Circular on the Bank's expectations as regards quality of reported prudential and financial data

NBB_2017_27 – 12 October 2017 Circular – Page 1/10 de Berlaimontlaan 14 - BE-1000 BRUSSEL Tel. +32 2 221 38 12 – Fax 32 2 221 31 04 ondernemingsnummer: 0203.201.340 RPR Brussel www.nbb.be Circular Brussels, 12 th of October 2017 Kenmerk: NBB_2017_27 uw correspondenten:
Pieter-Jan Janssens / Patricia Kaiser tel. +32 2 221 20 23 / 34 31 – fax +32 2 221 31 04 pieterjan.janssens@nbb.be / patricia.kaiser@nbb.be Circular on the Bank's expectations as regards quality of reported prudential and financial data Scope x Insurance or reinsurance companies under Belgian law. x Insurance or reinsurance companies that are part of a group under Belgian law within the meaning of Article 339, 2°, of the Law of 13 March 2016 on the legal status and supervision of insurance and reinsurance companies. x Companies under Belgian law that are part of a financial conglomerate under Belgian law within the meaning of Article 340, 1°, of the aforementioned Law of 13 March 2016. x Branches of third-country companies operating in insurance [or reinsurance] in Belgium. x Mutual health insurance societies as defined in Article 15, 79°, of the aforementioned Law of 13 March 2016. For these companies, the words “the Bank” should be replaced by “the Supervisor of mutual health funds and of national unions of mutual health funds” as defined in Article 15, 84°, of the same Law. x Credit institutions under Belgian law. x Financial services groups whose lead institution is a Belgian regulated entity (hereinafter referred to as “financial holding companies”) and financial services groups whose lead institution is a Belgian mixed financial holding company (hereinafter referred to as “mixed financial holding companies”). x Branches established in Belgium of foreign credit institutions. x Stockbroking firms under Belgian law; x Payment institutions under Belgian law; x Electronic money institutions under Belgian law; x Settlement institutions and institutions equivalent to settlement institutions under Belgian law; This circular shall not apply to insurance companies referred to in Articles 275, 276 or 294 of the aforementioned Law of 13 March 2016.

Circular – Page 2/10 NBB_2017_27 – 12 October 2017 Summary / Objectives The aim of this circular is to draw the attention of the financial institutions concerned to the high importance given by the supervisory authorities to the quality of the prudential and financial data submitted to supervisors by the institutions under supervision. It is also intended to raise awareness to the various quality tests which the institutions concerned are required to comply with for the data they submit. It subsequently proposes a wider reference framework for monitoring and improving the quality of the internal reporting process and prudential data to be subsequently communicated.

NBB_2017_27 – 12 October 2017 Circular – Page 3/10 Dear Sir or Madam, In the context of their prudential supervision tasks, the supervisory authorities (i.e. the Bank, the ECB and the EBA or EIOPA) periodically collect prudential and financial data from the aforementioned companies that are subject to their supervision. This collection of information takes place in a harmonised European framework for credit institutions as well as for insurance companies. In order to thoroughly carry out the tasks that are assigned to them, the supervisory authorities attach great importance to the quality of the data that are periodically transmitted by the institutions. The Bank therefore considers it necessary to provide the institutions it supervises with a set of recommendations so that they can ensure the expected level of quality in their prudential reporting. To this end, the circular first recalls the various aspects that make up the quality of the reporting, and goes on to determine what prudential expectations apply to institutions’ internal organisation as regards prudential reporting. It should be noted that the quality of the data reported for prudential supervision purposes falls under the responsibility of the institution that prepares and reports the data to the supervisory authorities. For the purpose of this circular, the term “institution” shall, unless otherwise specifically provided, refer to all entities that fall within the scope of the circular. This circular shall apply to all institutions falling within its scope. Its primary focus, however, is on the institutions subject to the European reportings referred to in sections 1.1 1 and 1.2 of this circular. All institutions shall apply the prudential expectations elaborated in this circular in a proportionate manner, taking into account their size, activities, risk profile and complexity, as well as the complexity of the reportings themselves. This circular shall apply immediately. However, a lead-in period shall be allowed in order to provide institutions with sufficient time to take the measures necessary to be in line with the expectations included in this circular and in order to provide accredited statutory auditors with sufficient time to verify the documents described. As a first step, institutions should draw up a self-assessment which verifies to what extent the institution already complies with the prudential expectations laid down in this circular. Accredited statutory auditors shall incorporate this self-assessment in the assessment performed by them in the context of their report on the 2017 year-end figures. They shall perform an initial verification of the requested documents regarding the prudential expectations in their assessment of the biannual reports on 30 June 2018.

