Circular NBB_2012_14 / Compliance function

Prudential policy and financial stability de Berlaimontlaan 14 – BE-1000 Brussel Tel. +32 2 221 35 88 – Fax + 32 2 221 31 04 ondernemingsnummer: 0203.201.340 RPR Brussel www.nbb.be Circular Brussels, 4 December 2012 Kenmerk: NBB_2012_14 Pagina(s): 24 uw correspondent:
Marc Pickeur / Merel Pieters
Tel. +32 2 221 39 99 / 02 221 40 05 – Fax +32 2 221 31 04 marc.pickeur@nbb.be / merel.pieters@nbb.be Hein Lannoy / Pascale Coulon Tél. +32 2 220 54 90 / 02 220 57 48 – Fax +32 2 220 54 96 conduct@fsma.be Compliance function Scope Credit institutions, stockbroking firms, payment institutions, electronic money institutions, settlement institutions and institutions equivalent to settlement institutions, insurance companies, reinsurance companies. By separate letter, the present circular will be communicated to the branches of credit institutions, stockbroking firms, insurance companies and reinsurance companies established in Belgium and falling under the jurisdiction of another member state of the European Economic Area (EEA), with the request to safeguard the application of the general good rules by means of an appropriate compliance function. Abstract/Objective Various supervisory laws require that the supervised institutions must have an appropriate, independent compliance function at their disposal. In the present circular, the NBB and the FSMA postulate a number of principles based on which they will assess, within the framework of their supervision, the adequate functioning and organisation of the compliance function. Structure
Part 1. Scope - Legal basis
Part 2. Definitions
Part 3. Principles relating to the compliance function
3.1 Overview of the principles
3.2 Assignments of the compliance function (principle 1)
3.3 Governance of the compliance function (principles 2-7)

3.4 Independence of the compliance function (principle 8)
3.5 Organisation of the compliance function (principles 9-11)
3.6 The compliance function within a group context (principle 12)
3.7 Calling in an expert (principle 13)
3.8 Smaller institutions (principle 14)
Dear Madam,
Dear Sir,
For the financial institutions, the compliance function is of the utmost importance, both for controlling their integrity and for protecting the financial consumer. The legislator has repeatedly emphasized this importance, which is why the supervisory laws 1 require that the financial institutions must permanently have an independent compliance function at their disposal. In its capacity of prudential supervisor, the National Bank of Belgium (hereinafter called "The Bank" or "NBB”) supervises compliance with the authorization and admission conditions by the institutions under its supervision. As a condition of recognition, the supervisory laws require that the institutions must take the necessary measures + to permanently have an appropriate, independent compliance function at their disposal. The NBB can further specify what this implies, after obtaining advice from the FSMA. The Financial Services and Markets Authority (hereinafter called "the FSMA") has the authority to supervise the organisation of the compliance function from the point of view of compliance with the rules of conduct 2 which must guarantee an honest, fair and professional treatment of the stakeholders. Compliance officers who, within the compliance function, are directly answerable to the senior management for the supervision of the rules of conduct 3, must be authorized by the FSMA 4 . Both supervisors find it desirable to reconcile their expectations with regard to the organisation of the compliance function, and therefore clarify their view regarding the organisation of the compliance function in this common circular. This is done on the basis of a number of principles which will be used as touchstones for assessing the organisation of the compliance function. These principles will be applied proportionally, with due account for the type of institution and for the nature of the services which are provided. This circular is made up of three parts. Part 1 specifies the scope and legal basis. Part 2 contains a number of definitions. Part 3 defines the principles which should be met by the compliance function. Each principle is explained. Wherever possible, "good practices" with regard to compliance are formulated. 1 See infra, PART 1 - Scope. 2 See article 45, §1, 3°, f) of the Law of 2 August 2002 on the supervision of the financial sector and on financial services (hereinafter called the "Law of 2 August 2002"). 3 See article 87bis of the Law of 2 August 2002. 4 Regulation of the FSMA regarding the authorisation of compliance officers, as approved by Royal Decree of 12 March 2012.

PART 1 Scope - Legal basis
1.1 Scope "ratione personae"
Under the supervisory laws, the following supervised institutions are obliged to permanently have an appropriate, independent compliance function at their disposal, and fall within the scope of the present circular:
credit institutions5; branches established in Belgium by credit institutions governed by the law of states which are not
part of the European Economic Area
6; stockbroking firms7; branches established in Belgium by stockbroking firms governed by the law of states which are not
part of the European Economic Area8;
payment institutions9; electronic money institutions10; settlement institutions and institutions equivalent to settlement institutions11; insurance companies12; branches established in Belgium by insurance companies governed by the law of states which are not part of the European Economic Area13; reinsurance companies14; branches established in Belgium by reinsurance companies governed by the law of states which are not part of the European Economic Area15. Taking effect at once, the present circular replaces the following circulars or parts thereof:
circular D1 2001/13 of 18 December 2001 to the credit institutions;
annex 2 to Circular D1/EB/2002/6 of 14 November 2002 to the investment firms;
circular PPB/D.255 of 10 March 2005 to the insurance companies;
section 1, chapter III of the annex to Circular PPB-2007-5-CPB of 5 March 2007 to the settlement
institutions and institutions equivalent to settlement institutions.
5 Article 20, §3, paragraph 3,of the Law of 22 March 1993.
6 Article 79, §1, paragraph 1 , 5°, of the Law of 22 March 1993 (reference to article 20 of the afore-mentioned law). 7 Article 62, §3, paragraph 4, of the Law of 6 April 1995. 8 Article 20, §1, 6°, of the Royal Decree of 20 December 1995 (reference to article 62 of the Law of 6 April 1995). 9 Article 14, §3, paragraph 4, of the Law of 21 December 2009, as soon as the amendment to the law has become effective. 10 Article 69, §3, paragraph 4, of the Law of 21 December 2009, as soon as the amendment to the law has become effective. 11 Article 10, §3, paragraph 3, of the Royal Decree of 26 September 2005. 12 Article 14bis, §3, paragraph 3, of the Law of 9 July 1975. 13 Article 14bis, §3, paragraph 3, of the Law of 9 July 1975. 14 Article 18, §3, paragraph 3, of the Law of 16 February 2009. 15 Article 18, §3, paragraph 3, of the Law of 16 February 2009.

