Code of Practice for SFIs Maintenance of Effective Communication with Clients

AIBT and CBA Hurricane Preparedness Industry developed Code of Practice CODE OF PRACTICE FOR SFIs MAINTENANCE OF EFFECTIVE COMMUNICATION WITH CLIENTS Dated: 26 July, 2021 CLEARING BANKS ASSOCIATION (CBA) & ASSOCIATION OF INTERNATIONAL BANKS AND TRUST COMPANIES (AIBT)

AIBT and CBA Hurricane Preparedness Industry developed Code of Practice Table of Contents PREAMBLE: 1 SECTION A: 2 GENERAL COMMUNICATION SECTION B: 4 ESTABLISHING COMMUNICATION PROTOCOLS DURING A CRISIS/CATASTROPHE

AIBT and CBA Hurricane Preparedness Industry developed Code of Practice Code of Practice for SFIs Maintenance of Effective Communication with Clients PREAMBLE This document jointly prepared by the Association of International Banks and Trusts (AIBT) and the Clearing Banks Association (CBA) provides guidance to Supervised Financial Institutions (SFIs) of the Central Bank of the Bahamas on: a) general communication with clients and b) the maintenance of effective communication protocols with clients before, during and after a major hurricane or other catastrophe. The Bahamas’ geographical location increases the probability of the country experiencing a hurricane and, as such, SFIs in the jurisdiction have to be prepared to deal with the impact of hurricanes which have increased in number and intensity over the years. For the purposes of this document, a catastrophic hurricane is defined as a category 4 or 5. Nevertheless, the guidance provided, can be applied in general. The guidance outlined in this document is based on industry best practices. Not all of the practices outlined in this document will be applicable to each licensee. SFIs should consider the guidance in the context of their Business Continuity Plans (BCPs) and assessing the sufficiency of their client communication protocols. This document was prepared by a working committee comprising representatives from the Clearing Banks Association and Association of International Banks and Trusts, in consultation with the Central Bank of The Bahamas. It does not constitute a statutory document. As a supervisory matter, however, the Central Bank expects that SFIs will follow this guidance, or put in place equivalently effective arrangements. It is to be noted that generally and specifically, in case of a catastrophe, it is imperative that SFIs have defined means of effective communication with clients. 1

AIBT and CBA Hurricane Preparedness Industry developed Code of Practice ARRANGEMENT OF SECTIONS Section A: General Communication Section B: Establishing Communication Protocols during a Crisis/Catastrophe SECTION A: GENERAL COMMUNICATION The Central Bank requires SFIs to maintain at least two methods of contact with each client, with an expectation that at least one of these methods is electronic. Physical address need not become one of the required contact methods. SFIs currently deploy several mechanisms for communicating with clients. For those institutions with a largely international client base, by far the most common communication channels will be via telephone and e-mail. However, those SFIs that serve the domestic market will still offer clients facilities for ‘face to face’ contact with employees. However, for clients to be able to receive communications via alternative methods they must be aware that these facilities exist and have the necessary means to receive information by the alternative channels offered. SFIs have existing responsibilities to maintain current client contact data and it is expected that SFIs will already have a means to send an electronic communication to the majority of clients. SFIs should be able to generate a list of clients who cannot receive communications by e-mail and efforts should be made to collect and then use an e-mail address for these persons or other electronic means. Digitisation of client files with robust electronic backup is encouraged to reduce the need to have to access to clients’ paper files to service clients and allow for easier access to clients’ information. SFIs who have not already done so, should consider Cloud data storage. SFIs should consider the creation of Customer Care mailboxes, if not already in place. These can be an additional contact for clients and, normally, several individuals are able to access same. Ensure at least two forms of contact other than mailing address are obtained when accounts are opened. Efforts are to be made on an ongoing basis to ensure existing client accounts have at least two forms of contact other than mailing address. SFIs should verify information held and, where appropriate, follow up with clients to ensure contact information is updated. As a matter of good practice, ensure that at least one of these forms or both, should be documented to the client’s file. SFIs should collect but need not verify, by utility bills or other means, personal mailing addresses for clients. However, SFIs may wish to consider verification of clients where possible, by review of their active digital product users. SFIs should encourage relevant clients to sign up for debit cards, and digital wallet products such as Sand Dollar, or avail themselves of other digital products for cashless payment of goods and services. 2

AIBT and CBA Hurricane Preparedness Industry developed Code of Practice SFIs to consider the establishment of a website (if not already in existence). In addition, SFIs to consider having a presence on Facebook, Instagram, Twitter and other reputable social media sites and be positioned to use e-blasts. Encourage clients to sign up for internet and mobile banking where these are available options for clients. 3

