Good practices Guidance on prudential reporting for investment firms and investment fund managers

Good practices Guidance on prudential reporting for investment firms and investment fund managers

2 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers DISCLAIMER Good practices set out suggestions or recommendations for supervised institutions. They describe examples of an approach to fulfilling the regulatory requirements arising from laws and regulations which we believe to be effective. Supervised institutions are free to adopt another approach as long as they otherwise comply with the laws and regulations, and are able to demonstrate this on reasoned grounds. For more information see the Explanatory guide to DNB’s policy statements.

3 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers The aim of this guidance document is to provide investment firms and managers of investment funds and UCITS (referred to below as “institutions”) with an overview of good practices for prudential reporting. Institutions are required by law to submit prudential reports to De Nederlandsche Bank (hereafter, referred to as "DNB"). The quality of the data we receive as part of these reports is essential to our work as a prudential supervisor. We therefore call on institutions to take additional measures to better ensure the quality of their prudential reporting. Data is one of the key building blocks for good and effective supervision by DNB. Data-driven supervision is an important cornerstone of our task as a prudential supervisor. High￾quality reporting helps us perform this task effectively and efficiently. For more information, see our Supervisory Strategy 2021-2024 and our Open Book pages on the supervision of investment firms. Institutions are required under Section 3:72 of the Financial Supervision Act (Wet op het financieel toezicht – Wft) and Article 54 of the European Investment Firm Regulation (IFR) to submit accurate reports in a timely manner. Our checks of prudential reports have revealed several errors and misinterpretations. Prudential reporting often involves filling in several specific templates. In many cases we find that not all templates have been filled in. In addition, the data entered are often incorrect or not in line with reporting instructions. The latter applies to both IFREP and FINREP reports. We have therefore prepared this good practices document to give institutions more guidance on how to correctly complete and submit their prudential reports and how to enhance data quality. See Information and documentation for more information and documentation on submitting reports. These good practices are inspired by the Principles for Effective Risk Data Aggregation and Risk Reporting of the Basel Committee on Banking Supervision (BCBS Principles). They have been tailored to the investment firms and investment fund managers sector and the applicable statutory requirements. These good practices can also be applied on a consolidated basis to institutions that are part of a group that is subject to consolidated supervision. Legal basis The legal basis for these good practices can be found in Sections 3:17(3) and 3:72 of the Wft and Article 54 of the IFR. Implementation These good practices take the nature, size and complexity of the institution into account. This means that an institution can tailor the implementation of these good practices to its nature, size and complexity.

4 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers Content 1 Good practices on overarching governance and infrastructure 5 2 Good practices on regulatory prudential data aggregation processes 8 3 Good practices on correctness,clarity, usability, frequency and distribution of prudential reports 11

5 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers 1 Good practices on overarching governance and infrastructure 1.1 Overarching governance Good practice 1 The institution’s board and management incorporate the identification, assessment and management of risks related to the quality of regulatory prudential data in the institution’s overall risk management framework. The risk management framework includes agreed service level standards for both outsourced and internal risk data-related processes, as well as the institution’s policies on data confidentiality, integrity and availability. Good practice 2 The institution’s board and management are responsible for reviewing, approving the institution’s framework for data aggregation, prudential reporting (including the reporting requirements) and ensure that adequate resources are deployed. Good practice 3 The institution’s board is aware of the limitations and related risks that prevent full data aggregation in the reports. We consider these examples to be good practices because the institution’s data aggregation capabilities and prudential reporting practices are subject to robust governance arrangements. Good practice 4a The institution has fully documented the processes for data aggregation and prudential reporting. We consider this to be a good practice because the institution has documented and aligned the processes for data aggregation and prudential reporting based on the institution’s risk profile. Good practice 4b The processes for data aggregation and prudential reporting are routinely considered in new initiatives, including acquisitions and/or divestitures, new product development and broader process and IT change initiatives. We consider these examples to be good practices because when considering material changes in the institution’s activities, the processes for the institution’s data aggregation and prudential reporting can be adjusted accordingly. This allows the board to explicitly consider the impact on the aggregation and reporting of regulatory prudential data. Good practice 4c The institution’s group structure does not affect the processes for data aggregation and prudential reporting. We consider this to be a good practice because the group structure does not interfere with data aggregation at the consolidated level or at another relevant level within the organisation,

