FINMA Circular 2017/1 Corporate governance – banks

Laupenstrasse 27, 3003 Bern
Tel. +41 (0)31 327 91 00, fax +41 (0)31 327 91 01 www.finma.ch Circular 2017/1 Corporate governance – banks Corporate governance, risk management and internal controls at banks Reference: FINMA Circ. 17/1 "Corporate governance – banks" Date: 22 September 2016 Entry into force: 1 July 2017 Last amendment:
Concordance:
4 November 2020 [Modifications are indicated by an asterisk (*) and are listed at the end of the document.] former FINMA Circ. 08/24 "Monitoring and internal control - banks", dated 20 November Legal framework: FINMASA Article 7 para. 1 let. b BA Articles 3 para. 2 lets. a and c, 3b–3f, 4quinquies and 6 BO Articles 11 para. 2 and 12 FinIA Articles 7, 9, 49 FinIO Articles 9, 12, 68 CAO Articles 7–12 Adressees BankA ISA FinIA FMIA CISA AMLA Other Banks Financial groups and congl. Other intermediaries Insurers Insurance groups and congl. Intermediaries Portfolio managers Trustees Managers of collective assets Fund management companies Investment firms (proprietarian trading) Investment firms (non propriet. trading) Trading venues Central counterparties Central securities depositories Trade repositories Payment systems Participants SICAVs Limited partnerships for CISs SICAFs Custodian banks Representatives of foreign CISs Other intermediaries SRO SRO-supervised institutions Audit firms Rating agencies X

Index
2/14
I. Subject matter
II. Terms
III. Scope of application (the principle
of proportionality)
IV. Board of directors
A. Duties and responsibilities
B. Members of top management
C. Basic principles governing a directorship
D. Committees and the division of responsibilities
V. Executive board
A. Duties and responsibilities
B. Requirements to be met by members of the executive board
VI. Risk policy and basic features of institu￾tion-wide risk management
VII. Internal control system
A. Revenue-generating units
B. Independent control bodies
VIII. Internal audit
A. Establishment
B. Supervision and organisation
C. Duties and responsibilities
IX. Group structures
X. Transitional provisions
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
Margin no.
2-7
9-46
9-15
16-25
26-29
30-46
47-51
47-50
52-59
60-81
62-81
82-97
82-86
87-90
91-97
98-99
100-105

3/14
Subject matter
This circular sets out the requirements to be met by the corporate governance, risk man￾agement, internal control system and internal audit at banks, securities firms, financial groups (Art. 3c para. 1 BA) and financial conglomerates dominated by banking or securities trading (Art. 3c para. 2 BA). These are referred to below as "institutions". Terms Corporate governance is understood to mean the principles and structures on the basis of which an institution is directed and controlled by its governing bodies. Risk management comprises the methods, processes and organisational structures used to define risk strategies and risk management measures in addition to the identifi￾cation, analysis, assessment, management, monitoring and reporting of risks. Risk tolerance comprises quantitative and qualitative considerations regarding the key risks which an institution is prepared to take to achieve its strategic business objectives in the context of its capital and liquidity planning. Where relevant, risk tolerance is defined per risk category as well as per institution. The risk profile provides an overall picture of the risk positions entered into by an institu￾tion at institution level and per risk category at a particular point in time. The internal control system (ICS) comprises the totality of the control structures and pro￾cesses which at all levels of an institution form the basis for achieving its business ob￾jectives and ensuring orderly business operations. The ICS comprises retrospective con￾trols and planning and management elements. An effective ICS consists of control activ￾ities which are integrated into work processes, appropriate risk management and com￾pliance processes, and monitoring bodies – particularly an independent risk control and compliance function – which adequately reflect the size, complexity and risk profile of an institution. Compliance is understood to mean abiding by the relevant statutory, regulatory and in￾ternal rules and observing generally accepted market standards and codes of conduct. Scope of application (the principle of proportionality) This circular applies to all institutions as defined in margin no. 1. The requirements are to be implemented on a case-by-case basis, giving due consideration to the size, com￾plexity, structure and risk profile of each institution. FINMA can relax or tighten the rules in individual cases.

