EU Directive 2013/36/EU:

https://www.eba.europa.eu/sites/default/documents/files/document library/Publications/Guidelines/2021/EBA-gl-2021-12%20Guidelines%20on%20the%20authorisation%20of%20credit%20institutions/1023885/Report%20GL%20on%20a%20common%20assessment%20methodology%20%28002%29%20-%20clean.pdf?retry= 1.

When evaluating the application of a new bank, CBI makes a rigorous analysis of the business plan, focusing on the applicant’s business model, strategy, and risk profile, to form a view on the viability and sustainability of the applicant bank’s business model. Applicants are aware that EBA guidelines apply for that purpose. Documentation requests and questionnaire for interviews have been disclosed. Internal procedures have been specified for supervisors in charge of examination of licensing applications.

The applicant’s risk profile will impact capital requirements and other prudential conditions set by CBI if the license is granted. Furthermore, the planned activities of the bank can impact the requirements decided by CBI. For example, there are stricter requirements concerning conflict of interest if the bank intends to provide investment services.

All major decisions on licensing, such as granting an operating license for a bank, rejecting an application for an operating license or registration, rejecting an authorization to acquire a qualifying holding, and adverse decisions regarding fitness and propriety of board members and senior management, are taken by the Financial Supervisory Committee of CBI.

Preparation of decisions on licensing involves all related CBI departments, including legal experts and banking supervisors, to ensure efficient synergies leading to a complete, thorough, and reliable assessment of applications. While CBI Compliance and Inspections department oversees the licensing process, banking supervisors from the Banking department (which manages off-site supervision of credit institutions and investment firms) oversee the financial examination of the application (for instance, business plan analysis, financial information on shareholders with a qualifying holding), and risk specialists from the Banking department oversee relevant risk domains. Input is also gained from the Financial Stability department.

Concretely, since the post-crisis restructuration of the banking sector, the licensing activity has been very limited for banks. CBI has only received two applications for a license as a credit institution, including one application for a license as a savings bank. CBI accepted both applications after thorough review and extensive dialogue with the applicant and within CBI. In both cases, the application came from a domestic entity. During the same period, CBI has not revoked or withdrawn any license of a credit institution. CBI mentions that it has not faced any special issue regarding applications for a license as a credit institution.

EC2

Laws or regulations give the licensing authority the power to set criteria for licensing banks. If the criteria are not fulfilled or if the information provided is inadequate, the licensing authority has the power to reject an application. If the licensing authority or supervisor determines that the license was based on false information, the license can be revoked.

Description and Findings re EC2

CBI has legal powers to set criteria for licensing banks. Information requirements relating to applications for a banking license are set out in Act No. 161/2002, article 5. The list of items defined in the law is concise, yet the FSA has legal power to request “other relevant information”.

Article 5 states that (the following excerpt is streamlined):

“An application for an operating license must be made in writing and shall be accompanied by:

1. Information on the type of operating license applied for, on activities subject to authorization, and other proposed activities.

2. The company’s Articles of Association.

3. Information on the structure of the organization, including information, inter alia, on how the proposed activities are to be pursued.

4. Information on the internal organization of the undertaking, including rules on supervision and work procedures.

5. A business plan and budget, indicating inter alia the expected growth and composition of own funds.

6. Information on founders, shareholders or guarantee capital owners, who directly or indirectly control qualifying holdings and the proportional holdings of all parties. If no one has a qualifying holding, information on the 20 largest shareholders or guarantee capital owners must be provided.

7. Information on the board of directors, managing director and other managers.

8. Auditor’s confirmation that share capital or guarantee capital has been paid up.

9. Information about the group to which the company belongs, including parent companies, financial holding companies and mixed financial holding companies in the group.

10. Information on close links between the undertaking and individuals or legal entities.

11. Other relevant information as determined by the Financial Supervisory Authority.”

Therefore, the examination process of applications for a banking license covers not only data, but also the set-up of governance, internal control, and risk management frameworks, in view of ensuring that newly licensed banks may be run properly as of day one.

Regarding the methodology used for assessing applications, CBI has disclosed on its website an extensive checklist of information and documentation that must be submitted with the application. This document (updated in August 2022) is only available in Icelandic: https://www.fme.is/media/eydublod/Starfsleyfi-fjarmalafyrirtaekis agust-2022.pdf.

According to Act No. 161/2002, article 7, CBI has the power to reject applications that do not meet standards, “including the risk control system and the eligibility of board members, managing directors and owners of qualifying holdings, in the opinion of the Financial Supervisory Authority.” CBI has mentioned that it has used this power as a preventive action power in order to push applicants to reconsider proposed arrangements that were not deemed satisfactory after preliminary examination of the application.

CBI can revoke a banking license afterwards, if it was based on false information, according to Act No. 161/2002, article 9.

EC3

The criteria for issuing licenses are consistent with those applied in ongoing supervision.

Description and Findings re EC3

CBI has introduced risk-based criteria for collecting information and documentation supporting applications for a banking license, as it is mentioned in the above-mentioned legal provisions and check-list (see references under CP5 EC2).

The risk-based approach for examination of licensing applications, and the issuance of banking licenses are not explicitly mentioned in the banking law or CBI application regulations, though it is advocated in above-mentioned EBA guidelines that are enforced in Iceland. It came out of BCP assessment meetings that CBI does implement a risk-based and comprehensive approach of licensing in that regard.

The licensing activity for new banks has been very limited for many years in Iceland. For illustration and a high-level review of the licensing process, CBI shared with BCP assessors two application cases relating to a savings bank and a credit undertaking. Summary documentation shared by CBI highlights that thorough examination is implemented, covering a broad range of risk-related topics, including on governance, compliance, internal control, and risk management frameworks. To ensure that applicants will be able to meet prudential requirements from day one, banking supervisors as well as risk specialists of the Banking department are involved in the assessment of application, in addition to legal experts within the same department. Thus, banking supervisors are aware of the necessity to implement a risk-based approach of licensing, considering all relevant quantitative and qualitative aspects of risk management frameworks set up by applicants, beyond just checking formal legal compliance of applications.

EC4

The licensing authority determines that the proposed legal, managerial, operational and ownership structures of the bank and its wider group will not hinder effective supervision on both a solo and a consolidated basis.⁴⁰ The licensing authority also determines, where appropriate, that these structures will not hinder effective implementation of corrective measures in the future.

Description and Findings re EC4

At the licensing stage, CBI has legal power to ensure that the proposed ownership structure of a bank would not undermine effective consolidated supervision and corrective action. Act No. 161/2002, article 7 paragraph 3, states that: “An operating license shall not be granted if close links between an applicant and individuals or legal entities obstruct supervision of the undertaking by the Financial Supervisory Authority. The same applies if laws or regulations of a state outside the European Economic Area which apply to such connected parties or problems related to their implementation hinder supervision.”

Legal provisions are less explicit on the legal power granted to CBI, at the licensing stage, to ensure that the proposed legal, managerial, and operational structures of a bank would not undermine effective consolidated supervision and corrective action. In that regard, CBI refers to EBA guidelines that are legally inserted into Act No. 161/2002. The licensing approach followed by CBI clearly covers the assessment of appropriateness of legal, managerial, and operational structures of the applicant bank.

There are no legal restrictions on characteristics of ownership of banks. CBI has not defined any specific strategy for licensing that may restrict the typology of bank ownership structures in addition to the regular EU/EBA framework. Non-banks, including natural persons, are allowed to control banks if they fulfill assessment criteria for owning qualifying holdings, including financial soundness and capacity to provide banks with financial support.

CBI asks for a declaration by the home supervisor stating that there are no obstacles to, or limitations on, disclosure to CBI of the information necessary for supervision of the target undertaking. If the assessment reveals that there are grounds to believe that the ownership will impede adequate supervision of the regulated bank, the prospective acquirer will not meet the prudential assessment criteria (Act No. 161/2002, article 42). CBI has used this legal power to oblige credit institutions (not banks, because no application has been received from banks) to upgrade their proposed ownership structure towards less complexity.

EC5

The licensing authority identifies and determines the suitability of the bank’s major shareholders, including the ultimate beneficial owners, and others that may exert significant influence. It also assesses the transparency of the ownership structure, the sources of initial capital and the ability of shareholders to provide additional financial support, where needed.

Description and Findings re EC5

Regarding the assessment of eligibility and suitability of banks’ major shareholders at the licensing stage, CBI has legal power laid out in Act No. 161/2002, Chapter VI on holdings and treatment of holdings. Eligibility criteria are set out in article 42(a) on eligibility assessment in a general way, including, among others, the owner’s financial soundness (point 3), and how ownership might impact the credit institution’s ability to comply and continue to comply with prudential requirements (point 4).

Act No. 161/2002 does not explicitly mention “transparency of the ownership structure” as a legal requirement for licensing, among above-mentioned eligibility criteria. Yet CBI refers to EBA guidelines in that regard. Other legal provisions give power to CBI to assess the eligibility of beneficial owners of a qualified holding in a bank, for instance article 49(a) on beneficial owners. CBI has not issued specific regulatory requirements on the ownership structure in view of ensuring transparency, because it found no need to do so, considering applicable EBA guidelines on this topic. No further national criteria have been specified regarding shareholders’ jurisdictions or legal structures.

CBI assesses transparency of banks’ ownership structure, at the licensing stage and at any occurrence of a change of ownership, on a case-by-case basis. The suitability assessment of owners of qualifying holdings is headed by supervisors of the Compliance and Inspections department. Financial evaluation of shareholders is carried out by banking supervisors. CBI’s AML/CFT team within this department conducts an AML/CFT analysis and verifies the source of funds used for acquiring significant banks’ shareholdings (as well as minimum capital), with input from the Financial Stability department.

The legal definition of an ultimate beneficial owner (UBO) is included in Act No. 140/2018 on measures against Money Laundering and Terrorist Financing, article 3, referred to in Act No 161/2002, article 1 (b), as one or more natural persons who ultimately own or control the customer, legal entity, or natural person on whose behalf a transaction or activity is being conducted or carried out. A beneficial owner is, in the case of a legal person, the natural person who in fact owns or controls the legal person through the direct or indirect ownership of a share of more than 25 percent in the legal person, or controls more than 25 percent of the voting rights, or is regarded as having control of the legal person in another manner.

Applicants for a banking license are required to disclose the full list of their shareholders. Further to this, all owners of a qualifying holding (10 percent, or more, of equity, or voting rights) are subject to additional disclosure requirements. CBI has issued guidelines on information requirements: https://www.fme.is/media/eydublod/SI5.1.20 Information-disclosure-for-notification-of-a-qualifying-holding.pdf. Among the extensive list of questions within CBI questionnaire are questions pertaining to the ultimate economic beneficiaries of the transaction and whether the proposed acquirer has eventually entered into derivatives contracts using shares issued by the targeted undertaking as underlying assets (see questions 5.11-5.12).

Indirect ownership situations are evaluated using the two-steps approach recommended in EBA Joint Guidelines JC/GL/2016/01 on the prudential assessment of acquisitions and increases of qualifying holdings in the financial sector: https://www.esma.europa.eu/system/files force/library/jc gl2016 01 joint guidelines on prudential assessment of acquisitions and increases of qualifying holdings - final.pdf?download = 1. The first step (“control-criterion”) envisages the application of the notion of control. Accordingly, all natural or legal persons (i) who acquires, directly or indirectly, control over an existing holder of a qualifying holding in a target undertaking, or (ii) who, directly or indirectly, controls the proposed direct acquirer of a qualifying holding in a target undertaking, should be considered as indirect acquirers of a qualifying holding. The second step (“multiplication criterium”) applies where the application of the control criterion does not determine that a qualifying holding was acquired indirectly.

According to Act No. 161/2002, article 49(a), if there is any doubt in the opinion of CBI, about who is or will be the beneficial owner of a qualifying holding, CBI shall notify the party who sent the notification, or the financial undertaking itself if the former cannot be reached, that CBI does not consider the party in question eligible to exercise the holding.

Regarding CBI’s control of source of funds to be used as banks’ capital, explicit questions are asked by CBI in the above-mentioned questionnaire (Section 7). As a bare minimum, CBI asks for a description of the source of the financing and documentation, in view of verifying that no money laundering is being attempted through the proposed acquisition (for example, a copy of a wire or bank transfer from a bank account in the name of the proposed acquirer to the seller, or a signed letter from a public accountant detailing the source of the financing). CBI’s AML/CFT team evaluates the submittals and verifies if further documentation is needed. CBI reports that it has not faced any issue regarding the source of funds used as capital.

EC6

A minimum initial capital amount is stipulated for all banks.

Description and Findings re EC6

The legal minimum capital amount required for banks is specified in Act No. 161/2002, article 14: the minimum initial capital shall not be lower than the equivalent in ISK of EUR 5 million for credit institutions, including banks, except EUR 1 million for savings banks (only if savings banks do not operate cross-border activities and do not engage in activities on securities and asset management). In each case, the minimum capital requirement shall not be less than 8 percent of the projected risk base.

In both cases, the initial disbursement shall be in the form of cash, premium account, retained earnings, or reserve fund. Prior to licensing, an external auditor shall issue a formal confirmation that the initial share capital has been paid in full up to the minimum capital requirement (article 5).

EC7

The licensing authority, at authorization, evaluates the bank’s proposed Board members and senior management as to expertise and integrity (fit and proper test), and any potential for conflicts of interest. The fit and proper criteria include: (i) skills and experience in relevant financial operations commensurate with the intended activities of the bank; and (ii) no record of criminal activities or adverse regulatory judgments that make a person unfit to uphold important positions in a bank.⁴¹ The licensing authority determines whether the bank’s Board has collective sound knowledge of the material activities the bank intends to pursue, and the associated risks.

Description and Findings re EC7

Regarding the licensing rules of banks’ board members and senior management, CBI is provided with legal powers by Act No. 161/2002, Chapter VII on board of directors, corporate governance, and employees, in particular article 52 which sets eligibility requirements, such as skills and experience, good reputation including the absence of criminal record. A legal requirement for the credit institution’s board to have a collective adequate knowledge and experience also is set out in article 52.

To implement the licensing process of board members and senior management in line with EBA guidelines, CBI has developed a questionnaire for interviewing candidates to managing director positions. This review is carried out by the Compliance and Inspections department and based on information submitted on behalf of the CEO and each board member. The CEO and all board members have to pass an oral examination, headed by this department.

Details on the evaluation of the suitability of proposed board members and senior management are specified in CBI rules No. 150/2017 on the implementation of the qualification assessment of managing directors and directors of financial companies (in Icelandic only): https://www.stjornartidindi.is/PdfVersions.aspx?recordId=cb215e5a-7ee4-4ea4-8613-5549793ab127.

Credit institutions must notify CBI as soon as possible, preferably beforehand, about appointments of a new CEO and new board members. The CEO and board members must submit information according to CBI questionnaire within four weeks. This questionnaire is currently being updated (November 2022). The questionnaire is reviewed, and additional information is collected if needed. For CEOs and board members of significant banks, and if there is any doubt about the fitness of a board member of any other kind of credit institution, an oral assessment is held by CBI, using a questionnaire. This questionnaire is also being updated. The oral assessment takes around 3-4 hours and covers the main points that CBI deems relevant for CEO’s and board members of credit institutions. The fit and proper process is the same for all credit institutions.

EC8

The licensing authority reviews the proposed strategic and operating plans of the bank. This includes determining that an appropriate system of corporate governance, risk management and internal controls, including those related to the detection and prevention of criminal activities, as well as the oversight of proposed outsourced functions, will be in place. The operational structure is required to reflect the scope and degree of sophistication of the proposed activities of the bank.⁴²

Description and Findings re EC8

CBI is aware that the licensing process should go beyond formal legal compliance checks and review of estimated performance data, but also incorporate a risk-based qualitative assessment of banks’ capacity to operate sound risk policies and management. CBI ensures that all important aspects of applications for a bank license which may be risk sensitive are reviewed by CBI’s risk specialists, notably: (i) a draft organization chart; (ii) governance, internal control, and risk management frameworks; (iii) ethics, compliance, and financial integrity frameworks, including AML/CFT; (iv) operational risk management, including ICT systems and security, business continuity planning, and outsourcing; (v) environmental, social, and governance (ESG) policies.

EC9

The licensing authority reviews pro forma financial statements and projections of the proposed bank. This includes an assessment of the adequacy of the financial strength to support the proposed strategic plan as well as financial information on the principal shareholders of the bank.

Description and Findings re EC9

CBI follows EBA guidelines on the authorization of credit institutions regarding financial analysis of banks’ business strategy and estimated financial projections. CBI reviews the proposed banks’ business plans, tentative financial statements (balance sheet, profit & loss), estimated prudential ratios, as well as the financial soundness of major shareholders, including natural persons if need be.

EC10

In the case of foreign banks establishing a branch or subsidiary, before issuing a license, the host supervisor establishes that no objection (or a statement of no objection) from the home supervisor has been received. For cross-border banking operations in its country, the host supervisor determines whether the home supervisor practices global consolidated supervision.

Description and Findings re EC10

CBI has legal power to request a no-objection statement from the home supervisory authority of any bank that would establish a branch in Iceland. As an EEA member country, Iceland also implements the EU passporting rules applicable to EEA countries.

Domestic banks that wish to open a cross-border branch within the European Economic Area may do so with a so-called “passport notification” to CBI, according to Act No. 161/2002, article 36. The information in the passport notification shall follow applicable EU regulation (EU) 926/2014 and (EU) 1151/2014. CBI will pass the notification on to the competent authority in the host country. If the branch is deemed a systemically important branch, further information shall be sent to the host country. No Icelandic bank has opened any branch abroad within the European Economic Area.

CBI can authorize domestic banks to open a branch in a country that is not a member of the European Economic Area, according to Act No. 161/2002, article 38, which lists information that CBI needs to be provided with before such authorization. So far, no Icelandic bank has opened any branch abroad outside of the European Economic Area.

Foreign banks within the European Economic Area can be authorized to open a branch in Iceland according to Act No. 161/2002, article 31 of after a “passport notification” has been received from the home member State. The information provided in the “passport notification” follows above-mentioned EU implemented regulation. If the branch is deemed a systemically important branch, further information shall be sent by the home country according to Article 31(a). Supervisory powers of CBI are laid down in article 34. No EEA foreign bank has opened any branch in Iceland so far.

Foreign banks that are domiciled outside of the European Economic Area can be authorized to open a branch in Iceland according to Act No. 161/2002, article 33, which lists detailed information that CBI needs to be provided with. No Non-EEA foreign bank has opened any branch in Iceland.

EC11

The licensing authority or supervisor has policies and processes to monitor the progress of new entrants in meeting their business and strategic goals, and to determine that supervisory requirements outlined in the license approval are being met.

Description and Findings re EC11

CBI plans to supervise newly licensed banks through regular supervisory process to ensure that legal and regulatory requirements are met according to specific licensing conditions, if any. Supervisory visits are envisaged in that regard (mostly applied for nonbank financial institutions, because no new bank has been opened in Iceland for years). CBI decides on a case-by-case basis whether to implement more stringent prudential requirements for new credit institutions. The determining factors may include the new bank’s business plan (CBI might want to monitor if the plan is working as planned, for instance by asking for monthly management accounts), as well as special risks that the business model might entail. There are no concessions granted for new banks, which must fulfill all normal capital and AML/CFT requirements from day one. CBI reports that it has not faced any material issue regarding new credit institutions shortly after they have been licensed. In practice, given that only one new savings bank has been licensed recently, there is no need to implement such specific monitoring frequently.