6 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers such as at the sub-consolidated level or at the level of the jurisdiction where the activities take place. In particular, data aggregation processes are independent of the institution’s choices regarding its legal organisation and geographical presence.  1.2  Data architecture and IT infrastructure Good practice 5 As part of the institution’s business continuity planning processes, the processes for data aggregation and prudential reporting are routinely considered and subjected to a business impact analysis. Good practice 6 The institution defines the roles and responsibilities regarding ownership and quality of data and information for both business and IT functions. The owners (business and IT functions) together with management ensure that appropriate controls are in place, throughout the data lifecycle and for all aspects of the technology infrastructure. The business owner ensures that relevant first-line staff enter data correctly, that data are kept up to date and aligned with data definitions, and that processes for data aggregation and prudential reporting are in line with the institution’s policies. Good practice 7 The institution uses the three lines of defence model for prudential reporting. The processes for prudential reporting are by default part of the institution’s internal audit plan. Good practice 8 The institution assigns responsibility to a board member for the processes of data aggregation and prudential reporting. This board member ensures that risks arising from prudential reporting and maintaining a data architecture and data management structure are documented in the institution’s operational risk management policy and risk appetite. Good practice 9 The institution provides training opportunities to the board and other designated staff to meet data aggregation and prudential reporting requirements.

7 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers We consider these examples to be good practices because the institution designs, builds and maintains an architecture for regulatory prudential data and an IT infrastructure that fully supports the processes for data aggregation and prudential reporting, not only in normal times but also in times of stress or crisis. We consider all the above examples related to overarching governance and infrastructure to be good practices because the institution has a robust governance framework, data architecture and IT infrastructure that apply as prerequisites aimed at compliance with the other good practices in this document. In particular, the institution’s board oversees management’s ownership of the implementation of all data aggregation and prudential reporting processes and the oversees strategy to implement within the prescribed timeframe.

8 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers 2 Good practices on regulatory prudential data aggregation processes 2.1 Correctness and integrity of processes regarding aggregated data Good practice 10 The institution aggregates regulatory prudential data accurately and reliably according to the following measures: a. Control measures for regulatory prudential data are as robust as those for accounting data. b. Where the institution uses manual processes and desktop applications, such as spreadsheets or databases, it has implemented effective risk mitigation measures. c. Regulatory prudential data are reconciled with the institution’s data sources, including accounting data where applicable, to ensure the data are accurate. d. The institution’s responsible staff have adequate access to regulatory prudential data to ensure they are able to accurately aggregate, validate and reconcile regulatory prudential data to prudential reports. Good practice 11 The institution has a manual that defines the concepts used so that regulatory prudential data are defined consistently across the organisation. Good practice 12 The institution maintains an appropriate balance between automated and manual systems. For many processes, a higher degree of automation is desirable to reduce the risk of errors. Where professional judgement is required, human intervention may be appropriate. Good practice 13 The institution documents all its processes for aggregating regulatory prudential data, whether automated or manual (judgement-based or not judgement￾based), and is able to explain them. We consider these examples to be good practices because the documentation includes an explanation of the appropriateness of any manual workarounds, as well as a description of their criticality to the proper aggregation of regulatory prudential data and intended actions to reduce the impact of such workarounds. Good practice 14 The institution periodically measures, monitors the correctness of regulatory prudential data, has appropriate escalation channels and action plans in place to remedy data quality deficiencies.

9 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers We consider the above examples to be good practices because the institution produces accurate and reliable regulatory prudential data not only in normal times but also in times of stress or crisis, while the other good practices are also met. Data aggregation is (largely) automated in order to minimise errors. 2.2 Completeness of data Good practice 15 The institution ensures that all regulatory prudential data are materially complete, and that any exceptions are identified and explained. We consider this to be a good practice because the institution is able to document and aggregate all regulatory prudential data. 2.3 Timeliness of data Good practice 16 The institution’s ability to aggregate regulatory prudential data enables it to produce the data in a timely manner to meet all prudential reporting requirements. The same applies to reports that must be resubmitted. Good practice 17 Different types of regulatory prudential data may be needed at different times, depending on the type of data. In a stress or crisis situation, certain data may be needed more quickly. The institution ensures that its systems are capable of rapidly producing aggregated critical regulatory prudential data in times of stress or crisis. We consider these examples to be good practices because the institution generates aggregated and up-to-date prudential data in a timely manner while complying with good practices with regard to correctness and integrity, completeness and adaptability. The exact timing depends on the nature and potential volatility of the regulatory prudential data to be aggregated and its criticality to the institution’s overall risk profile. In addition, the exact timing depends on the institution￾specific frequency of prudential reporting to DNB, both in normal times and in times of stress or crisis, which is determined on the basis of the institution’s characteristics and overall risk profile.

