Finanstilsynet's Guidelines on Recovery Plans

Circular

Print Version

Circular 1/2022 (pdf)

The Circular applies to:

Banks

Credit institutions

Parent companies in financial groups

Holding companies in financial groups

Financing undertakings

1 Introduction

This circular applies to undertakings that must prepare recovery plans in accordance with Section 20-5 of the Financial Enterprises Act. The circular replaces Circular 10/2019.

The circular has been updated in line with the European Banking Authority's (EBA) revised guidelines on recovery indicators (EBA/GL/2021/11). In section 3.2.2, Finanstilsynet has clarified the undertaking's obligations in the event of breaches of recovery indicators. EBA/GL/2021/11 Annex II provides a revised overview of mandatory recovery indicators. Section 3.2.5 has been updated with requirements for the level of recovery indicators for solvency and liquidity. Indicators that reflect minimum requirements must be calibrated such that the threshold value for breach exceeds the minimum requirement. Capital indicators must be calibrated such that the threshold value for breach is higher than the minimum requirement and buffer requirements. The undertaking must not take temporary relaxations of buffer requirements into account when determining threshold values for breaches of recovery indicators.

Finanstilsynet has made certain clarifications in section 3.2.3 (strategic analysis) and in section 3.2.4 (recovery measures and recovery capacity) as well as in section 3.3.2 (simplified requirements for recovery plans). Separate forms have been created in Altinn for the submission of recovery plans (KRT 1226) and for reporting breaches of recovery indicators (KRT 1228).

The circular summarizes and elaborates on the requirements for recovery plans, including requirements for content, as well as Finanstilsynet's expectations regarding undertakings' recovery plans and the undertakings' use of the proportionality principle, cf. Section 20-7, first paragraph of the Financial Enterprises Act.

The circular applies to:

banks

credit institutions

parent companies and other holding companies in financial groups

financing undertakings

The circular must be viewed in conjunction with requirements and guidelines in:

the Financial Enterprises Act, Chapter 20

the Regulation on Financial Enterprises and Financial Groups (the Financial Enterprises Regulation) 1)

the Regulation on Supplementary Rules to the Financial Enterprises Regulation, Chapter 20, 2) Part 4

european guidelines, recommendations and Commission Regulations, including:

EBA's guidelines on the use of scenarios in recovery plans 3)

EBA's guidelines on recovery indicators 4)

EBA's recommendation on group recovery plans 5)

Commission Regulation on simplified requirements for recovery plans and crisis resolution plans 6)

2 Legal Basis

Requirements for recovery plans are set out in the Financial Enterprises Act, Chapter 20, as well as the Regulation on Supplementary Rules to the Financial Enterprises Regulation, Chapter 20.

The requirement to prepare and update recovery plans follows from Section 20-5, first paragraph of the Financial Enterprises Act. Requirements for group recovery plans follow from Section 20-5, fourth paragraph, as well as the Regulation on Supplementary Rules to the Financial Enterprises Regulation, Chapter 20, Part 4, Article 20. Reference is also made to EBA's recommendation on group recovery plans.

Requirements for the content of recovery plans follow from Section 20-5 of the Financial Enterprises Act and the Regulation on Supplementary Rules to the Financial Enterprises Regulation, Chapter 20, Part 4, Section II. Section 20-7, second paragraph of the Financial Enterprises Act gives Finanstilsynet the authority to set simplified requirements for recovery plans for individual undertakings or groups of undertakings. Simplified requirements for recovery plans are discussed in point 3.3 of this circular. Reference is also made to Commission Regulation (EU) 2019/348 regarding which undertakings may be subject to simplified requirements. 7)

Chapter 3 of this circular summarizes the requirements placed on recovery plans.

Finanstilsynet shall assess whether undertakings' recovery plans meet the current requirements, cf. Section 20-5, second and fourth paragraphs of the Financial Enterprises Act. Which measures and instruments Finanstilsynet has available, in cases where the recovery plan has significant deficiencies, follow from Section 20-5, third paragraph, Section 14-6, third paragraph, and the Regulation on Supplementary Rules to the Financial Enterprises Regulation, Chapter 20, Part 4, Section III. Finanstilsynet's assessment of recovery plans and supervisory instruments is further elaborated in chapters 4 and 5 of the circular.

3 Requirements for Undertakings' Recovery Plans

3.1 The Role of the Board

The recovery plan is an important part of the undertaking's preparedness. The plan aims to stabilize and restore the undertaking's financial position in a serious stress situation. The Board must ensure that the undertaking has available effective and relevant measures that can be implemented in a stress situation without causing significant negative consequences for customers, other financial undertakings, or the economy as a whole.