4/14
1 The head of internal audit can also be selected by the audit committee.
Board of directors
A. Duties and responsibilities
The duties of an institution's board of directors, i.e. the governing body for guidance, super￾vision and control, comprise in particular:
a) Business strategy and risk policy
The board of directors sets out the business strategy and defines guiding principles for the institution's corporate culture. It signs off the risk policy and the basic features of institution-wide risk management and is responsible for issuing regulations, establishing and monitoring an effective risk management function, and managing overall risks. b) Organisation The board of directors is responsible for establishing an appropriate business organisa￾tion and issues the rules and regulations required to achieve this. c) Finances The board of directors bears ultimate responsibility for the financial situation and devel￾opment of the institution. It approves/signs off the capital and liquidity plans, the annual report, the annual budget, the interim financial statements and the financial objectives for the year. d) Personnel and other resources The board of directors is responsible for ensuring that an institution has appropriate lev￾els of personnel and other resources (e.g. infrastructure, IT) and for the personnel and remuneration policies. It appoints and dismisses the members of its committees, the members of the executive board, the chair of the executive board, the chief risk officer (CRO) and the head of internal audit.1 e) Monitoring and control The board of directors oversees the work of the executive board. It is responsible for ensuring that there is both an appropriate risk and control environment within the institu￾tion and an effective ICS. It appoints and monitors the internal audit, commissions the regulatory audit firm and assesses its reports.

5/14 f) Major structural changes and investments The board of directors takes decisions on major changes to the company and group structure, major changes in significant subsidiaries, and other strategically important pro￾jects. B. Members of the board of directors a) General prerequisites The board of directors in its totality has adequate management expertise and the pre￾requisite specialist knowledge and experience of the banking and financial services sec￾tor. It is diversified to the extent that all key aspects of the business, including finance, accounting and risk management, are adequately represented. b) Independence At least one third of the board of directors consists of independent members. FINMA may approve exceptions (e.g. for domestic financial groups) where there is good reason for doing so. Members of the board of directors are deemed to be independent if they: 18

• are not and have not in the previous two years been employed in some other function
  within the institution;
• have not been employed in the previous two years by the institution's audit firm as
  lead auditor (of the regulatory audit) responsible for the institution;
• have no commercial links with the institution which, in view of their nature and scope,
  would lead to conflicts of interest; and
• are not a qualified participant (within the meaning of Art. 3 para. 2 let. cbis BA and
  Art. 11 para. 4 FinIA) of the institution and represent no such participant.
  Members of the board of directors of cantonal or communal banks who have been ap￾pointed or selected by cantons, municipalities or other cantonal or communal institutions governed by public law are deemed to be independent within the meaning of margin no. 18 ff. provided that they:
• do not belong to the cantonal or communal government or administration or another
  cantonal or communal body governed by public law, and
• have received no instructions from their appointing body regarding their activity as
  members of the board of directors.

6/14
C. Basic principles governing a directorship
All members of the board of directors devote sufficient time to their roles and play an active part in strategic corporate governance. Members must perform their function in person and be permanently prepared to intervene in crisis situations and emergencies besides the normal pattern of meetings. The board of directors defines the requirements profile for its members, its chair, any members of committees, and the chair of the executive board. It approves and periodi￾cally assesses the requirements profile for the other members of the executive board, as well as for the CRO and the head of internal audit. It is responsible for succession plan￾ning. At least once a year the board of directors, where necessary with the assistance of a third party, critically assesses its own performance (meeting of targets and method of operating) and records the results in writing. The board of directors defines how conflicts of interest are to be handled. All current and previous conflicting interests must be disclosed. If a conflict of interest cannot be avoided, the institution takes appropriate steps to ensure that it is effectively limited or removed. D. Committees and the division of responsibilities a) Role of the chair The chair presides over the board of directors as a whole and represents it internally and externally. That person has a key role in shaping the strategy, communications and cul￾ture of the company. b) Committees Institutions in supervisory categories 1 to 3 must establish an audit committee and a risk committee. Institutions in supervisory category 3 may combine these into a single com￾mittee. Systemically important institutions must establish, at least at group level, a com￾pensation and nomination committee. The committees are responsible for ensuring ap￾propriate reporting to the board of directors. The personnel composition of the audit committee must differ sufficiently from that of other committees. A majority of the members of the audit and risk committees must be substantially inde￾pendent (see margin no. 18 ff.). As a matter of principle, the chair of the board of directors must be neither a member of the audit committee nor chair of the risk committee. Each committee as a whole must have sufficient knowledge and experience of the areas for which it is responsible.

