Circular NBB_2011_09 of 20 December 2011

The management report on the assessment of internal control, the management report on the assessment of internal control regarding investment services and activities, and the management declaration on periodic prudential reporting

Scope:

Credit institutions, stock exchange companies, payment institutions, clearing houses and entities assimilated to clearing houses, and Belgian mixed financial companies.

Summary/Objectives:

This circular specifies the various reports that the management body of supervised entities must transmit to the approved auditor and the NBB each year. It sets out the NBB's expectations regarding the assessment of internal control and the declaration on periodic prudential reporting.

Structure:

• Part 1. Scope
• Part 2. Management report on the assessment of internal control
• Part 3. Management report on the assessment of internal control regarding investment services and activities
• Part 4. Management declaration on periodic prudential reporting

---

Madam,
Sir,

A series of supervisory laws impose obligations on the management body of supervised entities. This circular clarifies the following three legal obligations:

1. the management report on the assessment of internal control;
2. the management report on the assessment of internal control regarding investment services and activities;
3. the management declaration on periodic prudential reporting.

This circular comprises four parts. Part 1 indicates the scope of each obligation; Parts 2 to 4 present the scope of the three distinct aspects.

Circular CBFA_2008_12 of 9 May 2008 on the management report on the assessment of the internal control system and the management declaration on periodic prudential reporting is repealed with regard to entities falling within the scope of this circular.

---

boulevard de Berlaimont 14 | 1000 Brussels t +32 2 221 21 11 | f +32 2 221 31 00 | www.bnb.be

---

NBB_2011_09 of 20 December 2011
2 / 10

PART 1. Scope

Each of the three obligations is linked to a specific scope.

1) Management report on the assessment of internal control

• credit institutions¹
• branches established in Belgium of credit institutions subject to the law of an EEA Member State²
• branches established in Belgium of credit institutions not subject to the law of an EEA Member State³
• stock exchange companies⁴
• branches established in Belgium of stock exchange companies not subject to the law of an EEA Member State⁵
• payment institutions⁶
• clearing houses and entities assimilated to clearing houses⁷
• branches established in Belgium of foreign clearing houses assimilated to clearing houses⁸
• Belgian financial companies⁹

2) Management report on the assessment of internal control regarding investment services and activities

• credit institutions¹⁰
• branches established in Belgium of credit institutions not subject to the law of an EEA Member State¹¹
• stock exchange companies¹²
• branches established in Belgium of stock exchange companies not subject to the law of an EEA Member State¹³
• clearing houses and entities assimilated to clearing houses¹⁴
• branches established in Belgium of foreign clearing houses assimilated to clearing houses¹⁵
• Belgian financial companies¹⁶

---

Footnotes:

¹ Article 20, § 5, paragraph 7, of the law of 22 March 1993.
² Article 70bis of the law of 22 March 1993.
³ Article 79, § 1, paragraph 1, 5°, of the law of 22 March 1993 (reference to Article 20 of said law).
⁴ Article 62, § 5, paragraph 7, of the law of 6 April 1995.
⁵ Article 20, § 1, 6°, of the Royal Decree of 20 December 1995 (reference to Article 62 of the law of 6 April 1995).
⁶ Article 14, § 5, paragraph 3, of the law of 21 December 2009.
⁷ Article 10, § 5, paragraph 6, of the Royal Decree of 26 September 2005.
⁸ Article 36 of the Royal Decree of 26 September 2005 (reference to Chapter II of said Royal Decree, including Article 10).
⁹ Article 4, § 1, paragraph 2, of the Royal Decree of 12 August 1994.
¹⁰ Article 20bis, § 7, paragraph 2, of the law of 22 March 1993.
¹¹ Article 79, § 1, paragraph 1, 5°, of the law of 22 March 1993 (reference to Article 20bis of said law).
¹² Article 62bis, § 7, paragraph 2, of the law of 6 April 1995.
¹³ Article 20, § 1, 6°, of the Royal Decree of 20 December 1995 (reference to Article 62bis of the law of 6 April 1995).
¹⁴ Article 10bis, § 7, paragraph 2, of the Royal Decree of 26 September 2005.
¹⁵ Article 36 of the Royal Decree of 26 September 2005 (reference to Chapter II of said Royal Decree, including Article 10bis).
¹⁶ Article 4, § 1, paragraph 2, of the Royal Decree of 12 August 1994.

