Instruction No. 18/2020: Reporting Duties Regarding Conduct, Organizational Culture, and Internal Governance and Control Systems

Instruction No. 18/2020
BO No. 7/2020 • 2020/07/15
..................................................................................................................................................................................................
Topics
Supervision :: Internal Control
Mod. 99999911/T – 01/14
Index
Text of the Instruction
CHAPTER I
General Provisions
CHAPTER II
Obligation to Report Annual Self-Assessment Reports
CHAPTER III
Annual Self-Assessment Reports in Financial Groups
CHAPTER IV
Reporting Deadlines to the Competent Supervisory Authority
CHAPTER V
Report on Whistleblowing
CHAPTER VI
Staff with Material Impact on the Institution's Risk Profile
CHAPTER VII
Reporting Regarding the Approval Process for a Higher Maximum Level of the Variable Component of Remuneration
CHAPTER VIII
Form of Reports
CHAPTER IX
Final and Transitional Provisions
Annex I – Risk Categories
Annex II – Deficiency Classification Methodology
Annex III – File for Reporting Deficiencies
Text of the Instruction
Subject: Reporting duties regarding conduct and organizational culture and internal governance and control systems This Instruction regulates, in accordance with the principle of proportionality, the reporting duties to the competent supervisory authority incumbent upon the entities covered by Bank of Portugal Notice No. 3/2020, regarding conduct and organizational culture and internal governance and control systems.

Instruction No. 18/2020 BO No. 7/2020 • 2020/07/15 Topics Supervision :: Internal Control
..................................................................................................................................................................................................
Mod. 99999911/T – 01/14
In particular, this Instruction establishes the rules to be observed by the entities covered by Bank of Portugal Notice No. 3/2020, regarding the following:
− Reporting of the self-assessment reports on the adequacy and effectiveness of organizational culture and internal governance and control systems, and respective annexes, to the competent supervisory authority; − Content and reporting, to the competent supervisory authority, of the report provided for in paragraph 7 of Article 116-AA of the General Regime of Credit Institutions and Financial Companies; − Content and reporting of the universe of staff who have a material impact on the institution's risk profile; − Reporting regarding the approval process for a higher maximum level of the variable component of remuneration, provided for in paragraph 5 of Article 115-F of the General Regime of Credit Institutions and Financial Companies. This Instruction also establishes, albeit non-exhaustively, the risk categories that must be considered by the entities covered by Bank of Portugal Notice No. 3/2020 for the purposes of identifying, assessing, monitoring, and controlling the risks to which they are or may become exposed (Annex I). Finally, this Instruction includes the file that must be used by the aforementioned entities to report identified deficiencies, regarding conduct and organizational culture and internal governance and control systems, and which will be available in the BPnet system. The draft of this Instruction was subject to public consultation, having heard the Securities Market Commission, the Insurance and Pension Funds Supervision Authority, and the National Data Protection Commission. Under these terms, the Bank of Portugal, using the powers conferred upon it by paragraph c) of Article 133 of the General Regime of Credit Institutions and Financial Companies, approved by Decree-Law No. 298/92, of December 31, determines the following:

CHAPTER I
General Provisions

Article 1.
Object
This Instruction regulates:
a) The reporting of self-assessment reports on the adequacy and effectiveness of organizational culture and internal governance and control systems by the entities covered by Bank of Portugal Notice No. 3/2020, hereinafter designated as “institutions”, and respective annexes, to the competent supervisory authority; b) The content and reporting, to the competent supervisory authority, of the report provided for in paragraph 7 of Article 116-AA of the General Regime of Credit Institutions and Financial Companies;

CHAPTER II
Obligation to Report Annual Self-Assessment Reports

Article 2.
Annual Self-Assessment Report
1 - Institutions submit to the competent supervisory authority the annual self-assessment report on the adequacy and effectiveness of organizational culture and internal governance and control systems, provided for in Article 55 of Bank of Portugal Notice No. 3/2020, accompanied by the following elements:
a) Identification of the persons responsible for internal control functions, with indication of their respective contacts (telephone and email address); b) Identification of the structural unit responsible for coordinating the preparation of the self-assessment report; c) Description, organized by risk categories to which the institution is exposed, taking into account the different risk categories listed in Annex I to this Instruction and the methodology for classifying deficiencies contained in Annex II, of the following deficiencies identified in the period to which the report refers and which are not yet fully corrected:
i) Deficiencies detected within the scope of control actions and evaluations carried out by the institution and its respective official auditor or official auditor society; ii) Deficiencies detected by any supervisory authorities. d) Description of deficiencies identified in previous reports and which remain open; e) Report issued by the head of the internal audit function validating the classification of deficiencies according to the methodology contained in Annex II; f) Explicit declarations by the management body and the supervisory body regarding the adequacy of the classification assigned to deficiencies classified at level F3 “high” or level F4 “severe”, according to the methodology contained in Annex II to this Instruction; g) Copy of the multi-annual internal audit action plan provided for in paragraph a) of paragraph 1 of Article 32 of Bank of Portugal Notice No. 3/2020 and indication of the date of the last audit action carried out on each structural unit of the institution, with explicit confirmation that all structural units and areas of activity of the institution are included in the plan;