1.2.Fields of activity of the compliance function
1.2.1 Legal, regulatory and specific fields of activity of the compliance function
The compliance function is made responsible for the supervision of the compliance with the legal and/or regulatory integrity rules and rules of conduct which are applicable to the institutions. The se include at least the fields listed below. For various fields, both the Bank and the FSMA have the power to supervise the compliance with the prevailing legal and regulatory provisions. These fields are listed below for each supervisor. For any questions regarding these fields, the compliance function can approach the competent supervisor. In addition, there are legal and regulatory provisions relating to the scope of the compliance function without one of the two supervisors directly supervising their compliance. For any questions regarding these fields, the compliance function should approach the service or institution mentioned in the relevant law or in the prevailing regulation. a) Credit institutions, stockbroking firms, payment institutions, electronic money institutions, and settlement institutions and institutions equivalent to settlement institutions (insofar as applicable) Fields in which the NBB, in its capacity of prudential supervisor, is competent for the supervision of the compliance with the relevant legal and regulatory provisions the compliance with the due diligence obligation in respect of the clients, the prevention of the use of the financial system for the purposes of laundering money and terrorism financing, and the prevention of the financing of the proliferation of weapons of mass destruction (Law of 11 January 1993 on the prevention of the use of the financial system for laundering money and terrorism financing, the implementing decrees and regulations in implementation thereof, including the circulars of the CBFA, in particular Circular CBFA_2011_09 of 1 March 2011 which contains an overview of the relevant legal provisions); the fiscal prevention policy (see Circular D1 97/10 of 30 December 1997) and the special mechanisms (see article 57, §3 of the Law of 22 March 1993 on the status and supervision of credit institutions, as well as circulars D1 97/9 and D4 97/4 of 18 December 1997); the compliance with the legal rules on the incompatibility of mandates16 or with the relevant rules as laid down in the institution's code of ethics. Fields in which the FSMA, in its capacity of supervisor for the rules of conduct, is competent for the supervision of the compliance with the relevant legal and regulatory provisions the compliance with the rules of conduct referred to in chapter II of the Law of 2 August 2002 and in the decrees and regulations in implementation thereof, in particular17:
 the MiFID rules of conduct (see articles 27-28bis of the Law of 2 August 2002 and implementing decrees) 18; 16 Article 27 of the Law of 22 March 1993 and article 70 of the Law of 6 April 1995. 17 For settlement institutions and institutions equivalent to settlement institutions, please refer to article 23 of the Law of 2 august 2002 for a definition of the concept of "rules of conduct". In its capacity of prudential supervisor and overseer , the NBB is also competent for the supervision of the organisation of these institutions. 18 In this connection, please refer to the "Guidelines on certain aspects of the MiFID compliance function requirements" as published by ESMA on 6 July 2012.

 the rules on market abuse (see article 25 of the Law of 2 August 2002 and implementing decrees),  the regulatory provisions adopted in conformity with article 45, §2 of the Law of 2 August 2002 in order to further the honest, fair and professional treatment of the stakeholders. the compliance with the rules of conduct relating to the intermediation in banking and investment services and the distribution of financial instruments (see the Law of 22 March 2006 on intermediation in banking and investment services and the distribution of financial instruments); the compliance with article 77bis of the Law of 6 April 1995 on the legal status and supervision of investment firms, which imposes rules governing the use of financial instruments19; the application of the Law of 4 August 1992 on mortgage loans; the compliance with the rules on publicity (see article 45, §2, of the Law of 2 August 2002, article 57 of the Law of 16 June 2006 concerning public offers of investment instruments and article 56 of the Law of 20 July 2004 on certain forms of collective management of investment portfolios); the follow-up of the handling of complaints (see article 16 of the CBFA regulation of 5 June 2007). Fields in which both the NBB and the FSMA are competent for the supervision of the compliance with the relevant legal and regulatory provisions, the NBB in its capacity of prudential supervisor and the FSMA in its capacity of supervisor for the rules of conduct the compliance with articles 20, § 3, and 20bis of the Law of 22 March 1993 on the legal status and supervision of credit institutions and articles 62, §3, and 62bis of the Law of 6 April 1995 on the legal status and supervision of investment firms and the implementing decrees and regulations adopted in implementation thereof (see, inter alia, the CBFA regulation of 5 June 2007 on organizational requirements for institutions that provide investment services, as approved by Royal Decree of 19 June 2007); the compliance with the principles on sound remuneration policy (see CBFA regulation of 8 February 2011 on sound remuneration policies in credit institutions as well as Circular CBFA_2011_05 of 14 February 2011 which provides an overview of the relevant legal provisions); Fields in which neither the NBB, nor the FSMA have direct powers with regard to the supervision of the compliance with the legal and regulatory provisions the compliance with the privacy legislation20 (see, inter alia, the Law of 8 December 1992 on the protection of privacy in relation to the processing of personal data and the Law of 8 August 1983 organising a national register of natural persons and the relevant implementing decrees); the compliance with the provisions regarding anti-discrimination legislation (see the Law of 10 May 2007); the Law of 6 April 2010 on market practices and consumer protection; 19 For settlement institutions and institutions equivalent to settlement institutions, please refer to article 69 of the Royal Decree
of 3 June 2007, which transposes the MiFID directive, as well as to article 23 of the Law of 2 August 2002. In its capacity of prudential supervisor and overseer, the NBB also sees to it that these institutions take the necessary organisational and administrative measures in order to prevent financial instruments of clients from being used for own account, in conformity with article 10bis, § 6 of the Royal Decree of 26 September 2005. 20 Also refer to the website of the Privacy Protection Commission: http://www.privacycommission.be.