---

NBB boulevard de Berlaimont 14 | 1000 Brussels t +32 2 221 21 11 | f +32 2 221 31 00 | www.bnb.be

---

NBB_2011_09 of 20 December 2011
3 / 10

3) Management declaration on periodic prudential reporting

• credit institutions¹⁷
• branches established in Belgium of credit institutions subject to the law of an EEA Member State¹⁸
• branches established in Belgium of credit institutions not subject to the law of an EEA Member State¹⁹
• stock exchange companies²⁰
• branches established in Belgium of stock exchange companies subject to the law of an EEA Member State²¹
• branches established in Belgium of stock exchange companies not subject to the law of an EEA Member State²²
• payment institutions²³
• clearing houses and entities assimilated to clearing houses²⁴
• Belgian financial companies²⁵
• Belgian mixed financial companies²⁶

---

Note regarding the application of the circular on a solo/consolidated basis.

This circular applies on a solo basis and on a consolidated basis²⁷. However, if regulated entities subject to NBB supervision are part of a group subject to consolidated or sub-consolidated supervision by the NBB, the report of these entities regarding the assessment of internal control may be part of the consolidated or sub-consolidated report, provided that the relevant aspects of the parent companies and regulated subsidiaries appear in the consolidated or sub-consolidated report in an identifiable manner. This procedure does not affect the responsibility of the management body, and if applicable, the management committee, of each regulated entity regarding compliance with its legal obligations, including the obligation to report to the statutory administrative body.

---

Footnotes:

¹⁷ Article 44, paragraph 2, of the law of 22 March 1993.
¹⁸ Article 71, paragraph 1, of the law of 22 March 1993 (reference to Article 44, paragraph 2, of said law).
¹⁹ Article 80, § 1, 4°, of the law of 22 March 1993 (reference to Article 44 of said law).
²⁰ Article 91, paragraph 2, of the law of 6 April 1995.
²¹ Article 7 of the Royal Decree of 20 December 1995 (reference to Article 91 of the law of 6 April 1995).
²² Article 21, 8°, of the Royal Decree of 20 December 1995 (reference to Article 91 of the law of 6 April 1995).
²³ Article 24, paragraph 2, of the law of 21 December 2009.
²⁴ Article 38, paragraph 2, of the Royal Decree of 26 September 2005.
²⁵ Article 6, § 3, of the Royal Decree of 12 August 1994.
²⁶ Article 12, § 3, of the Royal Decree of 21 November 2005.
²⁷ Financial companies are not required to report on the internal control system on a solo basis. They must, however, prepare such a report on a consolidated basis. In accordance with Article 4, § 1, of the Royal Decree of 12 August 1994, the supervision of financial companies also covers management, organization, and internal control, as referred to in Articles 20 and 20bis of the law of 22 March 1993, Articles 62 and 62bis of the law of 6 April 1995, and Article 153 of the law of 20 July 2004 for the consolidated set. The reporting obligation by the management body is therefore applicable by analogy to the consolidated situation of financial companies.

---

NBB boulevard de Berlaimont 14 | 1000 Brussels t +32 2 221 21 11 | f +32 2 221 31 00 | www.bnb.be

NBB_2011_09 of 20 December 2011
4 / 10

PART 2. Management report on the assessment of internal control

2.1 Context

The various supervisory laws provide that the management body and the statutory administrative body are responsible for the existence of an adequate internal control system in supervised entities.

Under the control of the statutory administrative body, the management body, and if applicable the management committee, takes the necessary measures to ensure that the entity has:
- reliable financial and prudential reporting;
- a set of internal control measures aimed at managing operational activities.

Annex 1 to this circular contains a detailed list of the legal provisions in this regard.

The statutory administrative body must, if applicable through the audit committee, verify whether the entity complies with the legal requirements. It must also take note of the adequate measures taken by the management body.

The management body must prepare at least once a year a report on compliance with the organizational requirements imposed by law and the adequate measures taken. The report must enable the supervisory body to verify that legal requirements are met.

The report must be transmitted to the supervisory body, the approved auditor, and the NBB.

This reporting is referred to below as the "report on the assessment of internal control."

The supervisory laws provide that the NBB determines the procedures for the report on the assessment of internal control. In accordance with these laws, the approved auditor collaborates in prudential supervision. It must evaluate the control measures taken by the entity and communicate its conclusions to the NBB. This evaluation must focus on the management report on the assessment of internal control. The NBB particularly expects the approved auditor to examine whether the aforementioned report reflects how the persons in charge of the management body drafted their report, and whether the report is based on sufficient documentation²⁸.