AIBT and CBA Hurricane Preparedness Industry developed Code of Practice SECTION B: ESTABLISHING COMMUNICATION PROTOCOLS DURING A CRISIS/CATASTROPHE A direct hit from a major hurricane will inevitably impact existing communication infrastructure. SFIs can expect that landline telephones, cell phone service and domestic internet service may be interrupted. Existing BCPs should anticipate loss of existing communication networks and provide for alternative communications means. These plans should recognise that widespread damage to the island may result in loss of existing facilities for an extended period. The method and sophistication of communication options will vary between SFIs. It is recognised that local SFIs who are members of an international group will likely have facilities to continue the operations of the SFI for an extended period at one of more offices of The Group outside of The Bahamas. In these cases, it is expected that it will be possible to route existing communication channels automatically so that clients will be able to use existing contact data. Indeed, SFIs which currently use a centralized call centre model are expected to be able to maintain uninterrupted communications with international clients. It is recognised that some SFIs may offer clients the option to not receive electronic communications and care must be taken to respect client choices in this regard. SFIs should consider adding to the communication agreement signed by clients during the account opening process that limiting electronic communications will restrict the SFIs ability to communicate during and after a crisis. Many clients are concerned about receiving unsolicited e-mails from financial institutions. This is a common method for criminals to steal personal information and commit cyber fraud. Care should be taken when alerting clients by electronic means to provide basic information and to reference existing online banking facilities or websites without providing links to the same. In anticipation of a major disruption event, SFIs should consider establishing a Crisis Communications Committee made up of a cross section of key employees within the organization. A lead and back up spokesperson should be identified to communicate key messages. The main function of this committee is to ensure that emergency communications procedures are defined and communicated to the wider institution in advance. This team can be separate and apart from the Crisis Management Team outlined in the SFI’s Business Continuity Plan (BCP), as this team will focus mainly on communication. In the event of a major business disruption event, this team will be ready to execute its communication strategy with the support of Senior Leadership. This will better position SFIs to respond to a crisis and not operate in a reactive mode. The Crisis Communication Committee should establish a Command Centre which can serve as a means of direct communication amongst the team members to facilitate discussions around immediate, ongoing, and future needs of employees and customers. This can be done electronically through chat groups (WhatsApp etc.) or through the company’s internal intranet, if available. Bear in mind that this form of communication may not be possible in the event of loss of power, or wireless data communication. Therefore, it is recommended that at least one key member of the team in each department has access to a landline, or satellite phone, along with an updated staff contact listing, to ensure communication is maintained. 4

AIBT and CBA Hurricane Preparedness Industry developed Code of Practice Satellite phones will allow communication with key stakeholders and emergency organisations to continue in the event of regular communication channels not being available after storm. Communication templates and holding statements for different events can be developed and approved by this Committee. A test run of the communication plan should be conducted annually and tested again during the hurricane season. Other considerations:  Identify alternate site(s) for operations to continue in a business disruption event – on New Providence, on family Islands or other country  Ensure critical employees identified, and identified critical employees to ensure that travel documents are current in the event they have to fly out of country to an alternate operations site.  Consider establishing a client hotline to receive messages and provide updates on closing/ opening status  Consider establishment of employee hotline  Ensure regularly tested backup generators are installed at premises and at alternate sites if possible  Employees with ability to work remotely to test access on regular basis  Maintain electronically a current list of key/large clients to be contacted  Keep electronic contact list of payroll file submitters Ideally, SFIs may wish to consider establishing an Emergency Notification System (ENS) which uses technology to automatically generate messages to clients and stakeholders in SFIs pre￾established database(s) which can be triggered with a single call or email. This is much faster than making individual calls and notifications can be communicated within minutes instead of hours or longer Benefits of an ENS are as below: o Can build custom recipient groups or consolidate communications list o Provides time-saving predefined scenarios o Build and maintain off-site support I) BEFORE THE STORM 96 HOURS:  All digital communication devices should be charged fully before a storm, or likely catastrophe, and additional supplies of batteries for said devices should be on hand. Ensure battery backups (uninterruptible power supply (UPS)) are tested and in working order.  Communication to clients should commence. SFIs should recognise that, even though existing communication methods such as e-mail and telephone may be unaffected by the passing of a major hurricane, staff will likely be unavailable to respond to client enquiries within an acceptable timeframe. As such, communications which warn clients of an approaching storm should make clear that interruption is likely. 5