Instruction No. 18/2020 BO No. 7/2020 • 2020/07/15 Topics Supervision :: Internal Control
..................................................................................................................................................................................................
Mod. 99999911/T – 01/14 h) Description, where applicable, of relevant changes to the institution's internal organization that have occurred in the period to which the report refers; i) With the first report to be made under the provisions of this Instruction and whenever relevant changes occur, description of the criteria developed by the institution for classifying deficiencies as provided for in Annex II; j) Assessment regarding the fulfillment of the conditions provided for in paragraph a) of paragraph 1 of Article 16 of Bank of Portugal Notice No. 3/2020 and, if these conditions are met, and the institution chooses not to have an independent risk management function, description of the mechanisms implemented to comply with the provisions of paragraph 1 of the same article; k) Assessment regarding the fulfillment of the conditions provided for in paragraph b) of paragraph 1 of Article 16 of Bank of Portugal Notice No. 3/2020 and, if these conditions are met, and the institution chooses not to have an independent compliance function, description of the mechanisms implemented to comply with the provisions of paragraph 1 of the same article; l) Assessment regarding whether the requirements provided for in paragraphs 3 and 4 of Article 16 of Bank of Portugal Notice No. 3/2020 are met and, if these are met, and the institution chooses to outsource the entirety of the internal audit function, justification of this option; m) If the institution has chosen to combine the risk management and compliance functions into a single structural unit, justification by the management body for this option, as provided for in paragraph 2 of Article 16 of Bank of Portugal Notice No. 3/2020. 2 - The reference date of the report referred to in paragraph 1 is November 30 of each year, and the competent supervisory authority may request updated information from institutions at any time, particularly status updates on the implementation of measures intended to correct the reported deficiencies.

Article 3.
Treatment of Deficiencies in the Annual Self-Assessment Report 1 - For the purposes of the provisions of paragraph c) of paragraph 1 of the preceding article, the description includes, for each deficiency classified at level F3 “high” or level F4 “severe”, according to the methodology contained in Annex II, the following elements:
a) Unique numeric or alphanumeric code assigned; b) Risk category or categories, in case the deficiency falls into more than one risk category, as per Annex I to this Instruction; c) Classification of the deficiency according to the methodology contained in Annex II to this Instruction; d) Structural unit, function, or body to which the deficiency relates; e) Date on which it was identified and the date on which it was communicated to the management body; f) Internal control function responsible for monitoring the implementation of measures intended to correct the deficiency; g) Description of the deficiency and its potential implications; h) Indication of whether the deficiency was identified by the official auditor or official auditor society or by another entity external to the institution, notably supervisory authorities, including reference to the document in which it was identified and reference date; i) Indication of whether the deficiency was already identified in the previous report; j) Measures in progress or to be adopted to correct the deficiency and prevent its future occurrence, including the deadlines established for this purpose; k) Indication of whether the planned date for implementing measures intended to correct the deficiency was extended, justification for the extension, and new planned date for implementing the aforementioned measures. 2 - For the purposes of the provisions of paragraph c) of paragraph 1 of the preceding article, the report also includes the number of deficiencies classified at level F1 “low” or level F2 “moderate”, according to the methodology contained in Annex II, with indication of the number of open deficiencies for more than one year and the number of measures that were subject to extension relative to the initially defined deadline. 3 - The institution maintains detailed documented information on deficiencies classified at level F1 “low” or level F2 “moderate”, which are made immediately available to the competent supervisory authority upon request. 4 - Each deficiency must be counted and reported only once, being reported by the structural unit, function, or body to which it relates. 5 - The management body ensures that the institution does not limit the number of deficiencies reported in the report. 6 - The reporting of deficiencies is carried out, in editable format, through the files contained in Annex III to this Instruction, available in the BPnet system.