Assessment of Principle 5

Compliant

Comments

The licensing activity has been very limited for banks in Iceland for many years.

Yet licensing requirements and processing are well structured. Based on a solid framework on licensing applications, supported by detailed requirements, comprehensive licensing criteria, and a risk-based assessment methodology, CBI may implement a thorough examination of application requests from entities for a banking license, as well as from natural persons for their appointment as members of the board of directors or senior management.

CBI has adequate power to require adjustments of proposed plans, if need be, or to reject applications.

Minimum capital requirements look rather low (the equivalent in ISK of EUR 5 million for banks), yet prudential capital adequacy requirements are much higher.

No main finding has been identified.

Principle 6

Transfer of Significant Ownership

The supervisor⁴³ has the power to review, reject and impose prudential conditions on any proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties.

Essential Criteria

EC1

Laws or regulations contain clear definitions of “significant ownership” and “controlling interest”.

Description and Findings re EC1

The definition of a “qualifying holding” is laid down in Act No. 161/2002, article 40 paragraph 2: “A qualifying holding shall mean a direct or indirect holding in a credit institution which represents 10 percent or more of its equity, guarantee capital or voting rights or enables the exercise of a significant influence on the management of the credit institution concerned.”

Quantitative thresholds of qualifying holdings are set up at 10 percent of equity, guarantee capital, or voting rights, 20 percent, 30 percent, and 50 percent. Direct or indirect ownership is considered in the law, as well as joint ownership of a group of connected parties. Therefore, persons or entities that act in concert to acquire a direct or an indirect qualifying holding are also covered by the legal requirement to notify CBI and are also subject to eligibility assessment.

The qualitative criteria relating to the “significant influence on the management” of the bank, set in article 40, may provide CBI with more flexibility than the mechanistic application of quantitative thresholds to assess the effective control that a shareholder may have on the bank, even if the related capital share stands below the legal 10 percent threshold. This legal change has addressed the finding identified in the 2014 ROSC for CP6.

EC2

There are requirements to obtain supervisory approval or provide immediate notification of proposed changes that would result in a change in ownership, including beneficial ownership, or the exercise of voting rights over a particular threshold or change in controlling interest.

Description and Findings re EC2

All authorizations concerning any modification of license applications of regulated banks requires prior approval from CBI. All changes of direct or indirect ownership of qualifying holdings (10 percent or more) must be notified in advance to CBI, which has time to assess proposed changes before deciding whether new shareholders are suitable, and to object if legal criteria are not met, according to Act No. 161/2002, Chapter VI, articles 40 to 49(a), EBA Joint Guidelines for the prudential assessment of acquisitions of qualifying holdings, as well as Guidelines on Information requirements. A merger between financial undertakings is subject to prior approval of CBI (article 106). CBI has recently updated its internal process in such a way that owners of qualifying holdings will have to complete an annual questionnaire that contains questions on the beneficial ownership of their qualifying holdings.

EC3

The supervisor has the power to reject any proposal for a change in significant ownership, including beneficial ownership, or controlling interest, or prevent the exercise of voting rights in respect of such investments to ensure that any change in significant ownership meets criteria comparable to those used for licensing banks. If the supervisor determines that the change in significant ownership was based on false information, the supervisor has the power to reject, modify or reverse the change in significant ownership.

Description and Findings re EC3

CBI has legal power to reject changes of significant ownership, as stated by Act No. 161/2002, Chapter VI on holdings and treatment of holdings. Assessment process and criteria are developed in article 42(a). Provisions on eligibility assessment, including CBI’s power to reject a proposed acquisition (because it is not eligible, or notification has not been sent to CBI), are developed in articles 43 and 46. Provisions on CBI’s power to amend a previous decision are developed in article 49 on disclosure obligations and ongoing evaluation of the eligibility of owners of qualifying holdings. The CBI has the power to cancel voting rights of a new shareholder assessed as non-eligible, and to request this shareholder to sell the related bank shareholding (Article 46). In addition, the CBI may revoke a banking license if the application is based on incorrect information (Article 9).

Clarification was requested during the mission about the legal deadline relating to approval delivery. Act No. 161/2002, article 42, mentions that: “Should the conclusion of the Financial Supervisory Authority not be available within the evaluation period as provided for in the third paragraph [60 days], it may be concluded that the Financial Supervisory Authority does not object to the plans of the party intending to acquire or increase a qualifying holding in the credit institution in question.” Such legal provision might be understood as obliging CBI to accept implicit approval of transfer of significant ownership, which might put CBI at risk. Though implicit approval of any licensing request should be considered as not appropriate, whatever the underlying reason, CBI explained to BCP assessors that in any case the deadline shall start when CBI has decided that the application for transfer of significant ownership has successfully met information and documentation requirements, so that supervisors would not be forced to decide implicitly without getting proper information and documentation.

In the last five years, CBI/FSA has not identified any need to require a change of control of a bank that was made without a notification or approval.

EC4

The supervisor obtains from banks, through periodic reporting or on-site examinations, the names and holdings of all significant shareholders or those that exert controlling influence, including the identities of beneficial owners of shares being held by nominees, custodians and through vehicles that might be used to disguise ownership.

Description and Findings re EC4

Act No. 161/2002, article 19, states that banks must disclose a list of every shareholder owning 1 percent or more of their share capital or guarantee capital on their website. This list must be continuously updated, all changes in ownership being reflected within four days. Further, for shareholders who are legal entities, banks must also disclose a list of their beneficial owners. In addition, article 48 states that banks admitted to trading on a regulated market must submit a yearly report to CBI detailing owners of qualifying holdings of their capital.

EC5

The supervisor has the power to take appropriate action to modify, reverse or otherwise address a change of control that has taken place without the necessary notification to or approval from the supervisor.

Description and Findings re EC5

Act No. 161/2002, article 45, addresses the issue of any failure of regulated banks to notify CBI of any change of qualifying holding. In that case, voting rights exceeding the threshold for a qualifying holding are canceled. In addition, article 46 states that, if CBI finds an ineligible owner owning a qualifying holding, voting rights exceeding the threshold for a qualifying holding are canceled, and the related owner must sell shares exceeding the same threshold within two months, or within another timeframe as decided by CBI.

EC6

Laws or regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest.

Description and Findings re EC6

Act No. 161/2002, article 8, obliges banks to notify CBI of any information that may affect whether the institution fulfills licensing requirements. This is a generic provision that does not explicitly mention the suitability of shareholders. Regarding shareholders, Chapter VI on holdings and treatment of holdings is not clear about banks’ obligation to inform CBI of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest.

Consequently, it is recommended that Act No. 161/2002 be amended to explicitly require banks to notify CBI as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest. Such additional legal provision could possibly be extended to significant, but non-major, shareholders, even to tentative shareholders (at least major tentative shareholders, also non-major tentative shareholders too, if useful), so that CBI be involved in early examination of the suitability of existing or new shareholders which may adversely impact banks. CBI would then have large legal powers of preventive or corrective action against non-suitable shareholders, which may be useful powers considering recent issues raised by the privatization of a major bank.

In that regard, according to the government’s website at the time of the BCP assessment mission, the MoFEA was planning to present a bill for debate in Parliament in November 2022 [postponed to February 2023 after the mission] which purpose is changing the sale proceedings of government equity stakes (in Icelandic only): https://www.stjornarradid.is/rikisstjorn/thingmalaskra/. No detailed information was available at the time of the mission in addition to the short following statement (translated from the above-mentioned source): “(16) Draft law on the treatment of the state’s holdings in companies. The bill aims to strengthen the handling of the state’s holdings in companies through a changed arrangement, where increased emphasis will be placed on transparency, equality, democratic involvement of parliament and the provision of information to the public”.

Assessment of Principle 6

Compliant

Comments

Regulation of transfer of significant ownership has been upgraded to provide CBI with adequate authorization powers of significant changes of banks’ shareholdings.

Yet Act No. 161/2002 is not clear enough about banks’ obligation to inform CBI of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest. Though Act No. 161/2002, article 8, obliges banks to notify CBI of any information that may affect whether the institution fulfills licensing requirements, this article does not explicitly mention the suitability of shareholders. In addition, Chapter VI on holdings and treatment of holdings is not clear about banks’ obligation to inform CBI of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest.

It is recommended that Act No. 161/2002 be amended to explicitly require banks to notify CBI as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest. Such additional legal provision could possibly be extended to significant, but non-major, shareholders, even to tentative shareholders (at least major tentative shareholders, also non-major tentative shareholders too, if useful), so that CBI be involved in early examination of the suitability of existing or new shareholders which may adversely impact banks.

Principle 7

Major Acquisitions

The supervisor has the power to approve or reject (or recommend to the responsible authority the approval or rejection of), and impose prudential conditions on, major acquisitions or investments by a bank, against prescribed criteria, including the establishment of cross-border operations, and to determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision.

Essential Criteria

EC1

Laws or regulations clearly define:

• (a) what types and amounts (absolute and/or in relation to a bank’s capital) of acquisitions and investments need prior supervisory approval; and

• (b) cases for which notification after the acquisition or investment is sufficient. Such cases are primarily activities closely related to banking and where the investment is small relative to the bank’s capital.

Description and Findings re EC1

The applicable legal framework has not laid down explicit provisions relating to “major acquisitions” envisaged by regulated banks, that is quantitative limitations, as well as qualitative risk management rules. Making such provisions explicit in the law would simply clarify the regulation framework on this topic.

Yet the existing legal and regulatory framework may compensate this formal gap.

Existing laws and regulations are restrictive regarding conditions applicable to banks on major acquisitions. The related legal framework mostly focuses on 4 topics: (i) ancillary activities; (ii) qualifying holdings in banks’ capital; (iii) mergers of regulated banks; and (iv) limits on large exposures. Banks cannot decide major acquisitions out of the scope of the above-mentioned list of 4 topics. On major acquisitions, CBI refers to Act No. 161/2002, article 21 on other services and ancillary activities, and article 22 on temporary activities and takeover of asset. CBI has published guidelines regarding side activities and temporary activities of credit institutions (in Icelandic only) specifying the conditions for each category of investments: https://www.fme.is/thjonustugatt/hlidar-og-timabundin-starfsemi/.

1°/ Ancillary Activities

Banks must notify CBI before pursuing ancillary activities. Article 21 states that banks can pursue ancillary activities provided they are a “normal extension” of their financial services, for example ownership of a company that buys claims from third parties, or any other kind of subsidiary established by the bank. In practice, as established per CBI’s guidelines, banks need only notify if they have an equity interest equal to, or more than 20 percent in another entity. Banks have to notify CBI of the pursuit of ancillary activities even if they have an equity stake lower than 20 percent if they nominate a board member of the entity. If CBI raises no objection to proposed ancillary activities within one month of receiving satisfactory notification, this shall be interpreted as authorization for commencing such activities.

2°/ Mergers

A merger of a bank with another financial undertaking is only permitted with the consent of CBI (Act No. 161/2002, article 106).

3°/ Equity interest arising from the work-out of problem exposures Banks may only pursue activities other that permitted activities listed in Act No. 161/2002 on a temporary basis and for the purpose of completing transactions or restructuring clients’ operations. Banks can therefore acquire equity stakes in entities in the course of working out problem exposures. CBI needs to be notified, with supporting reasoning given for equity stakes. As a general rule, banks must dispose of such equity stakes within 12 months. CBI can prolong this timeframe, for instance in case of illiquid assets.

4°/ Limits on acquisitions stemming from rules on large exposures

A bank’s aggregate exposure to non-consolidated subsidiaries and other related parties may not exceed the limits set by rules on large exposures, according to EU regulation CRR (article 395) which is implemented into Icelandic Law by Act No.161/2002, article 1(c).

5°/ Absolute limits on qualifying holdings to banks’ capital

Referring to CRR, articles 89-91, CBI imposes two limits on banks’ qualifying holdings in non-financial companies: (i) banks may not own qualifying holdings in individual financial or non-financial undertakings amounting to more than 15 percent of their (banks) capital base; and (ii) banks’ total qualifying holdings in non-financial undertakings may not amount to over 60 percent of banks’ capital base.

Legal criteria on major acquisitions have been enhanced as a consequence of the modification of Act No. 161/2002 on qualifying holdings (see CP6 EC6). At present, the legal approach on regulating major acquisitions relies on quantitative thresholds applicable to qualifying holdings, as well as qualitative criteria on effective control that may exist below legal thresholds. In that sense, the finding highlighted in the 2014 ROSC on CP7 has been addressed, regarding major acquisitions of banks in other financial institutions.

Based on this legal framework, CBI has the capacity to examine major acquisitions envisaged by banks, and assess banks’ capacity to complete related transactions, from a risk-based perspective.

EC2

Laws or regulations provide criteria by which to judge individual proposals

Description and Findings re EC2

Act No. 161/2002, supplemented by EBA’s and CBI’s guidelines, set out rules used by CBI when approving banks’ proposed investments:

• - article 21 specifies that ancillary investments need to be “a normal extension of the undertaking’s financial services”;

• - article 22 provides the perimeter for equity interest arising from the work-out of a problem exposure;

• - article 106 specifies the conditions that a credit institution needs to meet in order to get CBI’s approval for a merger.

EC3

Consistent with the licensing requirements, among the objective criteria that the supervisor uses is that any new acquisitions and investments do not expose the bank to undue risks or hinder effective supervision. The supervisor also determines, where appropriate, that these new acquisitions and investments will not hinder effective implementation of corrective measures in the future.⁴⁴ The supervisor can prohibit banks from making major acquisitions/investments (including the establishment of cross-border banking operations) in countries with laws or regulations prohibiting information flows deemed necessary for adequate consolidated supervision. The supervisor takes into consideration the effectiveness of supervision in the host country and its own ability to exercise supervision on a consolidated basis.

Description and Findings re EC3

CBI has a broad general legal power to restrict activities of a bank, according to Act No. 161/2002, article 10(a): “The Financial Supervisory Authority may restrict the activities of individual establishments if it sees specific reason to do so.” CBI is further empowered to set conditions for the continued operations of individual operating units.

Act No. 161/2002, article 39 on purchase of shares in a foreign financial undertaking, applies to the establishment of banks’ cross-border banking operations, If a bank intends to purchase or exercise a qualifying holding in a foreign financial undertaking, it must notify CBI in advance. In case of qualifying holdings in entities located outside of the EEA, CBI may prohibit such acquisition if it has legitimate grounds to presume that information provision for this activity will not be sufficiently reliable, or may impede consolidated supervision, or may create obstacles to the orderly resolution of the bank.

EC4

The supervisor determines that the bank has, from the outset, adequate financial, managerial and organizational resources to handle the acquisition/investment.

Description and Findings re EC4

As a general rule, CBI must analyze the safety and soundness of the types of investment set out in CP7 EC1, which includes financial and managerial resources. CBI has published a checklist on its website that describes the process and requirements for the approval of merger of financial undertakings. CBI is currently finalizing the internal manual to improve its assessment procedures with regards to adequacy of financial, managerial and organizational resources (November 2022).

CBI provided a concrete illustration case of supervisory assessment of a major acquisition submitted by a regulated bank to the approval of CBI which demonstrates effective implementation.

EC5

The supervisor is aware of the risks that non-banking activities can pose to a banking group and has the means to take action to mitigate those risks. The supervisor considers the ability of the bank to manage these risks prior to permitting investment in nonbanking activities.

Description and Findings re EC5

CBI is aware of the risks that non-banking activities can entail and has thus limited the banks’ ability to engage in non-banking activities, for instance by limiting banks’ ability to pursue ancillary activities only as a normal extension of their financial services (as developed under CP7 EC1).

Assessment of Principle 7

Compliant

Comments

As for transfer of significant ownership (CP6), regulation of major acquisitions envisaged by banks (CP7) has been enhanced accordingly, with the introduction of the qualitative criteria of significant influence in addition to standardized quantitative thresholds, which enables more flexibility for implementing risk-based supervision of major acquisitions.

Legislation and regulation, notably Act No. 161/2002, do not include a specific Section on “major acquisitions” explicitly, yet the combination of legal provisions on ancillary activities, mergers, equity interest arising from the work-out of problem exposures, and regular prudential requirements on large exposures, may compensate. Yet semantic clarification of legal requirements on authorization of major acquisitions envisaged by banks would be useful.

The legal regime of major acquisitions is restrictive to banks, which have not developed a significant development strategy through major acquisitions.

CBI has adequate powers to examine and possibly reject any major acquisition envisaged by a bank. Based on the recent case of a major acquisition made by a non-systemic Icelandic bank through its UK subsidiary, CBI may wish to upgrade its capacity to supervise major acquisitions at consolidated level further, even if it may create some duplication with the host country, yet this single case looks as it has been closely monitored by CBI.

No main finding has been identified.

Principle 8

Supervisory Approach

An effective system of banking supervision requires the supervisor to develop and maintain a forward-looking assessment of the risk profile of individual banks and banking groups, proportionate to their systemic importance; identify, assess and address risks emanating from banks and the banking system as a whole; have a framework in place for early intervention; and have plans in place, in partnership with other relevant authorities, to take action to resolve banks in an orderly manner if they become non-viable.

Essential Criteria

EC1

The supervisor uses a methodology for determining and assessing on an ongoing basis the nature, impact and scope of the risks:

• (a) which banks or banking groups are exposed to, including risks posed by entities in the wider group; and

• (b) which banks or banking groups present to the safety and soundness of the banking system

The methodology addresses, among other things, the business focus, group structure, risk profile, internal control environment and the resolvability of banks, and permits relevant comparisons between banks. The frequency and intensity of supervision of banks and banking groups reflect the outcome of this analysis.

Description and Findings re EC1

CBI/FSA utilizes a supervisory review and evaluation process (SREP) for less significant institutions (LSI) under the single supervisory mechanism (SSM) overseen by the European Central Bank (ECB). EBA’s Guideline on common procedures and methodologies for the supervisory review and evaluation process and supervisory stress testing (EBA/GL/2014/13 updated 19 July 2018) provided the basis for CBI/FSA’s SREP framework.

As part of the EEA, Iceland is obligated to abide by the EU framework, both from a banking legislative stance as well as in its supervisory approach for banking supervision. EEA members have considerable freedom to develop their own supervisory approaches on the basis of the SSM LSI SREP methodology. While the ECB sets overarching boundaries (e.g., in terms supervisory priorities, SREP methodology, joint supervisory standards, supervisory cycle and allows for a proportionate approach), national competent authorities/EEA members can develop within these boundaries their own supervisory framework and approach for LSIs tailored to the local circumstances.

CBI/FSA’s SREP methodology is outlined in a document entitled Common Criteria and Methodologies for SREP (CBI/FSA’s SREP methodology). This document is to be read in conjunction with three Annexes, all published on CBI/FSA’s website, entitled:

• a) Annex 1: Supervisory Benchmarks for the Setting of Pillar 2 Additional Own Funds Requirements for Credit and Concentration Risk;

• b) Annex 2: Supervisory Benchmarks for the Setting of Pillar 2 Own Funds Requirements for Market Risk; and

• c) Capital Buffers.