Note regarding branches established in Belgium of credit institutions subject to the law of an EEA Member State²⁹:

The assessment of internal control is limited to measures taken to comply with laws, decrees, and regulations applicable to these branches under Articles 68 (liquidity), 69 (internal and external monetary policy)³⁰, 71 (periodic statements), and 72 (keeping of accounts, inventory valuation, and publication of annual accounting information) of the law of 22 March 1993 (see Article 74, § 2, paragraph 1, 1°, of said law).

²⁸ See Circular CBFA_2009_19 of 8 May 2009 on the collaboration mission of approved auditors.
²⁹ Article 70bis of the law of 22 March 1993.
³⁰ This refers to:
- the mandatory reserve that may be imposed by the European Central Bank (ECB) - see ECB general documentation (http://www.nbb.be/doc/ts/Enterprise/Activities/MonetaryPolicy/gendoc2008fr.pdf) - and
- the possibility of withdrawing cash from the National Bank of Belgium - see NBB regulation (http://www.nbb.be/doc/ts/Enterprise/Activities/MonetaryPolicy/reglementBX2009fr.pdf).

NBB boulevard de Berlaimont 14 | 1000 Brussels t +32 2 221 21 11| f +32 2 221 31 00 | www.bnb.be

NBB_2011_09 of 20 December 2011
7 / 10

PART 3. Management report on the assessment of internal control regarding investment services and activities

3.1 Context

The supervisory laws concerning credit institutions, stock exchange companies, clearing houses and entities assimilated to clearing houses, and Belgian financial companies provide that these entities are required to implement adequate policies and procedures to ensure compliance with legal provisions regarding investment services and activities. The management body and the statutory administrative body are responsible for taking the necessary measures in this regard.

Under the control of the statutory administrative body, the management body, and if applicable the management committee, takes the necessary measures to ensure that the entity has:

A. appropriate rules applicable to personal transactions carried out on financial instruments by the entity, its directors, its senior managers, its employees, its linked agents, and its representatives;

B. adequate organizational and administrative measures to prevent conflicts of interest regarding investment services and activities;

C. adequate measures to ensure the continuity of investment services and activities;

D. adequate measures to limit operational risk related to outsourcing;

E. a database regarding its investment services and activities;

F. adequate measures for the protection of client assets.

The statutory administrative body must, if applicable through the audit committee, verify whether the entity complies with the legal requirements. It must also take note of the adequate measures taken by the management body.

The management body must prepare at least once a year a report on compliance with the requirements imposed by law for investment services and activities, as well as on the adequate measures taken in this regard. The report must enable the supervisory body to verify that legal requirements are met.

The report must be transmitted to the supervisory body, the approved auditor, and the NBB. In accordance with the supervisory laws, the NBB makes this information available to the FSMA.

This reporting is referred to below as the "report on the assessment of internal control regarding investment services and activities."

The supervisory laws provide that the NBB determines the procedures for said report. In accordance with these laws, the approved auditor collaborates in prudential supervision. It must evaluate the internal control measures taken by the entity regarding investment services and activities, and communicate its conclusions to the NBB. This evaluation must focus on the management report in this regard. The NBB particularly expects the approved auditor to examine whether the aforementioned report reflects how the persons in charge of the management body drafted their report, and whether the report is based on sufficient documentation³³.

3.2 Content of the report

The content of the report may be adapted, in consultation with the NBB and, if applicable, the approved auditor, based on the nature, volume, and complexity of the entity's activities and based on the operations it performs (application of the proportionality principle).

³³ See Circular CBFA_2009_19 of 8 May 2009 on the collaboration mission of approved auditors.

NBB boulevard de Berlaimont 14 | 1000 Brussels t +32 2 221 21 11 | f +32 2 221 31 00 | www.bnb.be

NBB_2011_09 of 20 December 2011
8 / 10

The report includes:
- a descriptive part;
- an evaluative part;
- a list of measures taken.

3.2.1. Description by the management body

This assessment takes the form of a concise description covering topics A to F mentioned in point 3.1.

3.2.2. Assessment by the management body

The management body conducts an assessment of the adequacy and functioning of the existing internal control regarding investment services and activities, and mentions the measures taken to remedy identified shortcomings. This assessment takes the form of a self-assessment covering topics A to F mentioned above.

Any negative assessment is subject to a detailed comment covering also the measures taken or to be taken.