7/14 c) Responsibilities of the audit committee These include in particular: 34

• drafting general guidelines for internal auditing and financial reporting for submission
  to the board of directors;
• monitoring and assessing the financial reporting and the integrity of the financial
  statements, including discussion of these topics with the member of the executive board who is responsible for finance and accounting, the lead auditor of the financial audit, and the head of internal audit;
• monitoring and assessing the effectiveness of the internal control system, specifically
  risk control, the compliance function and internal audit (in so far as this responsibility is not discharged by the risk committee);
• monitoring and assessing the effectiveness and independence of the regulatory au￾dit firm and its interaction with internal audit, including discussion of the audit reports
  with the lead auditor;
• assessing the regulatory audit plan, audit rhythm and audit results produced by the
  internal audit and the regulatory audit firm. d) Responsibilities of the risk committee These include in particular: 40
• discussing the risk policy and the basic features of institution-wide risk management
  and presenting relevant recommendations to the board of directors;
• assessing the institution's capital and liquidity planning and reporting to the board of
  directors;
• assessing, at least annually, the risk policy and the basic features of institution-wide
  risk management and ensuring that necessary changes are made;
• controlling whether the institution has adequate risk management with effective pro￾cesses which are appropriate to the institution's particular risk situation;
• monitoring the implementation of risk strategies, ensuring in particular that they are
  in line with the defined risk tolerance and risk limits defined in the risk policy and the basic features of institution-wide risk management.

8/14
The risk committee receives regular reports from the CRO and other relevant office hold￾ers on the respective aspects of the risk policy and the basic features of institution-wide risk management (see margin no. 52 ff.) and compliance with it. Executive board A. Duties and responsibilities The executive board is responsible for operational business activities which reflect the business strategy and the targets and resolutions of the board of directors and is also responsible in particular for:

• managing day-to-day business, operational revenue and risk management, including
  management of the balance sheet structure and liquidity and representing the insti￾tution vis-à-vis third parties in operational matters;
• submitting applications regarding transactions for which the board of directors is
  responsible or for which its approval is required, and issuing rules for regulating busi￾ness operations;
• developing and maintaining effective internal processes, an appropriate manage￾ment information system (MIS), an ICS and the necessary technological infrastruc￾ture;
  B. Requirements to be met by members of the executive board Members of the executive board, both individually and as an overall body, must have adequate management expertise and the specialist knowledge and experience of bank￾ing and financial services required to ensure compliance with licensing requirements in the context of the institution's operational activities. Risk policy and basic features of institution-wide risk manage￾ment The risk policy and the basic features of institution-wide risk management are developed by the executive board, approved by the board of directors and documented in a suitable way. The risk policy and the basic features of institution-wide risk management lay down the rules for dealing with significant risks, risk tolerance and the risk limits based on them in all key risk categories. Institutions in supervisory categories 1–3 must take account of the following aspects: 54*

9/14
2 By class, type and level and in line with the definitions set out in the Capital Adequacy Ordinance (CAO).