The Icelandic authorities have been utilizing its SREP methodology since 2016. As outlined in Sec 2.1 of CBI/FSA’s SREP methodology, the SREP score is one of the key drivers for the frequency and intensity of supervisory activities (including both the minimum engagement level (MEL) and the supervisory examination program (SEP)). The Figure below provides a high-level overview of the SREP, depicting the general phases of the overall SREP assessment, including: i) classification or categorization of institutions; ii) monitoring of key indicators; and iii) an assessment of the business model analysis (BMA), strength of internal governance and institution-wide controls, and the overall assessment of the impact of all risks to an institution’s capital and liquidity and funding. Once the overall SREP assessment is completed, CBI/FSA may determine the appropriate supervisory measure pertaining to an institution’s capital and liquidity or other appropriate supervisory measures. The SREP framework also includes intervention measures (as per Article9, 86(h) and 107(c) to (e) of Act No. 161/2002).

As per Article 86(b) of Act No.161/2002, CBI/FSA’s categorization of banks has resulted in the classification of three Domestic Systemically Important Banks (D-SIBs) based on an annual assessment, approved by the FSN, that takes into consideration, among other criteria: a) the size of the group; b) interconnectedness of the group with the financial system; c) whether the services or financial infrastructure provided by the group are available elsewhere (substitutability); d) complexity of the group; and e) scope of international activities. Note that the resolvability assessment of the banks is undertaken as part of the classification system, but also as part of the business model assessment and the formal resolvability assessment undertaken by X. (please see EC X for more detail). These three D-SIBs are considered high impact institutions as per the table below.

According to CBI/SREP methodology, CBI/FSA undertakes business model analysis that aims to identify possible threats to the viability of the business model and the sustainability of the overall strategy of the institution. The business model analysis includes an analysis of the business focus (overall strategy based on the risk appetite of the bank), and the organizational structure (to assess risks from entities in the group and the structure overall) as well as addressing a resolvability issues identified as part of the risk assessment, among other things. See sec 2.4.1 of the SREP methodology.

CBI/FSA’s assessment of the internal governance and institution-wide controls involves, among other things, the assessment of the bank’s overall governance framework, risk management framework pertaining to ICAAP/ILAAP, and information systems, etc.

CBI/FSA monitors key risk indicators on a quarterly basis using regulatory data as well as undertaking a risk assessment of the D-SIBs across all key risks (both quantitative and qualitative assessment), resulting in a risk report. There is a comparison of institutions, and the D-SIB risk reports are provided to the Director of Banking, the DG of Financial Supervision, and the Governor. Aggregate risk reporting is provided to the FMEN regarding the D-SIBs.

The Icelandic SREP framework is based on a proportionality approach, that takes into consideration the impact category rating of the institutions which results in a SREP score (see table below in EC2) and distinguishes between the nature/intensity and frequency of the SREP. For a high impact institution, a full SREP is completed annually and is aligned with CBI/FSA’s minimum engagement model (see EC2 for more detail on the MEM). Other categories of impact result in a proportionately timed analysis ranging from two to four years frequency. Note that the SREP score of F (one level below score 4) indicates that the institution is “failing or likely to fail” and is subject to early intervention measures pursuant to Article 86(h) of Act No. 161/2002 or measures pursuant to Chapter XII and Temporary Provision VI of the same Act - outlining CBI’s resolvability framework.

CBI/FSA has an extensive Supervisory Handbook (CCQ) for supervisors to know and understand each aspect of what needs to be assessed for each component of the SREP processes, included guided questions the supervisors should ensure they obtain answers on as part of their risk assessment. Although not impacting CBI supervisors’ capability in undertaking its SREP assessment, it was noted that certain aspects of this Handbook need to be updated (e.g., where new risks have not been defined, or where the Handbook is outdated and not in line with CBI’s current supervisory framework such as the use of the new supervisory assessment system).

EC2

The supervisor has processes to understand the risk profile of banks and banking groups and employs a well-defined methodology to establish a forward-looking view of the profile. The nature of the supervisory work on each bank is based on the results of this analysis.

Description and Findings re EC2

As indicated in EC1 CBI/FSA, based on the categorization of institutions, an annual SREP assessment is undertaken for the D-SIB based on these banks’ high impact category rating. Therefore, for the D-SIBs, CBI/FSA undertakes a considerable amount of forward looking analysis through the utilization of stress testing methodology for the BMA analysis as well for the assessment of ICAAP and ILAAP as well as meeting with bank’s risk experts/management to understand the results of these forward looking views. Should the analysis reveal issues/concerns (for example, if CBI’s analysis of a DSIBs ICAAP with respect to a certain kind of credit product was not adequate, CBI may request additional information from the bank, require additional or different stress testing, and or undertake an on-site credit review to obtain additional supervisory information to conclude on the bank’s overall SREP score/risk assessment), further work/follow up is undertaken by the supervisors. CBI/FSA makes a determination/conclusion on the assessment which could result in an additional prudential requirement (e.g., additional Pillar II capital requirements, etc.). The results of such analysis are taken into consideration for the determination of the SREP score.

CBI/FSA uses stress testing to determine the impact of a baseline scenario on an institution’s income statement and balance sheet and to determine whether its own funds are sufficient to meet the overall capital requirement over the forecasted period (Sec 2.4.1 of the SREP framework).

As part of the ICAAP review process, CBI/FSA undertakes an assessment of the institutions’ stress testing results pertaining to credit, counterparty and concentration risk; market risk; IRRBB and operational risk.

CBI/FSA also undertakes an assessment of institution’s ILAAP, including the results of the stress testing of risks to liquidity and funding.

CBI/FSA’s SREP framework/assessment results in a SREP score of 1 (minimal risk identified) to 4 (very high levels of risk identified), and includes an additional negative rating of F (as mentioned in EC1), please see table below for a further description. Note that the SREP score of F (one level below score 4) indicates that the institution is “failing or likely to fail” and is subject to early intervention measures pursuant to Article86(h) of Act No. 161/2002 or measures pursuant to Chapter XII and Temporary Provision VI of the same Act - outlining CBI’s resolvability framework.

Any results of the SREP (e.g., assessment of Pillar 2 requirements), are publicly released as per CBI’s transparency requirements Article9(a) of Act No. 87/1998. The SREP score is not communicated to either the bank or the public.

EC3

The supervisor assesses banks’ and banking groups’ compliance with prudential regulations and other legal requirements.

Description and Findings re EC3

Icelandic banks are required to comply with prudential regulations and many other legal requirements given the necessity to abide by the EU regulatory framework. This at times makes the assessment of banks’ compliance with prudential and other legal requirements a somewhat complicated task. CBI/FSA has mapped all prudential regulations and other legal requirements into one document to maintain an evergreen list of requirements.

Prudential regulations and requirements are in place and are closely tracked through regulatory reporting (monthly, quarterly, annual, etc.) based on FINREP and COREP and in some cases additional reporting (e.g., Portfolio Loan Analysis for credit risk, which tracks loan quality data; credit registry, which highlights large exposures and connected clients) and ad hoc reporting when CBI/FSA deems it necessary (e.g., exposures to problematic countries, etc.).

Further, CBI/FSA closely monitors other legal requirements (e.g., governance - fit and proper requirements, ultimate beneficial ownership, AML/CFT etc.).

CBI/FSA prepares a risk report (D-SIBs) that pulls all risk assessments together (prudential minimum requirements across all risk areas, off-site analysis, on-site inspection results, etc.) which is reported up through to senior management on a quarterly basis.

Further, banks are also closely monitoring internal prudential limits that go beyond minimum prudential and regulatory requirements (embedded in among other things recovery plans) and are legally bound to inform CBI/FSA immediately (e.g., Article 52(e) of Act No. 161/2002).

EC4

The supervisor takes the macroeconomic environment into account in its risk assessment of banks and banking groups. The supervisor also takes into account cross-sectoral developments, for example in non-bank financial institutions, through frequent contact with their regulators.

Description and Findings re EC4

The assessment of the macroeconomic environment in Iceland is carried out by the Financial Stability Unit (FSU) in CBI. In addition, the FSU also carries out the inherent liquidity risk assessment for the D-SIBs as well as overseeing liquidity and funding risk for the entire financial sector. Prior to the FME and CBI merger, representatives of the FSU would meet to discuss various issues. All liquidity data is shared amongst the banking supervisors and the FSD staff. Post-merger, CBI/FSA is able to ensure more frequent communication and cooperation than before between supervisors from financial supervision with specialists in the FSU as well as with the supervisors for non-bank financial institutions that CBI/FSA regulates. Even though this integration and cooperation is still being evolved and formalized, progress has been made to connect micro and macro prudential supervision and integrate it into prudential decisions on individual and market level.

Wider spectrum of collected data is now available for bank and non-bank markets and CBI/FSA now has access to regular information and analysis from financial stability on economic development and on the market situation at each time. For example:

• - Weekly summary for domestic and foreign securities markets (available in Teams).

• - Monthly analysis on foreign exchange market (Power BI tool)

• - Monthly analysis on equity markets (Power BI tool)

CBI/FSA incorporates the factors of the macroeconomic environment into its forwardlooking supervision in its assessment of BMA, ICAAP/ILAAP as well as financial statements (e.g., D-SIBs adhere to IFRS 9 financial asset valuation standards) which both form part of the SREP process and add to the assessment of the buildup of risk in banking sector. Cooperation is critical between the Banking Department and FSU that evaluates banks’ macroeconomic assumptions with peer review and comparison to publicly available forecasts on the macroeconomic environment. Emphasis is on challenging the presumptions of the banks for their forward planning and estimation of evolution of risk in their operations and forecasts.

CBI supervises all non-bank financial institutions such as payment institutions, pension funds, investment funds and insurance companies etc. CBI/FSA therefore possesses a first-hand overview of the banking sector and non-bank financial sector and its developments. The outcome of this review is incorporated into not only the risk assessment in SREP for each supervised entity but in an aggregated way to assess the banking sector which is regularly presented to the FSN and the FMEN.

EC5

The supervisor, in conjunction with other relevant authorities, identifies, monitors and assesses the build-up of risks, trends and concentrations within and across the banking system as a whole. This includes, among other things, banks’ problem assets and sources of liquidity (such as domestic and foreign currency funding conditions, and costs). The supervisor incorporates this analysis into its assessment of banks and banking groups and addresses proactively any serious threat to the stability of the banking system. The supervisor communicates any significant trends or emerging risks identified to banks and to other relevant authorities with responsibilities for financial system stability.

Description and Findings re EC5

The FME monitors, identifies and assesses the build-up of risks (e.g., credit and problem assets/adequacy of provisioning, liquidity and funding risk, market and IRRBB, etc.), trends and concentrations within and across the banking system as a whole through different supervisory means such as different on-site and off-site inspections, reviewing of regular reporting from the banks, through the SREP process. The FME communicates significant trends and emerging risks to the banks through the SREP process as well as by other different means depending on each situation.

System-wide risks, such as those arising from international imbalances or excessive risk concentration potentially leading to sectorial bubbles (e.g., residential, or commercial real estate) are monitored by the FSU. It is based on analysis performed by CBI/FSA and other EU institutions, particularly macro-prudential analysis. Sectorial analysis also facilitates the understanding of key market developments.

The most important findings of the banks are regularly reported to CBI committees where the MoFEA is present. The financial position and the major concerns of the supervisors regarding the condition of the banks or the banking sector is presented to the FSN and the FMEN quarterly and more frequently if required by certain circumstances. Furthermore, Directors within CBI/FSA have weekly meetings where major concerns can be discussed if needed.

Last, CBI publishes its Financial Stability report twice a year wherein all macroeconomic variables, significant trends and emerging risks are discussed.

EC6

Drawing on information provided by the bank and other national supervisors, the supervisor, in conjunction with the resolution authority, assesses the bank’s resolvability where appropriate, having regard to the bank’s risk profile and systemic importance. When bank-specific barriers to orderly resolution are identified, the supervisor requires, where necessary, banks to adopt appropriate measures, such as changes to business strategies, managerial, operational and ownership structures, and internal procedures. Any such measures take into account their effect on the soundness and stability of ongoing business.

Description and findings re EC6

As part of CBI/FSA’s on-going SREP assessment, analysis is carried out regarding banks’ organization structure, systems, outsourcing arrangements, etc., taking into consideration the bank’s risk profile and systemic importance. The objective of this assessment is to provide the foundation for a strategy/or measures that CBI/FSA should adopt to ensure resolvability issues are dealt with in advance of a problem.

At the FSN’s meeting of 28-29 September 2021, the Resolution Authority⁴⁵ presented draft resolvability assessments for the D-SIBs. Thereafter, the FMEN’s opinion of the resolvability assessments was sought (as per the FSN’s Rules of Procedures). After no comments from the FMEN, at the meeting held 5 November 2011 (minutes published on 29 November 2011), the FSN approved the resolvability assessments of the D-SIBs (no major requirements for D-SIBs resulted from the resolvability assessments - especially given the straightforward ownership structure of the banks post financial crisis) . No issues remain with respect to CBI/FSA’s ability to resolve the D-SIBs. Assessors noted that the financial supervisors did not provide input into the drafting of the resolvability assessments prior to being submitted to the FSN. Although the FMEN was able to provide input/comments after the development of the resolvability assessment. It would be beneficial to involve the financial supervisors in future versions, given their deep knowledge of the D-SIBs.

Furthermore, on 26 April 2022, CBI announced publicly⁴⁶ that the Resolution Authority prepared approved resolution plans for Iceland’s D-SIBs. (please see EC7 for more details on the role of the Resolution Authority and the resolution plans put in place for the D-SIBs).

EC7

The supervisor has a clear framework or process for handling banks in times of stress, such that any decisions to require or undertake recovery or resolution actions are made in a timely manner.

Description and Findings re EC7

CBI/FSA has an internal framework in place for handling banks in times of stress. At the outset, early detection of bank weaknesses are considered a part of the SREP process and the regular monitoring of each bank. KRI’s have been defined for each risk and signs of increased risk are addressed in the risk assessment. The close co-operation between supervisors within the Banking Department, Compliance and Financial Stability ensures that any signs of stress are addressed in a timely manner.

CBI/FSA does have the ability to call an emergency or special FMEN meeting to deal with an emerging issue with a problem bank. Further, CBI/FSA has a framework and operational processes for handling banks in times of elevated stress that require actions to be taken in a timely manner. Internal mechanisms for dealing with problem banks are established however a document formalizing the escalation process is in the midst of being finalized. A working group is in the process of drafting a manual to formally describe the framework and the escalation process within CBI for handling banks in times of stress related to own funds or liquidity.

This document reflects expectations of CBI/FSA supervisors to raise issues on a timely basis up to senior management and including the use of intervention tools, strategies and enforcement actions (such decisions are taken by the FMEN). Moreover, part of the framework includes ensuring that D-SIBs (that make up 94 percent of total assets in the banks sector as at end of June 2022) have both a recovery and resolution plan in place.

Early intervention is considered by CBI/FSA when:

• overall SREP score or the viability score for one of the main risk elements is 4; and/or

• indicators for capital ratio (own funds exceeding requirements), LCR or NSFR have reached their threshold; and/or

• events deemed significant occur.

Assessors are of the view that waiting until the overall SREP score or the viability score for one of the main risk elements is rated 4 would not be deemed “early intervention”. CBI should re-assess when it chooses to undertake “early intervention” measures to ensure it acts on a timely basis when necessary. Further, CBI/FSA should be taking corrective action well before banks reach regulatory capital and/or liquidity prudential requirements.

Supervisory measures are utilized when needed as stipulated in Article107(a) of Act No. 161/2002. Article107(c) outlines all early intervention tools available to CBI/FSA which is also in line with the EBA GL on triggers for use of early intervention measures (EBA/GL/2015/03), pursuant to Article27(4) of Directive 2014/59/EU.

Recovery plans, which have been prepared since 2017-18, are assessed on a yearly basis. Recovery plans are suited to list appropriate measures for recovery based on strategic analysis of core business lines and critical functions. CBI/FSA’s assessment of these plans includes a review of the proposed measures in connection to the scenario analysis is conducted in the recovery plan.

Further, in accordance with Article 4, Paragraph 2, of the Act on Resolution of Credit Institutions and Investment Firms, No. 70/2020 (Act No.70/2020 or the Resolution Act) and Rule No. 1733/2021, CBI together with the Resolution Authority will, among other things, put in place resolution plans for the D-SIBs. It is the decision of the FMEN if an institution is deemed to be failing or likely to fail (i.e., those that are unable to service their liabilities or are highly likely to be unable to do so) with the Governor of CBI who takes the final decision on the resolution process itself. Further the resolution plans cover the execution of bank resolution in the event that their financial position deteriorates to the point that they are deemed failing or likely to fail. Should a D-SIB fail, the resolution plan assumes that it will be possible to resolve it quickly and securely, and without funding from the Treasury or CBI. Resolution is intended to ensure that households and businesses continue to have unrestricted access to critical functions, thereby supporting financial stability in Iceland.

Arts 98-106 of Chapter XII of Act No. 161/2002 describes CBI’s legal framework in dealing with bank’s financial reorganization, winding up and mergers of financial undertakings in a crisis. All decisions of such nature are undertaken by the FMEN.

EC8

Where the supervisor becomes aware of bank-like activities being performed fully or partially outside the regulatory perimeter, the supervisor takes appropriate steps to draw the matter to the attention of the responsible authority. Where the supervisor becomes aware of banks restructuring their activities to avoid the regulatory perimeter, the supervisor takes appropriate steps to address this.

Description and Findings re EC8

Article 20 and 21 of Act No. 161/2002 outlines the authorized activities of credit institutions and other permitted and ancillary activities. Further, Article 3 states that only legal entities that are licensed as credit institutions may operate by collecting deposits or other repayable funds from the public. Therefore, if a firm wishes to undertake banking activities or a current bank wishes to undertake a new area of business that is not outlined in its current license, it must first obtain the prior approval of CBI.

CBI regularly monitors the market for any firms operating bank-like activities, as well as undertaking an annual project to actively survey the market for any new institutions within specific ISAT categories and checking for key wording linked to banking activities.

If a firm is found to be undertaking bank-like activities without a license, further investigation is conducted and if appropriate, CBI can impose administrative fines (as per Article 110(1) of Act No. 161/2002) which states that CBI/FSDA may level administrative fines on any party violating Article 3, prohibiting pursuit of activities subject to license without an operating license. Further, CBI may inform the public through the publication of a transparency announcement (as per Article 9(a) of Act No. 87/1998). Decisions of this nature are taken by CBI’s FMEN.

Internal procedures (e.g., CCQ) exist regarding what steps CBI representatives are required to address regarding a case of a firm undertaking bank-like activities.

Last, CBI/FSA supervisors review banks’ activities, including any restructuring initiatives that could avoid or circumvent certain conditions of law, rules, and regulation. In each such case, the Authority responds appropriately and demands that the banks rectify the situation.