10 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers 2.4 Adaptability Good practice 18 The institution’s processes for aggregating regulatory prudential data are flexible and adaptable to meet ad hoc requests (including from the prudential supervisor) and respond to regulatory changes when necessary. We consider this to be a good practice because the institution generates aggregated regulatory prudential data in a timely manner to meet a broad range of regular, on-demand and ad hoc regulatory reporting requests, including requests during stress/crisis situations, requests due to changing internal needs and supervisory requests for data.

11 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers 3 Good practices on correctness, clarity, usability, frequency and distribution of prudential reports The good practices below relate specifically to the prudential reports to be submitted to the prudential supervisor. The good practices in the previous section refer specifically to the aggregated data. 3.1 Correctness of reports Good Practice 19 To ensure the correctness of reports, the institution has at least the following in place: a. Documented requirements and processes to reconcile reports with regulatory prudential data. b. Automated and manual editing processes and reasonableness checks, including an overview of validation rules applied to quantitative information. The overview includes explanations of the conventions used to describe arithmetic or logical relationships that can be verified through these validations or checks. c. Integrated procedures for identifying, reporting and explaining data errors or data integrity weaknesses in exceptional reports. Good Practice 20 The institution ensures that reports on regulatory prudential data are correct and accurate so that the institution’s board and management can confidently rely on the aggregated information when making important decisions. Good Practice 21 The institution’s management has laid down requirements for the correctness and accuracy of both regular reports and reports in stress and crisis situations. These requirements reflect the critical nature of decisions based on this data. The four-eyes principle applies here, and both the relevant managers and the board have taken note of prudential reports before they are submitted to the prudential supervisor. Good Practice 22 The institution uses the same materiality criteria for prudential reporting as for accounting data. For example, if an omission or misstatement could influence users’ risk decisions, this could be considered a material risk. The institution is able to substantiate the grounds for the correctness requirements. The institution applies accuracy requirements based on validation, testing or reconciliation processes and results. We consider these examples to be good practices because the institution’s prudential reports correctly and accurately present the aggregated regulatory prudential data and also accurately reflect the financial data.

12 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers 3.2 Clarity and usefulness Good Practice 23 Regulatory prudential data reports contribute to the sound management of regulatory prudential data and decision￾making by the reports’ relevant recipients, in particular the board and management. Regulatory prudential data reports ensure that the information is meaningful and tailored to the needs of recipients. Good Practice 24 Prudential reporting policies and procedures address the different information needs of the board, management and other levels within the organisation, such as data committees. Good Practice 25 As one of the main recipients of reports on regulatory prudential data, the institution’s board is responsible for setting prudential reporting requirements and fulfilling its obligations to shareholders and other relevant stakeholders. Good Practice 26 The board alerts management in the following cases to monitor compliance: ▪ when regulatory prudential data reports do not meet its requirements ▪ when regulatory prudential data reports do not contain the appropriate level/ type of data needed to establish the institution’s risk tolerance and risk appetite Good Practice 27 The institution develops an inventory and classification of regulatory prudential data, with reference to the concepts used in the reports. We consider these examples to be good practices because the institution’s prudential reports convey information in a clear and concise manner. The reports are easy to understand yet comprehensive enough to make informed decisions. They contain meaningful information tailored to recipients’ needs.

13 DNB Good practices Guidance on prudential reporting for investment firms and investment fund managers 3.3 Frequency Good Practice 28 The frequency of prudential reporting varies according to the purpose and recipients. The institution periodically reviews the purpose of each report and sets requirements for the speed at which reports should be produced, both in normal times and in stress/crisis situations. The institution routinely tests its ability to produce accurate reports within set timeframes, especially in stress and crisis situations. We consider this a good practice because the board and management (or other recipients as appropriate) determine the frequency of producing and distributing reports on regulatory prudential data. 3.4 Distribution Good Practice 29 The institution has procedures for the prompt aggregation and analysis of regulatory prudential data and the timely distribution of reports to all relevant recipients. Speed is balanced against the need to ensure confidentiality. Good Practice 30 In times of stress and crisis, the institution ensures that all relevant and critical data is available to the prudential supervisor within a very short timeframe so that changing risks can be responded to effectively. We consider these examples to be good practices because reports on regulatory prudential data are distributed to relevant recipients while ensuring confidentiality.

De Nederlandsche Bank N.V. PO Box 98, 1000 AB Amsterdam +31 (0)20 524 91 11 dnb.nl Follow us: