The Nature and Art of Financial Supervision – Banking – Credit Institutions

IDENTIFIED RISKS & EXPECTED CONTROLS I THE NATURE AND ART OF FINANCIAL SUPERVISION VOLUME I BANKING CREDIT INSTITUTIONS IDENTIFIED RISKS EXPECTED CONTROLS A CROSS-SECTORIAL ANALYSIS 13 November 2020

Page 1 of 16 Contents Contents...................................................................................................................................................................... 1 Table of Abbreviations............................................................................................................................................ 2 Foreword ..................................................................................................................................................................... 3 Introduction................................................................................................................................................................ 4 Background on Banking Supervision................................................................................................................. 5 SREP and the MFSA Supervisory Approach............................................................................................... 5 International Cooperation ............................................................................................................................... 7 Future Significant Developments in the Regulatory Framework ...................................................... 8 Conduct Supervision......................................................................................................................................... 9 COVID-19 Measures.........................................................................................................................................10 Supervisory Engagement, Findings, Risks and Recommendations ......................................................11 Business Models and Stress Testing...........................................................................................................11 Internal Governance ........................................................................................................................................11 ...........................................................................................................................13 Credit Risk............................................................................................................................................................13 AML and CFT Risk Oversight.........................................................................................................................13 ...............................................................................................15 Concluding Remarks..............................................................................................................................................16

Page 2 of 16 Table of Abbreviations AML Anti-Money Laundering BR Banking Rule CET Common Equity Tier CFT Combatting the Financing of Terrorism CRD Capital Requirements Directive EBA European Banking Authority ECB European Central Bank EU European Union FIAU Financial Intelligence Analysis Unit FIU Financial Intelligence Unit FT Financing of Terrorism ICAAP Internal Capital Adequacy Assessment Process ILAAP Internal Liquidity Adequacy Assessment Process IRRBB Interest Rate Risk in the Banking Book IT Information Technology JST Joint Supervisory Team JSTC Joint Supervisory Team Coordinator LSIs Less Significant Institutions MFSA Malta Financial Services Authority ML Money Laundering MoU Memorandum of Understanding NSFR Net Stable Funding Ratio PSD Payment Services Directive SIs Significant Institutions SMEs Small and Medium-sized Enterprises SREP Supervisory Review and Evaluation Process SSM Single Supervisory Mechanism STR Suspicious Transaction Report

Page 3 of 16 Foreword Christopher P. Buttigieg Chief Officer Supervision Chief Executive Officer (ad interim) Banks perform a crucial role in the financial services sector. The business of banking, statutorily defined as the business of accepting deposits of money from the public, withdrawable or repayable on demand or after a fixed period or after notice, or that of borrowing or raising money from the public, in either case for the purpose of employing such money in whole or in part by lending to others or otherwise investing for the account and at the risk of the person accepting such money, 1 is core to any economy. This document, a first in a series of sector-specific publications from the Malta Financial Services Supervision Directorate, describes how the Authority regulates and supervises the Maltese banking sector, specifically credit institutions. It provides an overview of supervisory work conducted over the past year and identifies the main findings and risks identified. Moreover, in line with the MFS credit institutions are invited to take note of this publication and conduct a self-assessment exercise in order to benchmark themselves against the recommendations being made and subsequently address any weaknesses identified, as appropriate. Notwithstanding the challenges brought about by 2020, the banking supervision team at the MFSA has performed a considerable amount of work throughout the year. In this respect, I would like to take this opportunity to thank the Banking Supervision team for their dedication, commitment, and hard work the efforts of MFSA staff are key to any supervisory efforts the Authority undertakes. 1 Article 2 of the Banking Act, Chapter 371 of the Laws of Malta

Page 4 of 16 Introduction The Banking Supervision function of the MFSA is responsible for the oversight of all licensed banking activities in Malta which includes non-bank financial institutions (e.g. payment institutions). This oversight includes both off-site and on-site examinations of all licensed institutions applying a risk-based approach. The ultimate objective is to ensure that licensed entities are compliant with both national and international frameworks, as applicable. Supervision of both Significant Institutions (SIs), which is carried out together with the European Central Bank (ECB)through the Single Supervisory Mechanism(SSM), and that of Less Significant Institutions(LSIs)through the Supervisory Review and Evaluation Process (SREP), is executed by the function. Moreover, the function is also responsible for policy advice and development both within the MFSA and to external stakeholders, to consistently and effectively apply local legislation and transpose European Union (EU) legislation and guidelines issued by the European Banking Authority (EBA). The purpose of this publication is to describe the MFSA approach to oversight of credit institutions based in Malta as well as the SREP which the MFSA conducts as part of its banking supervision. This document also outlines and sets out the MFSA banking supervision focusfor 2021, base current economic, regulatory and supervisory environment, as well as on the work which the Authority has undertaken during 2020. Furthermore, throughout 2020, the Banking Supervision Function conducted a number of on￾site visits and meetings with board members and management of credit institutions - this publication also provides general feedback to the industry on findings, prevailing risks and puts forward recommendations which boards should use to inform their work plans.