Assessment of Principle 8

Largely Compliant

Comments

FSA/FME fully implemented its risk based SREP framework in 2019 which is based on a proportionality approach, that takes into consideration the impact category rating of the institutions which results in a SREP score and distinguishes between the nature/intensity and frequency of the SREP. For a high impact banks, a full SREP is completed annually and is aligned with CBI/FSA’s minimum engagement model that include deep analysis of ICAAP/ILAAP, BMA, etc. Other categories of impact result in an analysis ranging from two to four years frequency which in practice does not provide adequate supervisory coverage for these institutions, as most of the financial supervisor’s time/attention is focused on the DSIBs. For example, the forth commercial bank (not a D-SIB), although classified as medium to low impact, has experienced additional growth, etc. in the past year which should therefore have resulted in additional frequency of supervisory assessment or contact with senior management of the bank.

CBI undertakes a quarterly risk assessment analysis for high impact banks, speaks to bank’s senior management quarterly and rolls this assessment into the SREP framework culminating in a SREP score.

CBI’s SREP methodology is very labor intensive, and therefore it is important to ensure it has an on-going, ever green view (e.g., not just annually) of the risk assessment/risk profile of the banks, especially for DSIBs.

Last, CBI’s SREP methodology should reflect early intervention measures well before a bank reaches capital and/or liquidity minimum prudential requirements. Further, CBI should not wait until the overall SREP score or the viability score for one of the main risk elements is rated 4 to take intervention measures as this would not be deemed “early intervention”.

Principle 9

Supervisory Techniques and Tools

The supervisor uses an appropriate range of techniques and tools to implement the supervisory approach and deploys supervisory resources on a proportionate basis, taking into account the risk profile and systemic importance of banks.

Essential Criteria

EC1

The supervisor employs an appropriate mix of on-site⁴⁷ and off-site⁴⁸ supervision to evaluate the condition of banks and banking groups, their risk profile, internal control environment and the corrective measures necessary to address supervisory concerns. The specific mix between on-site and off-site supervision may be determined by the particular conditions and circumstances of the country and the bank. The supervisor regularly assesses the quality, effectiveness and integration of its on-site and off-site functions, and amends its approach, as needed.

Description and Findings re EC1

On-site and off-site supervisory functions are split amongst several departments within CBI/FSA that work very closely together and are described as follows:

• The Banking Department mainly conducts the off-site supervision together with risk specialists in the same department working horizontally on all banks. This department is responsible for the overall SREP process, which entails detailed quarterly risk assessments/meetings with bank senior management and reporting within CBI/FSA. Furthermore, this department drives the overall assessment of the ICAAP and ILAAP as well as the BMA which includes bi-lateral meetings on every risk captured by these processes. Risk specialists within the Banking Department, within the Inspections Department and the FSU will attend such meetings and assist with the overall assessment. The supervisors who oversee the D-SIBs in the Banking Department are considered the “owners” of the overall risk assessment of the bank.

• The Compliance and Inspections Department provides/undertakes:

  • a) legal support to the Banking Department when it comes to regulatory compliance and is responsible for all authorizations, including fit and proper assessment and corporate governance expertise; and

  • b) on-site inspections (together with the various risk specialists from the Banking Department joining the on-site team when needed).

  • c) on and off-site AML/CFT supervision that oversees all institutions in the various markets that CBI/FSA regulates, including banks.

• The FSU, Liquidity Section conducts the micro-prudential supervision of inherent liquidity and funding risk of banks and performs stress testing for the entire banking sector.

The Banking Department oversees the SREP process cycle and will request, as part of the planning process, the on-site inspection team to undertake an area of particular concern. In addition, at times, there is a need for a follow-up inspection concerning any shortcomings that were found as highlighted in previous on-site inspections.

During CBI/FSA’s Supervisory Work Programme process formal requests are made by the Banking Department for on-site inspections, together with a justification. Meetings are usually held with the Inspections department to further clarify the request, scope the inspections, including holding discussions to determine the best way to conduct the onsite. During each on-site inspection regular meetings are held between the Inspections department and Banking department to provide progress update.

The IA of CBI/FSA regularly assesses the main processes for off-site and on-site supervision providing feedback and recommendations. Post-merger of CBI and the FSA, the IA undertook several reviews to ensure that the various areas dealing with banking supervision and regulation were working as it should.

Assessors reviewed several D-SIB supervisory files pertaining to the quarterly risk assessment and risk report, SREP analysis (BMA, ICAAP and ILAAP) which appeared to be extensive in both in how the analysis is undertaken/captured and then communicated to banks. Any observations from on-site inspections are also rolled into these various assessments.

Further, assessors reviewed example on-site inspection reports for various D-SIB “thematic reviews”. The on-site risk specialists are very knowledgeable, have industry experience and are very capable of undertaking reviews across various risk areas. The onsite inspections are generally carried out on a thematic review basis, covering all three D-SIBs. Individual follow-up inspections are carried out when necessary.

It was noted that when undertaking an on-site credit risk review, the inspectors would choose a limited sample of credit files to review, albeit these files would potentially be classified as large exposures, and then make broader comments/conclusions on the bank’s overall practices. It is recommended that future on-site inspections are undertaken, particularly for the D-SIBs, with larger sample sizes and overall, a deeper scope across the various aspects of the risk area. Further, with the extensive EBA guidelines that have been released over the past several years, it would be beneficial for CBI to undertake deeper on-site inspections of the DSIBs’ various material risk areas to ensure adequate compliance with these newly adopted guidelines.

Overall, the mix of off-site supervision with on-site inspection appears to be appropriate with most of the work being allocated to the D-SIBs. However, the approach of the onsite inspection should be re-assessed to ensure that the depth of the reviews encompasses, on a risk basis, the review of adequate policies and procedures, internal controls, including the strength of bank’s risk management processes. Further, CBI should implement a standard for the frequency of on-site inspections applicable for all banks, regardless of impact rating.

EC2

The supervisor has a coherent process for planning and executing on-site and off-site activities. There are policies and processes to ensure that such activities are conducted on a thorough and consistent basis with clear responsibilities, objectives and outputs, and that there is effective coordination and information sharing between the on-site and offsite functions.

Description and Findings re EC2

As part of the annual supervisory planning process, the supervisory tasks planned for the following year is based on the outcome of the risk assessments undertaken over the prior year, together with the results of the SREP process and prior on-site inspections. In general, future tasks are scheduled to mitigate the risk identified using the most appropriate measures available (off-site or on-site inspections, follow-up meetings etc.). CBI/FSA’s methodology for the planning off-site risk assessment versus on-site inspections is also driven by the minimum engagement model (based on the impact rating) - please see CP8 EC1 for more detail.

All tasks surrounding the planning cycle for both on-site and off-site supervisors is described in detail in CBI/FSA’s CCQ. For example, the list of the tasks for the following year that the off-site banking supervisors wishes the on-site inspectors to perform are listed as an input for the planning process. (VER-0107). Following this step, the CCQ then lists the processes that describe the “project planning” phase which helps determine the annual Supervisory Work Programme. Regular progress updates can be found as per processes VER-0041 and VER-0073 outlined in the CCQ. The off-site supervisors (owners) meet with the on-site inspection team to discuss planned tasks. The senior management of the Banking Department then decide/discuss what priorities need to take place for the coming year based on the resources available and finalize the Supervisory Work Programme for the following year, as well as prepare the budget planning process that results in a view of the Supervisory Work for the next 3-5 years.

EC3

The supervisor uses a variety of information to regularly review and assess the safety and soundness of banks, the evaluation of material risks, and the identification of necessary corrective actions and supervisory actions. This includes information, such as prudential reports, statistical returns, information on a bank’s related entities, and publicly available information. The supervisor determines that information provided by banks is reliable⁴⁹ and obtains, as necessary, additional information on the banks and their related entities.

Description and Findings re EC3

CBI/FSA utilizes a variety of information, including prudential data (see CP10 for compliance with EBA reporting framework), additional reporting requirements, ad hoc data requests, data obtained from on-site inspections, risk reports and other documents directly from the bank, including shareholdings, as well as publicly available data to assess and evaluate the major risk categories on a monthly, quarterly, and annual basis.

Additionally, CBI has an extensive data gathering from both supervised entities, other corporations, and institutions for various usage for central bank tools, such as Portfolio Loan Analysis (PLA), credit registry (corporate loans that provide collateral data and connected client/group information and data on real estate backed loans such as household mortgages). Not all data gathered by CBI (e.g., data collected by the FSU) is available to the Banking Department supervisors but if there is need for certain information available it can be requested and it is provided so long as personal client information is not released.

CBI also subscribes to various databases and information centres like Bloomberg, S&P banking data (mostly used by the FSU).

Further, CBI/FSA makes use of information from both open public sources as well as subscribed ones for on- and off-site supervision. Open sources like Firm registry - Skatturinn, National registry - Pjodskra (integrated into Vaki), Statistics Iceland from Hagstofan.

With respect to shareholder information, Article19(4) of Act No. 161/2002 requires all financial undertakings to specify on its website the names and proportional holdings of all shareholders that hold 1 percent or more in the financial institution. Changes are to be updated in four days or less. Real owners are to be disclosed for legal entities that hold shares larger than 1 percent in the financial undertaking.

Several CBI/FSA on-site thematic inspections have been carried out over the past 24 months to validate D-SIB’s reporting, covering the following topic: review data reporting in credit registry; the right use of SME-discount; review on the use of risk weights in COREP report - limited to certain risk weights and mitigation for loans with insurance in real estate (home and corporate); valuation review; and a review on forbearance⁵⁰.

All communications, findings and material important data are filed in OneCrm file management system of CBI/FSA.

EC4

The supervisor uses a variety of tools to regularly review and assess the safety and soundness of banks and the banking system, such as:

• (a) analysis of financial statements and accounts;

• (b) business model analysis;

• (c) horizontal peer reviews;

• (d) review of the outcome of stress tests undertaken by the bank; and

• (e) analysis of corporate governance, including risk management and internal control systems.

The supervisor communicates its findings to the bank as appropriate and requires the bank to take action to mitigate any particular vulnerability that have the potential to affect its safety and soundness. The supervisor uses its analysis to determine follow-up work required, if any.

Description and Findings re EC4

CBI/FSA uses a variety of tools to review and assess the safety and soundness of the banks as part of its SREP process and its quarterly monitoring risk assessment/risk reporting including KRIs. This assessment includes a review of:

(a) the financial statements of the banks, issued on a quarterly basis. Following the review supervisors undertake meetings with the banks’ management to discuss CBI/FSA’s evaluation of risks inherent in the bank’s operations.

(b) the banks business plans and models which are reviewed annually through the SREP process and challenged in this context. The different stress tests performed by the banks are also reviewed and challenged by CBI/FSA especially when analyzing the different types of risks in the SREP process (e.g., credit, concentration, liquidity and funding, market risk and IRRBB, etc.).

(c) results of the quarterly risk assessment and risk reports provide senior management to make peer comparisons across all three of the D-SIBs.

(d) results of bank’s stress testing is embedded in the ICAAP and ILAAP reports received and reviewed by CBI/FSA as part of its annual SREP assessment for the D-SIBs (less frequent review for the lower impact banks); and

(e) corporate governance and internal controls are mainly monitored through the SREP process but also the evaluation of the eligibility and fit and proper conditions of the board of directors and the managing director of the bank is assessed regularly through off-site assessment processes. The quality of risk management of the various risk reviews is carried out when on-site inspections are undertaken but limited to the subject of the review (see CP15 for more information). Assessors are of the view that CBI does not undertake formal or deep assessments of bank’s corporate governance, including the quality of risk management or internal control functions, except through off-site analysis and when the on-site team happens to carry out a thematic on-site inspection (e.g., there is not a dedicated and focused review of corporate governance, etc.).

The findings of the SREP process as well as off-site inspections are communicated to the banks including expectations on the requirements of banks to address any deficiencies identified. See EC8 for additional information on how the result of this analysis is carried out and the frequency of this communications.

CBI/FSA follow-up with banks on its findings through the use of the bank IA, as well as through additional discussions or follow up on-site inspections. CBI/FSA tracks outstanding deficiencies in its internal system. Further, CBI/FSA also makes use of the EA to follow up on specific issues previously identified.

EC5

The supervisor, in conjunction with other relevant authorities, seeks to identify, assess and mitigate any emerging risks across banks and to the banking system as a whole, potentially including conducting supervisory stress tests (on individual banks or systemwide). The supervisor communicates its findings as appropriate to either banks or the industry and requires banks to take action to mitigate any particular vulnerability that have the potential to affect the stability of the banking system, where appropriate. The supervisor uses its analysis to determine follow-up work required, if any.

Description and Findings re EC5

CBI/FSA supervisory practices ensure constant awareness of the importance of individual institutions health and soundness for the banking and financial system as a whole. The Banking Department and the FSU work together with the purpose of identifying, assessing, and mitigating emerging risks, across banks and for the banking system as a whole.

Risk is assessed on both on an individual bank and system-wide level in CBI. Macroprudential supervision stress tests are undertaken as part of the risk assessment under CBI/FSA’s SREP procedures as well as part of the bank’s recovery plan scenario analysis. Various stress tests and scenario analysis is used under and for assessment on various risk categories, according to Banking Department supervisory procedures that build on the SREP methodology. FSU and the Banking Department work together on assessing the stress test framework in ICAAP/ILAAP reports as well as the bank’s recovery plans. This analysis is mostly dedicated to the D-SIBs which represent close to 94 percent of total assets. Results of stress-tests, including potential vulnerabilities in D-SIBs overall risk profile is communicated to the bank. CBI’s approach is to adjust minimum capital or liquidity requirements for individual banks once vulnerabilities are detected. Assessors noted examples of where this is done in practice by CBI.

FSU is also responsible for system wide stress test conducted by CBI. Macroprudential policy⁵¹ of CBI centres on safeguarding the stability of the financial system as a whole by limiting systemic risk. Its main objective is to enhance stability and increase resilience, thereby reducing the risk of financial shocks. In order to achieve its macroprudential objectives, CBI has macroprudential tools that it can apply when warranted. These tools generally take the form of CBI rules, including rules on capital buffers for financial institutions, foreign exchange balance, liquidity, and net stable funding, as well as rules restricting loan-to-value ratios and loan-to-income or debt service-to-income ratios for consumer mortgages. Decisions on the application of macroprudential tools are taken by the FSN. The Committee bases its decisions on an analysis of the position of the financial system, the financial markets, the economy as a whole, systemic risk, and resilience against potential shocks. CBI also carries out stress tests to evaluate resilience and conducts scenario analyses of key risk factors.

The annual system wide stress test is a systemic one (e.g., a macroprudential stress test with a cyclical stress scenario). The scenarios used are published on CBI’s website and findings as well on aggregated level in the report in CBI’s Financial Stability Report.

The credit registry gives a monthly overview of material exposures and systemic built up of risk in the banking system as a whole where financial undertakings with certain thresholds are required to report their loan portfolio to FME with the credit registry, version 3.0. FME can use this data and see how exposures to certain parties, connected parties or sectors is building up in the system and act on it if needed. The information is used to assess connections between debtors of banks and possible contagion effects between banks and to the economy as a whole. CBI/FSA recently received more extensive credit registry data that provides information for the whole loan portfolio of the bank beyond 300 million ISK. This will allow the FSU the ability to run special stress tests on the entire portfolio of banks.

EC6

The supervisor evaluates the work of the bank’s internal audit function, and determines whether, and to what extent, it may rely on the internal auditors’ work to identify areas of potential risk.

Description and Findings re EC6

CBI/FSA evaluates the work of the banks’ IA functions on a yearly and ad hoc basis. Once a year, at a minimum, the IA of D-SIBs reports to CBI/FSA on the conclusions of its reviews. The Banking Department meets with the bank’s IA to discuss the reviews undertaken and, in some cases, if the reviews are considered reliable, will rely on the results of such findings. Furthermore, the IA shall specifically and promptly report to CBI/FSA any comments made and submitted to the board of directors. The Banking Department/Compliance have asked for copies of IA reports of the D-SIBs for review of findings. Last, CBI/FSA may at any time subject the qualifications of the director of the IA to a special investigation if deemed necessary.

EC7

The supervisor maintains sufficiently frequent contacts as appropriate with the bank’s Board, non-executive Board members and senior and middle management (including heads of individual business units and control functions) to develop an understanding of and assess matters such as strategy, group structure, corporate governance, performance, capital adequacy, liquidity, asset quality, risk management systems and internal controls. Where necessary, the supervisor challenges the bank’s Board and senior management on the assumptions made in setting strategies and business models.

Description and Findings re EC7

As outlined in CBI/FSA’s SREP methodology for its minimum engagement model (e.g., the frequency of meetings with Board and senior management representatives is based on the bank’s impact assessment). For D-SIBs, this includes annual engagement with both the Board (which is made up entirely of external representatives) and senior management. Specifically, the Banking Department (together with risk specialists) meet quarterly with the CFO, CRO or their representatives) to discuss the quarterly financial statement and state and trend in material risk categories. Issues addressed are among many things financial results, strategy, operational trends, major operational events, credit risk, valuation of financial assets and asset quality etc.

Further, as part of the SREP process a planned meeting is held for all material risk categories within the ICAAP/ILAAP where results of this assessment are presented. High level and middle management attend these meetings from the banks as well as relevant specialists for each risk category. Often more than one meeting is held for each risk.

A special meeting is held for BMA where assumptions and presumptions are discussed as well as it helps assess macroeconomic assumptions used for forecasted business plan for 3-5 years. Before final results of the SREP risk assessment are presented to the financial undertaking/bank a draft is delivered and a meeting for that draft is held in case there are misunderstandings or misrepresentation of facts etc. in FME’s SREP results or capital requirements. Finally, after the formal opposition proceedings, findings of the SREP process are presented in letter to the board as well as a meeting is held with the board and senior management where relevant issues are addressed as well as the findings of the risk assessment and capital requirements. As indicated previously, this process is carried out for the D-SIBs only.

The Banking Department occasionally contacts the banks’ Boards and Audit Committees on an ad hoc basis, as needed. However, CBI/FSA is in frequent formal and informal communications with the banks’ directors and senior and middle management in connection with various on-site and off-site inspections, requests, and applications, etc.

EC8

The supervisor communicates to the bank the findings of its on- and off-site supervisory analyses in a timely manner by means of written reports or through discussions or meetings with the bank’s management. The supervisor meets with the bank’s senior management and the Board to discuss the results of supervisory examinations and the external audits, as appropriate. The supervisor also meets separately with the bank’s independent Board members, as necessary.

Description and Findings re EC8

The findings of the SREP process are communicated to the banks first informally (via meetings), then draft findings are presented to the bank for in a report for formal opposition proceedings and then final letters are issued to the banks. If results in the SREP contain an assessment of Pillar 2 risks, this letter is posted on CBI/FSA’s website according to the transparency notices (Act No. 87/1998).

With respect to on-site inspections, draft reports are provided to the banks prior to the exist meeting, this report also subject to formal opposition proceedings, with a final report issued a usually a couple of weeks after this exit meeting. The Banking Department then issues a formal letter with all requirements and recommendations as a result of the on-site examination which is sent to the bank. In this letter, the timeframe for finishing all amendments is defined and it is the Banking Department supervisors who are tasked with the follow up to ensure that relevant amendments are implemented by the bank.

