Instruction No. 18/2020 on Reporting Duties Regarding Conduct, Organizational Culture, and Internal Governance and Control Systems

Instruction No. 18/2020
BO No. 7/2020 • 2020/07/15
..................................................................................................................................................................................................
Topics
Supervision :: Internal Control
Mod. 99999911/T – 01/14
Index
Text of the Instruction
Annex I - Risk Categories
Annex II - Methodology for Classifying Deficiencies
Annex III - Reporting of Deficiencies
I. Deficiencies classified at level F3 (high) and F4 (very high)
Annex IV - Reporting of the universe of employees who have a material impact on the institution's risk profile

Text of the Instruction
Subject: Reporting duties regarding conduct and organizational culture and internal governance and control systems

This Instruction regulates, in accordance with the principle of proportionality, the reporting duties to the competent supervisory authority incumbent upon the entities covered by Bank of Portugal Notice No. 3/2020, regarding conduct and organizational culture and internal governance and control systems.

In particular, this Instruction establishes the rules to be observed by the entities covered by Bank of Portugal Notice No. 3/2020, regarding the following:

Reporting of self-assessment reports on the adequacy and effectiveness of organizational culture and internal governance and control systems, and their respective annexes, to the competent supervisory authority;
Content and reporting, to the competent supervisory authority, of the report provided for in paragraph 7 of Article 116-AA of the General Regime of Credit Institutions and Financial Companies;
Content and reporting of the universe of employees who have a material impact on the institution's risk profile;
Reporting regarding the approval process for a higher maximum level of the variable component of remuneration, provided for in paragraph 5 of Article 115-F of the General Regime of Credit Institutions and Financial Companies;

This Instruction also establishes, albeit non-exhaustively, the risk categories that must be considered by the entities covered by Bank of Portugal Notice No. 3/2020 for the purposes of identifying, assessing, monitoring, and controlling the risks to which they are or may become exposed (Annex I).

Instruction No. 18/2020 BO No. 7/2020 • 2020/07/15 Topics Supervision :: Internal Control
..................................................................................................................................................................................................
Mod. 99999911/T – 01/14

Finally, this Instruction also includes the file that should be used by the aforementioned entities to report identified deficiencies, in matters of conduct and organizational culture and internal governance and control systems, which will be available in the BPnet system.

The draft of this Instruction was subject to public consultation, having heard the Securities Market Commission, the Insurance and Pension Funds Supervisory Authority, and the National Data Protection Commission.

In these terms, the Bank of Portugal, using the powers conferred upon it by paragraph c) of Article 133 of the General Regime of Credit Institutions and Financial Companies, approved by Decree-Law No. 298/92 of December 31, determines the following:

CHAPTER I
General Provisions

Article 1.
Object

This Instruction regulates:
a) The reporting of self-assessment reports on the adequacy and effectiveness of organizational culture and internal governance and control systems by the entities covered by Bank of Portugal Notice No. 3/2020, hereinafter referred to as "institutions", and their respective annexes, to the competent supervisory authority; b) The content and reporting, to the competent supervisory authority, of the report provided for in paragraph 7 of Article 115-X of the General Regime of Credit Institutions and Financial Companies; c) The content and reporting of the universe of employees who have a material impact on the institution's risk profile, provided for in paragraph c) of paragraph 1 of Article 41 of Bank of Portugal Notice No. 3/2020; d) The reporting regarding the approval process for a higher maximum level of the variable component of remuneration, provided for in paragraph 5 of Article 115-F of the General Regime of Credit Institutions and Financial Companies; e) The reporting regarding the designation of the official auditor or audit firm, provided for in paragraph i) of Article 39 of Bank of Portugal Notice No. 3/2020; f) The reporting to the competent supervisory authority provided for in paragraph 2 of Article 85 of the General Regime of Credit Institutions and Financial Companies, equally applicable in the cases provided for in paragraph 4 of Article 109 of the same instrument.

