Rule on the Identification and Assessment of Critical Functions of a Commercial Bank

Unofficial translation Decree № 129/04 of the Governor of the National Bank of Georgia on The Rule on the identification and assessment of critical functions of a Commercial Bank

2020 June Tbilisi

Pursuant to the Subparagraph “g” of Paragraph 1 of Article 15 and Paragraph 2 of the Article 551 of the Organic Law of Georgia on “the National Bank of Georgia”, I hereby order: Article 1. To adopt the attached Rule on the identification and assessment of critical functions of a Commercial Bank. Article 2. The rule shall enter into the force upon publication. K. Gvenetadze

The Rule on the identification and assessment of critical functions of a Commercial Banks Article 1. General provisions

1. The Rule on the identification and assessment of critical functions of a Commercial Bank (hereinafter - the rule) determines criteria for identification and assessment critical functions and shared critical services of the Commercial Banks and branches of foreign bank operating in Georgia (hereinafter - a bank). 2.In case the present rule does not regulate any issue related to the identification and assessment of the critical functions of the commercial banks, the National Bank of Georgia (hereinafter – NBG) or a bank with the approval of the NBG shall interpret the issue or act in accordance to the best practices which includes the technical standards and regulatory acts of Financial Stability Board (FSB) and European Banking Authority (EBA).
2. If a bank and NBG are unable to agree upon the interpretation of any clause or terminology or on any other issue following from the rule, the case should be decided as the NBG deems appropriate. Article 2. Definitions
3. The terms used in the present rule shall have the following meanings for the purposes of this rule: a) Critical function - The Service or operation provided by a bank to third parties, not affiliated to a bank and the sudden disruption/delaying of which is likely to cause the disruption of services that are essential to the real economy or to disrupt financial stability and which cannot be substituted or is hard to substitute within reasonable timeframe. Critical functions should be based on regular business and core business lines of a bank; b) Shared critical service – The service obtained by a bank, including authoring service, the sudden termination/delaying of which is likely to cause the disruption of normal operating of critical functions of a bank. Shared critical services include IT services, security systems, accounting and registering systems or real estate valuation systems of bank; c) Self-assessment document – The document developed by a bank within strategic analysis of the recovery plan which determines and assesses critical functions of a bank according procedures and criteria set out in this rule. Self-assessment document also should contain other elements regulated in this rule and template attached in the appendix N1.
4. Other terms used in this rule bear the meaning as defined in the relevant legal acts of the Georgian legislation. Article 3. Identification of the critical functions by a bank
5. A bank should determine critical functions within self-assessment document and provide relevant substantiate and rationale. Critical functions should be determined by individual features of a bank according to the supply-side analysis provided in the article 4 of this rule and impact analysis provided in the article 5 of this rule and with particular regard at least on the following criteria: a) The share of a bank in a banking/financial sector and share on the financial products’ market; b) The size of a bank and profile of the governance;

c) Risk profile; d) The social functions of a bank and functions that has impact on the real economy; e) Other functions determined by a bank with approval of NBG. 2. A bank is obliged to determine shared critical services while assessing critical functions and assess interconnectedness between them, which implies outlining potential damage caused by sudden disruption/delaying each shared critical service and establishing potential impact on the critical function(s) of a bank. Taking into consideration the individual features of a bank, critical functions might be following: a) Deposits - Acceptance of deposits from retail and corporate clients of a bank and administering deposit accounts. While considering acceptance deposits as a critical function, a bank should, at least, take into consideration the types and overall number of the deposits as well as a potential damage and contagion effect on the other providers caused by sudden disruption/delaying this function. In addition, a bank should take into consideration overall share of insured deposits as defined by the Law of Georgia on “Deposits Insurance System”; b) Lending – Granting loans to retail and corporate clients of a bank including consumer loans, mortgage loans, unsecured and other types of credits and administering relevant accounts. While considering lending as a critical function of a bank the latter should, at least, take into consideration the size of loan portfolios, including the ratio of secured and unsecured loans, types and overall numbers of borrowers, liquidity and maturity of the loans; c) Payment services, Cash, Settlement, Clearing, Custody services – Providing payment, cash, settlement, clearing and custodian services to retail and corporate clients of a bank. While considering abovementioned services as a critical function, a bank should, at least, take into consideration overall number of payment service clients and providers, types and overall number and amount of transactions, share of a bank on credit and debit card transactions. In addition, a bank should assess the types of payment services. If bank provides payslips, the number of clients and amount of transactions should also be considered; d) Security market services - Providing financial agent’s function, brokerage and/or other services allowed for a bank regulated under the law of Georgia on Securities Market. 3. In addition to the functions provided under the paragraph 2 of this article, a bank may consider other services as a critical functions, based on individual features and other social or economic functions related to the core business lines of a bank regulated under the article 20 of the Law of Georgia on “Commercial Bank Activities”. Article 4. Supply-side analysis (Substitutability) 1.A bank is obliged to assess substitutability of each considered function under the self-assessment document based, at least, on the following elements: a) Legal requirements (barriers), infrastructural requirements, level of concentration of the banking sector and share of a bank on the banking sector regarding considered function with elements provided under paragraph 2 of this article; b) The numbers and the names of other providers with ability to provide considered function. 2. The concentration of a banking sector provided under the paragraph 1 of this article should be assessed with following elements: a) The level of concentration of the banking sector and related trends;