3.2.3 List of measures taken

The management body provides a list of relevant adequate measures it has taken during the period under review within the framework of the internal control process regarding investment services and activities.

3.3 Form of the report

The scheme appearing in Annex 7 of this circular constitutes a template to be followed as much as possible. The entity will adapt it according to its organization and the risks to which it is exposed. It will ensure that it does not modify the form of its report, so that the NBB can perform a comparison over time and distinguish developments.

The report is signed by the person or persons representing the management body. With the prior agreement of the NBB, the reporting may be transmitted to it electronically according to the procedures it determines.

3.4 Periodicity and precise timing of the report

The reporting is prepared annually. It is transmitted to the NBB and the approved auditor within the month following the closing of the financial year.

For the 2012 reporting (i.e., that concerning the 2011 financial year), entities benefit from an exceptional two-month period following the closing of the financial year.

PART 4. Management declaration on periodic prudential reporting

The supervisory laws provide that the management body, and if applicable the management committee, transmits to the NBB a declaration regarding the periodic statements it communicates to the NBB at the end of the first half of the financial year and at the end of the financial year.

The management body declares to the NBB each semester that the periodic statements meet legal requirements. A copy of this declaration is transmitted to the approved auditor. This same report is transmitted to the statutory administrative body.

NBB boulevard de Berlaimont 14 | 1000 Brussels t +32 2 221 21 11 | f +32 2 221 31 00 | www.bnb.be

NBB_2011_09 of 20 December 2011
9 / 10

The management body, and if applicable the management committee, declares to the NBB that the periodic statements it transmits are consistent with the accounting and inventories. To this end, the periodic statements must be:
- complete, meaning they mention all data appearing in the accounting and inventories on the basis of which they are prepared, and
- correct, meaning they correspond exactly to the accounting and inventories on the basis of which they are prepared.

The management body confirms having taken the necessary steps to ensure that the aforementioned statements are prepared in accordance with the NBB's current instructions, as well as by applying the accounting and valuation rules governing the preparation of annual accounts, or, for periodic statements not relating to the end of the financial year, by applying the annual accounts relating to the last financial year.

The declaration reproduces the terms of the law.

If the management body cannot subscribe to such a declaration without reservation, it specifies in which areas shortcomings have been identified and what measures have been taken or will be taken to remedy these shortcomings.

The declaration is transmitted to the NBB no later than three months after the reporting period concerned. The declaration mentions the total balance sheet as well as the result of the period considered. A new declaration is transmitted if the periodic statements are adapted; it justifies the adaptations made.

The declaration is signed by the person or persons representing the management body. With the prior agreement of the NBB, the reporting may be transmitted to it electronically according to the procedures it determines.

* * *

A copy of this circular is sent to the approved auditor(s) of your entity.

Please accept, Madam, Sir, our distinguished salutations.

The Governor,

Luc COENE

NBB boulevard de Berlaimont 14 | 1000 Brussels t +32 2 221 21 11 | f +32 2 221 31 00 | www.bnb.be

NBB_2011_09 of 20 December 2011
10 / 10

Annex 1 - credit institutions, stock exchange companies, and payment institutions
NBB_2011_09-1 / List of legal provisions regarding internal control whose compliance must be ensured by the management body;

Annex 2 - credit institutions
NBB_2011_09-2 / Recommended scheme for the management report of credit institutions regarding the assessment of internal control;

Annex 3 - credit institutions
NBB_2011_09-3 / Internal control system assessment framework for credit institutions;

Annex 4 - stock exchange companies
NBB_2011_09-4 / Recommended scheme for the management report of stock exchange companies regarding the assessment of internal control;

Annex 5 - payment institutions
NBB_2011_05-2 / Recommended scheme for the management report of payment institutions regarding the assessment of internal control;

Annex 6 - clearing houses and entities assimilated to clearing houses
NBB_2011_09-6 / Recommended scheme for the management report of clearing houses and entities assimilated to clearing houses regarding the assessment of internal control;

Annex 7 - credit institutions, stock exchange companies, clearing houses, and entities assimilated to clearing houses
NBB_2011_09-7 / Recommended scheme for the management report of credit institutions, stock exchange companies, clearing houses, and entities assimilated to clearing houses, as well as Belgian financial companies, regarding the assessment of internal control.

NBB boulevard de Berlaimont 14 | 1000 Brussels t +32 2 221 21 11 | f +32 2 221 31 00 | www.bnb.be