Isle of Man Financial Services Authority Guidance Note on Recovery Planning for Deposit Takers

Isle of Man Financial Services Authority First published 4 Jan 2021, updated 29 Jan 2021 and 28 Nov 2023 Page 1 of 9 GUIDANCE NOTE FOR DEPOSIT TAKERS (Class 1(1) and Class 1(2)) (Applies to Isle of Man incorporated entities only) Recovery Planning January 2021 (updated November 2023) STATUS OF GUIDANCE The Isle of Man Financial Services Authority (“the Authority”) issues guidance for various purposes including to share best practice, to assist licenceholders to comply with legislation and to provide examples or illustrations. Guidance is, by its nature, not law, however it is persuasive. Where a person follows guidance this would tend to indicate compliance with the legislative provisions. In relation to Recovery Planning, this guidance note is issued under Section 16(1) of the Bank (Recovery and Resolution) Act 2020.

Isle of Man Financial Services Authority Page 2 of 9 Contents

1. Background & Scope…………………………………………………………………………….…3
2. Expected Recovery Plan Contents……………………………………………………………4
3. Submission of the Recovery Plan to the Authority…………………………………..8
4. Glossary…………………………………………………………………………………………………..9

Isle of Man Financial Services Authority Page 3 of 9

1. Background & Scope 1.1 A key component of an effective framework for the supervision of banks includes appropriate arrangements to ensure that bank failures; i) take place in an orderly fashion and ii) impose costs on the creditors and shareholders of the failed firm (e.g. through ‘bail-in’), as opposed to imposing costs on taxpayers (through ‘bail-out’). These arrangements are commonly referred to as Bank Recovery and Resolution (‘BRR’) regimes. 1.2 The aims of a BRR regime are to ensure the continuation of critical banking functions, to protect covered depositors and client assets, to avoid negative effects on financial and economic stability and to minimise reliance on public financial support to failing banks. In addition, to provide for speed and transparency and as much predictability as possible through legal and procedural clarity and advanced planning for orderly resolution. 1.3 Within an overall approach to BRR, recovery planning is an activity which banking groups must undertake themselves to document management actions open to the bank to deal with recovery from a severe stress situation. The bank examines its options and identifies a range of credible measures that it can take to restore its operations to good financial health. In developing its recovery plan, a bank should have no expectation of the availability of public financial support. 1.4 With effect from 4 January 2021, the Bank (Recovery and Resolution Act) 2020 (the ‘Act’) came fully into force in the Isle of Man. Part 3 of the Act specifies the requirements which banks in the Island must follow in preparing recovery plans (‘RPs’), where the bank has been directed to prepare a RP by the Authority. RPs for banks which are not incorporated locally will be obtained and reviewed by the Authority, where considered appropriate, in consultation with the home regulatory authority of the bank concerned. 1.5 There are a number of useful reference sources, which the Authority recommends that banks review in the course of preparing their RPs, such as guidance issued from time to time by the Financial Stability Board (“FSB”) and by the European Banking Authority (‘EBA’), the European Central Bank and the Bank of England. In large part, the Authority’s RP guidance note has drawn upon the work undertaken by those standard-setting agencies, where considered appropriate to the scale and nature of the Isle of Man banking industry. 1.6 An Isle of Man incorporated bank is a separate legal entity regulated by the Authority and as such, the Authority expects a bank to have its own RP. However, it is appreciated that a group-level RP may encompass the recovery arrangements for the Isle of Man subsidiary, as permitted under Section 18 of the Act. In such cases, the group RP may be presented to the Authority, with local management expected to be able to explain how this relates to the Isle

Isle of Man Financial Services Authority Page 4 of 9 of Man subsidiary and demonstrate why they are satisfied that the RP adequately covers the recovery arrangements in relation to the Isle of Man entity. 1.7 It is expected that a bank will adopt a proportionate approach to the development and documentation of its RP and the Authority expects such plans to vary in detail depending on the nature, scale and complexity of individual banks. Above all, the Authority recommends that banks ensure their RPs are practical and implementable, if they are to be of use to the bank during a time of severe stress. 2. Expected Recovery Plan Contents 2.1 Overall Plan Summary 2.1.1 The overall summary of the bank’s RP should present a high-level picture of the information that is laid out in greater depth in the main sections of the plan. In particular, this section should encompass:  A summary of the recovery plan’s information on governance  A summary of the strategic analysis undertaken by the bank, including a summary of the expected impact that undertaking identified recovery actions in a stress scenario will have on the financial position of the bank – i.e. whether it is likely to successfully recover or not  A summary of any material changes since the plan was last produced or updated  A summary of the communication elements of the plan  A summary of the preparatory measures set out in the recovery plan, to enable the bank to deal effectively with the onset of a stress scenario 2.2 Strategic Analysis 2.2.1 The RP should provide a succinct summary of the strategy of the bank and include an analysis of the bank’s core business lines and whether or not the bank provides critical functions. 2.2.2 Critical functions are defined in the Act as “activities, services or operations, the discontinuance of which is likely to lead to the disruption of services that are essential to the real economy of the Island or to disrupt financial stability due to the size, market share, external and internal interconnectedness, complexity, or cross-border activities of a bank or group, with particular regard to the substitutability of those activities, services or operations.”1

1 For further consideration of how a bank might determine its critical functions and core business lines refer to the websites of the EBA and FSB.

Isle of Man Financial Services Authority Page 5 of 9 2.2.3 Core business lines are defined in the Act as “business lines and associated services which represent material sources of revenue, profit or franchise value for a bank or a bank’s group.” 2.2.4 In addition, banks should identify any core shared services they perform or outsource to a third party where failure would impair the bank’s ability to continue its core business lines and similarly any critical shared services performed by the bank or outsourced to a third party, which would lead to the inability to perform critical functions in the event of bank failure. 2.2.5 A bank’s RP should be developed with the maintenance of critical functions (where provided) and an understanding of the impact on core business lines from the exercise of recovery options, in mind. 2.3 Governance 2.3.1 Within the RP, there should be a section providing a detailed description of: 2.3.1.1 The development process of the RP, including: a) The role and functions of the persons responsible for preparing, implementing and updating the RP b) The name of the person with responsibility for ensuring the RP remains up to date at all times c) A description of how the RP integrates into the wider corporate governance and risk management arrangements of the bank (and the wider banking group, where relevant, including any group arrangements for recovery planning). In line with Section 16(2) of the Act, the Authority expects the board of the bank to review and approve the RP, subjecting its conclusions to an appropriate level of challenge and discussion. 2.3.1.2 The escalation process to be followed in the event of a recovery trigger being breached. 2.4 Recovery Triggers 2.4.1 These triggers, which may include both quantitative and qualitative measures, should be an extension of the bank’s existing risk management monitoring framework for capital, liquidity and operations.

Isle of Man Financial Services Authority Page 6 of 9 2.4.2 A clear distinction should however exist between the calibration of ‘early warning’ indicators for these risk areas and the triggers for the activation of the recovery plan. 2.4.3 Recovery triggers need not mean that, in every instance, the recovery plan must be invoked. In some cases, it may be appropriate that the activation of a recovery trigger causes management to consider whether to activate the recovery plan, or whether an alternative response might be appropriate in the given circumstances. Even if the latter approach is taken, the bank should consider informing the Authority as part of its approach to communications (see section 2.7). 2.4.4 The Authority does not mandate the inclusion of any specific triggers for the purpose of recovery planning. Rather, it is for the bank to consider and select those recovery triggers that it feels are most appropriate to the scale and nature of its business and thereafter to calibrate such triggers accordingly, provided the selected indicators meet the requirements set out in Section 19(2) of the Act. 2.4.5 For more information on setting recovery triggers, banks may wish to review the guidance published by the EBA in this area. 2.5 Stress Scenarios 2.5.1 In line with Section 19(1) of the Act, the bank should develop a range of severe stress scenarios, designed to bring the bank almost, but not fully, to the point of non-viability (i.e. the breach, or likely breach, of its minimum regulatory capital or liquidity levels). In this regard, reverse stress tests undertaken for ICAAP purposes and / or liquidity stress tests undertaken by the bank may be a useful starting point, with outcomes being adjusted so as to ensure the scenario deals with a situation from which the bank is in fact recoverable, rather than a ‘gone concern’. 2.5.2 The Authority expects banks to develop three to four stress scenarios, commensurate with the risk profile and activities of the bank. These should cover at least one systemic stress scenario and one bank specific (idiosyncratic) scenario resulting in a liquidity and / or capital and / or operational stress, capable of leading to the bank’s failure, in the absence of management intervention. The chosen scenarios should be relevant to the operations of the bank and should address both fast and slow-moving crises, which could be combined with consideration of wider macroeconomic stress scenarios impacting the bank. 2.5.3 Where scenarios utilise financial data, it should be clear what date (or dates) the data relates to. The data utilised should, ideally, be as timely as possible, and within 6 months of the approval of the RP by the board of the bank. For

Isle of Man Financial Services Authority Page 7 of 9 example, if data used is at 31 December, the RP should be approved by the board of the bank by the following June. 2.5.4 For more information on developing stress scenarios, banks may additionally wish to review the guidance published by the FSB and EBA in this area. 2.6 Recovery Options 2.6.1 The bank should identify and develop a range of credible recovery options designed to respond to severe financial stress scenarios and which could reasonably be expected to contribute to maintaining or restoring the viability of the bank. 2.6.2 These recovery options may well be an extension of the bank’s existing contingency arrangements for capital, liquidity or business continuity matters, but are likely to be more profound or extreme in nature. 2.6.3 For many subsidiary banks, it will be appropriate to consider recovery options where group support may be obtained. However all the implications of these arrangements will need to be considered, including the potential need for overseas regulatory or other consents, or indeed the possibility that, in a given stress scenario, group support may be more difficult to achieve. The Authority therefore expects banks to include recovery options that are not reliant on group support or involvement. 2.6.4 For each option identified as being relevant to the bank’s chosen stress scenarios, the impact of exercising the option should be clearly documented in the RP, in terms of its effect on restoring the bank’s financial position. In addition, the impact of the option on the ongoing viability of the bank (post the stress scenario) should be identified, in order to understand the potential implications of exercising the recovery option, for the bank’s business model thereafter. 2.6.5 In addition, the feasibility of executing each recovery option should be considered and documented, including a description of: i) the timeline within which an option could reasonably be put into effect; ii) impediments to its successful implementation that would need to be overcome and; iii) preparatory measures, which the bank has taken, or acknowledges, would need to be taken, in order to facilitate the smooth execution of the recovery option.

Isle of Man Financial Services Authority Page 8 of 9 2.7 Communication Plan 2.7.1 The RP must contain a section dealing with the communications plan relating to the RP, which should set out an analysis of how communications would be implemented in the event of the invocation of one or more of the recovery options set out in the RP. 2.7.2 In particular the plan should address the internal communication to key stakeholders, such as group counterparties and staff and also the external communications approach towards stakeholders including the Authority, other counterparties, clients and the general public (as appropriate). 3. Submission of the Recovery Plan to the Authority 3.1 Following approval of the RP by the board of the bank, as required by Section 16(2) of the Act, it should be submitted to the Authority on a timely basis2 for noting and review. As part of this, the Authority will consider any implications for the resolvability of a bank arising from the RP. The Authority will provide feedback on its review of the RP to the bank thereafter. This feedback may include a requirement for the RP to be amended and resubmitted (in the event that it is considered materially deficient in some respect by the Authority). Alternatively, the feedback may include matters, which the bank should address, within the next iteration of the RP. The Authority has a range of powers to deal with situations where an inadequate or incomplete RP has been furnished by a bank, as set out in Sections 22 and 23 of the Act. 3.2 The Authority expects the bank to subject its RP to periodic review, which should be annual as a minimum. If there is no material change to the risk profile, business strategy or operating model of the bank, confirmation of this to the Authority will be sufficient. However, in the event of material changes to any of those factors, the Authority requires an updated RP to be submitted for its review. Further, if material changes are made to the RP by the bank on a more frequent basis, then the bank should promptly notify the Authority of those changes within one month of them being approved.

2 The Authority considers a period not exceeding three months after Board approval of the Recovery Plan, to be a timely basis for submission.

Isle of Man Financial Services Authority Page 9 of 9 4. Glossary of key terms The ‘Act’ The Bank (Recovery and Resolution) Act 2020. The ‘Authority’ The Isle of Man Financial Services Authority. ‘Bail-in’ The rescue of a financial institution that is on the brink of failure whereby shareholders and unsecured creditors potentially take a loss on their holdings. ‘Bail-out’ The rescue of a financial institution that is on the brink of failure whereby public funds are used to provide capital and / or liquidity support. Core business lines Business lines and associated services, which represent material sources of revenue, profit or franchise, value for a bank or a bank’s group. These activities should not be confused with critical functions, which are concerned with the impact on the Isle of Man economy/financial stability, but in some cases, a critical function may also be a core business line. Core shared services Services performed or outsourced to a third party where failure would impair the bank’s ability to continue its core business lines. Covered depositors Depositors holding deposits within the financial coverage limit of the Isle of Man Depositors’ Compensation, or an analogous Scheme in another jurisdiction. Critical functions Activities, services or operations, the discontinuance of which is likely to lead to the disruption of services that are essential to the real economy of the Island or to disrupt financial stability due to the size, market share, external and internal interconnectedness, complexity, or cross-border activities of a bank or group, with particular regard to the substitutability of those activities, services or operations. Examples could include deposit taking, provision of clearing / payment services or mortgage lending / SME credit provision to the Isle of Man economy, where the bank has a meaningful market share of those activities. Critical shared services Services performed by the bank or outsourced to a third party, where failure would lead to the inability to perform critical functions. EBA European Banking Authority. FSB Financial Stability Board. ICAAP Internal Capital Adequacy Assessment Process. Recovery Plan (‘RP’) Contingency plans to be established to restore capital adequacy and maintain liquidity or otherwise mitigate the impact of stresses on the bank and its customers. Recovery trigger Trigger for consideration of action in a recovery plan. Reverse stress test Reverse stress tests are stress tests that require a firm to assess scenarios and circumstances that would render its business model unviable, thereby identifying potential business vulnerabilities.