b) If the banking sector is highly concentrated, the number of other providers and their shares on the market; c) The probability of contagion effect on other providers considering the size, governmental structure, financial and technical characteristics of a bank. 2. To conduct proper supply-side analysis, a bank should provide to NBG, at least following information: a) Information about other provider(s) (if any), which, under certain circumstances, are able to provide considered function with particular regard on their technical and material features. A bank should also assess the potential impact on the concentration of the banking/financial sector; b) Information regarding interested bank(s)/other provider(s) (if any), to provide considered function as well as the information about potential economic and financial profitability regarding considered function; c) Information regarding necessary infrastructure to provide considered function, including material and non-material assets, number of ATM-s and branches, necessary IT ecosystem and software, interbank contracts (if any) about using ATM-s with Preferential terms and conditions; d) Information regarding all other requirements to provide considered function properly, which also includes obtaining all necessary permissions and licenses; e) Information regarding stability of the banking/financial sector and possible negative effects on a banking/financial sector caused by providing considered by other provider(s); f) Information regarding acceptable maximum delay of the considered function and necessary timeframe to involve other providers to arrange considered function; g) Information regarding necessary resources and timeframe to adapt infrastructure for other providers to arrange considered function; h) Information regarding necessary human resources, including increasing staff and providing capacity building for other to properly arrange considered function; i) Information regarding the problems caused by sudden disruption/delaying of the considered function including hampering proper functionality of other banks. 3. After assessing elements set under the paragraphs 1 and 2 of this article, a bank should determine one the following statuses below for each function: a) Non-substitutable – No other providers are available to properly substitute considered bank in order to arrange considered function with reasonable expenses and within acceptable timeframe; b) Hard to substitute –Considered function can be carried out by other provider but it requires additional measures and resources; c) Easy to substitute – considered function can be easily arranged by other provider without additional efforts and resources.

Article 5. Impact analysis

1. Under the self-assessment document, a bank is obliged to assess possible negative impacts on the clients (third parties, not affiliated to a bank), the banking/financial sector and the real economy, caused by sudden disruption/delaying of each considered function, based at least on the following elements:

a) The types of the products/services connected to the considered function, including interbank transactions and services regarding banking service. A bank should also take into consideration the types and number of the clients (retail and corporate clients), types of a banking services – including remote banking services and services at the branch; b) The range of considered function and importance for the real economy regarding banking services on the local and international market; c) The potential damage on the stability of the banking/financial sector and related systemic infrastructures (if any), possible contagion effect on the other providers and probable negative effects caused by sudden termination /delaying of the considered function; d) The size of potential negative effects on the clients of a bank, including retail and corporate clients and possibility of negative contagion effect on the similar clients of the other bank caused by sudden termination /delaying of the considered function; e) The potential damage on the involved third parties, proper functionality of state administrative services, including administration of pension contributions, income taxes, levies, fees and other duties caused by sudden termination /delaying of the considered function; 2. After assessing elements set under the paragraphs 1 of this article, a bank should determine one of the following statuses below for each function: a) Significant negative impact – Sudden termination/delaying of the considered function will have a significant negative impact on the proper functionality of the banking/financial sector, real economy and third parties (not affiliated to a bank); b) Moderate negative impact – Sudden termination /delaying of the considered function will have a moderate negative impact on the proper functionality of the banking/financial sector, real economy and third parties (not affiliated to a bank); c) Minor negative impact - Sudden termination /delaying of the considered function will have a minor negative impact on the proper functionality of the banking/financial sector, real economy and third parties (not affiliated to a bank).