CHAPTER II
Obligation to Report Annual Self-Assessment Reports

Article 2.
Annual Self-Assessment Report

1- Institutions shall submit to the competent supervisory authority the annual self-assessment report on the adequacy and effectiveness of organizational culture and internal governance and control systems, provided for in Article 55 of Bank of Portugal Notice No. 3/2020, accompanied by the following elements:
a) Identification of those responsible for internal control functions, with indication of their contacts (telephone and email address); b) Identification of the structural unit responsible for coordinating the preparation of the self-assessment report; c) Description, organized by risk categories to which the institution is exposed, taking into account the different risk categories listed in Annex I to this Instruction and the methodology for classifying deficiencies contained in Annex II, of the following deficiencies that are not yet fully corrected:
i) Deficiencies detected within the scope of control actions and assessments carried out by the institution and its respective official auditor or audit firm; ii) Deficiencies detected by supervisory authorities. d) Deficiencies identified and deficiencies corrected within the reference period, by degree of impact, taking into account the methodology contained in Annex II to this Instruction; e) Report issued by the head of the internal audit function with a validation of the classification of deficiencies taking into account the methodology contained in Annex II; f) Express declarations by the management body and the supervisory body regarding the adequacy of the classification and reclassification attributed to the deficiencies, taking into account the methodology contained in Annex II to this Instruction; g) Copy of the multi-year internal audit action plan provided for in paragraph a) of paragraph 1 of Article 32 of Bank of Portugal Notice No. 3/2020 and indication of the date of the last audit action carried out on each structural unit of the institution, with express confirmation that all structural units and areas of activity of the institution are included in the plan; h) Description, where applicable, of relevant changes to the internal organization of the institution that have occurred in the period to which the report relates; i) With the first report to be made under the provisions of this Instruction and whenever relevant changes occur, description of the criteria developed by the institution for classifying deficiencies in accordance with Annex II; j) Assessment regarding the fulfillment of the conditions provided for in paragraph a) of paragraph 6 of Article 16 of Bank of Portugal Notice No. 3/2020 and, if these conditions are met, and the institution chooses not to have an independent risk management function, description of the mechanisms implemented to comply with the provisions of the same article; k) Assessment regarding the fulfillment of the conditions provided for in paragraph b) of paragraph 6 of Article 16 of Bank of Portugal Notice No. 3/2020 and, if these conditions are met, and the institution chooses not to have an independent compliance function, description of the mechanisms implemented to comply with the provisions of the same article; l) Assessment regarding whether the requirements provided for in paragraphs 7 and 8 of Article 16 of Bank of Portugal Notice No. 3/2020 are met and, if these are met, and the institution chooses to outsource the entire internal audit function, justification for this choice; m) If the institution has chosen to combine the risk management and compliance functions in a single structural unit, in accordance with paragraphs 1 and 5 of Article 16 of Bank of Portugal Notice No. 3/2020, assessment by the management body regarding the maintenance of the adequacy of this option in light of the nature, scope, and complexity of the institution's activities; n) Report on the analysis of the
management framework for risks associated with information and communication technologies, provided for in paragraph 5 of Article 6 of Regulation (EU) 2022/2554 of the European Parliament and of the Council of December 14, 2022; o) Express declarations by the risk management and compliance functions regarding, respectively, the compliance of transactions concluded with related parties with the institution's risk profile, as well as compliance with the institution's current policy on the matter and with applicable legislation and regulation.

2 - The reference date for the report referred to in paragraph 1 is September 30 of each year, and the competent supervisory authority may request updated information on its content from institutions at any time, including status updates on the implementation of measures intended to correct the reported deficiencies.

Article 3.
Treatment of Deficiencies in the Annual Self-Assessment Report

1- For the purposes of paragraph c) of paragraph 1 of the preceding article, the description of deficiencies classified at level F3 "high" or level F4 "very high", taking into account the methodology contained in Annex II, is carried out in the format contained in Table I of Annex III to this Instruction.

2 - For the purposes of paragraph c) of paragraph 1 of the preceding article, the description also includes the number of deficiencies classified at level F1 "low" or level F2 "moderate", taking into account the methodology contained in Annex II, and is carried out in the format contained in Table II of Annex III to this Instruction.

3 - The institution maintains detailed documented information on deficiencies classified at level F1 "low" or level F2 "moderate", which are made immediately available to the competent supervisory authority upon request.

4- For the purposes of paragraph d) of paragraph 1 of the preceding article, the description is carried out in the format contained in Tables III and IV of Annex III to this Instruction.

5 - Each deficiency must be counted and reported only once, being reported by the structural unit, function, or body to which it relates.