the compliance with specific provisions for the banking sector (such as the codes of conduct of Febelfin and Beama); the compliance with the internal values and integrity rules. b) Insurance and reinsurance companies Fields in which the NBB, in its capacity of prudential supervisor, is competent for the supervision of the compliance with the relevant legal and regulatory provisions the compliance with the due diligence obligation towards the clients, the prevention of the use of the financial system for the purposes of laundering money and terrorism financing, and the prevention of the financing of the proliferation of weapons of mass destruction (the Law of 11 January 1993 on the prevention of the use of the financial system for laundering money and terrorism financing, the implementing decrees and regulations in implementation thereof, including the circulars of the CBFA, in particular Circular CBFA_2011_09 of 1 March 2011 which contains an overview of the relevant legal provisions); the special mechanisms (see Circular D. 207 of 30 November 2001 - Special mechanisms aimed at or resulting in the favouring of tax evasion by third parties); the compliance with the legal or regulatory rules on the incompatibility of mandates or with the relevant rules as laid down in the institution's code of ethics; Fields in which the FSMA, in its capacity of supervisor for the rules of conduct, is competent for the supervision of the compliance with the relevant legal and regulatory provisions the regulatory provisions adopted in implementation of article 45, § 2 of the Law of 2 August 2002 in order to further the honest, fair and professional treatment of the stakeholders; the compliance with the provisions on the protection of the insurance taker, information to the client and publicity (see the Law of 25 June 1992 on terrestrial insurance contracts, the Law of 9 July 1975 concerning the supervision of insurance companies, the Law of 27 March 1995 on insurance and reinsurance intermediation and on the distribution of insurance, the Royal Decree of 14 November 2003 on life insurance activities, the Law of 28 April 2003 on supplementary pensions and Circular CBFA 2010_22 of 19 October 2010 on legal expenses insurance); the compliance with the rules of conduct for insurance and reinsurance intermediation and for the distribution of insurance policies (see the Law of 27 March 1995 on insurance and reinsurance intermediation and on the distribution of insurance and communication CBFA 2009_10 of 20 February 2009); the application of article 12 of the Law of 10 May 2007 on combating certain forms of discrimination and article 12 of the Law of 10 May 2007 on combating discrimination between men and women21; the application of the Law of 4 August 1992 on mortgage loans. Fields in which both the NBB and the FSMA are competent for the supervision of the compliance with the relevant legal and regulatory provisions, the NBB in its capacity of prudential supervisor, and
the FSMA in its capacity of supervisor for the rules of conduct the compliance with article 14bis, §3, of the Law of 9 July 1975 concerning the supervision of insurance companies; 21 It should be noted that the FSMA's competence for the supervision of the compliance with these provisions is limited to the subject matter of the supplementary pensions, see article 32, §§2 and 3 of the Law of 10 May 2007 on combating certain forms of discrimination and article 38, §§2 and 3 of the Law of 10 May 2007 on combating discrimination betwee men and women.

the compliance with the principles on sound remuneration policy (see, inter alia, Circular CBFA_2009_34 of 26 November 2009); Fields in which neither the NBB, nor the FSMA are directly competent for the supervision of the compliance with the legal and regulatory provisions or codes the compliance with the provisions relating to anti-discrimination (see the Law of 10 May 2007 on combating certain forms of discrimination and the Law of 10 May 2007 on combating discrimination between men and women, with the exception of article 12 of both laws, cf supra); the Law of 6 April 2010 on market practices and consumer protection; the compliance with the privacy legislation22 (see, inter alia, the Law of 8 December 1992 on the protection of privacy in relation to the processing of personal data and the Law of 8 August 1983 organising a national register of natural persons and the relevant implementing decrees); the compliance with the codes and rules of conduct of Assuralia; the compliance with internal values and integrity rules.
1.2.2 Other fields of activity in respect of the possible compliance risk
Senior management examines which other fields and activities are part of the fields of activity of the compliance function. It does so on the basis of a risk analysis and in consultation with the board of directors. Possible fields and activities might include:
consumer credit (the Law of 12 June 1991 on consumer credit and the Royal Decree of 4 August 1992 on consumer credit charges, rates, contract duration and repayment terms); the compliance with financial embargos, including the freezing of the assets of certain persons and entities; foreign legislation having an impact on the compliance fields (such as OFAC/FATCA and/or Bribery Act).
PART 2. Definitions
Compliance is a part of each institution's corporate culture which emphasizes honesty and integrity, compliance with high ethical standards in doing business, and compliance with both the spirit and the letter of the prevailing legislation. The behaviour of both the institution and its staff members must reflect integrity, i.e. honesty, reliability and credibility. Clients must always be treated in an honest, fair and professional manner. Effective compliance implies that the values pursued by the institution are embedded in the way it conducts its business. Effective compliance means that the institution not only pursues its own interest, but also takes account of the needs and interests of its clients. This also implies that the institution and its staff members follow an integer approach when they face a situation which might be inconsistent with the values pursued by the institution. Both the institution and its staff members must be willing to adjust their behaviour. The compliance risk is the risk that a legal, administrative or regulatory sanction is imposed on an institution and/or on its staff member(s) because of the non-compliance with the legal and regulatory integrity rules and rules of conduct, resulting in a loss of reputation and a possible financial damage. This loss of reputation can also result from non-compliance with the relevant internal policy and with the 22 See also the website of the Privacy Protection Commission: http://www.privacycommission.be.