Article 6. The process of assessment of the considered function by a bank

1. In the process of assessment of the considered function under the self-assessment document, a bank should fill in the table provided in the appendix N2 of this Rule based on the individual features of a bank and assessment of the determined statuses based on supply-side analysis (substitutability) and impact analysis provided in the articles 4 and 5 of this rule. 2.In case of necessity, a bank is entitled to invite shareholders, investors, employees and other structural units of a bank and other stakeholders in the process of assessing critical functions with the prior consent of NBG. Article 7. Review of self-assessment document of a bank by the NBG

1.A bank is obliged to submit self-assessment document based on the criteria and elements set by this Rule under the recovery plan annually, but no later than April 30. 2.The NBG reviews self-assessment document of a bank in following circumstances: a) Annually, within assessing a recovery plan; b) In case of implementation the recovery plan or imposing resolution regime as defined by the Law of Georgia on “Commercial Bank Activities”. In such case, a bank is obliged to reassess and

revise the list of critical functions in order to update self-assessment document in order to reach compatibility with any changes (if any) within the timeframe set by NBG. A bank is also obliged to make updates into the self-assessment documents based on governance strategy, financial management policy of a bank or other events apart from a bank which might have some material impact on the proper functionality of a bank. 3. The NBG reviews the self-assessment document submitted by a bank within 6 months based on the elements provided in the articleს 3, 4 and 5 of this rule and based on the risk profile, systematic importance, the scale of business and its ownership structure. 4. within the subparagraph “b” of the paragraph 2 of this article, the NBG is entitled to adopt different procedures than defined by the paragraph 3 of this article and urgently review the self￾assessment document of a bank in order to eliminate potential threats or damage caused by sudden disruption/delaying critical functions of a bank. 5. In the assessment process of the self-assessment document provided by a bank, the NBG is entitled to request additional information from a bank, interview the employee(s) and member(s) of the governmental bodies of a bank and impose relevant supervisory measures, including on-site supervision. 6. If NBG considers that the document is in compliance with the requirements established by the present Rule, NBG approves the document. 7. If NBG considers that the document is not in compliance with the requirements of this Rule NBG does not approve the document and send relevant reasonable remarks, sets additional time for elimination these deficiencies up to two months. Upon argumented request from a bank, NBG is entitled to prolong time for no more than 1 month if this will not cause threat to financial stability or the continuation of critical functions. 8.Within the paragraph 7 of this article, the NBG is entitled to request additional necessary information based on individual features of a bank in order to provide sufficient assessment and identification process of critical functions and elaborate proper self-assessment document. 9.If a bank submitted insufficient self-assessment document which is not considered to be compatible with the requirements and criteria of this rule by NBG and a bank does not provide updated self-assessment document as defined by the paragraph 7 of this article, the NBG is entitled to elaborate the self-assessment document of a bank if there are actual threats of damage caused by sudden disruption/delaying critical functions of a bank. 10. If a bank infringesrequirements and procedures set by this rule, the NBG is authorized to impose appropriate supervisory measures or/and sanctions – fine as defined by the law of Georgia on Commercial bank Activities. Article 8. Transitional provisions Systematically important banks should submit self-assessment documents to NBG no longer than January 1st of 2021, whereas other banks should submit no later than June 30th of 2021.

Appendix N1 - Template Appendix N2 - Table Impact analysis Supply-side analysis (substitutability) Criticality Significant negative impact Non-substitutable Critical Hard to substitute Critical Easy to substitute Non-critical Moderate negative impact Non-substitutable Critical Hard to substitute Non-critical Easy to substitute Non-critical Minor negative impact Non-substitutable Non-critical Hard to substitute Non-critical Easy to substitute Non-critical