6- The management body ensures that the institution does not limit the number of deficiencies reported in the report.

7 - The tables contained in Annex III to this Instruction are available in the BPnet system and are reported to the competent supervisory authority in editable format.

CHAPTER III
Annual Self-Assessment Reports in Financial Groups

Article 4.
Group Annual Self-Assessment Report

1- The parent company of a financial group shall submit to the competent supervisory authority the group's annual self-assessment report, provided for in Article 58 of Bank of Portugal Notice No. 3/2020, accompanied by the following elements:
a) Identification of those responsible for internal control functions of the parent company, with indication of their telephone numbers and email addresses; b) Identification of the structural unit responsible for coordinating the preparation of the self-assessment report; c) Description, organized by risk categories to which the financial group is exposed, taking into account the different risk categories listed in Annex I to this Instruction and the methodology for classifying deficiencies contained in Annex II, of the following deficiencies identified in the group that remain open, with identification of the entity to which they relate:
i) Deficiencies detected within the scope of control actions and assessments carried out by the official auditor or audit firm, the parent company, or any subsidiary;

ii) Deficiencies detected by supervisory authorities; iii) Deficiencies associated with centralized tasks of the various entities of the group, when there are common services. d) Deficiencies identified and deficiencies corrected within the reference period, by degree of impact, taking into account the methodology contained in Annex II to this Instruction; e) Express declarations by the management body and the supervisory body of the parent company regarding the adequacy of the classification attributed to deficiencies classified at level F3 "high" or level F4 "very high", taking into account the methodology contained in Annex II and assessment of the impact such deficiencies have on the group's internal control system; f) Copy of the multi-year internal audit action plan of the parent company relating to organizational culture and internal governance and control systems of the financial group and indication of the date of the last audit action carried out, with express confirmation that all relevant components of the financial group are included in the plan; g) Description, where applicable, of relevant changes to the organizational structure of the financial group that have occurred in the period to which the report relates; h) With the first report to be made under the provisions of this Instruction and whenever relevant changes occur, description of the criteria developed by the institution for classifying deficiencies in accordance with Annex II.

2 - For the purposes of paragraphs c) and d) of the preceding paragraph, the description of deficiencies is carried out in the format contained in Annex III to this Instruction.

3 - If it considers the justification for excluding the obligation to prepare individual reports insufficient, in accordance with paragraph 7 of Article 58 of Bank of Portugal Notice No. 3/2020, the competent supervisory authority may request their preparation at any time, and the parent company must take this into account in the group's annual self-assessment report.

4- The reporting of deficiencies is carried out, in editable format, through the tables contained in Annex III to this Instruction, available in the BPnet system.

CHAPTER IV
Deadlines for Reporting to the Competent Supervisory Authority

Article 5.
Entities Authorized to Receive Deposits

The management body of institutions that correspond to entities authorized to receive deposits ensures that the annual self-assessment report referred to in paragraph 2 of Article 54 of Bank of Portugal Notice No. 3/2020, including the elements referred to in Article 2 of this Instruction, is

submitted to the competent supervisory authority by November 15 of each year.

Article 6.
Entities Not Authorized to Receive Deposits

1- The management body of institutions not covered by the provisions of the preceding article ensures that the annual self-assessment report referred to in paragraph 2 of Article 54 of Bank of Portugal Notice No. 3/2020, including only the elements referred to in paragraphs c) and d) of paragraph 1 of Article 2 of this Instruction, is submitted to the competent supervisory authority by November 15 of each year.

2 - The institutions referred to in this article shall immediately submit to the competent supervisory authority the other elements referred to in Article 2 whenever requested to do so.

Article 7.
Financial Groups

1- The management body of the parent company of a financial group ensures that the group's annual self-assessment report, referred to in paragraph 3 of Article 54 of Bank of Portugal Notice No. 3/2020, including the elements referred to in Article 4 of this Instruction, is submitted to the competent supervisory authority by November 15 of each year.

2 - The provisions of Articles 5 and 6 of this Instruction do not apply to subsidiaries of a financial group; the provisions of the final part of paragraph 5 of Article 54 of Bank of Portugal Notice No. 3/2020 apply to them.