1. Definition of data quality
   Generally speaking, data quality can be defined as the adequacy of the data for the ultimate user goal. In this regard, six dimensions can be established (accuracy, reliability, completeness, consistency, plausibility and timeliness) against which the quality of the data can be assessed (see the annexe for a description of these dimensions). Due to the increasing importance of the quality of the data reported, the supervisory authorities place strong emphasis on the “data quality rules” developed by them. For the various types of prudential reporting, there are, at multiple levels of supervision, Data Quality Tests to verify and monitor the reported prudential data. These rules can be consulted on the websites of the supervisory authorities, enabling institutions to check their reportings against these tests before submitting them to the Bank. The organisational measures to be taken by institutions with regard to data quality must ensure that the institution complies at all times with the 6 dimensions of data quality as defined above. 1 The term ”credit institutions” should be interpreted in the broad sense. This circular focuses in particular on institutions that are required to comply with the European reporting requirements.

Circular – Page 4/10 NBB_2017_27 – 12 October 2017 Implementation of these principles will as a minimum require compliance with the quality requirements set out in the legal framework for reporting. These requirements concern not only the reporting procedure as such (format, language used, timeliness, etc.) but also the content of the reporting (validation tests defined by European or Belgian reporting standards). In addition to these minimum requirements, a number of tests are necessary in some cases in order to verify that all dimensions of data quality have been complied with (e.g. plausibility tests). These tests are not meant to invalidate any reporting carried out in accordance with the legal requirements; instead, their purpose is to enable both the institution and the supervisor to assess the quality of the reporting, and, beyond that, the information it provides as regards solvency, risk, financial performance, etc. In principle, this circular shall apply to all reportings that are required to be submitted periodically to the Bank. However, this circular primarily focuses on European reportings (reportings in the context of the EBA ITS and of the ECB FINREP Regulation for credit institutions, and of the EIOPA ITS and the so￾called ‘list of assets’ for insurance companies).
1.1. CREDIT INSTITUTIONS
The obligations relating to the requirements for prudential reporting as imposed on credit institutions are laid down in Directive 2013/36/EU 2 (CRD IV), supplemented by Regulation (EU) 575/2013 3 (CRR). The CRR mandated the EBA to draw up a draft implementing technical standard (ITS) for prudential reporting. This ITS as presented by the EBA defines the formats, frequencies, deadlines and definitions for prudential reporting and has been approved through Regulation (EU). 680/2014 4 as subsequently amended (hereinafter "the EBA’s ITS"). The EBA’s ITS is a harmonised European framework for reporting financial data (FINREP), own funds and capital requirements (COREP), as well as large exposures, leverage, liquidity and stable financing, encumbered assets, non-performing exposures, etc. In addition to the reporting requirements as imposed by the EBA’s ITS, the ECB adopted Regulation (EU) 2015/534 5 (SSM Regulation) for the purposes of the Single Supervisory Mechanism (SSM). The SSM Regulation extends FINREP reporting requirements to reporting on a non-consolidated basis for banks within the euro area (with respect to both SIs and LSIs). In addition to reporting at European level, the Bank also requires periodic reporting of prudential data at national level from the institutions concerned. This type of reporting relates in particular to Scheme A and reporting under pillar II (in particular reporting on interest rate risk). The EBA’s validation rules are regularly updated: rules can be added, and existing rules can be changed or even disabled. These (EBA) validation rules are included in the published versions of the ITS and on the EBA website 6. 2 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC. 3 Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012. 4 Commission Implementing Regulation (EU) No 680/2014 of 16 April 2014 laying down implementing technical standards with regard to supervisory reporting of institutions according to Regulation (EU) No 575/2013 of the European Parliament and of the Council (as subsequently amended). 5 Regulation (EU) 2015/534 of the European Central Bank of 17 March 2015 on reporting of supervisory financial information (ECB/2015/13). 6 The list and details of the validation rules can be found on the EBA website: http://www.eba.europa.eu/risk￾analysis-and-data/reporting-frameworks.