• standardised categorisation2 of key risks to ensure consistency with risk manage￾ment objectives;
• specification of potential losses from these key risk categories; 56
• definition and application of the tools and organisational structures required to iden￾tify, analyse, evaluate, manage and monitor the key risk categories and for reporting
  purposes;
• development of documentation which enables appropriate verification of the defini￾tion of risk tolerance and the corresponding risk limits;
• provisions relating to risk data aggregation and reporting for institutions in supervi￾sory categories 1 to 3. In the case of systemically important institutions, these provi￾sions must include information about data architecture and IT infrastructure which
  enables an aggregated and timely risk analysis/assessment and risk data aggrega￾tion/reporting across all of the institution's key risk categories both under normal cir￾cumstances and in periods of stress. Internal control system There are at least two controlling bodies within the ICS: the revenue-generating units, and the control bodies which are independent of them. A. Revenue-generating units Revenue-generating units carry out their control function as part of everyday business activities by managing risks and specifically by directly monitoring, managing and report￾ing on them. B. Independent control bodies The independent control bodies monitor risks and compliance with statutory, regulatory and internal rules. Individual institutions can establish a variety of control bodies which must, however, at least cover the duties and responsibilities of risk control (margin no. 69–76) and the compliance function (margin nos. 77–81). The compensation system for independent control bodies must not create incentives which could lead to conflicts of interest with the duties of these bodies. a) Establishment and supervision

10/14
In the context of their duties, the independent control bodies have unlimited information, access and inspection rights and are to be integrated independently from the revenue￾generating units into the overall organisation or the ICS. They must be provided with the necessary resources and powers. The institution defines one or more persons on the executive board to be responsible for the independent control bodies. It ensures that the independent control bodies have direct access to the board of direc￾tors. Institutions in supervisory categories 1 to 3 have an autonomous risk control and com￾pliance function as independent control bodies. They appoint a CRO who, in addition to risk control, can also be responsible for other independent control bodies. Systemically important institutions appoint a CRO who is a member of the executive board. b) Duties and responsibilities of risk control Risk control ensures systematic monitoring of and reporting on individual and aggregated risk positions. This includes conducting stress tests and scenario analysis under unfa￾vourable operating conditions as part of the quantitative and qualitative analysis. Institu￾tions participating in the small banks regime in accordance with Articles 47a–47e CAO must conduct scenario analysis as a minimum. In the case of institutions in supervisory categories 1 to 3, risk control also ensures the appropriate implementation of provisions relating to risk data aggregation and reporting as set out in margin no. 59. Risk control also monitors the institution's risk profile in line with the risk tolerance and risk limits defined in the risk policy and the basic features of institution-wide risk man￾agement. Risk control is also responsible for developing and operating adequate risk monitoring systems, defining and applying principles and methods for risk analysis and assessment (e.g. assessment and aggregation methods, validation of models), and monitoring sys￾tems to ensure compliance with supervisory regulations (especially regulations relating to capital adequacy, risk diversification and liquidity). Risk control is to be appropriately consulted during the development of new or expanded product categories, services or business/market areas and for major or complex trans￾actions. Risk control is actively involved in the process of defining risk limits and ensures that risk limits are consistent with the defined risk tolerance and reconciled to the results of the

11/14 stress tests and that they are defined in such a way as to constitute an operationally effective management tool for the executive board. Risk control reports to the executive board at least every six months and to the board of directors at least annually on the institution's risk profile and its activities as defined in margin no. 69 ff. A copy of these reports must be provided to internal audit and the reg￾ulatory audit firm. In the event of special developments, risk control promptly informs the executive board and internal audit. If matters with far-reaching implications are involved, it also informs the board of directors. c) Duties and responsibilities of the compliance function The duties and responsibilities of the compliance function include at least the following activities:

• conducting an annual assessment of the compliance risk of the institution's business
  activities and developing a risk-oriented activity plan for approval by the executive board. The activity plan must also be made available to internal audit;
• reporting promptly to the executive board on any major changes in the compliance
  risk assessment;
• reporting annually to the board of directors on the assessment of compliance risk
  and the activities of the compliance function. A copy of the relevant reports must be provided to internal audit and the regulatory audit firm;
• reporting serious compliance breaches and matters with far-reaching implications in
  a timely manner to the executive board and the board of directors, as well as sup￾porting the executive board in its choice of appropriate instructions and measures. Internal audit must be informed accordingly. Internal audit A. Establishment Every institution shall establish an internal audit function. 82 If it seems inappropriate to establish an internal audit, the relevant duties and responsi￾bilities can be delegated to:
• internal audit of the parent company or to the internal audit of another group company,
  provided that this is a bank, a securities firm or another officially supervised financial intermediary (e.g. an insurance company) (for foreign banks see Art. 4quinquies BA),