AIBT and CBA Hurricane Preparedness Industry developed Code of Practice Information sent to clients prior to the arrival of the storm should include an estimate of the period during which the SFI will be closed and include telephone numbers and e-mail addresses that the client may wish to use for different purposes. For example, those SFIs that have international offices may wish to provide contact information for staff in one of these offices to provide emergency services whilst the SFI is closed. If, as part of the BCP, some local staff will be relocated and be available to clients from different locations these facilities and their operating hours should be explained.  SFIs are to ensure their continuity and contingency plans are activated for clients  Conduct test arrangements with alternate operational site(s) and identify any issues requiring attention  Ensure employee, key vendor contact lists and media contacts are up to date  Client and employee hotlines to be updated and to be kept updated  Back-up generator(s) are to be tested and fully topped up with fuel to allow for SFIs to still operate if the island’s electricity supply is unavailable  Large clients & high impact clients to be contacted to ensure urgent payments and payrolls can be processed prior to SFIs closure.  Employees with ability to work remotely to test access to systems to allow for client communication during and after storm.  ABMs to be topped up with cash – decisions to be made on which locations to be completely closed and when others will be closed. Updates to be provided on website and social media.  Ensure hard copy of BCP and Communications Plan held by key employees at work and at home 72 HOURS:  SFI WhatsApp groups to be reviewed and updated  Ensure call trees are updated. Alternate contacts to be obtained for individuals deciding not to shelter in their homes if they live in vulnerable storm surge areas. 24-48 HOURS:  SFIs with remote arrangements outside of country to complete switch over of operations to alternate site(s) within SFI’s group.  Secure premises and equipment where necessary. Specialized equipment should be powered down to avoid any damage and elevated if possible  Update website, all social media platforms, online banking (where applicable) with details of the SFI’s status, inclusive of their operating hours, facilities & services available/unavailable etc.  SFI to send out general notice to radio and media organisations to advise of closing hours.  Employees to place out of office messages on their telephone and email with details of the SFI’s status, operating hours, facilities & services available/unavailable and available channels.  Keep communications open as long as possible to keep clients informed. 6

AIBT and CBA Hurricane Preparedness Industry developed Code of Practice II) DURING THE STORM  Keep communication open as much as feasible.  Keep Head Office and alternate operational sites updated on status of storm.  Where necessary, alternate operational sites to engage clients with updates.  SFIs with call centers outside of country will be able to provide some services to clients.  Use call trees and WhatsApp groups to make contact with team members to ensure all employees are safe.  During and after the catastrophe it is important that we maintain clear and consistent communication across all levels. SFIs should use all communication mediums at their disposal to communicate with staff and customers, including but not limited to:

• E-Mail
• Company intranet (if available)
• Communication apps (WhatsApp etc.)
• Social media accounts
• Radio and television announcements The use of multiple communication channels will allow SFIs to reach staff and customers wherever they may be, once mobile, data, and power services are available.  SFIs should maintain a contact listing for all employees. The list should include both cell phone and landline contacts wherever possible, and should be available both digitally and hard copy. Management and or local incident management team leads should be tasked with reaching out to employees regularly, and encouraging them to do the same.  Communication with staff should include clear information regarding office hours, and physical location changes, if necessary. III) AFTER THE STORM  After all-clear by government agencies, status on employees wellbeing are to be obtained and assessments are to be made on any physical damage to SFI premises and communication.  Property services and identified individuals to coordinate inspection of premises for damages and to determine the extent of any damage.  Assessment to be made to determine if operations within country/island can resume, BCP mode to continue and if minimum services are to be offered to clients  SFI’s website and social media platforms are to be updated with details of the SFI’s status, their operating hours, facilities, services and channels available/unavailable.  Radio houses and print media are to be contacted to effect announcements via radio and newspaper to advise the public of the SFI’s status, their operating hours, facilities, channels & services availability.  Activate contact list for large clients & high impact clients to determine if there are any urgent payments and payroll to be processed.  Designated Customer mailboxes and client hotlines to be updated with the status of SFI’s operations. 7

AIBT and CBA Hurricane Preparedness Industry developed Code of Practice  Where possible, employees to update out of office messages on telephone and email with details of the Bank’s status, their operating hours, facilities, services and channels availability. POST MORTEM The Crisis Leadership Team should perform a post mortem to determine how well the company’s Communications Strategy worked, pre and post catastrophe. This process should be used to determine what worked, what did not work, and solutions to improve the process moving forward. This post mortem should be inclusive, and employees from a wide cross section of the company should be represented. The results of this post evaluation meeting may require an update to the company’s existing BCP, and may also require changes to physical or technical infrastructure. SFIs should expect to share the results of this post mortem with the Central Bank. CENTRAL BANK SUPERVISION Each SFI will need to document, secure internal approval for, and regularly review its client communication plan. The Central Bank will review this plan, and provide input as appropriate, as part of its ongoing supervision and examination of each SFI. 8