NBB_2017_27 – 12 October 2017 Circular – Page 5/10 The validation rules imposed by the ITS result in an “error message” in OneGate if the reported data fail to meet the requirements. In such case, the reporting session cannot be finalised. As part of CRD IV and the CRR, the EBA also publishes a series of questions and answers on reporting under the EBA’s ITS. The main purpose of these Q&As is to contribute to consistent and effective implementation of the EBA’s ITS; they can be consulted on the EBA website 7. The Data Quality Framework was established within the context of the SSM. It aims to verify the quality of the data reported for SSM purposes. Under the Framework, the ECB has developed complementary qualitative tests in collaboration with the national supervisory authorities, among which the NBB. These additional data quality controls focus primarily on consistency and plausibility of the reported data and also apply, along with the EBA validation rules, to the various European reporting obligations (with respect to both SIs and LSIs). In future, new additional controls will further be developed and evaluated within the SSM. The Bank has decided to also implement in OneGate, in parallel with the EBA’s ITS validation rules, a set of additional data quality checks 8. The SSM’s additional data quality controls will initially be implemented in OneGate as “warnings”. These warnings will inform the declarant if and when the data submitted fail to meet the additional quality standards. They are designed in such a way that the declarant is informed of possible data quality concerns but is nonetheless able to close the report in OneGate. The additional quality controls will be published on the Bank’s website:
https://www.nbb.be/doc/dq/onegate/documentation_domains/xbrl/xbrl_documention_fr.html. Any adaptations to the additional quality controls will also be made available through this portal. In addition to direct quality assessment in OneGate, the Bank also closely monitors the quality of reported prudential data and makes enquiries from the institutions concerned. These questions-and-answers procedures initiated by the Bank relate both to mandatory reporting at the European level and to the various types of reporting at national level. As the institutions concerned are expected to provide prudential data that meet the data quality test criteria, the Bank encourages them to comply in the most complete and precise manner with the various reporting requirements.
1.2. INSURANCE COMPANIES
The obligations relating to the prudential reporting requirements for insurance companies are imposed by
Article 35 of the Solvency II Directive of 25 November 2009 on the taking-up and pursuit of the business
of Insurance and Reinsurance. That article has been complemented by the Delegated Regulation of 10 October 2014 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II), which lays down in Articles 304 to 314 the items and content for reporting, as well as the applicable deadlines and means of communication. Furthermore, upon EIOPA’s proposal, an ITS (Commission Implementing Regulation (EU) 2015/2450 (RSR) of 2 December 2015) lays down the implementing technical standards with regard to the templates for the submission of information to the supervisory authorities. 7 The EBA’s questions and answers can be found on the EBA website: https://www.eba.europa.eu/single-rule￾book-qa. 8 As from the reference period 31/12/2016, the SSM’s additional quality controls have been added to the process for validating prudential reporting within OneGate.

Circular – Page 6/10 NBB_2017_27 – 12 October 2017 That ITS, which aims to harmonise the models to be used for reporting the information required to the supervisory authorities in order to promote convergence in supervision, relates to information on the Solvency II balance sheet, own funds, SCR calculation, technical provisions, assets, reinsurance, etc. In addition to standardised European reporting under Solvency II, the Bank also requires additional information such as the (non-consolidated) annual accounts, life and non-life profitability statistics, interest rate risk reporting and liquidity reporting. For insurance companies, the validation rules are determined at European level as part of the abovementioned regulations for standardised reporting under Solvency II. The formulas are regularly updated, new validation rules can be added, and existing rules can be changed or even disabled. These (EIOPA) validation rules are included in the ITS (EU Regulation 2015/2450 (RSR)) and are published on the EIOPA website. In addition to the validation rules contained in the ITS, EIOPA also publishes several questions and answers on practical issues related to Solvency II reporting. The main purpose of these Q&As is to contribute to consistent and effective implementation of the ITS. In addition, the Bank has included in its Communication NBB_2016_01 on data quality relating to reporting element S.06.02 (“list of assets“) the detailed requirements laid down in the technical annexes on reporting items. The Bank has drawn up a list of the controls which the list of assets must comply with. The list is based on the specifications that are set out in the log files and apply to both the preparatory phase and Solvency II proper. Insurance companies and insurance groups are expected to carry out these controls prior to submitting the list of assets to the Bank. The validation rules imposed by the ITS result in an “error message” in OneGate if the reported data fail to meet the requirements. In such case, the reporting session cannot be finalised.
2. Supervisory expectations on internal organisation in the context of data quality
The Banking Law requires credit institutions to “have sound and appropriate structures for the organisation of the business, including supervisory measures, to ensure effective and prudent management of the institution, and in particular founded on (…) 2° appropriate administrative and accounting procedures and internal control, especially including a control system that provides a reasonable level of assurance of the reliability of the financial reporting process” (Article 21, § 1, of the Law of 25 April 2014 on the legal status and supervision of credit institutions and stockbroking firms, hereinafter referred to as the “Banking Law”). Similarly, the Law on supervision of insurance and reinsurance companies provides that in order to “guarantee effective and prudent management, every insurance or reinsurance company shall have an appropriate governance system, including supervisory measures, based in particular on (…) 2° appropriate administrative and accounting procedures and internal control, especially including control procedures that provide a reasonable level of assurance of the reliability of the reporting process” (Article 42, § 1, of the Law of 13 March 2016 on the legal status and supervision of insurance and reinsurance companies, hereinafter referred to as the “Insurance Law”). In this context, the Bank considers it useful to specify certain general expectations as regards the internal organisation of the institutions concerned so that they are able to provide the supervisory authorities with the best level of information quality for the purposes of prudential supervision. These expectations are without prejudice to the applicable regulations (in particular as regards governance or the use of internal models) and are intended exclusively to clarify their implications in the specific context of data quality. Institutions should apply all principles elaborated in this circular in a proportionate manner, based on their size, activities, risk profile and complexity, as well as on the complexity of the reportings themselves.