The findings of any particular off-site inspection are communicated to the banks on various case specific issues and based on the inspection’s level of formality, depending on the severity of the issue /issues at hand. In a formal off-site inspection, the findings are communicated through a formal report following the similar procedure as on-site inspection and delivered with a formal letter and communication process. In a less formal inspection, findings can be communicated to the bank by letter, at a meeting, through email or in a phone conversation. All findings are accounted for in the SREP risk assessment process. If findings are severe and need boards involvement necessary measures are taken, including valuating if the matter calls for revaluation of SREP risk assessment.

Results of on-site inspections sent to the senior management of the bank and the final decision letters are sent to the BOD. Assessors note that the on-site inspection reports should also be provided to the BOD to ensure awareness of the detail of CBI/FSA’s findings. Furthermore, assessors noted the substantial time lag (up to 8 months) between the results of the inspection reports being handed over to senior management of the bank and the final letter on the results of the on-site inspection issued to the BOD. CBI/FSA should re-assess its timeliness of communication with the BOD with regards to the on-site inspection formal letters as the time lag between when the on-site inspection report is issued and the formal supervisory letter is issued, could cause confusion with the bank’s BOD/senior management as to what deficiencies are still outstanding, etc.

EC9

The supervisor undertakes appropriate and timely follow-up to check that banks have addressed supervisory concerns or implemented requirements communicated to them. This includes early escalation to the appropriate level of the supervisory authority and to the bank’s Board if action points are not addressed in an adequate or timely manner.

Description and Findings re EC9

CBI/FSA’s SREP framework entails continuous communication with the D-SIB (less so for savings banks), KRI and risk assessment monitoring.

CBI/FSA’s Vaki internal reporting systems tracks all outstanding requirements and recommendations as well as findings that require further investigation or follow-up where specific timelines/deadlines for action is tracked. This electronic system will send automatic notifications to the Banking supervisor for follow-up, this helps ensure nothing is left unattended in the follow-up process.

Urgent matters regarding for example a bank becoming aware of a breach of a capital or liquidity requirement prior to CBI/FSA, are required to report such issues immediately. CBI/FSA then determines how such issues are handled according to its severity and urgency. KRI and regular quarterly risk assessment monitoring also ensures issues are follow-up on a timely basis.

If the matters under consideration are deemed material, CBI/FSA will re-consider the risk score of the SREP assessment. CBI senior management are notified as well as approve any actions or update to the SREP assessment.

EC10

The supervisor requires banks to notify it in advance of any substantive changes in their activities, structure and overall condition, or as soon as they become aware of any material adverse developments, including breach of legal or prudential requirements.

Description and Findings re EC10

Article 9(2) of Act No. 87/1998 states that the FSA shall be notified in advance, as applicable, of any changes in previously submitted information, including information concerning the board of directors or managing directors, any increase or decrease in the number of branches, and when a financial undertaking no longer meets the conditions for the issue of an operating license.

CBI/FSA receives notifications regarding various changes in the banks’ activities, structure, and conditions. For example, the banks frequently inform CBI/FSA in due time of major changes or foreseeable breaches of laws, rules, or regulations. The notifications are usually informal at first and subsequently require a meeting with the banks or that the banks write a formal letter to CBI/FSA. Notification of some changes is done through regular reporting.

Last, banks are required to provide notification to CBI/FSA of any structural changes as per Article21 (2) and Article22 of Act No. 161/2002.

EC11

The supervisor may make use of independent third parties, such as auditors, provided there is a clear and detailed mandate for the work. However, the supervisor cannot outsource its prudential responsibilities to third parties. When using third parties, the supervisor assesses whether the output can be relied upon to the degree intended and takes into consideration the biases that may influence third parties.

Description and Findings re EC11

Article9(2) of Act No. 161/2002 states that the FSA may appoint an expert to investigate certain aspects of the activities or operations of a regulated entity, or to undertake other specific supervision of such an entity.

CBI/FSA performs its supervision to large extent with its own staff. Occasionally CBI/FSA hires an independent third party to assist its employees with specific tasks such as an onsite inspection. CBI/FSA in this case would assess its degree of reliance on such work with third parties.

CBI/FSA seeks to assess the ability of the third party to perform the task in question professionally and subjectively considering relations and potential interests. Third parties sign statements in this regard and agreement are made for their mandate. Various internal checklists are outlined in CBI/FSA internal requirements and include:

• checklist for hiring specialist

• draft of statement to the supervised entity informing of the hire and cost

• draft agreement with specialist

• draft mandate letter

• draft final decision of the hire of specialist

• draft information of cost

• draft information on extension of use of specialist

EC12

The supervisor has an adequate information system which facilitates the processing, monitoring and analysis of prudential information. The system aids the identification of areas requiring follow-up action.

Description and Findings re EC12

In recent years CBI/FSA has increased its ability to store, process, monitor and analyze information automatically by developing its IT systems and its business intelligence capabilities. Streamlining information gathering across the post-merger of CBI/FSA in order to ease the burden of reporting with the common reporting framework (EU) is in progress. Further, much work is being undertaken to implement solutions for supervisors to access and analyze relevant data (e.g., newly developed Power BI tool) as well as implementing solutions for supervisors to access and analyze relevant data. Older outdated solutions are in the process of being outed like Targit and InfoPath reports.

In addition, the data warehouse stores sources of information that is accessible to relevant employees through various tools and analysis, like PBI, Vaki and K-helix.

Analysis of the prudential data in COREP, FINREP, PLA and the credit registry reports are an important part of the supervision and build the foundation for KRI monitoring along with the EBA risk reporting framework. CBI/FSA has implemented its KRI system wherein many indicators with defined limits indicate warning signals that supervisors must take into account in their regular monitoring and risk assessment reporting.

Although Vaki is designed to store and structure the risk-based supervision, risk assessment and supervisory information as well as document KRI breeches, it is still somewhat under development due to technical issues.

Results of SREP reports, including the conclusion of SREP and letters sent as a result of an on-site inspection are documented and tracked in Vaki (see ECX for more detail). Furthermore, risk assessment, with recommendations for on- or off-site inspections or other supervisory measures, is stored in Vaki and used in supervisory planning process as well.

Additional Criteria

AC1

The supervisor has a framework for periodic independent review, for example by an internal audit function or third party assessor of the adequacy and effectiveness of the range of its available supervisory tools and their use, and makes changes as appropriate.

Description and Findings re AC1

Assessment of Principle 9

Largely Compliant

Comments

CBI’s off-site supervision function undertakes the full SREP assessments, however the scope for the on-site program needs to encompass a broader scope of review work (not just thematic reviews focusing on specific risk areas of concern), covering not only material risks but deep assessments of corporate governance, including the quality of risk management and internal control functions, with a risk-based approach over a multi-year cycle. While on-site inspectors carry out their inspections on a timely basis (inspection reports are provided to management only), banks’ Board of Directors only receive “formal letters’, which include remedial/corrective actions that are being issued with at times delays as supervisors await the results of all three on-site inspections to be completed (to ensure consistency in findings) and legal sign off on letters. This current process is undermining the effectiveness of CBI’s communication which needs to be done on a timely basis. CBI’s internal standard on completion of reviews (e.g., the issuance of the formal letters to the Board within 4 weeks), should be adhered to.

Further, CBI should implement a standard for the frequency of on-site inspections applicable for all banks, regardless of impact rating.

Principle 10

Supervisory Reporting

The supervisor collects, reviews and analyses prudential reports and statistical returns⁵² from banks on both a solo and a consolidated basis, and independently verifies these reports through either on-site examinations or use of external experts.

Essential Criteria

EC1

The supervisor has the power⁵³ to require banks to submit information, on both a solo and a consolidated basis, on their financial condition, performance, and risks, on demand and at regular intervals. These reports provide information such as on- and off-balance sheet assets and liabilities, profit and loss, capital adequacy, liquidity, large exposures, risk concentrations (including by economic sector, geography and currency), asset quality, loan loss provisioning, related party transactions, interest rate risk, and market risk.

Description and Findings re EC1

Article 32 of Act. No. 92/2019 and Article107 of Chapter XIII of Act No. 161/2002, provides CBI/FSA with the authority to require banks to submit all information that it deems necessary, on both a solo and consolidated basis.

Article107 (2-6) states that:

The FSA may demand any sort of documentation or information from subsidiaries or affiliates, or from other parties regarded as having close connections with a financial undertaking, which the FME regards as necessary in the course of its supervision of the financial undertaking concerned.

The FSA may demand any sort of data or information from holding companies in the financial sector or mixed holding companies, provided the FME deems such information necessary for its supervision of financial undertakings that are subsidiaries of these holding companies.

The FSA shall oversee dealings by a financial undertaking with its subsidiaries and affiliated companies, companies that control or have holdings in the financial undertaking, and other subsidiaries and affiliated companies of such companies. Furthermore, the FME shall keep track of dealings between a financial institution and individuals with holdings of 20 percent or more in the above-mentioned companies. Financial undertakings shall provide the FSA with a report on such dealings in accordance with its specific instruction. Where the dealings are made with enterprises or individuals in other states, cooperation between supervisory authorities shall be as provided for in international agreements to which Iceland is a party and cooperation agreements concluded by the FSA on their basis.

The FSA may, at the request of supervisory authorities in another state, verify information from parties in Iceland subject to supplementary supervision of financial conglomerates. The supervisory authorities concerned may participate in efforts to verify such information.

Should the FSA be of the opinion that activities covered by this Act are pursued without the required authorization, it may demand from the parties concerned or parties subject to supervision such data and information as are necessary to determine whether such is the case. It can demand that such activities be ceased immediately. In addition, it may make public the names of parties regarded as offering services without the required authorization.

Article 9 of Act No. 87/1998 states the FSA shall inspect the operations of regulated entities as often as deemed necessary. These entities are required to grant the FSA access to all their accounts, minutes, documents, and other material in their possession regarding their activities which the FSA considers necessary.

CBI/FSA has adopted and implemented EBA reporting framework and validation rules. Lists for regular reporting to CBI/FME is publicly available for each sector⁵⁴ covering both EBA reports and CBI/FSA reports. Example of various amendments requirement for rereporting based on data validation rules have been numerous in recent years.

CBI receives the following standardized reports according to CBI’s data reporting process, that includes solo (parent bank), consolidated (group) as well as on and off-balance sheet information and include:

Monthly: (either from parent companies and/or subsidiaries)

• Assets, liabilities, and equity report

• Report on foreign currency assets and liabilities

• Various reports on Loans and Default loans (credit registry, LPA)

• Liquidity reports

• Balance of foreign assets and liabilities

• Results of stress tests (ad hoc)

• Report on liquidity risk (only those under sign-off condition)

• AMM (XBRL report)

Quarterly:

• Consolidated interim financial statements

• Interim financial statements FINREP report with financial statements

• Asset encumbrance (FINREP)

• Capital adequacy report (COREP)

• Report on large exposures

• Report on IRRBB

• Report on market risk (newly developed report by CBI/FSA)

Semi-annually:

• Reports on other services, ancillary activities, and temporary operations

• Interim financial statement (excluding banks: less than 2 billion ISK)

• Report on transactions with related parties

• Foreign assets and liabilities owed to foreign creditors

Annually:

• Audited financial statements

• Auditor’s report to the board of directors

• Auditors report on loans to related parties

• Report on internal controls

• Report from internal auditor on the main findings for the year

• Compliance officer annual report

• Report on equity owners that are qualified holders and their equity share

• ICAAP/ILAAP

• Recovery plan

• Funding Plan

• Loans to related parties

• IT self-assessment

• AML - self assessment

In addition to the above referenced reports, additional information is routinely collected and verified as part of on-site and off-site inspection and as well as ad-hoc inquiries.

EC2

The supervisor provides reporting instructions that clearly describe the accounting standards to be used in preparing supervisory reports. Such standards are based on accounting principles and rules that are widely accepted internationally.

Description and Findings re EC2

Article 88 of Act No. 161/2002 states that the annual accounts must give a clear picture of the financial position and operating performance of the financial undertaking. They must be compiled in accordance with law, rules, and good accounting practices, and include, for instance, a profit and loss account, a balance sheet, explanatory notes, and information on off-balance-sheet items.

The D-SIBs have implemented the IFRS accounting standards as stipulated by Chapter VIII of Act. No. 3/2006 on Annual Accounts. Rules No. 834/2003 on the Financial Statements of Credit Institutions apply to the smaller savings banks as they have not implemented the IFRS standards. CBI is of the view that it would be too onerous to have the smaller savings banks adhere to the IFRS standards - opting for the continued use of Rules No. 834/2003.

The FSA has issued the following Rules relating to annual accounts of financial undertakings which provide clear reporting instructions to banks:

• Rules No. 834/2003 on the Financial Statements of Credit Institutions;

• Rules No. 97/2004 on the Financial Statements of Management Companies of UCITS; and

• Rules No. 102/2004 on the Financial Statements of Securities Companies and Securities Brokerages.

• Rules No. 1085/2021 on disclosure requirements of financial undertakings.

EC3

The supervisor requires banks to have sound governance structures and control processes for methodologies that produce valuations. The measurement of fair values maximizes the use of relevant and reliable inputs and is consistently applied for risk management and reporting purposes. The valuation framework and control procedures are subject to adequate independent validation and verification, either internally or by an external expert. The supervisor assesses whether the valuation used for regulatory purposes is reliable and prudent. Where the supervisor determines that valuations are not sufficiently prudent, the supervisor requires the bank to make adjustments to its reporting for capital adequacy or regulatory reporting purposes.

Description and Findings re EC3

FSA has issued methodology and benchmarks for assessing risk systematically in the SREP process. These benchmarks are reviewed regularly. The supervisor assesses whether the valuation used for regulatory purposes is reliable and prudent.

IFRS 9 standards are required in accordance with Chapter VIII of Act No. 3/2006. The requirements set out in the Chapter are consistent with the EU Accounts Directive. Smaller banks that have not implemented the standards must prepare their accounts in accordance with Chapter VII (valuation rules) of Rules No. 834/2003. All banks are required to have audited financial statements utilizing appropriate valuation methodologies and practices.

Financial undertakings are required to have their financial statements audited by certified auditors. Part of the audit and the discussion with the auditor of supervised entities involves discussing value of financial assets and valuation methods.

The supervisor may disagree with the financial undertaking on what constitutes a prudent valuation and may require banks to either write down (impair) assets or increase the own funds requirement.

CBI/FSA legislation, rules or guidelines (including EBA guidelines) do not specifically require that bank’s valuation framework and control procedures be subject to adequate independent validation and verification, either internally or by an external expert.

EC4

The supervisor collects and analyses information from banks at a frequency commensurate with the nature of the information requested, and the risk profile and systemic importance of the bank.

Description and Findings re EC4

CBI/FSA collects and analyses data from banks in accordance with the impact assessment of the banks based on its SREP Methodology. Please see EC1 for detail on the type and frequency of reporting to CBI/FSA by banks. D-SIBs are required to file FINREP prudential reporting which provides more in-depth data and at a greater frequency than the COREP reporting applicable to savings banks with less frequency and data points.

CBI collects information regarding KRIs, as well as for the regular monitoring to undertake its risk assessment of banks according to supervisory handbook of FME (CCQ).

Post-merger, CBI/FSA is working towards the streamlining of information gathering, the data warehouse and the way information is accessible to supervisors. Still all reported data is available and accessible through legacy systems and PowerBI software. FME has adopted the EBA data model framework and collects EBA material reports. Risk indicators of the EBA risk framework have been in use and FME uses KRI approach in its regular monitoring and risk assessment. The risk management procedure (see CP 8 and 9) of the FME and of CBI ensure that information is collected, analyzed, and reviewed according to risk-based supervision.

Analysis is conducted at intervals corresponding with reporting frequency and calibrated to the significance of data collected for risk analysis (e.g., liquidity reports are collected and analyzed monthly, whereas less important data may be collected and analyzed with lower frequency).

EC5

In order to make meaningful comparisons between banks and banking groups, the supervisor collects data from all banks and all relevant entities covered by consolidated supervision on a comparable basis and related to the same dates (stock data) and periods (flow data).

Description and Findings re EC5

As described in EC 1 and 2, reports and data are collected by the FSA from all credit institutions are on a comparable basis and related to the same dates and periods as appropriate. Risk assessment, KRI-approach and regular monitoring include cross comparison and tends between reporting periods.

FINREP and COREP data collection is put through various validation exercises (in accordance with EU requirements), and therefore CBI/FSA is able to draw meaningful comparisons between banks. Data is collected from all relevant entities covered by consolidated supervision; however, the legal structure of the D-SIBs is very straight forward with no cross border operations, without any issues regarding whether dates and periods are questionable.

Another way to compare data from banks is to use EBA published data like the quarterly risk dashboard and annual transparency exercises information where banks, countries etc. can be compared. Now that the EBA has expanded its data collection under EUCLID to include all credit institutions in the EC/EEA a larger set of data for comparable institutions is expected to become available. Also, CBI has access to S&P Global Market Intelligence data and can, when necessary, compare various data to set of banks and companies around the world.

EC6

The supervisor has the power to request and receive any relevant information from banks, as well as any entities in the wider group, irrespective of their activities, where the supervisor believes that it is material to the condition of the bank or banking group, or to the assessment of the risks of the bank or banking group or is needed to support resolution planning. This includes internal management information.

Description and Findings re EC6

CBI/FME has the power to request and receive any relevant information from banks or any related party where it is believed to be material for the supervision or to the financial position of the bank as per Article9 (3) of Act No. 87/1998 states that both individuals and legal entities are required to:

In connection with its supervision and investigations under the provisions of special legislation, natural and legal persons are required to supply the Financial Supervisory Authority with any information and material the Authority considers necessary. In this context it is of no relevance whether the information concerns the party to which the request is directed or transactions with other parties on which the party is able to supply information which concerns the investigation and supervision of the FSA. Provisions of law concerning confidentiality do not restrict the obligation to provide information and access to data. This shall not apply to information obtained by legal professionals in the course of ascertaining the legal position of their client, including advice on instituting or avoiding judicial proceedings, or information obtained before, during or after the conclusion of judicial proceedings if the information is directly related to such proceedings.

Please see EC1 for more detail.

EC7

The supervisor has the power to access⁵⁵ all bank records for the furtherance of supervisory work. The supervisor also has similar access to the bank’s Board, management and staff, when required.

Description and Findings re EC7

Article 9(1) of Act 87/1998 and Article107 of Act No. 161/2002 states that CBI/FSA has the power to have full access to information regarding its supervisory work (see EC1 for more detail).

Article 9 of Act No. 87/1998 states the FSA shall inspect the operations of regulated entities as often as deemed necessary. These entities are required to grant the FSA access to all their accounts, minutes, documents, and other material in their possession regarding their activities which the FSA considers necessary.

As part of risk-based supervision regular interviews are conducted with board and high-level management and can be conducted on ad-hoc basis as well. Onsite inspections are also conducted where all bank data and information are made available on basis of forementioned legal requirements.