internal values and rules of conduct regarding the integrity of the institution's activities. A loss of reputation has a harmful effect on the credibility of the institution and its staff members. Credibility is a basis for being active in the financial sector. The compliance function is an independent function within the financial institution, aimed at the compliance with the rules relating to:
the integrity of the institution's activities; and the management of the institution's compliance risk.
PART 3. Principles relating to the compliance function
Preliminary remark with regard to the terminology used In the following, the terms "board of directors" and "senior management" should be read as "board of directors, where appropriate the audit committee established within the board of directors" and "senior management, where appropriate the executive committee" respectively, except in principle 2 where solely the board of directors is meant.
3.1 Survey of the principles
Principle 1
The compliance function is responsible for identifying and assessing the compliance risk. It sees to the supervision, testing and drawing up of recommendations and to the reporting on the compliance risk run by the institution. Furthermore, the compliance function gives advice on and participates in drafting guidelines regarding the compliance with regulations. It assists senior management in organising the training of the staff members in the field of compliance and, in co-operation with the operational services, sees to enhancing the awareness of its staff members with regard to the compliance risk. It acts as a contact point for its staff members. The compliance function draws up an action plan at least once a year. Principle 2 The board of directors takes the initiative for promoting an integrity-based business by the institution. The board of directors sees to it that the institution has an appropriate integrity policy and enterprise values. Principle 3 The board of directors sees to it that senior management takes the necessary measures for the institution to permanently have an appropriate, independent compliance function aimed at ensuring compliance by the institution, its directors, senior management, staff members and authorized agents with the legal rules regarding business integrity. At least once a year, the board of directors assesses whether the compliance risks are adequately detected and managed.

Principle 4
Senior management is responsible for managing the compliance risk. To this effect, it formulates an integrity policy which must be regularly updated. It sees to it that all members of the institution, where appropriate the group (see infra, principle 12), are informed of it and comply with it. Principle 5 Senior management takes the necessary measures for the institution to permanently have an appropriate, independent compliance function aimed at ensuring compliance by the institution, its directors, senior management, staff members and authorized agents with the legal rules regarding business integrity. At least once a year, senior management reports to the board of directors. Principle 6 At appropriate intervals and at least once a year, the compliance function reports to senior management and informs the board of directors. Principle 7 The compliance function is part of a coherent whole of transversal control functions which require mutual co-ordination. Principle 8 The compliance function should be independent of the institution's operational activities. Principle 9 Each institution sees to it that the compliance function is organized in an appropriate and permanent way. Principle 10 The compliance function should have the necessary resources, both human and material, for carrying out its assignments. Principle 11 Each institution should take care that the head and the staff members of the compliance function observe the necessary integrity and discretion in carrying out their assignments. Principle 12 The integrity policy and compliance function within a group are managed centrally by the parent institution. These should be in conformity with the local laws and regulations.

Principle 13
The responsibility for the institution to comply with laws and regulations must not be outsourced. If necessary, and for carefully specified compliance assignments, an expert can be temporarily used. Principle 14 In smaller institutions, the compliance function can be performed by a member of the senior management. If necessary, an expert can be used. The institution informs the supervisory authorities in advance about the latter.
3.2 Assignments of the compliance function
Principle 1
The compliance function is responsible for identifying and assessing the compliance risk. It sees to the supervision, testing and drawing up of recommendations and to the reporting on the compliance risk run by the institution. Furthermore, the compliance function gives advice on and participates in drafting guidelines regarding the compliance with regulations. It assists the senior management in organizing the training of the staff members in the field of compliance and, in co-operation with the operational services, enhances the awareness of its staff members with regard to the compliance risk. It acts as a contact point for the staff members. The compliance function draws up an action plan at least once a year. The compliance function is a second line of defence function (see infra, principle 7). Some of the legal and/or regulatory assignments referred to below imply that the institution sets up a contact point for third parties charged with the supervision of the compliance with certain integrity rules, such as the Financial Data Processing Unit, the Bank and the FSMA. On a voluntary basis, the institution can decide to set up contact points for other third parties, such as the judicial authorities and the tax authorities.
3.2.1 Identification and assessment of the compliance risk (compliance risk assessment)
The compliance function proactively identifies, documents and assesses the compliance risks of the institution. The compliance function assesses the institution's compliance procedures, controls and guidelines, identifies possible shortcomings, and proposes changes, if necessary. If possible, the compliance function measures the compliance risk and uses the result to reduce this risk. Automated systems can be useful for monitoring certain areas (for instance for monitoring the number of complaints from clients).

3.2.2 Advice
The compliance function advises senior management and the operational services and branches on the concrete application of the laws, regulations, standards and codes which fall within its assignment, including the reporting of relevant developments in their areas. Together with senior management, the compliance function participates, as an advisor, in the drafting and constant updating of an integrity policy (instructions, guidelines, policies, codes of ethics and/or procedures), and takes measures to manage the compliance risks. It also participates in the discussions on new products, services/markets and changes in the business organisation, where its advice is based on a correct identification, documentation and assessment of the existing compliance risks. This also applies to the relevant publicity rules.
3.2.3 Supervision and testing (monitoring)
The compliance function sees to it that the institution complies with the legal and/or regulatory integrity rules and rules of conduct which are applicable to it. To this effect, the control results from the operational services are used (the so-called first line of defence - see infra, principle 7). Complementary techniques are also used, such as:

• sampling and assessing the outcome of the transactions carried out;
• recording and monitoring risk indicators such as complaints and breaches;
• observing transactions with and on behalf of clients;
• having conversations with staff members; and
• monitoring the exception reports.
  The compliance function informs the relevant operational and/or support services about the results of its supervisory activities, and follows up how the relevant services respond to it.
  3.2.4 Training, contact point and enhancing awareness
  The compliance function assists senior management in training the institution's staff members in the field of compliance matters. It acts as a contact point for the institution's staff members having questions regarding compliance matters. In association with the operational services, the compliance function sees to enhancing the awareness of the institution's staff members with regard to the detection and management of compliance risks.
  3.2.5 Drawing up an action plan
  The compliance function draws up a written action plan. It describes in a sufficiently detailed manner the nature and frequency of the assignments to be performed by the compliance function within a certain period of time (one or several years). The plan is based on a risk-based approach, the principles of which are laid down in writing and assessed on a regular basis. The risk analysis encompasses all of the institution's activities and departments, and takes account of all relevant data resulting from earlier compliance activities. The analysis also includes any expected developments and innovations. The action plan should be realistic and should, amongst other things, allow for sufficient time to carry out other (also unexpected) assignments than those specified in the plan, as well as training.