NBB_2017_27 – 12 October 2017 Circular – Page 7/10 Principle 1 - Governance – The process of preparing, verifying and submitting the prudential data to the Bank should be supported by a robust, documented governance system based on the following:
1.1. An identification of the role and responsibilities of the institution’s decision-making
bodies 9 with a view to ensuring the institution's compliance with the reporting requirements, including the afore-mentioned aspects on data quality. Ensuring quality in the reported prudential data is a concern that needs to be addressed at the managerial level. Therefore it is important to explicitly define, within the institution, the roles and responsibilities of management and the board of directors (as well as the audit committee, if any). These roles and responsibilities shall be defined with a view to ensuring that all necessary means and procedures have been provided in a credible manner in order to report the prudential data to the Bank in compliance with the rules on quality. These rules on internal organisation should be used as a basis in submitting the statements and confirmation required of the management committee (or, as the case may be, senior management) in accordance with Article 106, § 2, of the Banking Law and Article 80, § 5, of the Insurance Law. In this context, the Bank also notes that the duties of internal audit services within institutions may include monitoring and verifying compliance with the expectations described in this circular.
1.2. Allocating sufficient human resources with the necessary level of expertise to ensure that
the institution is able at all times to comply with the prudential reporting requirements. Identifying these persons and their roles and responsibilities at each stage of the reporting process, from collection of the data required for the various types of reporting, through the procedure for processing these data, using them in preparing the reporting documents and verifying that the data comply with the applicable instructions 10 (especially as regards data quality as referred to above), to transmission of the reporting to the Bank according to the instructions in force (deadlines, formats, language used, etc.). It is essential that the institution should undertake an assessment of the human resources required for reporting and should have them permanently in place. As a result, the roles and responsibilities of these individuals (where appropriate, aggregated at the level of the division concerned) should be defined and documented in detail. These definitions and documentation should at all times enable the persons in charge of internal and external controls to determine the source of any deficiencies in preparing and submitting the data and to remedy them in terms of human resources. From a security point of view, it is recommended that the institutions concerned should entrust the preparation of the tables and their final validation to separate persons. Any inconsistencies present in the first step may in such cases be detected during subsequent validation.
1.3. The established governance should be subject to periodic review and necessary
improvements in order to enable the institution to comply with its reporting obligations at all times 9 The board of directors (and the audit committee if any) and the management committee (or, as the case may be, senior management). 10 These instructions are varied and specific for each reporting item. They may stem from European Regulations or from regulations, circulars and other documents issued by the competent authorities.