EC8

The supervisor has a means of enforcing compliance with the requirement that the information be submitted on a timely and accurate basis. The supervisor determines-the appropriate level of the bank’s senior management is responsible for the accuracy of supervisory returns, imposes sanctions for misreporting and persistent errors, and requires that inaccurate information be amended.

Description and Findings re EC8

Article11 (Penalties and daily fines) of Act No. 87/1998 states that the FME has the power to impose penalties if the regulated entity fails to provide the requested information or fails to heed requests for rectifications within a reasonable time limit. Further, Article112(b)(2) of Act No. 161/2002 states that deliberate misreporting to an official is a criminal offence punishable by up to 2 years imprisonment. Last, CBI has comprehensive legal powers that can be applied to gather data or information as well as enforcement aid as per Chapters IX and XI of Act No. 92/2019.

The FME imposes penalties in the form of ’per diem’ fines if banks fail to provide the requested information within a set time limit. The FME also follows up to ensure that inaccurate information is amended in a timely manner. FME has imposed such penalties in practice (as described above) as well as for bank’s misreporting or for persistent errors.

The authorized official of the bank must sign all supervisory returns. Also, automated reminder notices via e-mail of upcoming reporting due dates are delivered 5-7 days to the bank before the due date by FSA’s reporting system.

EC9

The supervisor utilizes policies and procedures to determine the validity and integrity of supervisory information. This includes a programme for the periodic verification of supervisory returns by means either of the supervisor’s own staff or of external experts.⁵⁶

Description and Findings re EC9

CBI/FSA applies professional skepticism in its risk-based supervision on qualitative and quantitative information. KRI-review is used in addition to delta analysis of reported data, followed by off-site communications when needed. The verification is supplemented by on-site visits. Comparison of financial reporting is also compared to risk reporting like FINREP.

The FSA has defined, implemented, and issued a high-level process for data reporting to ensure consistency in the FSA approach to determining the validity and integrity of supervisory information. A process and procedure for Data Quality Assurance (DQA) rules have been implemented in the FSA Management-IT systems which result in defective data submissions being either rejected or flagged for follow-up. As part of this framework FSA has adopted the EBA Data Model and its validation framework and validation rules are applied for data integrity and reporting in other FSA’ reports like Credit registry.

EC10

The supervisor clearly defines and documents the roles and responsibilities of external experts,⁵⁷ including the scope of the work, when they are appointed to conduct supervisory tasks. The supervisor assesses the suitability of experts for the designated task(s) and the quality of the work and takes into consideration conflicts of interest that could influence the output/recommendations by external experts. External experts may be utilized for routine validation or to examine specific aspects of banks’ operations.

Description and Findings re EC10

Article9(2) of Act No. 87/1998 states that:

The FSA may appoint a specialist for inspecting certain aspects of the operations or management of a party subject to supervision, or to undertake specific supervision of such a party. The specialist shall be appointed for a specific period, but no longer than four weeks at a time. The specialist is entitled to working facilities on the premises of the party subject to supervision, and shall be given access to all requested accounts, minutes, documents, and other material in their possession. The specialist is entitled to attend meetings of the board of the party subject to supervision as an observer with the right of speech. His obligation to observe secrecy shall be in accordance with Chapter IV of this Act. The party subject to supervision shall carry the expense of the specialist’s work, in part or whole, as estimated by the FSA.

The FSA defines and documents the roles and responsibilities of external experts, including the scope of the work, and monitors the quality of the work. Procedure thereabout is available to FSA if needed. Further Article94 of Act No. 161/2002 states that the FSA may carry out special audits and engage a State Authorized Public Accountant for this purpose.

Please see CP9 EC11 for more detail.

EC11

The supervisor requires that external experts bring to its attention promptly any material shortcomings identified during the course of any work undertaken by them for supervisory purposes.

Description and Findings re EC11

When an external expert is appointed by the FSA according to Article9 of Act No. 87/1998 indicates that a contract is signed that requires the expert in question to inform the FSA about any material shortcomings identified regarding the operation of parties subject to supervision.

EC12

The supervisor has a process in place to periodically review the information collected to determine that it satisfies a supervisory need.

Description and Findings re EC12

CBI/FSA has defined a high-level process for the review of all data reporting to ensure that supervisory data needs are being met. The process includes the performance of an annual assessment as part of the planning process when determining the banks’ mandatory reporting requirements and submission schedule for the following year. CBI/FSA has a process for assessing and reviewing incoming data and this process is being adapted for the overall merged CBI.

Assessment of Principle 10

Compliant

Comments

CBI’s IT infrastructure, supervisory data collection and interfaces built or being built for supervisors is very dynamic. CBI collects data from a variety of sources (FINREP, COREP and goes beyond the EU framework LPA, credit registry data, ad hoc data requests etc.). Further, the interfaces in the process of being built or are built (Power BI,Vaki) enable supervisors to effectively work with key data points, produce graphs and analysis to support the SREP and risk assessment processes. Further, CBI utilizes data verification methodology in line with EU expectations.

Principle 11

Corrective and Sanctioning Powers of Supervisors

The supervisor acts at an early stage to address unsafe and unsound practices or activities that could pose risks to banks or to the banking system. The supervisor has at its disposal an adequate range of supervisory tools to bring about timely corrective actions. This includes the ability to revoke the banking license or to recommend its revocation.

Essential Criteria

EC1

The supervisor raises supervisory concerns with the bank’s management or, where appropriate, the bank’s Board, at an early stage, and requires that these concerns be addressed in a timely manner. Where the supervisor requires the bank to take significant corrective actions, these are addressed in a written document to the bank’s Board. The supervisor requires the bank to submit regular written progress reports and checks that corrective actions are completed satisfactorily. The supervisor follows through conclusively and in a timely manner on matters that are identified.

Description and Findings re EC1

Article10 of Act No. 87/1998 states that if a bank does not comply with laws or regulations, CBI must order that the situation be rectified within a reasonable time limit. CBI must opine on any aspect of the situation or operation of a regulated entity that it considers unsound and inconsistent with proper business practices in other respects. Should that situation arise, CBI may call a meeting of the board of directors to discuss its comments and demands, and ways to rectify the situation. A representative of CBI may chair the meeting and have the right to speak and make proposals.

If on-site and/or off-site inspections reveal that a bank does not comply with laws and regulations, the bank is required to make corrections/take corrective actions within a defined time limit communicated in writing. Following on-site inspections CBI requires the IA of the bank to assess whether corrective actions have been met. CBI also assesses whether corrective action have been completed in a satisfactorily manner.

The findings of CBI are always in written form, addressed to the bank’s BOD or its CEO, as per Article108 of Act No. 161/2002 states that the FSA shall justify its decisions in writing regarding the application of supervisory powers or penalties pursuant to this Act.

For example, assessors noted that in certain cases where material findings from such a review result in the inspection report being provided to the CEO instead of the BOD. CBI/FSA should ensure that all inspections reports are provided to bank BODs/Audit Committee and not just the CEO. (noted in CP9)

In addition, assessors noted that CBI/FSA tend to make use of an assessment of additional capital rather than make use of the other intervention tools/measures outlined in Article107(a) of Act No. 161/2002.

EC2

The supervisor has available⁵⁸ an appropriate range of supervisory tools for use when, in the supervisor’s judgment, a bank is not complying with laws, regulations or supervisory actions, is engaged in unsafe or unsound practices or in activities that could pose risks to the bank or the banking system, or when the interests of depositors are otherwise threatened.

Description and Findings re EC2

Article107(a) and (c) of Act No. 161/2002 provides CBI/FSA with a range of appropriate options for intervention when a bank is not complying with laws, regulations, rules or guidelines.

Article107(a) is used for less severe situations. If the credit institution does not fulfill legal and regulatory requirements of if CBI is of the opinion that, within the next 12 months, it is likely that a credit institution will not be in a position to fulfil legal or regulatory requirements, CBI can impose certain measures upon the credit institution, the choice of which is appropriate given the gravity of the situation (Article 107 A (3))

Article107 (c) is used when the financial situation has further deteriorated: When the credit institution violates the Act (161/2002), or its regulations, or increasingly serious financial situation (including worse liquidity position, increased leverage or increased defaults) makes it more likely that it will violate the Act or its regulations (cf. 107 9(c)(1)) as well as subject to per diem fines pursuant to Article 11 of Act 87/1998..

See EC4 for a full description of tools.

EC3

The supervisor has the power to act where a bank falls below established regulatory threshold requirements, including prescribed regulatory ratios or measurements. The supervisor also has the power to intervene at an early stage to require a bank to take action to prevent it from reaching its regulatory threshold requirements. The supervisor has a range of options to address such scenarios.

Description and Findings re EC3

CBI/FSA has the power to intervene at an early stage to require banks to address issues. Specifically, Article107(a) and (b) of Act 161/2002 outlines the ability of CBI to require banks to hold additional capital well before the breach of regulatory ratios and states that: The FSA shall notify financial undertakings of the guidance on additional own funds it deems desirable, in particular on the basis of a stress test as provided for in the seventh paragraph of Article 80, in excess of its obligations under this Act and the requirements of the FSA laid down in Art.107(a) to cover risks that the obligation does not cover sufficiently.

CBI has a range of options to address scenarios described in EC2 and EC3 - please find description of supervisory measures and tools in EC4.

EC4

The supervisor has available a broad range of possible measures to address, at an early stage, such scenarios as described in essential criterion 2 above. These measures include the ability to require a bank to take timely corrective action or to impose sanctions expeditiously. In practice, the range of measures is applied in accordance with the gravity of a situation. The supervisor provides clear prudential objectives or sets out the actions to be taken, which may include restricting the current activities of the bank, imposing more stringent prudential limits and requirements, withholding approval of new activities or acquisitions, restricting or suspending payments to shareholders or share repurchases, restricting asset transfers, barring individuals from the banking sector, replacing or restricting the powers of managers, Board members or controlling owners, facilitating a takeover by or merger with a healthier institution, providing for the interim management of the bank, and revoking or recommending the revocation of the banking license.

Description and Findings re EC4

CBI/FSA has an appropriate range of supervisory measures to address, at an early stage, when a bank is not complying with laws, regulations, rules and/or guidelines.

Article107(a) of Act 161/2002 outlining supervisory powers states that the FSA shall demand that a financial undertaking take the necessary corrective measures in a timely manner if the undertaking does not comply with the provisions of this Act, as well as the regulations and rules adopted by virtue of it.

If, on the basis of data or information in its possession, the FSA considers it likely that a financial undertaking will not be able to comply with the provisions of this Act within the next 12 months, as well as the regulations and rules deriving from it, the FSA shall require the financial undertaking to take the necessary corrective measures in a timely manner. Corrective measures may include, among other things, the application of powers pursuant to this Article or other provisions of the law that are necessary to respond to the situation of the relevant financial undertaking.

To enforce the requirements and follow up on the evaluation as provided for in Article 80 and the fourth and fifth paragraphs of Article 81, third paragraph of Art.109(ff) and Regulation (EU) no. 575/2013, the FSA is authorized to prescribe:

1. higher own funds requirements than those laid down in Regulation (EU) no. 575/2013

2. improvements to internal processes, cf. Chapter IX,

3. that a financial undertaking present a special plan on how the undertaking will fulfil the requirements of this Act as well as the regulations and rules deriving from it, and set deadlines for financial undertakings regarding the implementation of the plan, including due to delays or improvements made to the plan.

4. write-down of assets in the calculation of own funds.

5. limiting or restricting a financial institution’s activities or, as applicable, sale or assets or business units that create excessive risk.

6. reduction of the risks entailed by the undertaking’s activities, products or system, including due to outsourced activities.

7. that financial undertakings limit bonuses to a percentage of net profits when payouts lead to insufficient own funds.

8. that financial undertakings use net profits to strengthen its own funds.

9. that dividend and interest payments to shareholders, guarantee capital owners and owners of additional Tier 1 instruments shall be limited or prohibited, provided this does not cause the financial undertaking to default.

10. Imposing specific liquidity requirements, including due to maturity mismatches between a financial undertaking’s assets and liabilities.

11. More frequent reporting requirements.

12. Additional disclosure to the market.

Article107(c) of Act No. 161/2002, which outlines early interventions by the FSA states that the FSA can apply early interventions against a credit institution or investment firm with guarantee capital if:

a. the undertaking violates the provisions of this Act or government directives based on them and regulations established on their basis, including Regulation (EU) no. 575/2013 or

b. it is likely that, due to a deteriorating financial situation, including a deteriorating liquidity position, increased hedging, increased defaults by borrowers or a concentration of exposures, that the undertaking will violate the Act or government directives as provided for in point (a).

If the circumstances referred to in points (a) or (b) exist, the FSA can implement or demand that a credit institution or investment firm take at least one or more of the following actions:

1. Take measures prescribed in the recovery plan or update the recovery plan and carry out actions according to the updated plan.

2. Submit an action plan with a timeframe to the Financial Supervisory Authority.

3. Call a shareholders’ meeting or guarantee capital owners meeting. If that requirement is not complied with, the Financial Supervisory Authority can call a shareholders’ meeting or guarantee capital owners meeting. In both cases, the Financial Supervisory Authority determines the agenda of the meeting and can demand that certain issues be discussed and decided upon.

4. Dismiss one or more board members and/or managing director, if they do not meet the requirements as provided for in Article 52 (eligibility requirements), Article 52(a) (conflict of interest), Article 54 [also covered in Article107(c)] (violating the conditions of early intervention measures). Note that Article 110 (b) and 112 (f) provide the power to ban an individual from working at a bank or serving on a bank Board.

5. Submit to the Financial Supervisory Authority a plan for negotiations on debt restructuring with creditors.

6. Change the undertaking’s business strategy.

7. Restructure the undertaking.

Further, Article 107 (c) provides for the ability to put in place interim management.

Last, conditions precedent for the CBI to revoke a banking license are set out in Article 9.

CBI/FSA has formed a working group to put in place a formal “escalation” procedure when a problem or issue arises. This procedure, when finalized, is expected to also cover all procedural mechanisms to deal with a crisis situation for a problem bank. This document is expected to be finalized in the coming months. Although certain procedures are covered in the CCQ Supervisory Handbook, assessors have indicated that this escalation of procedures to deal with problem banks should be finalized quickly to ensure that CBI/FSA staff know and understand the procedures and supervisory measures/tools that need to be undertaken quickly in a crisis situation.

Assessors were informed regarding the use of supervisory measures in 2015 for a savings bank wherein various legislative tools were utilized. This is the only case available for assessors review since the crisis of Icelandic bank failures in 2009.

EC5

The supervisor applies sanctions not only to the bank but, when and if necessary, also to management and/or the Board, or individuals therein.

Description and Findings re EC5

Administrative sanctions in the form of penalty payments can and has been issued against both individuals and legal entities.

CBI/FSA has the power to remove a credit institution’s CEO or one or more of its board members if it is of the opinion that the credit institution has seriously violated against laws or administrative rules or if there has been a case of serious mismanagement, cf. Article107(d) of Act No. 161/2002.

EC6

The supervisor has the power to take corrective actions, including ring-fencing of the bank from the actions of parent companies, subsidiaries, parallel-owned banking structures and other related entities in matters that could impair the safety and soundness of the bank or the banking system.

Description and Findings re EC6

Article10(a) of Act 161/2002 states that CBI/FSA has the power to restrict activities of a bank. CBI/FSA is further empowered to set conditions for the continued operations of individual operating units. CBI/FSA would utilize these powers to take corrective actions to limit of restrict actions between parents and other entitles within the groups when/if necessary (e.g., restrict the payment of management fees or dividends, payment of service fees, etc.).

EC7

The supervisor cooperates and collaborates with relevant authorities in deciding when and how to effect the orderly resolution of a problem bank situation (which could include closure, or assisting in restructuring, or merger with a stronger institution).

Description and Findings re EC7

Recovery plans are assessed on a yearly basis. Recovery plans are suited to list appropriate measures for recovery based on strategic analysis of core business lines and critical functions. The assessment reviews these proposed measures in connection to the strategic analysis scenario analysis is conducted in the recovery plan. Recovery plans of systematically important credit institutions have been assessed by FME since 2017-2018 and discussed in detail with each institution.

Further, in accordance with the Article4, Paragraph 2, of the Act on Resolution of Credit Institutions and Investment Firms, No. 70/2020 (Act No.70/2020 or the Resolution Act) and Rule No. 1733/2021, it is the decision of the FMEN if an institution is deemed to be failing or likely to fail (i.e., those that are unable to service their liabilities or are highly likely to be unable to do so) together with the Governor of CBI who takes the final decision on the resolution process itself.

Resolution plans have been put in place by the Resolution Authority to cover the execution of bank resolution in the event that their financial position deteriorates to the point that they are deemed failing or likely to fail. Should a D-SIB fail, the resolution plan assumes that it will be possible to resolve it quickly and securely, and without funding from the Treasury or CBI. Resolution is intended to ensure that households and businesses continue to have unrestricted access to critical functions, thereby supporting financial stability in Iceland.

CBI is empowered to pass necessary information on to other financial supervisors within the EEA as per Arts 109(u), 109 (v), 109(w), 109(x) and 10 (aa) of Act 161/2002.

Additional criteria

AC1

Laws or regulations guard against the supervisor unduly delaying appropriate corrective actions.

Description and Findings re AC1

AC2

When taking formal corrective action in relation to a bank, the supervisor informs the supervisor of non-bank related financial entities of its actions and, where appropriate, coordinates its actions with them.

Description and Findings re AC2

Assessment of Principle 11

Largely Compliant

Comments

CBI/FSA has an appropriate range of supervisory measures to address, at an early stage, when a bank is not complying with laws, regulations, rules and/or guidelines.

Assessors did note CBI/FSA’s tendency to make use of an assessment of additional capital (P2R) rather than make use of the other intervention tools/measures outlined in Article107(a) of Act No. 161/2002.

CBI/FSA has established a working committee to develop and implement internal escalation procedures which help CBI to effectively operationalize such a plan when needed.

Principle 12

Consolidated Supervision

An essential element of banking supervision is that the supervisor supervises the banking group on a consolidated basis, adequately monitoring and, as appropriate, applying prudential standards to all aspects of the business conducted by the banking group worldwide.⁵⁹

Essential Criteria

EC1

The supervisor understands the overall structure of the banking group and is familiar with all the material activities (including non-banking activities) conducted by entities in the wider group, both domestic and cross-border. The supervisor understands and assesses how group-wide risks are managed and takes action when risks arising from the banking group and other entities in the wider group, in particular contagion and reputation risks, may jeopardize the safety and soundness of the bank and the banking system.

Description and Findings re EC1

A legal framework is established to enable CBI to implement consolidated supervision of banking groups. Main legal provisions are laid out in Act No. 161/2002, notably Chapter XIII Section B articles 109 to 109(t) on supervision on a consolidated basis, covering a wide range of relevant issues, from consolidated prudential requirements to the conduct of consolidated supervision, including consolidated regulatory reporting, cooperation among authorities on cross-border banking groups, conditions for group financial support. In addition, CBI is empowered to address banking groups fragilities at consolidated level, by article 107(g) on early intervention on a consolidated basis.