CHAPTER V
Report on Reporting of Irregularities

Article 8.
Annual Report to be Submitted to the Competent Supervisory Authority

1- The annual report provided for in paragraph 7 of Article 115-X of the General Regime of Credit Institutions and Financial Companies must contain:
a) A description of the means for receiving, processing, and archiving reports of irregularities provided for in paragraph 1 of Article 115-X of the General Regime of Credit Institutions and Financial Companies; b) Indication, for each report received in the reference period, of the following elements:
i) Internal reference assigned to the report; ii) Date of receipt of the report; iii) Summary description of the reported facts and analysis of the report, including its legal framework; iv) Summary description of the diligence carried out to verify the reported facts; v) Whether the process is pending or finalized; vi) Result of the investigation; vii) Date of sending response to the whistleblower, whenever the report is not anonymous; viii) Date of conclusion of the procedure and justification for any extensions of the initially defined deadline; ix) Description of measures adopted or to be adopted as a result of the report or justification for not adopting any measures; c) Indication of the total number of reports received in the reference period.

2 - The Central Box of the Mutual Agricultural Credit prepares a model report to be issued by institutions integrated into the Integrated System of Mutual Agricultural Credit.

3 - The institutions referred to in the preceding paragraph shall submit the annual report provided for in this article to the Central Box of the Mutual Agricultural Credit within 15 days of its completion, and this institution may request clarifications it deems necessary regarding the same.

Article 9.
Reporting of the Report on Reporting of Irregularities

1- The report referred to in the preceding article is prepared with reference to September 30 of each year and submitted to the competent supervisory authority by November 15 of each year.

2 - Reports regarding institutions integrated into the Integrated System of Mutual Agricultural Credit are submitted by the Central Box of the Mutual Agricultural Credit to the competent supervisory authority by December 15 of each year.

CHAPTER VI
Other Reports

Article 10.
Reporting of the Universe of Employees Who Have a Material Impact on the Institution's Risk Profile

1 - The reporting to the competent supervisory authority of the universe of employees who have a material impact on the institution's risk profile, provided for in paragraph c) of paragraph 1 of Article 41 of Bank of Portugal Notice No. 3/2020, is carried out by January 31 of each year and includes at least the following elements regarding each employee:

a) Unique identification number of the employee; b) Function or responsibility within the institution; c) Identification of the structural unit where they perform their duties; d) Identification of the criterion applied to assess the material impact on the institution's risk profile; e) Total annual remuneration earned in the year prior to the reporting year, disaggregated between fixed and variable remuneration and calculated in accordance with regulatory technical standards for the purposes of the qualitative and quantitative criteria appropriate to identify categories of staff whose professional activities have a material impact on their risk profile.

2 - All employees with a material impact on the institution's risk profile, as well as those who meet the quantitative criteria but whose professional activities have been assessed as not having a material impact on the institution's risk profile, are covered by the provisions of the preceding paragraph.

3 - In the case of financial groups, the report is submitted by the parent company and includes all employees with a material impact on the risk profile of the entire group of institutions, financial or otherwise, integrated into the consolidated supervision perimeter.

4 - The reporting referred to in this article is submitted in an editable format, using the table contained in Annex IV to this Instruction, which is available in the BPnet system.

Article 11.
Reporting provided for in paragraph 5 of Article 115-F of the General Regime of Credit Institutions and Financial Companies

For the purposes of reporting the information provided for in paragraph 5 of Article 115-F of the General Regime of Credit Institutions and Financial Companies, institutions shall submit to the competent supervisory authority the following elements:
a) Within 5 business days after the convening of the general meeting, a detailed proposal regarding the approval of a higher maximum level of the variable component of remuneration presented to said general meeting, in accordance with paragraph 4, letter a) of Article 115-F of the General Regime of Credit Institutions and Financial Companies; and b) Within 5 business days after the general meeting, a copy of the minutes of said meeting containing the resolution adopted in accordance with paragraph 4, letter b) of Article 115-F of the General Regime of Credit Institutions and Financial Companies, regardless of its outcome.

Article 12.
Reporting of the appointment of the statutory auditor or statutory audit firm

Except for Agricultural Mutual Credit Societies that are part of the Integrated System of Agricultural Mutual Credit, institutions authorized to receive deposits shall submit to the competent supervisory authority, with a minimum advance notice of 30 days prior to submission to the competent body of proposals for the appointment or election of a statutory auditor or statutory audit firm, a demonstration of the adequacy of the proposals in relation to the requirements established in applicable legislation and regulation, including the internal analysis supporting the selection.