Circular – Page 8/10 NBB_2017_27 – 12 October 2017 Principle 2 - Technical capacities - Institutions should design, establish and manage such data architecture and IT infrastructure as are appropriate for producing and verifying prudential reporting in accordance with the instructions. Implementation of this principle should take into account at least the following:
2.1. The capacities thus established should at all times ensure compliance with reporting
instructions, also in times of stress or crisis.
The adequacy of the capacities thus established should be assessed both in terms of quality and importance. Since each institution has its own characteristics, the criterion to be taken into consideration in defining the appropriate level of capacities to be established is the obligation to provide timely prudential reporting in compliance with the applicable instructions and in accordance with the aforementioned legal provisions (Article 106 of the Banking Law and
Article 80, § 5, of the Insurance Law).
2.2. The capacities should be sufficient and should include in particular the tools necessary
for timely detection and resolution of errors and inconsistencies in reporting by reference to the above data quality expectations (throughout the various stages, from advance preparation of data to submission of reporting to the competent authority). The tools should also ensure that the list of errors and inconsistencies detected is archived and that adequate follow-up is ensured of these errors and inconsistencies.
2.3. The tools and techniques for internal information management should be as automated
and integrated as possible.
The use of manual information processing should be avoided as much as possible and should, where it is resorted to, be the subject of appropriate control procedures. Similarly, the use of non￾integrated tools, such as miscellaneous unconnected computer applications, may also weaken the integrity and quality of the reporting process. At the very least, where such non-integrated tools are used, a secured, verified and documented process should be in place to ensure reliability of the entire information processing process. However, wherever manual information processing is applied in the process, the institution should include in its documentation the reason for the use of this manual information processing, as well as potential associated risks. Institutions are also expected to clarify, in the documentation, the measures taken by them to compensate for these risks.
2.4. The tools in place should be subject to periodic review and necessary improvements in
order to enable the institution to comply with its reporting obligations at all times Principle 3 - Process - The process of preparing, verifying and submitting the prudential data to the Bank should follow a documented internal process that is appropriate to meet the requirement that the data should be reported in compliance with the applicable instructions. In order to meet the legal expectations in this respect, it is important that institutions should ensure that each step of the internal reporting process is precisely defined, in particular the determination of the necessary appropriate controls and validation procedures that will be applied throughout the data production process. In this regard, institutions should ensure the following:
3.1. A written general description of the processes in place, containing

• A description of the flow of information within the institution;

NBB_2017_27 – 12 October 2017 Circular – Page 9/10

• A description of the processes for verifying that reporting is in compliance with the
  instructions in force and the processes for correction and final validation of reporting before it is communicated to the supervisory authority;
• A list of mandatory quarterly reports and of all tests to be complied with in order to ensure the
  quality of the data (as well as additional institution-specific tests);
• Where relevant, a glossary of all the concepts used in reporting and the link between the
  various concepts, as well as the instructions contained in the standards on prudential reporting. The glossary may also contain a list of the main interpretations and assumptions drawn from the regulatory framework for the tables to be sent. In the case of a group, it is important that this glossary should be standardised as much as possible among the various entities of the group.
• A record of all reconciliations between different systems and divisions within the institution
  itself.
  3.2. Per reporting table, a list of the various divisions involved in the preparation of the table,
  in the validation process, in the automatic and manual (internal) controls and in the final approval. This is all the more important if reporting is based on data from various departments within the institution or from international models.
  3.3. The process in place should also integrate and document the key controls to be carried
  out and the steps that must be taken to ensure that the above expectations are met in terms of data quality. These key controls may be important for verifying the quality of reported data where one department uses figures that have been prepared by another department. Procedures for detecting, reporting and explaining data integrity errors or issues through reports should be fully integrated and consistent within each entity as well as, inasmuch as possible, at the group level. The documentation maintained should show the links between these elements and the aforementioned governance and capacities principles (indicating e.g. who operates a particular control, at what time, and using what tool). Key controls will also cover any reconciliation of periodic data reported to the Bank with the internal information management systems, both at the accounting level and for risk management purposes. The importance of key controls notwithstanding, the integrity of information originating from another department or from internal models constitutes another major focus for users of this information. Consequently, the Bank also stresses the importance of data integrity. In addition, the Bank deems it appropriate for institutions to have a sufficiently robust and documented user access policy.
  3.4. The processes in place should be subject to periodic review and necessary improvements
  in order to enable the institution to comply with its reporting obligations at all times

Circular – Page 10/10 NBB_2017_27 – 12 October 2017
3. Expectation as regards the accredited statutory auditor
In addition to the measures that institutions can take internally, accredited statutory auditors will also be required to examine data quality. To this end, it is essential that documentation for each of the organisational elements set out above should be sufficiently detailed, clear and up-to-date in order to enable the accredited statutory auditor to verify, for the purpose of the opinion required from him on the periodic statements, whether the institution has adequately implemented all relevant and effective measures to ensure quality of reporting under the regulatory requirements and expectations laid down in this Circular. Yours faithfully, Jan Smets Governor