Among other legal provisions relevant to consolidated banking supervision included in Act No. 161/2002 are the following:

• - the board of directors and managing director shall notify CBI when a group of companies is formed, and when substantial changes in organization of a group of companies take effect (article 52(c));

• - consolidated accounting is applicable at banking group level (article 97);

• - CBI has the right to acquire information and carry out on-site inspections in associated companies or companies in which the bank is a shareholder.

Act No. 61/2017 on supplementary supervision of financial conglomerates implemented EU directive No. 2002/87/EC (FICOD), as amended by EU directive No. 2011/89/EU, in Iceland . This Act provides CBI with additional responsibilities and tools to supervise financial conglomerates. While specific banking and insurance regulations are already applicable to the banking activities of financial conglomerates, this Act requires CBI to apply supplementary supervision to financial groups in order to reduce the risks inherent in their activities, and CBI is provided with powers to oversee the conglomerates’ parent entities, such as holding companies. There is only one financial conglomerate in Iceland, with no major bank involved.

Supervision of banking groups is conducted both on a consolidated basis and on a standalone basis. CBI maintains oversight on the overall structure of a bank, both through prudential reporting checklists, and the bank’s consolidated financial statements and reports. Regulatory prudential reporting encompasses both the stand-alone and consolidated levels. CBI supervisors review prudential reporting and financial statements of banking groups on a quarterly basis and file their findings and concerns in checklists. SREP is implemented for banking groups on a consolidated basis.

EC2

The supervisor imposes prudential standards and collects and analyses financial and other information on a consolidated basis for the banking group, covering areas such as capital adequacy, liquidity, large exposures, exposures to related parties, lending limits and group structure.

Description and Findings re EC2

Act No. 161/2002 lays down rules on prudential requirements applicable to banking groups on a consolidated basis. Chapter X sets prudential regulations of capital buffers. Rules on consolidated supervision of capital adequacy and liquidity are mainly found in EU CRR and CBI Rules No. 1520/2022 on liquidity requirements for banks which implements the EU liquidity regulation. Chapter XIII of Act No. 161/2002 has enacted provisions on measures to be taken if own funds are insufficient. In addition, Chapter XI states rules regarding annual accounts, auditing, and consolidated accounts. CBI also refers to EU CRR, Part 4, articles 387 to 403, on rules regarding large exposures.

Consolidated capital requirements are defined in article 83(d): “Capital buffers for systemically important financial undertakings globally shall be maintained on a consolidated basis. CBI of Iceland may stipulate by regulations that other capital buffers be maintained on a consolidated, sub-consolidated or entity basis, as appropriate.”

Article 109 is extending the scope of legal requirements to banking groups as a principle: “The provisions of Chapters VII, IX and IX A shall apply to groups where the parent company is a financial undertaking, mixed financial holding company or financial holding company. The parent company shall be responsible for implementation of this provision within the group.”

CBI has legal power to impose prudential standards at the stand-alone and consolidated levels regarding capital adequacy, large exposures, exposures to related parties, lending limits, group structure, and liquidity. Consolidated supervision powers are enforced in prudential regulations by Act 161/2002, Article 109 (l), as well as in supervisory processes, such as regulatory reporting templates on a consolidated basis. Moreover, CBI imposes more stringent standards well above the minimum requirements, based on its own assessment, if needed. CBI has also issued the following rules on liquidity and funding: Rules No. 266/2017 on credit institutions’ liquidity ratios, and Rules No. 750/2021 on credit institutions’ minimum net stable funding ratios.

CBI reviews reports from banks and their financial statements on a consolidated basis, and takes appropriate action, when necessary.

EC3

The supervisor reviews whether the oversight of a bank’s foreign operations by management (of the parent bank or head office and, where relevant, the holding company) is adequate having regard to their risk profile and systemic importance and there is no hindrance in host countries for the parent bank to have access to all the material information from their foreign branches and subsidiaries. The supervisor also determines that banks’ policies and processes require the local management of any crossborder operations to have the necessary expertise to manage those operations in a safe and sound manner, and in compliance with supervisory and regulatory requirements. The home supervisor takes into account the effectiveness of supervision conducted in the host countries in which its banks have material operations.

Description and Findings re EC3

Cross-border activities of banks and banking groups are regulated by Act No. 161/2002, notably Chapter V, supplemented by Chapter XIII Section B that includes many detailed articles (from 109 to 109(hh)) regarding consolidated supervision.

CBI may demand any sort of documentation or information from subsidiaries or affiliates or from other parties regarded as having close connections with a regulated bank, which CBI regards as necessary for consolidated supervision.

Regular supervision is conducted on a consolidated basis, including foreign operations. CBI implements oversight of the overall structure of a bank, based on banks’ prudential reporting, consolidated financial statements, and reports. The prudential reporting is structured on a consolidated as well as on a stand-alone basis. Management of group operations can be evaluated during on-site inspections.

The SREP is conducted on a consolidated basis, resulting in evaluating the risk profile of each banking group, and key risks are rated. Part of the SREP focuses on corporate governance and risk management, covering both domestic and international activities.

Icelandic systemically important banks have developed very few operations in foreign countries since the 2008-10 great financial crisis. One commercial bank has very recently developed its network abroad, with the acquisition of a UK subsidiary, which operations are still not material. CBI considers the effectiveness of supervision conducted in host countries in which banks have material operations. Should operations in foreign countries become material, CBI would step up supervisory work accordingly.

EC4

The home supervisor visits the foreign offices periodically, the location and frequency being determined by the risk profile and systemic importance of the foreign operation. The supervisor meets the host supervisors during these visits. The supervisor has a policy for assessing whether it needs to conduct on-site examinations of a bank’s foreign operations, or require additional reporting, and has the power and resources to take those steps as and when appropriate.

Description and Findings re EC4

As a general principle, CBI has legal power for implementing supervision of foreign branches and subsidiaries of a banking group regulated in Iceland, according to Act No. 161/2002, article 107.

In reality, given that Icelandic banks have currently no foreign establishments, except one subsidiary of a non-major bank in the UK, the existing legal framework on international cooperation aimed at enabling consolidated supervision by CBI has not been concretely implemented.

EC5

The supervisor reviews the main activities of parent companies, and of companies affiliated with the parent companies, that have a material impact on the safety and soundness of the bank and the banking group, and takes appropriate supervisory action.

Description and Findings re EC5

As already mentioned under CP5 EC4, CBI has legal power to identify the shareholding structure of regulated banks, including qualified holdings and ultimate beneficial ownership.

Based on Act No. 161/2002, Article 107 (Para 2) and Article 49, CBI has legal power to oversee main shareholders of regulated banks, including parent companies, as well as sister companies (that is, subsidiaries of parent companies), in order to identify any risk issue that might impact regulated banks, coming from shareholders’ group structures that are not included in the scope of consolidated banking supervision.

During the mission, CBI has mentioned that there has been no need to oversee any parent company so far, given the absence of non-financial holding companies among major banks’ shareholders. Therefore, there has been no case for which banking supervisors would have needed accessing to a parent company on-site, applying enforcement action over the parent company and/or its directors and managers, requiring financial reports of the parent company, restricting upstream dividends or transactions between the bank and its affiliates, or applying consolidation of any relevant entity, even if not directly controlled.

EC6

The supervisor limits the range of activities the consolidated group may conduct and the locations in which activities can be conducted (including the closing of foreign offices) if it determines that:

• (a) the safety and soundness of the bank and banking group is compromised because the activities expose the bank or banking group to excessive risk and/or are not properly managed;

• (b) the supervision by other supervisors is not adequate relative to the risks the activities present; and/or

• (c) the exercise of effective supervision on a consolidated basis is hindered

Description and Findings re EC6

CBI has legal power to limit the range of activities that banking groups may conduct, according to Act No. 161/2002, Chapter V Section B. CBI may prohibit activities of banks abroad.

Powers of limitation of banks’ foreign activities are included in Act No. 161/2002. Article 9 lays down the grounds for revocation of an operating license, which may be decided in full or in part. Article 10(a) lays down rules regarding restrictions on banks’ activities, which may be decided if CBI sees specific reasons to do so. In addition, CBI is authorized to establish special conditions for the continued operations of individual establishments of a bank. Furthermore, CBI is permitted to temporarily restrict, in part or in full, operations that an undertaking is permitted to engage in, whether the undertaking is subject to an operating license or not. Before any revocation may be enacted by CBI, related banks must be allowed a suitable period to rectify the situation, if rectification is possible in the estimation of CBI.

In practice, such power has not been used, because CBI did not need to use it.

EC7

In addition to supervising on a consolidated basis, the responsible supervisor supervises individual banks in the group. The responsible supervisor supervises each bank on a stand-alone basis and understands its relationship with other members of the group.⁶⁰

Description and Findings re EC7

CBI implements banking supervision at stand-alone level and consolidated level through supervisory processes.

Assessment of Principle 12

Compliant

Comments

The legal framework is in place to ensure consolidated supervision of banking groups, which is implemented by CBI in supervisory processes.

The existing legal framework enable CBI’s oversight of regulated banks’ main shareholders, including parent companies and sister companies (at least, risk-significant subsidiaries of parent companies), in order to identify and address any risk issue that might impact regulated banks, coming from shareholders’ group structures that are not included in the scope of consolidated banking supervision. In practice, the need of such extended CBI oversight on banks’ shareholders has not been identified yet. Effective CBI oversight of banks’ shareholdings on a regular basis, not only at the licensing stage or at the change of ownership stage, may be further developed.

Principle 13

Home-host Relationships

Home and host supervisors of cross-border banking groups share information and cooperate for effective supervision of the group and group entities, and effective handling of crisis situations. Supervisors require the local operations of foreign banks to be conducted to the same standards as those required of domestic banks.

Essential Criteria

EC1

The home supervisor establishes bank-specific supervisory colleges for banking groups with material cross-border operations to enhance its effective oversight, taking into account the risk profile and systemic importance of the banking group and the corresponding needs of its supervisors. In its broadest sense, the host supervisor who has a relevant subsidiary or a significant branch in its jurisdiction and who, therefore, has a shared interest in the effective supervisory oversight of the banking group, is included in the college. The structure of the college reflects the nature of the banking group and the needs of its supervisors.

Description and Findings re EC1

CBI has legal power to establish supervisory colleges that would be needed for international cooperation aimed at ensuring consolidated supervision of banking groups, according to Act No. 161/2002, article 109(j) on supervisory colleges.

In reality, since no Icelandic bank has any foreign branch or subsidiary, except one nonmajor bank’s subsidiary in the UK (Alternative Investment Fund Manager), there has been no concrete need for CBI to set up supervisory colleges. This UK subsidiary is nonmaterial for UK supervisory authorities, and bilateral cooperation may take place as needed based on the bilateral MoU.

EC2

Home and host supervisors share appropriate information on a timely basis in line with their respective roles and responsibilities, both bilaterally and through colleges. This includes information both on the material risks and risk management practices of the banking group⁶¹ and on the supervisors’ assessments of the safety and soundness of the relevant entity under their jurisdiction. Informal or formal arrangements (such as memoranda of understanding) are in place to enable the exchange of confidential information.

Description and Findings re EC2

As mentioned in CP3 EC2, CBI has signed many bilateral and multilateral Memorandums of Understanding (MOUs), and CBI has legal power to share information and collaborate with foreign supervisory authorities, within and without the EEA.

According to Act No. 87/1998, article 14, CBI may provide foreign regulatory authorities of other EEA member states with confidential information, if such information sharing is part of cooperation in the supervision of activities of regulated entities and is useful in permitting the conduct of the supervision prescribed by law. CBI may share confidential information with regulatory authorities of non-EEA countries, provided that obligations of confidentiality are observed. Existing MoUs include provisions concerning information sharing, on-site inspections, and protection of confidentiality.

There are no branches of foreign banks operating in Iceland, and no supervised entity in Iceland has any branch in another country. Subsequently, CBI is not using any of the signed MoU’s for the purpose of prudential supervision of specific entities, except for the UK subsidiary of the non-major Icelandic bank (a recent acquisition). However, CBI mentioned that it used these MoU’s for getting information when assessing the qualified holders of supervised entities, years ago, and it faced no issues that impacted CBI assessment.

CBI is a member of only one supervisory college relating to a payment institution (therefore, not a bank).

EC3

Home and host supervisors coordinate and plan supervisory activities or undertake collaborative work if common areas of interest are identified in order to improve the effectiveness and efficiency of supervision of cross-border banking groups.

Description and Findings re EC3

As already mentioned, since no Icelandic bank has any foreign branch or subsidiary, except one non-material bank subsidiary in the UK, CBI has not started any work concerning coordinating or planning supervisory activities with other authorities acting as home or host supervisors.

Only one European foreign investment firm has opened a branch in Iceland, using the EU/EEA passporting framework. CBI has received information concerning the branch from the home supervisor according to EU Directive 2014/65/EU. Supervision of this branch is performed by CBI according to Act No. 115/2021 on markets in financial instruments. CBI has faced no issues with cross-border information sharing on that case.

EC4

The home supervisor develops an agreed communication strategy with the relevant host supervisors. The scope and nature of the strategy reflects the risk profile and systemic importance of the cross-border operations of the bank or banking group. Home and host supervisors also agree on the communication of views and outcomes of joint activities and college meetings to banks, where appropriate, to ensure consistency of messages on group-wide issues.

Description and Findings re EC4

As already mentioned, since no Icelandic bank has any foreign branch or subsidiary, except one non-material bank subsidiary in the UK, CBI has not developed any communication strategy with other authorities acting as home or host supervisors.

EC5

Where appropriate, due to the bank’s risk profile and systemic importance, the home supervisor, working with its national resolution authorities, develops a framework for cross-border crisis cooperation and coordination among the relevant home and host authorities. The relevant authorities share information on crisis preparations from an early stage in a way that does not materially compromise the prospect of a successful resolution and subject to the application of rules on confidentiality.

Description and Findings re EC5

As already mentioned, since no Icelandic bank has any foreign branch or subsidiary, except one non-material bank subsidiary in the UK, CBI has not developed any crossborder crisis cooperation and coordination that would involve relevant home and host authorities.

Yet Iceland is part of the cooperation agreement on cross-border financial stability, crisis management, and resolution signed between relevant ministries, central banks and financial supervisory authorities of Iceland, Denmark, Finland, Norway, Sweden, Lithuania, Latvia, and Estonia.

On a national basis, the Resolution Authority of CBI has made resolution plans for banks, according to Act No. 70/2020, article 9.

EC6

Where appropriate, due to the bank’s risk profile and systemic importance, the home supervisor, working with its national resolution authorities and relevant host authorities, develops a group resolution plan. The relevant authorities share any information necessary for the development and maintenance of a credible resolution plan. Supervisors also alert and consult relevant authorities and supervisors (both home and host) promptly when taking any recovery and resolution measures.

Description and Findings re EC6

The resolution framework of a cross-border banking group is subject to legal provisions in Act No. 161/2002, Chapter XII, which addresses financial reorganization of a bank with head offices located in Iceland and a branch in another EEA state, as well as financial reorganization of a bank with its head office located abroad and a branch in Iceland.

As mentioned under CP13 EC5, CBI has not developed any cross-border crisis cooperation and coordination that would involve relevant home and host authorities, because there has been no need to do so, given the inexistence of cross-border banking groups in both ways. Therefore, development of group resolution plans including cross-border arrangements has not been relevant so far.

Yet the Resolution Authority of CBI has made resolution plans for domestic systemically important banks, according to Act No. 70/2020, article 9.

EC7

The host supervisor’s national laws or regulations require that the cross-border operations of foreign banks are subject to prudential, inspection and regulatory reporting requirements similar to those for domestic banks.

Description and Findings re EC7

The legal framework enforces the principle of a similar supervision of domestic banks and Icelandic branches and subsidiaries of EEA foreign banks. Yet this principle has not been implemented, because there has not been any branch of foreign banks in Iceland.

EC8

The home supervisor is given on-site access to local offices and subsidiaries of a banking group in order to facilitate their assessment of the group’s safety and soundness and compliance with customer due diligence requirements. The home supervisor informs host supervisors of intended visits to local offices and subsidiaries of banking groups.

Description and Findings re EC8

The legal framework enabling mutual on-site inspections exists, but it has not been implemented so far, because of the lack of cross-border entities.

EC9

The host supervisor supervises booking offices in a manner consistent with internationally agreed standards. The supervisor does not permit shell banks or the continued operation of shell banks.

Description and Findings re EC9

The licensing regime prohibits shell banks from operating in Iceland. In that regard, when examining applications for a new banking license, CBI reviews the applicant bank’s operational structure. CBI has confirmed that there are no shell banks, nor any booking office of any bank located in Iceland.

EC10

A supervisor that takes consequential action on the basis of information received from another supervisor consults with that supervisor, to the extent possible, before taking such action.

Description and Findings re EC10

The legal framework in place states that information received by CBI from foreign supervisors for banking supervision is protected as confidential. In the event that CBI would have to take action on the basis of such information, CBI would consult with foreign supervisors, as appropriate, before taking action. Yet such framework has not been concretely implemented so far, because of inexistence of cross-border entities.

Assessment of Principle 13

Compliant

Comments

Home-host relationships don’t need to be much developed in Iceland because crossborder banking activities through branches and subsidiaries is limited in both ways.

However, a dedicated legal and institutional framework is in place on home-host relationships, which is appropriate.

Immateriality of cross-border banking entities has made the set-up of supervisory colleges, as well as the conduct of on-site inspections abroad, unnecessary so far. Crossborder cooperation for supervisory purpose is implemented on a case-by-case basis. CBI is well connected to other supervisory authorities with which it may be relevant to ensure effective relationships, especially among Nordic countries.

No main finding has been identified.

Prudential Regulations and Requirements

Principle 14

Corporate Governance

The supervisor determines that banks and banking groups have robust corporate governance policies and processes covering, for example, strategic direction, group and organizational structure, control environment, responsibilities of the banks’ Boards and senior management,⁶² and compensation. These policies and processes are commensurate with the risk profile and systemic importance of the bank.

Essential Criteria

EC1

Laws, regulations or the supervisor establish the responsibilities of a bank’s Board and senior management with respect to corporate governance to ensure there is effective control over the bank’s entire business. The supervisor provides guidance to banks and banking groups on expectations for sound corporate governance.

Description and Findings re EC1

The responsibilities of the BOD of a company are set out in Article68 of the Act respecting Public Limited Companies, No. 2/1995, (Act No. 2/1995) which state the BOD undertake the Company affairs and ensures the Company’s organization and activities are at all times in correct and in good order. The Company’s BOD and the Director undertake the administrative activities of the Company, where the Director is in charge of daily operations. Furthermore, the Company’s BOD shall ensure that the book-keeping and the handling of Company funds be sufficiently supervised.

Iceland has implemented Article 88 of Directive 2013/36/EU into Arti 54 of Act 161/2002. It is stated that the board is responsible for the company’s operations and strategy, robust governance arrangements, which include a clear organisational structure with well-defined, transparent, and consistent lines of responsibility, risk strategy, adequate internal control mechanisms, including sound administration and accounting procedures. The board must oversee the process of disclosure and communications.