Article 13.
Reporting provided for in paragraph 2 of Article 85 of the General Regime of Credit Institutions and Financial Companies

1 - In cases where, in accordance with the provisions of paragraph 2 of Article 85 and paragraph 4 of Article 109 of the General Regime of Credit Institutions and Financial Companies, the administrative body of a credit institution considers that the presumption of indirect granting of credit to one or more entities covered by that provision has been rebutted, the credit institution shall submit to the competent supervisory authority, with a minimum advance notice of 30 days relative to the moment when the credit is granted:
a) A certified copy of the minutes of the meeting in which such resolution was taken, which must include the description of the operation covered and the grounds for the resolution; b) A copy of all information elements and respective documentation that served as the basis for the rebuttal of the presumption.

2 - Any project to amend the operations covered by the preceding paragraph is, after compliance with the provisions of paragraph 4 of Article 33 of Bank of Portugal Notice No. 3/2020, and in the event that the operation is carried out, communicated by the credit institution to the competent supervisory authority with a minimum advance notice of 30 days relative to its production of effects.

CHAPTER VII
Form of Reporting

Article 14.
Reporting through the BPnet system

1 - Documents reported to the competent supervisory authority under this Instruction are submitted through the BPnet system, regulated by a Bank of Portugal Instruction, with the exception of the reports referred to in Articles 11 to 13 of this Instruction.

2 - The reports referred to in Articles 11 to 13 of this Instruction are submitted to the competent supervisory authority by letter or by email.

CHAPTER VIII
Final and Transitional Provisions

Article 15.
Transitional reporting deadlines

1 - The first reporting of the reports and other documents provided for in this Instruction to the competent supervisory authority occurs by March 1, 2021, accompanied by a description of the activities specifically developed, in progress, and planned for 2021, intended to ensure full compliance with the provisions of Bank of Portugal Notice No. 3/2020 and this Instruction, including training actions on the subject, attended and to be attended by members of the administrative and supervisory bodies, other senior management members, and holders of essential functions.

2 - The next report occurs by December 31, 2021, as provided for in this Instruction.

Article 16.
Entry into force

This Instruction enters into force on the day following its publication.

Annex to Instruction No. 18/2020 BO No. 7/2020 • 2020/07/15
Topics Supervision :: Internal Control
......................................................................................................................................................................................
Mod. 99999911/T – 01/14

Annex I - Risk Categories

Risk Category	Subcategories of Risk
Business Model Risk	Business model risk
Strategy risk
Environmental, Social and Governance Risk	Physical and transition risks (environmental)
Risk management structure and risk culture
---
Infrastructures, data and reporting
Credit Risk	Bank book default risk
Counterparty credit risk
---
Bank book migration risk
Reduction in receivables risk
Settlement and delivery risk
Credit concentration risk
Bank book country risk
Securitization risk
Foreign currency lending risk
Residual risk
Specialized lending risk
Equity risk in the book (including holdings in insurers)
Real estate risk
Market Risk	Credit spread risk and default risk (including migration risk) in the trading book
Currency risk
---
Commodity risk
Credit valuation adjustment risk
Equity instruments risk in the banking book
Basis risk
Concentration risk / Liquidity risk
Non-delta risk
Banking Book Interest Rate Risk	Gap risk
Basis risk
---
Option risk
Banking Book Credit Spread Risk	Banking book credit spread risk

Operational Risk | External fraud

Employment practices and workplace safety practices
Damage to physical assets
Business disruption and system failures
Execution, delivery and process management
Information technology
Liquidity and Funding Risk
Cash flow mismatch risk
---
Funding cost risk
Wholesale funding risk
Retail funding risk
Intragroup liquidity and/or funding risk
Liquidity and/or funding concentration risk
Compliance Risk
Conduct Risk
Money Laundering and Terrorist Financing Risk

Note: The risk categories and subcategories contained in this annex correspond to a non-exhaustive list of risks to which an institution is or may become exposed, intending to reflect commonly used taxonomies. In accordance with the provisions of Article 2, paragraph 1, letter c) and Article 4, paragraph 1, letter c) of Instruction No. 18/2020, for the purposes of describing deficiencies to be reported in the annex to the annual self-assessment report, institutions allocate their deficiencies to the risk categories contained in this annex.

Annex II - Deficiency Classification Methodology

Classification	Impact	Description
◼ F1	Reduced	Deficiencies, as defined in Article 13, paragraph 3, of Notice No. 3/2020, with reduced actual or potential impact on the institution's financial situation, own funds level, own funds requirements, internal governance, liquidity, leverage, business model, risk management and control of the institution. ◼ F2

Annex III - Reporting of Deficiencies

I. Deficiencies classified at level F3 (high) and F4 (very high)

Entity | Numeric or alphanumeric code of the deficiency Category of risk of the deficiency Current classification of the deficiency [F3/F4] Was the deficiency reclassified? If yes, indication of the date of reclassification and classification previously assigned. [DD.MM.YY] [F1 to F4] Structural unit, function or body to which the deficiency relates Date of identification of the deficiency [DD.MM.YY] Date on which the deficiency was communicated to the administrative body [DD.MM.YY] Internal control function responsible for monitoring the implementation of measures intended to correct the deficiency Description of the deficiency Description of the potential implications of the deficiency Was the deficiency identified by the Statutory Auditor/Statutory Audit Firm or another entity external to the institution? If yes, identification of the entity, indication of the document in which it was identified and reference date Was the deficiency identified by a supervisory authority? If yes, identification of the authority, indication of the document in which it was identified and reference date Was the deficiency already identified in the previous report? If applicable, does the deficiency have an impact on the group? [Yes / No / N/A] Measures intended to correct the deficiency Expected date for correction of the deficiency [DD.MM.YY] Was the expected date for implementation of the measures subject to extension? Number of extensions of the date defined for implementation of measures intended to correct the deficiency Justification for this/these extension(s)

New expected date for implementation of measures intended to correct the deficiency [DD.MM.YY]

II. Deficiencies classified at level F1 (reduced) and F2 (moderate)

Entity:
Risk Category | No. of F1 deficiencies | No. of measures intended to correct F1 deficiencies that were subject to extension | No. of F2 deficiencies | No. of measures intended to correct F2 deficiencies that were subject to extension --- | --- | --- | --- | --- Credit Risk | <1 year | between 1 and 3 years | >3 years | Market Risk | <1 year | between 1 and 3 years | >3 years | Banking Book Interest Rate Risk | <1 year | between 1 and 3 years | >3 years | Operational Risk | <1 year | between 1 and 3 years | >3 years | Liquidity and Funding Risk | <1 year | between 1 and 3 years | >3 years | Internal Governance Risk | <1 year | between 1 and 3 years | >3 years | Business Model Risk | <1 year | between 1 and 3 years | >3 years | Environmental, Social and Governance Risks | <1 year | between 1 and 3 years | >3 years | Banking Book Credit Spread Risk | <1 year | between 1 and 3 years | >3 years | Compliance Risk | <1 year | between 1 and 3 years | >3 years | Reputational Risk | <1 year | between 1 and 3 years | >3 years | Excessive Leverage Risk | <1 year | between 1 and 3 years | >3 years | Other Risks | <1 year | between 1 and 3 years | >3 years |

III. Deficiencies identified within the reference period*

*Filling instructions:

The evolution over the reference period must be considered, i.e., from October 1 to September 30. In the report to be submitted by November 15, 2025, institutions must consider as reference the period between December 1, 2024 and September 30, 2025.
Report the total number of deficiencies identified in the reference period, disaggregating the deficiencies corrected by September 30.
(1) Deficiencies identified in the context of external services contracted at the initiative of the institutions, including to comply with legal or regulatory requirements, must be reported as deficiencies identified by the institutions themselves. (2) Deficiencies identified in the context of audits determined by the Bank of Portugal must be reported as deficiencies identified by the prudential supervisory authority.