The action plan includes an overview of the required human and material resources. The human resources not only focus on the number of persons, but also on the required expertise for carrying out the planned activities. The action plan is drawn up by the head of the compliance function, and is approved by the senior management (see also infra, principle 8). This approval implies that the necessary resources are made available to the compliance function. The plan is to be validated by the board of directors within the framework of its supervisory function.
3.2.6 Monitoring and interpreting (new) laws and regulations relating to compliance matters
The compliance function draws up an inventory of, monitors and permanently follows up national and international rules, relevant codes of conduct and standards in the fields of good practices, rules, circulars and guidelines of national and international supervisors with regard to compliance risks, and interprets them for all of the institution's activities. The same applies to all rules for the advancement of the honest, fair and professional treatment of clients and stakeholders. The compliance function cooperates with the legal function in this area.
3.3 Governance of the compliance function
3.3.1 Responsibility of the board of directors
Principle 2
The board of directors takes the initiative for promoting integrity-based business by the institution. The board of directors sees to it that the institution has an appropriate integrity policy and enterprise values. Preliminary remark: this principle solely applies to the board of directors, and not to the audit committee set up within the board of directors. It is important that the institution's strategic objectives, enterprise values and codes of conduct be laid down in writing. These objectives, values and codes are to be communicated throughout the whole institution. The compliance with the latter is to be promoted by the institution's board of directors and senior management. When implementing these values, it is important that senior management imposes strict and demanding rules of conduct upon itself and sets a good example ("the tone at the top"). The integrity policy of an institution should be formalized in a document which contains the principles and values to be pursued by all of the institution's staff members as well as by the members of the board of directors and the senior management. The document clarifies the methodology the institution aims to apply for detecting and managing the compliance risks in all of the institution's departments, where appropriate on a group level (see infra, principle 12). The internal codes of conduct deals with subjects such as corruption, the acceptance or granting of unjustified gifts or advantages in cash or in kind, the improper fulfillment of transactions between staff members and the institution (credit-granting, preferential tariffs, …) and all sorts of other illegal or unethical behaviour in or outside the institution. The board approves the integrity policy, the codes of conduct and the measures to be taken for the management of conflicts of interest, as well as the possible revisions thereof. At least once a year, the board of directors assesses whether the integrity policy is appropriate for the institution's activities.

Good practice:
It can be useful to make a distinction between general guidelines (which apply to all staff members) and specific guidelines (which concern specific groups of staff members or specific situations). Such concrete codes of conduct enhance clarity. Principle 3 The board of directors sees to it that senior management takes the necessary measures for the institution to permanently have an appropriate compliance function aimed at ensuring the compliance by the institution, its directors, senior management, staff members and authorized agents with the legal rules regarding business integrity . At least once a year, the board of directors assesses whether the compliance risks are adequately detected and managed. The status of the compliance function is laid down in a charter (see infra, principle 8). This charter is approved by the senior management, and submitted to the board of directors for approval. At least once a year, the board deliberates on the compliance risks run by the institution, where appropriate on a group level (see infra, principle 12). For its deliberations, the board relies, inter alia, on the periodic reporting by the senior management (see infra, principle 5), the reports of the head of the compliance function, the comments made by the supervisory authorities, and conversations with senior management. The board validates the compliance function's action plan (see supra, Principle 1). The board receives an overview of the significant findings of the past year and the resulting recommendations. The board is also informed of important changes in the legal and regulatory context, and how they affect the integrity policy and/or the organisation and functioning of the compliance function. It is reminded that senior management draws up an annual report on the assessment of the internal control, including the compliance function. Senior management transmits the report, inter alia, to the board of directors. The minutes of the board extensively reports on these deliberations. The minutes provide details on the information on which the board has based its judgment. They contain the outcome of the deliberations, as well as all measures approved by the board.
3.3.2 Responsibility of the senior management
Principle 4
Senior management is responsible for managing the compliance risk. To this effect, it formulates an integrity policy which must be regularly updated. It sees to it that all members of the institution, where appropriate the group (see infra, principle 12), are informed of it and comply with it. Principle 2 provides further clarifications on the integrity policy. Lasting shortcomings in the first line of defence controls (see infra, principle 7) and in the management of the compliance risk, are the responsibility of senior management.

Principle 5
Senior management takes the necessary measures for the institution to permanently have an appropriate, independent compliance function aimed at ensuring the compliance by the institution, its directors, senior management, staff members and authorized agents with the legal rules regarding business integrity. At least once a year, the senior management reports to the board of directors. Senior management is responsible for developing and implementing procedures which identify the compliance risks and, as far as possible, measure, monitor and manage them. Senior management sees to an organisational structure which outlines clear compliance responsibilities, assigns the relevant responsibilities and lays down the reporting lines. Senior management approves the compliance function's action plan, and ensures that the compliance function gets the means, both human and other, which are required for carrying out the action plan (also see principles 1 and 10). Senior management informs the compliance function of new developments, initiatives, projects and products, to identify and manage any possible compliance risks. It transmits the agendas of the executive committee to the compliance function, as well as the notes submitted to the executive committee (when necessary for the performance of its duties) and the detailed minutes of the meetings. Senior management informs the board of directors of important shortcomings with regard to compliance. Shortcomings are important when they imply a significant risk of a legal, administrative or regulatory sanction or when they could lead to a significant loss of reputation. Senior management decides what corrective measures should be taken, and the precise nature of the sanctions it should impose when the integrity policy is not complied with or when the compliance function reveals serious shortcomings. The same applies when recommendations from the compliance function are not observed, or when provisions regarding compliance matters are not implemented, or insufficiently or lately implemented. In conformity with circulars NBB_2011_09 of 20 December 2011 and CBFA_2009_26 of 24 June 2009, senior management draws up an annual report on the assessment of the internal control, including the compliance function. Senior management transmits the report to the board of directors, the statutory auditor and the NBB. The compliance function comes directly under a member of the senior management. There should be no conflict of interest between this assignment and the other powers of the senior management member. If a member of the senior management is competent for both the compliance function and the risk management function, this member will pay equal attention to both functions. The relevant member of the senior management cannot be competent for the internal audit function, without prejudice to the application of the principle of proportionality. Good practice:
It is a good practice to give the head of the compliance function the opportunity to at least once a year provide clarifications on the action plan for the next year to senior management, along with an overview of the findings of the past year and their resulting recommendations. On this occasion, it is also advisable to report important changes in the legal and regulatory context, and to explain their impact on the integrity policy and/or on the organisation of the compliance function.

3.3.3 Reporting
Principle 6
At appropriate intervals, and at least once a year, the compliance function reports to the senior management and informs the board of directors. According to an appropriate frequency and at least once a year, the compliance function draws up written compliance reports and submits its action plan at least once a year to the senior management as well as to the board of directors for approval (see also supra, point 3.2.5). The internal audit function receives a copy of the compliance reports and of the action plan. The compliance reports mentions at least the following:
major problems, shortcomings and/or breaches and serious incidents it has found; an overview of important recommendations, specifying which ones have not been observed by the operational services. Senior management informs the compliance function of its response to the findings and recommendations stated in the compliance function's reports. The compliance function directly informs the board of directors of the monitoring it has carried out and of the important findings and/or developments which pose a significant risk of a legal, administrative or regulatory sanction. The person who is responsible for preventing money laundering and terrorism financing23 draws up an annual activity report, addressed to the senior management. This person transmits a copy of the report to the supervisors.
3.3.4 Relationship between the compliance function and the operational services and other
transversal functions
Principle 7
The compliance function is part of a coherent whole of transversal control functions requiring mutual co-ordination. The supervisory laws stipulate that each institution must have three different transversal functions: a compliance function, a risk management function and an internal audit function. Each of these functions, together with the management of the operational services, forms a line of defence against the risks run by the institution:
first line: the internal control in the operational services; second linel: the transversal functions of compliance and risk management and the actuarial function within (re)insurance companies; third line: the internal audit function. The responsibility for designing, implementing and applying concrete measures in the field of internal control, rests with the management of the operational services. 23 Function described in article 18 of the Law of 11 January 1993 on the prevention of the use of the financial system for laundering money and terrorism financing.

The risk management function is the function which is charged by senior management with implementing the risk management system, i.e. the whole of strategies, processes and procedures required for monitoring the risks or combinations of risks to which the institution is exposed or might be exposed, with the exception of the compliance risk. Staff members of the risk management functions cannot carry out any assignments which are the responsibility of the compliance function. The compliance function assesses the institution's compliance risk, and sees to it that the institution observes the laws, regulations and rules of conduct which fall within its fields of activity. The internal audit function assesses the adequacy of the internal control measures, including the risk management function and the compliance function. Staff members of the internal audit function cannot carry out any assignments which are the responsibility of the compliance function. Each transversal function is responsible for identifying and managing the risks in the operational services in collaboration with these services. Since the transversal functions exist alongside each other, they should align their activities and see to an adequate exchange of relevant information. Staff members of one transversal function communicate findings which are relevant to another function to that function. More in general, it is reminded that the supervisory laws24 clearly stipulate that each institution must have an appropriate policy structure, which refers in particular to:
a coherent and transparent organisational structure, providing for an appropriate separation of functions; a well defined, transparent and coherent systemfor the assignment of responsibilities; appropriate procedures for the identification, measurement, management, tracking and internal reporting of any significant risk incurred by the institution due to activities in which it engages or intends to engage; a remuneration policy and culture which are consistent with and contribute to a sound and effective risk management25. The institution makes sure it meets the legal organisational requirements. Each institution should, in particular, have an appropriate separation of functions and a coherent system for the assignment of responsibilities. Good practice:
It is a good practice to have written procedures and controls, including the relationships between the procedures and controls of different services. When larger institutions document the relationships between different, cooperating services, this will contribute to the clarity of the relevant assignments, and it will be easier to come to agreements. 24 See for the credit institutions: article 20, §2, of the Law of 22 March 1993; for the stockbroking firms : article 62, §2, of the Law of 6 april 1995; for the settlement institutions and institutions equivalent to settlement institutions:
article 10, §2, paragraph 1, of the Royal Decree of 26 september 2005; for the reinsurance companies:
article 14bis, §2, of the Law of 9 July 1975; for the reinsurance companies: article 18, §2, paragraph 1, of the Law
of 16 February 2009.
25 For the credit institutions. The other supervisory laws do not contain any similar provision. Reference is made to the Royal Decree of 22 February 2011 approving the regulation of the Banking, Finance and Insurance Commission of 8 February 2011 on sound remuneration policies in financial institutions.

3.3.5 Relationship between the compliance function and the legal function
It is strongly recommended that the legal function will not to carry out any compliance assignments. The legal function monitors the legal developments, and advises senior management on the consequences of these developments for the institution, for instance in view of drawing up contracts. The legal function and the compliance function are jointly in charge of monitoring and interpreting the legislation relating to compliance matters, each within their respective authority.
3.4 Independence of the compliance function
Principle 8
The compliance function should be independent of the institution's operational activities. Practically,the independence of the compliance function is implemented as follows:
a) the compliance function has a formal status within the institution; b) a head of the compliance function is appointed within the institution; c) the person in charge of the compliance function and the staff members of the compliance function remain free from possible conflicts of interest between their compliance responsibility and possible other responsibilities, especially commercial responsibilities; d) the staff members of the compliance function have access to all information and staff members insofar as necessary for carrying out their assignment; Each of these four elements is clarified below. a) Status of the compliance function The status of the compliance function within the institution should be described in a document called the "charter". The charter should be communicated to all of the institution's staff members, including the authorized agents. The charter stipulates at least:
the objective and scope of the compliance function (see Principle 1 and the comment on this principle); the position of the compliance function within the institution, its authority and responsibilities; the "comply or explain" principle: when a decision or recommendation of the compliance function is not observed, this should always be explained; the possibility for the compliance function to question compliance decisions made by other services, and to report this to a higher hierarchical level (a so-called "escalation procedure"); the relationships, incompatibilities and co-ordination with other control functions and services within the institution, such as the internal audit function, the risk management function and other supervisory functions (see supra, principle 7 and infra, point c); the principles governing the compliance function as described in the present circular; the organisation of the compliance function within the institution; the compliance function's right of initiative; the authorization given by senior management to all of the compliance function's staff members to have, on their own initiative, inquiries of all staff members, to become acquainted with all of the