12/14

• a second audit firm which is independent of the institution's regulatory audit firm, or 85
• a group company or independent third party, provided that the regulatory audit firm
  confirms that it has the necessary expertise and appropriate technical and personnel resources. B. Supervision and organisation Internal audit reports to the board of directors or its audit committee and fulfils the audit￾ing and monitoring responsibilities assigned to it in an independent fashion. It has an unlimited right of inspection, information and audit within the institution and its consoli￾dated companies as defined in margin no. 98. Internal audit must adequately reflect the size, complexity and risk profile of the institution and forms an organisationally autonomous unit which is independent of business opera￾tions. Internal audit must meet the qualitative requirements defined by the Institute of Internal Auditing Switzerland (IIAS). The work of internal audit is based on the International Standards for the Professional Practice of Internal Auditing, as issued by the Institute of Internal Auditors (IIA). The compensation system for employees of internal audit must not define incentives which could lead to conflicts of interest.
  C. Duties and responsibilities
  Internal audit delivers independent audits and assessments of the appropriateness and effectiveness of the company's organisation and business processes, particularly as re￾gards the institution's ICS and risk management. It conducts a comprehensive risk assessment of the institution's significant risk catego￾ries as described in margin no. 53 on an annual basis; this takes appropriate account of external developments (e.g. the economic environment, regulatory changes) and internal factors (e.g. major projects, business strategy). The internal audit unit of institutions par￾ticipating in the small banks regime in accordance with Articles 47a-47e CAO can con￾duct the assessment every two years, provided that the risk profile of the institution has not changed substantially. Based on this risk assessment and other auditing requirements, internal audit defines the audit objectives and planning for the next audit period and submits them and any necessary changes to the board of directors or its audit committee for approval. Internal audit ensures that the executive board and the regulatory audit firm are informed about the risk assessment and audit objectives.

13/14
Internal audit reports in writing in a timely manner on all material findings both to the board of directors or its audit committee and to the executive board. Internal audit publishes a report setting out the key audit findings and important activities in the audit period at least annually and submits this report with any corresponding con￾clusions to the board of directors or its audit committee, the executive board and the regulatory audit firm for their information. Furthermore, internal audit or another independent unit within the institution (e.g. the compliance function or risk control) informs the board of directors or its audit committee at least every six months about progress made in eliminating major shortcomings and/or implementing the recommendations of internal audit or the regulatory audit firm. Group structures This circular applies by extension to financial groups and conglomerates ("groups"). 98 Groups must regulate the duties and responsibilities of the units with overall responsibil￾ity for group management. While giving due consideration to the business activities and material risks at group and individual institution level, the defined standards must ensure the efficient and consistent management of the group, permit necessary information ex￾change, take account of legal and organisational structures and define the duties, re￾sponsibilities and necessary independence of the respective management levels. Par￾ticular attention must be paid to risks which arise specifically from combining a number of companies into a single business entity. Transitional provisions Abrogated 100*-104* The relevant later date applies to meeting the more far-reaching provisions on risk data aggregation and reporting, as set out in margin no. 59 for systemically important banks:

• entry into force of this circular, and
• a three-year transitional period following designation as a systemically important
  bank within the meaning of Article 8 para. 3 BA.

List of modifications
14/14
This Circular has been modified as follows:
These modifications were adopted on 31 October 2019 and will enter into force on 1 January 2020. modified margin nos. 10, 41, 43, 45, 46, 52, 53, 54, 69, 71, 92 abrogated margin nos. 100, 101, 102, 103, 104 other modifications change in title before margin no. 52 The references and terms were adjusted upon the entry into force of FinIA and FinSA on 1 January 2020.