CHAPTER III
Annual Self-Assessment Reports in Financial Groups

Article 4.
Group Annual Self-Assessment Report
1 - Institutions submit to the competent supervisory authority the annual self-assessment report of the group, provided for in Article 58 of Bank of Portugal Notice No. 3/2020, accompanied by the following elements:
a) Identification of the persons responsible for internal control functions of the parent company, with indication of their respective telephone numbers and email addresses; b) Identification of the structural unit responsible for coordinating the preparation of the self-assessment report; c) Description, organized by risk categories to which the financial group is exposed, taking into account the different risk categories listed in Annex I to this Instruction and the methodology for classifying deficiencies contained in Annex II, and considering the provisions of paragraph 1 of Article 3, of the following deficiencies identified in the period to which the report refers and which are not yet fully corrected:
i) Deficiencies detected within the scope of control actions and evaluations carried out by the official auditor or official auditor society, the parent company, or any subsidiary that have an impact on the internal control system of the financial group; ii) Deficiencies detected by any supervisory authorities regarding the internal control system of the financial group; iii) Deficiencies associated with centralized tasks of the various entities of the group, when common services exist. d) Description of deficiencies identified in previous reports and which remain open; e) Explicit declarations by the management body and the supervisory body regarding the adequacy of the classification assigned to deficiencies classified at level F3 “high” or level F4 “severe”, according to the methodology contained in Annex II and assessment of the impact such deficiencies have on the group's internal control system; f) Copy of the multi-annual internal audit action plan of the parent company regarding the internal control system of the financial group and indication of the date of the last audit action carried out, with explicit confirmation that all relevant components of the financial group's internal control system are included in the plan; g) Description, where applicable, of relevant changes to the organizational structure of the financial group that have occurred in the period to which the report refers; h) With the first report to be made under the provisions of this Instruction and whenever relevant changes occur, description of the criteria developed by the institution for classifying deficiencies as provided for in Annex II. 2 - For the purposes of the provisions of paragraph c) of the preceding paragraph, only deficiencies that, regardless of their classification at the subsidiary level, are classified at level F3 “high” or level F4 “severe”, according to the methodology defined in Annex II to this Instruction, considering the impact they have on the group, are relevant. 3 – If the competent supervisory authority considers the justification for excluding the obligation to prepare individual reports to be insufficient, as provided for in paragraph e) of paragraph 1 of Article 58 of Bank of Portugal Notice No. 3/2020, it may request their preparation at any time. 4 - The reporting of deficiencies is carried out, in editable format, through the files contained in Annex III to this Instruction, available in the BPnet system.

CHAPTER IV
Reporting Deadlines to the Competent Supervisory Authority

Article 5.
Entities Authorized to Accept Deposits
The management body of institutions that correspond to entities authorized to accept deposits ensures that the annual self-assessment report referred to in Article 55 of Bank of Portugal Notice No. 3/2020, including the elements referred to in Article 2 of this Instruction, is submitted to the competent supervisory authority by December 31 of each year.

Article 6.
Entities Not Authorized to Accept Deposits
1 - The management body of institutions not covered by the provisions of the preceding article ensures that the annual self-assessment report referred to in Article 55 of Bank of Portugal Notice No. 3/2020, excluding the elements referred to in Article 2 of this Instruction, is submitted to the competent supervisory authority by December 31 of each year. 2 – The institutions referred to in this article submit, immediately, to the competent supervisory authority, the elements referred to in Article 2, whenever requested to do so.

Article 7.
Financial Groups
1 - The management body of the parent company of a group that includes entities authorized to accept deposits:
a) Ensures that the annual self-assessment report of the group, referred to in paragraph 1 of Article 58 of Bank of Portugal Notice No. 3/2020, including the elements referred to in Article 4 of this Instruction, is submitted to the competent supervisory authority by December 31 of each year; b) Ensures that individual reports regarding entities authorized to accept deposits, referred to in paragraph e) of paragraph 1 of Article 58 of Bank of Portugal Notice No. 3/2020, including the elements referred to in Article 2 of this Instruction, are submitted to the competent supervisory authority within the deadline referred to in the preceding subparagraph. 2 - The management body of the parent company of a group ensures that the annual self-assessment reports referred to in paragraph e) of paragraph 1 of Article 58 of Bank of Portugal Notice No. 3/2020, excluding the elements referred to in Article 2 of this Instruction when they concern entities not authorized to accept deposits, are submitted to the competent supervisory authority by December 31 of each year. 3 - The management body of the parent company of a group submits, immediately, to the competent supervisory authority, the elements referred to in Article 2 of this Instruction, concerning entities not authorized to accept deposits, whenever requested to do so. 4 - The reporting by the parent company of the individual reports referred to in this article complies with the obligations provided for in Articles 5 and 6 of this Instruction.

CHAPTER V
Report on Whistleblowing

Article 8.
Annual Report to be Submitted to the Competent Supervisory Authority 1 - The annual report provided for in paragraph 7 of Article 116-AA of the General Regime of Credit Institutions and Financial Companies must contain:
a) A description of the means for receiving, processing, and archiving whistleblowing reports provided for in paragraph 1 of Article 116-AA of the General Regime of Credit Institutions and Financial Companies; b) Indication, for each report received in the reference period, of the following elements:
i) Internal reference assigned to the report; ii) Date of receipt of the report; iii) Summary description of the reported facts and analysis of the report, including its legal framework; iv) Summary description of the diligence carried out to investigate the reported facts; v) Whether the process is pending or finalized; vi) Result of the investigation; vii) Date of sending a response to the whistleblower, whenever the report is not anonymous; viii) Description of measures adopted or to be adopted as a result of the report or justification for not adopting any measures; c) Indication of the total number of reports received in the reference period. 2 - The Central Box of the Mutual Agricultural Credit System prepares a model of report to be issued by institutions integrated into the Integrated System of Mutual Agricultural Credit. 3 - The institutions referred to in the preceding paragraph submit the annual report provided for in this article to the Central Box of the Mutual Agricultural Credit System within 15 days of its completion, and this institution may request any clarifications it deems necessary regarding the same.

Article 9.
Reporting of the Report on Whistleblowing
1 - The report referred to in the preceding article is prepared with reference to November 30 of each year and submitted to the competent supervisory authority by December 31 of each year.

Instruction No. 18/2020 BO No. 7/2020 • 2020/07/15 Supervision Topics :: Internal Control
..................................................................................................................................................................................................
Mod. 99999911/T – 01/14
2 - Reports concerning institutions integrated into the Integrated System of Mutual Agricultural Credit are sent by the Central Box of Mutual Agricultural Credit to the competent supervisory authority by January 31 of each year.

CHAPTER VI
Staff who have a material impact on the institution's risk profile

Article 10.
Reporting of the universe of staff who have a material impact on the institution's risk profile The reporting to the competent supervisory authority of the universe of staff who have a material impact on the institution's risk profile, provided for in point (c) of paragraph 1 of Article 41 of Banco de Portugal Notice No. 3/2020, is carried out by December 31 of each year and must include at least the following elements regarding each staff member:
a) Unique identification number of the staff member; b) Function or responsibility in the institution; c) Identification of the structural unit where they perform their duties; d) Identification of the criterion applied to assess the material impact on the institution's risk profile; e) Total annual remuneration received in the last year, calculated in accordance with regulatory technical standards for the purposes of the qualitative and quantitative criteria appropriate for identifying categories of personnel whose professional activities have a significant impact on their risk profile.

CHAPTER VII
Reporting regarding the approval process for a higher maximum level of the variable component of remuneration

Article 11.
Reporting provided for in paragraph 5 of Article 115-F of the General Regime of Credit Institutions and Financial Companies For the purposes of reporting the information provided for in paragraph 5 of Article 115-F of the General Regime of Credit Institutions and Financial Companies, institutions send the following elements to the competent supervisory authority:
a) Within 5 working days after the call for the general assembly meeting, a detailed proposal regarding the approval of a higher maximum level of the variable component of remuneration presented to the aforementioned general assembly, in accordance with point (a) of paragraph 4 of Article 115-F of the General Regime of Credit Institutions and Financial Companies; and b) Within 5 working days after the general assembly meeting, a copy of the minutes of the aforementioned meeting containing the decision adopted in accordance with point (b) of paragraph 4 of Article 115-F of the General Regime of Credit Institutions and Financial Companies, regardless of its outcome.

CHAPTER VIII
Form of reports

Article 12.
Reporting through the BPnet system
1 - The documents reported to the competent supervisory authority under this Instruction are submitted through the BPnet system, regulated by Banco de Portugal Instruction No. 5/2016, with the exception of the reporting referred to in Article 11 of this Instruction. 2 - The reporting referred to in Article 11 of this Instruction is submitted to the competent supervisory authority by letter or by electronic mail.

CHAPTER IX
Final and transitional provisions

Article 13.
Transitional reporting deadlines
1 - The first reporting of the reports and other documents provided for in this Instruction to the competent supervisory authority takes place by March 1, 2021, accompanied by a description of the activities specifically developed, ongoing, and planned for 2021, aimed at ensuring full compliance with the provisions of Banco de Portugal Notice No. 3/2020 and this Instruction, including training actions on the subject, attended and to be attended by members of the administrative and supervisory bodies, other senior management members, and holders of essential functions. 2 - The subsequent reporting takes place by December 31, 2021, as provided for in this Instruction.

Article 14.
Entry into force
This Instruction enters into force on the day following its publication.

Annex to Instruction No. 18/2020 BO No. 7/2020 • 2020/07/15
Supervision Topics :: Internal Control
.....................................................................................................................................................................................
ANNEX I
RISK CATEGORIES
Risk Category Subcategory of Risk
Business Model Risk
Business model viability
Business model sustainability
Internal Governance Risk
Internal governance structure
Risk management structure and risk culture
Infrastructures, data, and reporting
Credit Risk
Default risk
Country risk
Foreign exchange credit risk
Sovereign risk
Specialized lending risk
Counterparty credit risk
Migration risk
Credit spread risk
Credit concentration risk
Securitization risk
Residual risk
Reduction in receivables risk
Settlement and delivery risk
Market Risk
General position risk (debt instruments)
Specific position risk (debt instruments)
Credit spread risk
Equity instrument risk
Migration risk
Default risk
Commodity risk
Foreign exchange risk
Option risk
Credit valuation adjustment risk
Equity instrument risk in the banking book
Basis risk
Sovereign risk
Concentration risk / Liquidity risk
Banking Book Interest Rate Risk
Revaluation risk
Yield curve risk

Annex to Instruction No. 18/2020 BO No. 7/2020 • 2020/07/15
Supervision Topics :: Internal Control
.....................................................................................................................................................................................
Basis risk
Option risk
Operational Risk
Internal fraud
External fraud
Employment practices and workplace safety
Clients, products, and commercial practices
Damage to physical assets
Business disruption
Execution, delivery, and process management
Information and communication technologies
Liquidity and Funding Risk
Wholesale funding risk
Retail funding risk
Funding cost risk
Intraday risk
Liquidity and/or funding foreign exchange risk Intragroup liquidity and/or funding risk Liquidity and/or funding concentration risk Cash flow mismatch risk Other Risks Reputational risk Compliance risk Money laundering and terrorist financing risk Pension fund risk Insurance risk Real estate risk Step-in risk Participation risk Other concentration risks Excessive leverage risk Group risk Note: Institutions must allocate the risks to which they are exposed to the seven risk categories indicated in the table above. The column designated “Subcategory of Risk” aims to present a non-exhaustive list of risks to which an institution is or may become exposed, intending to reflect risk taxonomies commonly used by institutions.

ANNEX II
DEFICIENCY CLASSIFICATION METHODOLOGY

ANNEX III
FILE FOR REPORTING DEFICIENCIES
Deficiencies classified with level F3 (high) and F4 (severe) Entity Numeric or alphanumeric code of the deficiency [DD.MM.YY] Risk category(ies) Deficiency classification [F3/F4] Structural unit, function, or body to which the deficiency relates Date of identification of the deficiency [DD.MM.YY] Date when it was communicated to the administrative body [DD.MM.YY] Internal control function responsible for monitoring the implementation of measures intended to remedy the deficiency Description of the deficiency Description of the potential implications of the deficiency Deficiency identified by the ROC/SROC or other entity external to the institution? If affirmative, identification of the entity, indication of the document in which it was identified, and reference date Deficiency identified by supervisory authority? If affirmative, identification of the authority, indication of the document in which it was identified, and reference date Deficiency already identified in the previous report? Measures intended to correct the deficiency Expected date for correction [DD.MM.YY] Was the expected date for the implementation of measures subject to extension? Justification for the extension New expected date for the implementation of measures intended to remedy the deficiency [DD.MM.YY]

Annex to Instruction No. 18/2020 BO No. 7/2020 • 2020/07/15
Supervision Topics :: Internal Control
..................................................................................................................................................................................................
Mod. 99999911/T – 01/14
Deficiencies classified with level F1 (reduced) and F2 (moderate) Risk category No. of F1 deficiencies No. of measures intended to correct F1 deficiencies that were subject to extension No. of F2 deficiencies No. of measures intended to correct F2 deficiencies that were subject to extension Credit Risk <1 year between 1 and 3 years >3 years Market Risk <1 year between 1 and 3 years >3 years Banking Book Interest Rate Risk <1 year between 1 and 3 years >3 years Operational Risk <1 year between 1 and 3 years >3 years Liquidity and Funding Risk <1 year between 1 and 3 years >3 years Internal Governance Risk <1 year between 1 and 3 years >3 years Business Model Risk <1 year between 1 and 3 years >3 years Other Risks <1 year between 1 and 3 years >3 years

Instruction No. 18/2020: Reporting Duties Regarding Conduct, Organizational Culture, and Internal Governance and Control Systems

Lineage: In force