institution's activities, evidence, files and information, including the minutes of the advisory and decision-making bodies, insofar as necessary for carrying out the assignment; the guarantee from senior management that all findings and assessments made within the framework of the compliance function may be expressed and communicated freely to senior management and, if necessary, to the board of directors, the statutory auditor or the supervisors; the possibility for the head of the compliance function to directly (which means without informing senior management about it in advance) and on his/her own initiative, contact the chairman of the board of directors, the statutory auditor or the supervisors when he/she deems it necessary to do so; the obligation of the compliance function to report to senior management and to the board of directors (including the frequency thereof). The charter should not infringe or impose any restrictions on the right of the compliance function to report suspicions to the competent external contact points such as the Financial Data Processing Unit and the FSMA for market abuse. Communication FSMA_2012_02 of 19 January 2012 states that the compliance function's charter should be transmitted to the FSMA via e-Corporate26. b) Head of the compliance function Each institution appoints a head of the compliance function. This person will be sufficiently high in the hierarchy in order to be able to directly report to the member of senior management in charge of the compliance function . The head of the compliance function takes care that the principles of the present circular are observed. The head of the compliance function draws up the above-mentioned charter. At least once a year, he/she draws up an action plan, which will be submitted to senior management for approval. The action plan specifies the means which are required for carrying out the plan (see also supra, 3.2.5). The head of the compliance function preferably has an approval from the FSMA in conformity with article 87bis of the Law of 2 August 2002. 26 The FSMA communication concerns the following "regulated companies":

• the credit institutions governed by Belgian law, insofar as they perform investment services;
• the branches established in Belgium by credit institutions governed by the law of states which are not part of
  the European Economic Area (EEA), insofar as they perform investment services;
• the investment firms governed by Belgian law;
• the branches established in Belgium by investment firms governed by the law of states which are not part of
  the European Economic Area (EEA);
• the management companies of collective invesment undertakings governed by Belgian law, insofar as they
  perform investment services;
• the branches estabished in Belgium by management companies of collective investment undertakings
  governed by the law of states which are not part of the European Economic Area (EEA), and insofar as they perform investment services. The communication is also partly applicable to the branches established in Belgium of credit institutions, investment firms and management companies of collective investment undertakings, insofar as they provide investment services. There is a specific notification to the FSMA for the regulated companies and EEA branches which do not provide any investment services.

The head of the compliance function should have the possibility to directly (which means without informing senior management about it in advance) and on his/her own initiative, contact the chairman of the board of directors, the statutory auditor or the Bank and/or the FSMA when he/she deems necessary to do so. Senior management informs the board of directors without delay when the head of the compliance function is discharged from his/her assignment, and specifies the reason(s) for this. It also informs the NBB and the FSMA without delay of this decision. These authorities may decide to have an interview with the head of the compliance function that is removed from office. c) Conflicts of interest The independence of the head of the compliance function and of other staff members of the compliance function can be undermined if they are given a position in which they may be faced with a real or possible conflict of interest. The institution should take robust measures to avoid conflicts of interests, by avoiding that other assignments of the staff members of the compliance function conflict with their compliance assignment. More in general, attention is drawn to the organisational requirements as described in the supervisory laws. Each institution must, in particular, have an adequate separation of functions and a coherent system for the assignment of responsibilities. The remuneration committee, or failing such a committee, the board of directors, monitors the remuneration of the head of the compliance function27. d) Access to information and staff members All staff members of the compliance function have the right to directly, on their own initiative and without prior authorization, have talks with all staff members, and to become acquainted with all of the institution's activities, evidence, files and information, including the minutes and other documents of the advisory and decision-making bodies, insofar as necessary for carrying out the assignment. They should have the guarantee from senior management that all findings and assessments made within the framework of the compliance function may be expressed and communicated freely to senior management and, if necessary, to the board of directors.
3.5 Organisation of the compliance function
Principle 9
Each institution sees to it that the compliance function is organized in an appropriate and permanent way. Each institution ensures an adequate organization of the compliance function in conformity with the organization principles of the supervisory laws and the present circular. The compliance function's activity should not be limited to specific circumstances, services or activities of the institution. The function should beensured continuously and permanently, and cover all activities. 27 For credit institutions, the remuneration must meet the conditions as laid down in section 2.3 of the Guidelines on Remuneration Policies and Practices published by CEBS on 2 December 2010 and included in the annex to Circular CBFA_2011_05 dd 14 February 2011 on sound remuneration policy.

Principle 10
The compliance function should have the necessary resources, both human and material, for carrying out its assignments. When fixing the resources for the compliance function, the institution's size, the nature and complexity of its activities, and the assignments with which the compliance function will be entrusted, are taken into account. The compliance function follows a risk-based approach aimed at an efficient use of the resources allocated to the function. Competence, motivation and continuing traning are of essential importance to the compliance function's efficiency. When appointing staff members for the compliance function, their know-how and experience will be checked. The institution sees to it that the compliance function takes the necessary measures in order to keep the expertise up-to-date through continuing training. It is advisable for the staff members of the compliance function to attend training sessions and regular refresher courses authorized or organized by the sector. Principle 11 Each institution takes care that the head and the staff members of the compliance function observe the necessary integrity and discretion in carrying out their assignments. Both the head and the staff members of the compliance function perform an integrity-sensitive task. Their integrity should be checked when appointing these persons. When recruiting employees from outside the institution, their relevant antecedents will be checked.
3.6 The compliance function within a group context
Principle 12
The integrity policy and the compliance function within a group are managed centrally by the parent institution. They should be in conformity with the local laws and regulations. The integrity policy as well as the guidelines and codes of conduct are managed centrally for the entire group. Belgian institutions operating abroad Unless their activities don't involve any compliance risk, a compliance function is organized and a head of compliance is appointed in branches and subsidiaries of Belgian institutions. Such a compliance function reports hierarchically to the senior management of the branch or subsidiary, and functionally to the head of the compliance function in Belgium. The organisation of the compliance function in foreign branches of Belgian institutions should be in conformity with local laws and regulations.