Entity:
Deficiency Classification | Responsible for identifying the deficiency | Deficiencies Identified Total No. | No. of deficiencies corrected --- | --- | --- | --- F1 | By the institution itself (or by subcontracted entity) (1) | Prudential supervisory authority (2) | Statutory Auditor/Statutory Audit Firm | Other supervisory authority | F2 | By the institution itself (or by subcontracted entity) (1) | Prudential supervisory authority (2) | Statutory Auditor/Statutory Audit Firm | Other supervisory authority | F3 | By the institution itself (or by subcontracted entity) (1) | Prudential supervisory authority (2) | Statutory Auditor/Statutory Audit Firm | Other supervisory authority | F4 | By the institution itself (or by subcontracted entity) (1) | Prudential supervisory authority (2) | Statutory Auditor/Statutory Audit Firm | Other supervisory authority |

IV. Deficiencies corrected within the reference period*

*Filling instructions:

The evolution over the reference period must be considered, i.e., from October 1 to September 30. In the report to be submitted by November 15, 2025, institutions must consider as reference the period between December 1, 2024 and September 30, 2025.
Report the number of deficiencies corrected in the reporting period, regardless of their date of identification, disaggregating the deficiencies in which the initial deadline defined for implementation of measures intended for their correction was extended.
For the purposes of calculating the average correction time (in days), the time elapsed between the date of implementation of the measures intended for their correction and the date of identification of the deficiency must be considered. The average correction time should be aggregated by deficiency classification and responsible for its identification.
Also regarding the calculation of the average correction time of deficiencies, for the purposes of reporting this

Entity:
Deficiency Classification | Responsible for identifying the deficiency | Deficiencies Corrected | Average correction time of deficiencies (days) Total No. | No. of deficiencies whose deadline for implementation of measures was extended --- | --- | --- | --- F1 | By the institution itself (or by subcontracted entity) (1) | Prudential supervisory authority (2) | Statutory Auditor/Statutory Audit Firm | Other supervisory authority | F2 | By the institution itself (or by subcontracted entity) (1) | Prudential supervisory authority (2) | Statutory Auditor/Statutory Audit Firm | Other supervisory authority | F3 | By the institution itself (or by subcontracted entity) (1) | Prudential supervisory authority (2) | Statutory Auditor/Statutory Audit Firm | Other supervisory authority | F4 | By the institution itself (or by subcontracted entity) (1) | Prudential supervisory authority (2) | Statutory Auditor/Statutory Audit Firm | Other supervisory authority |

table, a deficiency is considered corrected when the initially defined action plan has been fully implemented, even if its formal conclusion is pending validation by the Statutory Auditor/Statutory Audit Firm or by the prudential supervisory authority that identified it.

An extension of the deadline is considered to have occurred in cases where the date on which the action plan was effectively implemented is later than the date initially defined for this purpose (disregarding the date on which the correction of the deficiency was validated).
If, in the reporting period, an action plan was considered implemented, but the person responsible for its validation did not agree with its conclusion, giving rise to a new action plan, it is considered that the time period for correction of the deficiency corresponds to the time elapsed between the identification of the deficiency and the effective date of implementation of the revised action plan.
(1) Deficiencies identified in the context of external services contracted at the initiative of the institutions, including to comply with legal or regulatory requirements, must be reported as deficiencies identified by the institutions themselves. (2) Deficiencies identified in the context of audits determined by the Bank of Portugal must be reported as deficiencies identified by the prudential supervisory authority.

Annex IV - Reporting of the universe of employees who have a material impact on the risk profile of the institution

REPORTING OF EMPLOYEES WITH MATERIAL IMPACT ON THE RISK PROFILE OF THE INSTITUTION*

*Filling instructions:

Entity: identification of the specific entity where the employee performs their duties.
Description of the criterion: description of the criterion applied to assess the material impact on the institution's risk profile.
Fixed remuneration: the value of the fixed remuneration corresponds to the total fixed remuneration attributed during the year prior to the reporting year, expressed in euros.
Variable remuneration: total variable remuneration attributed in the reference year considered in accordance with regulatory technical standards.

Instruction republished by Instruction No. 4/2025, published in BO No. 3/2025 Supplement, of March 20.

Reporting Year:
Entity | Employee Identification No. | Function | Structural Unit | Type of Criterion | Description of Criterion | Fixed Remuneration | Variable Remuneration --- | --- | --- | --- | --- | --- | --- | ---
| | | | [qualitative/quantitative/internal/exclusion] | | |

Lineage: Amended

Timeline

Similar documents from other regulators