In its assessment of the recovery plan, Finanstilsynet will place weight on the undertaking having a broad range of recovery measures, and that the plan is integrated into the undertaking's risk management and internal control system. Finanstilsynet expects that procedures are established to ensure that the plan is reviewed at least annually and tested as needed, and that the plan is processed by the Board. The plan must be updated more frequently than annually if Finanstilsynet imposes this requirement, or if changes have occurred in the undertaking that necessitate changes to the plan, cf. Section 20-5, first paragraph, letter e of the Financial Enterprises Act. When the recovery plan has been revised and approved by the undertaking's Board, it must be submitted to Finanstilsynet. 8)

The undertaking must use Altinn form KRT-1226.

The undertaking must have a holistic approach to contingency planning and contingency plans. The Board must ensure that there is consistency between plans for operational and business continuity, 9) liquidity contingency, 10) capital plans (ICAAP) 11) and the recovery plan.

The Board of undertakings subject to the requirement for internal audit 12) must ensure that an independent assessment of the recovery plan is conducted regularly. The independent assessment should be part of the Board's decision-making basis when processing the recovery plan.

3.2 Content Requirements

This chapter specifies what information the recovery plan must contain as a minimum and the expectations. Finanstilsynet has expectations regarding undertakings' recovery plans.

The recovery plan must include:

a summary of the recovery plan

decision and escalation processes in the event of breaches of recovery indicators

strategic analysis, including analysis of critical functions and core business

recovery measures

recovery capacity

recovery indicators

scenario testing

preparatory measures

communication plan

contingency exercises

3.2.1 Summary of the Recovery Plan

The recovery plan must contain a short summary 13) of information regarding:

decision and escalation processes

recovery indicators (level and definition of the indicator)

recovery measures and expected effect of the measures individually and collectively

matters that may hinder the implementation of measures

communication plan

overview of changes since the last revision of the document (possibly in an appendix)

overview of how the undertaking has followed up on Finanstilsynet's feedback (possibly in an appendix)

Finanstilsynet expects that the summary has a format and content that makes it easy to get a quick overview of the most central parts of the plan, as well as relevant escalation and decision processes.

3.2.2 Allocation of Responsibilities, Decision and Escalation Processes

The recovery plan must describe how recovery indicators and decision processes are integrated into the undertaking's ongoing risk management and internal control.

It must be clear who has been involved in the work on the recovery plan, and who is responsible for revising the plan.

The responsibility for identifying, informing, and reporting breaches of recovery indicators must be clearly defined. 14) The recovery plan must also clarify who is responsible for implementing any measures, and if necessary, deciding that the undertaking should establish a crisis team. The plan must provide information on deadlines, who is to be informed and consulted, and who makes relevant decisions.

It is assumed that relevant roles and functions in different group undertakings participate in the preparation and updating of the plan, and that the undertaking has established procedures to ensure consistency between processes at the group level and processes in individual group undertakings. If individual group undertakings have individual recovery plans, there must be a clear connection and consistency between the information, decision, and escalation processes of the various plans.

Further details on breaches of recovery indicators Breaches of recovery indicators must be reported to the relevant decision-making level within one business day after the breach is confirmed, and the undertaking must notify Finanstilsynet of breaches of recovery indicators no later than two business days after the breach is confirmed. When reporting breaches of recovery indicators, the undertaking must use Altinn form KRT-1228.

The undertaking must report the first time a breach of a recovery indicator occurs. Thereafter, it must report quarterly as long as the indicator remains breached. This applies to the categories 15)

capital indicators

liquidity indicators

profitability indicators

portfolio quality indicators

In the event of breaches of macroeconomic indicators and market indicators, as well as indicators for financing costs/spread outflows, the undertaking must only report to Finanstilsynet the first time the indicator is breached, and when the indicator is no longer breached.

In the report submitted to Finanstilsynet, it must be clear which indicator(s) have been breached, when the indicator was breached and when it was discovered, what the cause of the breach is, and how the undertaking will handle the breach. The report must indicate whether the undertaking considers implementing specific measures, and if so, which measures have been implemented. Finanstilsynet may give the undertaking further instructions regarding reporting and the content of the report.

3.2.3 Strategic Analysis

The recovery plan must contain an overview and description of which group undertakings are covered by the plan, the undertakings' core business areas, critical functions, as well as internal and external connections. 16)

Description of Undertakings Covered by the Recovery Plan The recovery plan must contain an overview of the undertaking's operational and legal structure. It must be clearly stated which group undertakings are covered by the plan. The undertakings may assume that all relevant 17) group undertakings are covered. The plan must give a general description of the undertakings covered by the plan, including business model, strategy, and business plan, as well as a description of significant risks the undertaking is exposed to. 18)

Internal Connections The recovery plan must contain an overview of internal connections, including financial, legal, and operational matters and balances that may have a significant impact on the implementation of the undertaking's recovery measures and any crisis measures from authorities. Finanstilsynet assumes that the undertaking describes and quantifies significant financial exposures and obligations, including guarantee obligations. It is also expected that the undertaking assesses how internal obligations may be affected in a crisis situation, and the consequences of this. Sensitivity analyses may be used to illustrate such consequences. The recovery plan must also report on any agreements on intra-group financial support with an overview of the agreement parties and terms. 19)

The plan must also describe operational matters that are significant for daily operations and continuation of business in a crisis situation. The undertaking must itself assess which areas are relevant to illuminate, but critical IT systems and centralized support functions should be assessed. The plan should also provide an overview of relevant agreements on outsourcing and internal service level agreements (SLA), and the undertaking must assess operational matters that may hinder or complicate the implementation of relevant measures in a crisis situation.

External Connections The recovery plan must provide an overview of significant external connections, i.e., all significant exposures and obligations towards external third parties (e.g., other financial undertakings, central counterparties, clearing houses, settlement banks, and other undertakings participating in an interbank, payment, or securities settlement system). All guarantees etc. towards partially owned MFA (Market Facilitation Authority) undertakings must be mentioned specifically.

The undertaking must assess how access to necessary services and markets may be affected in a serious stress situation. The assessment must be based on a serious stress situation in the undertaking and in relevant counterparties, i.e., that the counterparty is no longer able to deliver services. Finanstilsynet expects the undertaking to assess and describe possible consequences of downgrades, breaches of loan terms, or other relevant events that result in the cessation of services or access to markets.

The plan must also provide an overview of undertakings that use the undertaking's services or products where the undertaking or the group itself is a significant third party, and what consequences the cessation of the undertaking's services or products may have for these undertakings.

Core Business The recovery plan must contain an assessment of the undertaking's core business.

The purpose is primarily to give the supervisory authority and the crisis management authority an understanding of, and overview of, which business areas are central for continued operations during the crisis management of the undertaking. The assessment of core business must be methodical and based on both quantitative and qualitative assessments. The undertaking is free to choose which assessment criteria to use, but must document and justify the criteria that form the basis and the final assessments.

Finanstilsynet considers contribution to earnings and financing as important assessment criteria. Business areas that do not contribute significantly to the undertaking's profitability may still be strategically valuable or create future value for the undertaking. The undertaking should therefore also place weight on reputation and brand value, and trust among customers and investors. Examples of other assessment criteria may be the number of employees or market share.

Societal Critical Functions The recovery plan must contain an assessment of the undertaking's societal critical functions, i.e., business, activities, services, or products that could cause significant negative consequences for customers, other financial undertakings, or financial stability if they were to cease. Finanstilsynet asks undertakings to be aware that an undertaking with societal critical functions 20) is not necessarily defined as systemically important according to the provisions in the CRR/CRD IV Regulation Section 30. An important assessment criterion is whether the undertaking's services and functions could be replaced by other providers under serious crisis conditions. Important services/products/functions that cannot be replaced by other providers within a reasonable time must be defined as societal critical. When assessing whether the function can be replaced by other providers, the undertaking must assume that several undertakings are affected by crisis simultaneously (system crisis). For example, the undertaking's lending business may be difficult to replace in a broad economic downturn or system crisis. Finanstilsynet may decide that the undertaking's products or services are to be defined as societal critical, regardless of the undertaking's own assessment.

Summary of Strategic Analysis The recovery plan must give a summary overview linking core business, societal critical functions, internal and external connections to the various undertakings/business areas in the group (table).

3.2.4 Recovery Measures

Recovery measures are various measures the undertaking can implement to maintain or restore the undertaking's financial position in, or after, a stress period. Preparations and assessment of measures in advance of a crisis situation constitute a central part of the undertaking's preparedness.

Selection of Measures The recovery plan must contain an overview of all measures that, alone or in combination, increase the probability that the undertaking will survive different types of stress. The measures must be relevant to the undertaking. The plan must also include measures that can be implemented in a normal situation.

As a rule, the undertaking's room for action in a serious stress situation will depend on which measures the undertaking has implemented at an earlier time, as the undertaking's alternatives are limited as the measures are implemented. The undertaking's room for action will also be influenced by the macroeconomic situation, and by what other financial undertakings do at the same time. The overview must clearly show which measures are mutually exclusive, and whether the measures are considered relevant to implement during a bank-specific crisis and a system crisis.

Reasonableness Assessment of Measures The measures must be realistic and can be implemented within a reasonable time and without adverse effects on customers, other financial undertakings, and the economy as a whole. Finanstilsynet assumes that the recovery plan describes situations where it may be relevant to implement the various measures, and that the undertaking assesses to what extent the measures are mutually exclusive or limit other measures. In this context, Finanstilsynet expects the undertaking to also assess matters that may hinder, delay implementation, or reduce the effect of the individual measure. For each measure, the undertaking must assess operational, legal, and financial matters that may hinder the implementation of the measure, both in a bank-specific crisis and in a system crisis, cf. point 3.2.3. If the undertaking assesses that there are matters that may hinder, reduce the effect of, or delay the implementation of the measures, the undertaking must describe how the obstacles can be remedied. See also the discussion of preparatory measures in point 3.2.7. It should also be clear whether the implementation of the relevant measures depends on third parties. If the undertaking has relevant experience from implementing similar measures, Finanstilsynet assumes that previous experiences are included in the assessment of the measures.

Access to Central Bank Facilities and Overview of Assets That Can Be Pledged as Collateral The recovery plan must contain an analysis of the undertaking's access to central bank facilities. The plan must provide an overview of assets that can be pledged as collateral to the central bank. 21)

Finanstilsynet also expects the undertaking to prepare an operational plan for access to liquidity facilities, both in Norges Bank and, if relevant, in foreign central banks. The undertaking must familiarize itself with the different facilities and what is required to gain access to them. The undertaking should also assess the time aspect related to the use of central bank facilities in a potential crisis situation, cf. the point below.

Timeline and Plan for Implementation of Measures The undertaking must have an action plan for each of the measures and describe the process for implementing the individual measure, i.e., what is required of preparations and necessary decision processes before, during, and after the measure is implemented. The action plan must include the Board's assessment of how societal critical functions can be maintained when the measures are implemented.

The undertaking must assess how long it will take to implement each of the measures and when it would be most relevant to implement the measure (early or late in a crisis process). The assessments must be made in light of different stress scenarios. Finanstilsynet assumes that the undertaking also assesses the timeline in light of internal and external connections, and other matters that may hinder the implementation of the measures.

The undertaking must take into account necessary preparations, such as obtaining data basis and other information, permission from customers and relevant supervisory authorities, as well as any legal clarifications necessary to implement the measure. If the implementation of the measure depends on third parties and/or external IT systems/services, this must also be taken into account in the assessment. The undertaking must also assess necessary steps that may contribute to faster implementation of the individual measure.

The timeline must show when each of the measures is expected to give the desired effect on capital and liquidity indicators as well as profit and balance sheet.

Recovery Capacity Finanstilsynet assumes that the undertaking explains how the measures, alone or in combination, could contribute to restoring the financial position under different market conditions and stress situations. The undertaking must analyze, assess, and quantify the assumed effect of the individual recovery measures. The undertaking must at least indicate the expected effect on common equity tier 1 capital ratio, unweighted capital ratio, and LCR, both in percentage and in NOK amounts, as well as the expected effect on profit and balance sheet. It must be clearly stated which assumptions underlie the undertaking's assessments. Expected effect can be given in intervals as long as it is clear which assumptions underlie the different sizes in the interval. The undertaking should give the effect of each individual measure, and the total effect of the measures in combination (recovery capacity). In addition, the undertaking must assess the effect of the measures in different scenarios, cf. point 3.2.6.

For measures involving the sale of assets, the undertaking must use known valuation principles, possibly observed market value for the sale of similar business. The assumptions must be documented. Finanstilsynet expects the undertaking to assume a significant reduction in sale values that reflects expected market conditions at the time of sale, where the undertaking is expected to be in a serious stress situation. The undertaking should document what information must be available to implement a purchase analysis (due diligence), and document that such information can be made available within the current timeframe. Undertakings should assess whether there are matters that hinder information from being shared with third parties, and how this can be handled. In the sale of business, the undertaking may also include any assessments of possible buyers.

When assessing the undertaking's recovery capacity, the undertaking should take into account the organization's ability and capacity to handle the implementation of several measures simultaneously, both in a bank-specific crisis and in a general crisis.

Consequence Analysis The undertaking must assess any consequences the measures may have for the undertaking's (group's) business, for customers, other financial undertakings, and the economy as a whole. The undertaking must assume continued operations after relevant measures have been implemented.

The undertaking must assess consequences for profitability, product composition, risk profile, reputation, and trust. Consequences for the undertaking's core business must be assessed specifically. Measures that involve a significant burden on the undertaking's resources may also affect the undertaking's ongoing operations in a recovery phase.

Undertakings with societal critical functions must assess which support functions and systems must be available for the societal critical functions to continue after the implementation of measures. This applies especially to the sale of business. Examples of support functions and systems may be IT and/or control systems, resources and expertise areas related to financing, risk management, control, modeling, IT, accounting, etc. The undertaking should make the assessment both in light of a bank-specific crisis and a system crisis.

Undertakings with societal critical functions must be crisis-managed. 22) Undertakings with societal critical functions must assess how the implementation of measures may limit the alternatives in a potential subsequent crisis management of the undertaking, and whether the