CBI/FSA’s expectations and guidance on governance are set out in various guidelines and rules, including:

• EBA/GL/2018/03 on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing (5.3 Organisation and functioning of the management body)

• EBA/GL/2021/05 on internal governance (Title II - Role and responsibility of the management body)

• EBA-ESMA/GL/2021/06 on the assessment of the suitability of members of the

• management body and key function holders

• EBA/GL/2019/02 on outsourcing arrangements (In particular: 6 Sound governance arrangements and outsourcing, 7 Outsourcing policy)

EC2

The supervisor regularly assesses a bank’s corporate governance policies and practices, and their implementation, and determines that the bank has robust corporate governance policies and processes commensurate with its risk profile and systemic importance. The supervisor requires banks and banking groups to correct deficiencies in a timely manner.

Description and Findings re EC2

Part of CBI/FSA’s regular monitoring includes the financial supervisors’ identifying issues as early as possibly by monitoring changes or signs that could be indicators of weaknesses or threats to the institution’s governance and internal control framework. Regular monitoring consists of quarterly “status” assessments performed three times a year (i.e., quarterly - as the overall risk assessment is conducted in one of the quarters). The main objective is to have in place a documented summary of the status of the bank’s governance including an overview of incidents, indicators and cases that have occurred in the last week and months. However, the assessment may trigger further investigation or need for an on- or off-site inspection, based on the severity of the case.

CBI internal methodology and guidance for supervisors is outlined in its Supervisory Handbook (CCQ) 01 entitled assessment of governance and internal control as well as the requirements for regular monitoring.

CBI/FSA supervisors assess whether bank’s governance systems are in place and in line with supervisory expectations. Internal guidance is outlined in CBI/FSA’s Supervisory Handbook (CCQ) and includes the following subjects:

02 Overall internal governance framework (VIN-0042)

03 Composition, organization and functioning of the management body (VIN-0044)

04 Corporate risk and culture (VIN-0043)

05 Remuneration policies and practices

06 Internal control framework (VIN-0047)

07 Risk management framework, including ICAAP and ILAAP (VIN-0046)

08 Summary of findings and risk scores for the overall risk assessment of internal governance (VIN-0049)

The annual SREP assessment for D-SIBs takes into account all on and off-site inspections, reviews of regular reporting (risk reports, internal audit and compliance reports, etc.), interviews with board members, managers and employees, and institution’s selfassessments.

Deficiencies are communicated to the bank through different channels depending on the severity of the issue. Arti 107(a) of Act No. 161/2002 states that CBI/FSA may require a financial undertaking, which does not meet the provisions of Act No. 161/2002 and regulations and rules based thereof, to take corrective action in a timely manner. In order to ensure compliance, CBI may require:

• a capital base in excess of 8 percent of the risk base;

• improvements of internal processes;

• depreciation of assets in the calculation of the capital base;

• restrictions or limitations on the business activities of the financial undertaking; and

• reduction of the risks entailed by the business activities of a financial undertaking.

In case of formal (administrative) decisions, CBI demands corrective actions to be implemented within a specific timeframe. Some weaknesses, i.e., strengthening risk culture, are long term projects. Then CBI requires a documented project plan for the implementation of improvements within in a certain time frame. In order to ensure compliance with the plan, CBI has meetings with senior management and if necessary, the BOD.

CBI/FSA requires banks to make improvements and correct deficiencies through various channels - regular communication, formal meetings and with formal administrative actions (letters). Recent corrective measures include:

• updating policy and processes for conflicts of interest

• strengthening framework for compliance risk

• addressing weaknesses in risk culture and internal controls

• ensuring effectiveness and functioning of the board

• addressing weak meeting minutes of the board which were unsatisfactory (discussion not represented in the minutes)

• strengthening process for follow-ups of findings of internal control functions/external audit/authorities.

Assessors note that CBI/FSA’s SREP methodology pertaining to low and medium-low impact category classification, do not necessary require meetings/interviews with the CRO, CFO, IA, Board members, compliance officer or EA - only ’when necessary’. Further, meetings with the CEO are only required every 3 years. Although it is acknowledged that CBI/FSA financial supervisors are in contact with the bank throughout the year, and will take action if there are any indications of breaches/poor governance however this does not necessarily equate to having contact with the Board members and critical control functions. CBI/FSA does undertake fitness and propriety of board members upon appointment and financial supervisors review IA and EA reports as part of the regular monitoring.

CBI/FSA during on-site inspections does have the opportunity to make contact with certain of these key individuals and that the last formal comprehensive assessment of governance for institutions classified as low/medium low risk was in 2016 with plans to make another similar assessment in 2023.

Assessors recommend that CBI/FSA re-assess the frequency with which it makes contact with Board members for both the savings/commercial banks that are classified as low or medium low impact to ensure adequate coverage/oversight of corporate governance frameworks in these banks. According to the SREP framework, it is possible these key functions/Board members may never be interviewed. Although the size of the savings banks may be immaterial, the reputation risk to CBI/FSA of one of these institutions failing is high considering the general view of the importance of these banks in the Icelandic community. Moreover, CBI/FSA should ensure adequate oversight of the strength of these critical functions/board members for banks that operate cross border. Last, the corporate governance expert working within the Banking Department oversees the D-SIBs only and it would therefore be appropriate for similar coverage of the remaining banks, on a risk basis.

EC3

The supervisor determines that governance structures and processes for nominating and appointing Board members are appropriate for the bank and across the banking group. Board membership includes experienced non-executive members, where appropriate. Commensurate with the risk profile and systemic importance, Board structures include audit, risk oversight and remuneration committees with experienced non-executive members.

Description and Findings re EC3

Iceland has a two-tier system by law and at the shareholder’s meetings elects the members of the board which is a supervisory board. All members of the supervisory board are required to be non-executive directors (NED’s). Following the shareholder’s meeting and appointment of board members, the board convenes and elects’ members of the committees in line with legal and supervisory requirements. Appointment of new members is subject to approval of CBI/FSA. Please see below and EC 6 for the assessment of fitness and propriety of individual board members, which includes an assessment of whether the proposed non-executive member possess adequate experience for the position.

Article88 of directive 2013/36/EU (CRD), the establishment of a nomination committee has not been required by law nor expected by the supervisor. However, in June 2022 requirements on the establishment, responsibilities and functioning of the nomination committee were incorporated in Act No. 161/2002 on financial undertakings (Article53) and will apply to D-SIBs from July 2023. Article53 includes an exemption clause, the requirement of a nomination committee does not apply if all board members are appointed by the Icelandic State Financial Investments (ISFI).

Article78 of Act No. 161/2002 sets out detailed requirements of the establishment, responsibilities and functioning of the risk committee of the board. The risk committee consists of board members only and are all non-executive directors (paragraph 1). CBI/FSA has the authority to allow financial undertakings to combine the risk committee and audit committee (Article78, paragraph 4). CBI also has the authority to grant an exemption of the establishment of a risk committee (Article78 paragraph 5). CBI/FSA grants exemptions, as per paragraph 4 and 5 in relation to the undertaking’s size, nature, and complexity.

Article108(a) in Act No. 3/2006 on Annual accounts sets out requirements of the establishment, responsibilities and functioning of the audit committee in public interest entities including banks.

Article57(e) of Act No. 161/2002 sets out detailed requirements of the establishment, responsibilities and functioning of the remuneration committee for D-SIBs. It is stipulated that the committee should consist of at least three members of the board, including the chairman.

CBI/FSA’s expectations and guidance for the establishment, responsibilities and functioning of the committees of the board are set out in the following guidelines:

• EBA/GL/2021/05 on internal governance

• EBA-ESMA/GL/2021/06 on the assessment of the suitability of members of the management body and key function holders

BCI/FSA assesses the composition of the board in line with the bank’s strategy, risk profile and complexity by:

• Reviewing the rules of procedure of the board and its committees

• Review of the self-assessment of the board and its committees in the line with Annex I - Joint EBA and ESMA GL on the assessment of suitability;

• Interviews with members of the BOD, senior management, and heads of internal control functions;

• Interviews with members of the BOD, senior management, heads of internal control functions; and

• exit interviews (previous indications of weaknesses in the functioning and composition of the board often confirmed in exit interviews).

Assessors note that the EBA guidelines (Art. 76(3), sub-paragraph 4, of CRD IV) as well as Art. 78(4) of Act 161/2002 suggest that, based on nature, size, and complexity of the institutions, that the audit committee and the risk committee of the Board may be combined. Assessors recommend, in line with Basel standards, that if a supervisory authority requires an audit committee and risk committee, that the audit committee be kept distinct from other committees, such as the risk committee (BCBS Guideline on Corporate Governance Principles for Banks, July 2015, item 68 and 71⁶³). It is recommended that different non-executives be appointed to the audit committee and the risk committee, as well as keeping these subjects/issues separate in order to assure the member who oversees the risk of the institution is not also approving/reviewing the audited financial statements of the institution.

EC4

Board members are suitably qualified, effective and exercise their “duty of care” and “duty of loyalty”.⁶⁴

Description and Findings re EC 4

The requirements of fitness and propriety are set out in Art. 52 of Act No. 161/2002 and in the EBA-ESMA/GL/2021/06 on the assessment of suitability.

Following the initial appointment members of the board/CEO submit background information which CBI/FSA examines and verifies as well as evaluating their knowledge, skills and experience based on the submitted information. In the case of board members of D-SIBs and the CEO of the commercial bank designated as a financial conglomerate the knowledge will also be evaluated during an oral interview. For smaller institutions, individuals will only be evaluated with an oral interview if there are doubts about their knowledge.

Review and assessment of self-assessments of the board and senior management are in line with Annex I - Joint EBA and ESMA GL on the assessment of suitability is part of regular monitoring and the annual SREP process.

Article52, paragraph 2 of Act No. 161/2002 states that the main fit and proper criteria for the board members and the managing director is that they may not behave in any manner that would give cause to doubt their ability to be responsible for sound and prudent business operations or to abuse their position or harm the undertaking.

Assessors recommend that going forward, CBI/FSA specifically assess Board members “duty of care” and “duty of loyalty” as defined in the footnote attached to EC4 of CP14 and with respect to Act No. 161/2002.

EC5

The supervisor determines that the bank’s Board approves and oversees implementation of the bank’s strategic direction, risk appetite⁶⁵ and strategy, and related policies, establishes and communicates corporate culture and values (e.g., through a code of conduct), and establishes conflicts of interest policies and a strong control environment.

Description and Findings re EC5

The board’s role and responsibilities are set out in Article54 of Act No. 161/2002.

CBI/FSA regularly assesses, through its off-site and in on-site inspections, and as part of the annual assessment in line with requirements of the board’s responsibilities in (Article 54). Article 54 stipulates that the board of directors is also responsible for ensuring that corporate governance and internal organization promote the efficient and prudent management of the undertaking, and the separation of duties prevents conflicts of interest. These requirements are further stipulated in EBA/GL/2021/05 on internal governance, in Title II - Role and responsibility of the management body (Art. 22.l), Chapter IV Risk culture and business conduct and Chapter 11 Conflict of interest policy at institutional level and Chapter 12 Conflict of interest policy for staff.

CBI/FSA’s objective is verifying the board is fulfilling it role and responsibilities in setting and overseeing the implementation of its policies through various on- and off-sites and regular interviews. Supervisors determine if and how the BODs are promoting a strong risk culture and awareness of risk (tone from the top) throughout the operations of the bank. The assessment of the board’s role and responsibilities includes reviewing meeting minutes, policies, governance statements, procedures, risk reports, results of internal audits and compliance reports. Further, CBI/FSA’s objective is to verify if the board discusses the institution’s risk appetite on regular basis and whether the board receives adequate and appropriate information on risk (risk reports) and whether sufficient time is allowed in board meetings to consider and discuss those risks.

Supervisory Handbook in CCQ used by supervisors as part of this guidance:

03 Composition, organization and functioning of the management body;

04 Corporate and risk culture (VIN-0043)

07 Risk Management framework, including ICAAP and ILAAP (VIN-0046).

The assessment includes the:

• review of risk policies, code of conduct, various policies and procedures and their implementation in daily operations of the bank

• review of meeting minutes of the board

• interviews with board members, senior management, heads of control functions

CBI/FSA has required bank’s boards to enhance their role in overseeing the implementation of its policies and to increase their focus and attention on a specific issue, for example during the ICAAP/ILAAP process, assessment of internal controls, recovery plans, and conflict of interest policies. CBI/FSA has also required banks boards to strengthen banks risk culture, emphasizing the importance of strong corporate and risk culture and “tone from the top” and how it should be visible not only in policies, codes of conduct and published material but also in the conduct of board, senior management and employees and all activities of the bank.

EC6

The supervisor determines that the bank’s Board, except where required otherwise by laws or regulations, has established fit and proper standards in selecting senior management, maintains plans for succession, and actively and critically oversees senior management’s execution of Board strategies, including monitoring senior management’s performance against standards established for them.

Description and Findings re EC6

CBI/FSA regularly assesses, as part of the SREP process “assessment of internal governance and institution-wide controls” and in line with requirements of the board’s responsibilities in (Article 54) which are further stipulated in EBA guidelines. The EBA/GL/2021/05 stipulates that internal governance should set out clear requirements of the supervisory role of the board. The EBA/GL/2021/06 stipulates the assessment of fitness and propriety. EBA-ESMA/GL/2021/06 sets out clear requirements on the responsibilities of the financial undertaking to assess the fitness and propriety of board, senior management, and other key functions holders. CBI/FSA determines the bank’s fit and proper procedures by undertaking the:

• review and assessment of the bank’s procedures for selecting and assessing the performance of senior management and key function holders (including heads of internal control functions);

• review of the board’s annual assessment of the performance of CEO;

• review and assessment of self-assessments of the board and senior management in line with Annex 1 of the Joint EBA and ESMA GL on the assessment of suitability;

• review of meeting minutes of the board;

• interviews with members of the board and CEO, including a discussion on succession planning

• succession planning of the management body (EBA/GL/2021/05 Article 22(g))

CBI/FSA has required a bank to review and update their policy and of assessment of senior management and key function holders. In that case the bank had only carried out the assessment at the time of the initial appointment and did not fulfil their role in continuously ensuring the fitness and propriety of senior management and key function holder. CBI has also required corrective measures where the board’s policy did not include heads of internal control functions.

EC7

The supervisor determines that the bank’s Board actively oversees the design and operation of the bank’s and banking group’s compensation system, and that it has appropriate incentives, which are aligned with prudent risk taking. The compensation system, and related performance standards, are consistent with long-term objectives and financial soundness of the bank and is rectified if there are deficiencies.

Description and Findings re EC7

Iceland has implemented Article94 of EU’s CRD V into Article57 B(1) of Act No. 161/2002, which obliges financial undertakings, including credit institutions, to ensure that variable remuneration (“bonuses”) fulfil a number of conditions, including but not limited to

• the total amount of the variable remuneration is based on a combination of the assessment of the performance of the individual and of the business unit concerned and of the overall results of the institution and when assessing individual performance, financial and non-financial criteria are taken into account;

• the assessment of the performance is set in a multi-year framework in order to ensure that the assessment process is based on longer-term performance and that the actual payment of performance-based components of remuneration is spread over a period which takes account of the underlying business cycle of the credit institution and its business risks;

• the total variable remuneration does not limit the ability of the institution to strengthen its capital base; and

• the variable remuneration should not exceed 25 percent of the employee’s fixed remuneration.

CBI/FSA is of the view that a compensation system that fulfills the above-mentioned conditions is consistent with the long-term objective and financial soundness of banks. In recent years, CBI/FSA has imposed fines and undertaken other enforcement actions on financial undertakings, including but limited to banks, that have violated rules on variable remuneration.

EC8

The supervisor determines that the bank’s Board and senior management know and understand the bank’s and banking group’s operational structure and its risks, including those arising from the use of structures that impede transparency (e.g., special-purpose or related structures). The supervisor determines that risks are effectively managed and mitigated, where appropriate.

Description and Findings re EC8

Following the initial appointment of members of the board and the CEO of D-SIBs and conglomerates, their knowledge of the bank and banking group operational structure and its risk, including those arising from the use of structures that impede transparency is evaluated.

Regular interviews with the board and senior management have been part of regular monitoring since 2016 (CCQ CBI/FSA Supervisory handbook) and an important part of the annual SREP assessment. Topics vary and depend on activities, issues, and risks which the bank is faced with at the time. In recent years CBI has emphasized the importance of clear and transparent organisational, operational, and legal structures of the bank in line with the term “know your structure” in the EBA/GL/2021/05 on internal governance.

As part of the annual assessment the composition, organisation and functioning of the board, its committees and management board, self-assessments of the board and senior management are reviewed, and the results are discussed with board and if relevant with management.

Assessors noted that commercial banks in Iceland have very straight forward and transparent organizational structures.

EC9

The supervisor has the power to require changes in the composition of the bank’s Board if it believes that any individuals are not fulfilling their duties related to the satisfaction of these criteria.

Description and Findings re EC9

Article 10 paragraph 4 of Act No. 87/1998 states that if the board members or managing directors of regulated entities do not meet the eligibility requirements of the special laws that apply to the activities of regulated entities, the FSA may demand that the person resign, either temporarily or permanently. If the requirements of the FSA are not met within a reasonable time limit, the FSA can unilaterally dismiss the person.

CBI/FSA has made use of this section of the legislation.

Additional Criteria

AC1

Laws, regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any material and bona fide information that may negatively affect the fitness and propriety of a bank’s Board member or a member of the senior management.

Description and Findings re AC1

Assessment of Principle 14

Largely Compliant

Comments

Assessors recommend that CBI/FSA re-assess the frequency with which it makes contact with Board members for both the savings/commercial banks that are classified as low or medium low impact to ensure adequate coverage/oversight of corporate governance frameworks in these banks. According to the SREP framework, it is possible these key functions/Board members may never be interviewed. Although the size of the savings banks may be immaterial, the reputation risk to CBI/FSA of one of these institutions failing is high considering the general view of the importance of these banks in the Icelandic community. Moreover, CBI/FSA should ensure adequate oversight of the strength of these critical functions/board members for banks that operate cross border. Last, the corporate governance expert working within the Banking Department oversees the D-SIBs only and it would therefore be appropriate for similar coverage of the remaining banks, on a risk basis. The work undertaken by the corporate governance expert is adequate with many touch points with senior management and boards. Further, CBI carries out fit and proper assessments when Board members are on-boarded.

CBI/FSA do not specifically assess Board members “duty of care” and “duty of loyalty” as defined in the footnote attached to EC4 of CP14. Further, CBI permits audit committee and risk committee to combine, whereas Basel indicates these two committees should be distinct., as keeping these subjects/issues separate in order to assure the member who oversees the risk of the institution is not also approving/reviewing the audited financial statements of the institution.

Principle 15

Risk Management Process

The supervisor determines that banks⁶⁶ have a comprehensive risk management process (including effective Board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate⁶⁷ all material risks on a timely basis and to assess the adequacy of their capital and liquidity in relation to their risk profile and market and macroeconomic conditions. This extends to development and review of contingency arrangements (including robust and credible recovery plans where warranted) that take into account the specific circumstances of the bank. The risk management process is commensurate with the risk profile and systemic importance of the bank.⁶⁸