Foreign institutions operating in Belgium
Belgian institutions having a foreign financial institution as a parent company, and Belgian branches of institutions governed by the law of states which are not part of the European Economic Area, fall within the scope of the present circular, and should have a compliance function which meets the principles of the present circular. The organisation of the compliance function should be in conformity with the Belgian legal and regulatory provisions. The compliance function within the parent company is in charge of cooperation and co-ordination, providing support and advice, and streamlining the various local compliance functions within the group. When analysing their reports, the compliance function pays attention to the main shortcomings found, the corrective measures agreed upon, and the monitoring thereof. Due to the great diversity of groups, the preceding obligation can be deviated from, provided that a prior permission has been received from the supervisory authorities. The objectives of the present circular should be reached at all times. Attention is to be paid to the provisions regarding the appointment and role of the person responsible for the prevention of the use of the financial system for laundering money and terrorism financing28.
3.7 Usingan expert
Principle 13
The responsibility of the institution to comply with laws and regulations, must not be outsourced. If necessary, and for carefully specified assignments related to compliance, an expert can be temporarily used. The supervisory laws stipulate that each institution must take the necessary measures to permanently have an appropriate, independent compliance function. This provision implies that the responsibility of the institution to comply with rules and regulations, must not be outsourced. However, the institution may use an expert for certain well specified assignments, for instance when the necessary expertise is not available within the institution. Using an expert can be a temporary solution when the institution has insufficient staff members to carry out all assignments of the compliance function. The institution should be able to explain to the supervisory authorities why it has used one or more experts andwhich criteria were applied to select them, paying special attention to the expert's competence, availability and objectivity. Except for smaller institutions (see infra, principle 14), using an expert should be temporary and only for well specified assignments. 28 See sections 10.2 and 10.3 of Circular CBFA_2011_09 of 1 March 2011. These specific provisions take precedence over the general provisions of the present circular.

The head of the compliance function ensures, under the responsibility of senior management, that the person to whom the compliance assignment has been outsourced, carries out this assignment in conformity with all principles stated in the present circular. For reasons of objectivity, the expert should not have been previously charged with an advisory function in the field for which the expert's assistance is requested, unless appropriate measures have been taken to guarantee the expert's objectivity, such as a sufficiently long cooling-off period. Attention is also to be paid to other threats to the expert's objectivity, such as financial interests, and business and personal relations. The head of the compliance function ensures, under the responsibility of senior management, that any specialised know-how of the expert consulted, is assimilated within the institution. This can be achieved, for instance, by having the expert assisted by a staff member of the compliance function. Good practice When assessing the expert's expertise and availability, the institution can apply, inter alia, the following criteria:
competence
 personal experience with the expert's previous work;  discussions with the expert;  knowledge of the expert's qualifications;  the articles or books published by the expert;  standards applicable to the performance of the work requested;  membership of a professional organisation. availability  geographic location of the expert;  availability of time and resources.
3.8 Smaller institutions
Principle 14
In smaller institutions, the compliance function can be performed by a member of the senior management. If necessary, an expert can be used. The institution informs the supervisory authorities in advance about the latter. Smaller institutions which deem it desirable for organisational or economic reasons, can assign the compliance function to a member of senior management. This member must be independent of the activities supervised by the compliance function. Contrary to principle 7 already stated above, it is acceptable that in smaller institutions this member of senior management is also responsible for the risk management function. This member of senior management can carry out the compliance activities wholly or partly himself, or assign them wholly or partly to an expert, either from outside the institution, or from outside the institution but within the group to which the smaller institution belongs (see supra, principle 12).

When the compliance activities are carried out by a member of senior management, special attention is to be paid to avoiding conflicts of interest. When the institution uses an expert, it makes sure that the expert has the necessary competence, availability and objectivity. It is emphasized that the responsibility to comply with laws and regulations, continues to rest with the institution (see supra, principle 13). The member of senior management responsible for the compliance function ensures that the expert carries out his/her compliance assignments in conformity with all principles contained in the present circular. For reasons of objectivity, one sees to it that the expert has not previously been charged with an advisory function in the field for which his/her assistance is used, unless adequate measures have been taken to guarantee the expert's objectivity, such as a sufficiently long cooling-off period. Attention is also to be paid to other threats to the expert's objectivity, such as financial interests, and business and personal relations. The institution informs the supervisory authorities in advance when it wishes to use an expert for all or
part of the assignments of the compliance function. Before using the expert, the institution takes into
account the comments made by the supervisory authorities.
The principles of Circular PPB 2004/5 of 22 June 2004 (credit institutions and investment firms), of Circular PPB-2006-1-CPA of 6 February 2006 (insurance companies) and of Circular PPB-2007-5-CPB of 5 March 2007 (settlement institutions and institutions equivalent to settlement institutions) on sound management of outsourcing activities, remain in full force. Good practice The institution can, inter alia, apply the following criteria when assessing the expertise and availability of the expert:
competence
 personal experience with the expert's previous work;  discussions with the expert;  knowledge of the expert's qualifications;  the articles or books published by the expert;  standards applicable to the performance of the work requested;  membership of a professional organisation. availability  geographic location of the expert;  availability of time and resources. Yours sincerely, Luc Coene Jean-Paul Servais Governor of the National Bank of Belgium Chairman of the Financial Services and Markets Authority