Page 5 of 16 Background on Banking Supervision SREP and the MFSA Supervisory Approach The MFSA, as a National Competent Supervisory Authority, is in charge of supervising LSIs based in Malta (subject to the oversight of the ECB) 2 , while credit institutions classified as SIs are under the direct supervision of the ECB via the SSM through Joint Supervisory Teams (JST). Each JST is composed of supervisors from the ECB and the MFSA, headed by a Coordinator (JSTC), who is an ECB employee and assisted by sub-coordinators working within the MFSA Banking Supervision. The SREP aims to determine the way credit institutions deal with their risks and the specific factors they are exposed to, that could adversely affect their capital and liquidity positions. More broadly, the goal of SREP is to promote a resilient banking system via the assessment of risks each credit institution poses to the overall financial system. The MFSA conducts its supervision using a standardised methodology in line with the EBA Guidelines on SREP 3 and the SSM LSI SREP Methodology 4 , that focuses on the assessment of:

1. business model, profitability, and strategy;
2. adequacy of internal governance and risk management;
3. risks to capital on a risk specific basis, including credit risk, market risk, operational risk and Interest Rate Risk in the Banking Book (IRRBB);
4. adequacy of liquidity planning and funding stability. The assessment also includes the evaluation of the Internal Capital Adequacy Assessment Process (ICAAP), and Internal Liquidity Adequacy Assessment Process (ILAAP), as well as the performance of stresstests. This review is then combined into an overall SREP assessment, to arrive at the overall overall assessment of the viability and risk profile of the particular credit institution. The MFSA performs this review on an annual basis to determine whether banks are complying with relevant Maltese and European laws, the various guidelines and recommendations and the 2 However, the ECB still has full responsibility for certain common procedures, with respect to LSIs, such as granting and withdrawal of bank licences and the acquisition of qualifying holdings. These common procedures are carried out in cooperation with the MFSA. 3https://eba.europa.eu/sites/default/documents/files/documents/10180/2282666/fb883094-3a8a-49d9-a3db￾1d39884e2659/Guidelines%20on%20common%20procedures%20and%20methodologies%20for%20SREP%20and%20supervisory%20stress %20testing%20-%20Consolidated%20version.pdf 4 https://www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm.srep_methodology_booklet_lsi_2020.en.pdf

Page 6 of 16 On the basis of this examination, the MFSA issues individual SREP decisions determining capital and liquidity requirements and other supervisory measures to address the specific weaknesses and shortcomings of each credit institution (at consolidated level). Ad consists of the MFSA banking supervision strategic and operational planning for the upcoming supervisory cycle. Furthermore, the SREP exercise feeds into the determination of the minimum level of supervisory engagement for a specific institution which has a direct impact on the -site and on-site supervisory activities, which aim to provide an in-depth analysis of various risks, internal control systems, business models and governance, also taking into account risk culture aiming to detect weaknesses or vulnerabilities that could have an impact on adequacy of own funds and viability of the credit institution. The MFSA Banking Supervision function is also mindful of the money laundering (ML) and financing of terrorism (FT) risks that credit institutions can be exposed to, and whilst the Financial Intelligence Analysis Unit (FIAU) is the national agency responsible for the prevention of ML and FT, the Authority has a vested supervisory interest to prevent the use and involvement of credit institutions in such crimes. In its supervisory work, the MFSA Banking Supervision functionworks closely with the FIAU and the MFSA Financial Crime Compliance function in conducting AML/CFT supervision of credit institutions on a risk-based approach. All phases of AML/CFT supervision, from the sectoral risk assessments to decisions on breaches and the imposition of sanctions, are coordinated and integrated in a joint supervisory approach. The purpose of supervision is to: o build sufficient financial resilience to mitigate risks posed to users of financial services those who use their services, to financial stability or in the event of stress; o create an environment in which banks treat their customers in a fair and transparent manner so they can make appropriate financial decisions to support their working and personal lives; o monitor how the boards of banks are implementing appropriate control environments to reduce the capacity of their businesses to be used to support money laundering or the financing of terrorism. This is done in cooperation with the FIAU. The MFSA has a number of tools at its disposal to improve the approach of individual banks to these objectives: o The MFSA can require banks to report on certain matters or review their operational approach to the management of particular risks and present their findings together with proposed improvements to their processes;

Page 7 of 16 o The MFSA holds meetings with the members of the boards or executive management to monitor how they are discharging their responsibilities or to hold them to account for the adequate risk mitigation in areas for which they are responsible; o The MFSA interviews prospective board or executive management to assess whether banks are putting forward appropriately qualified and experienced people for senior roles. During interviews, the MFSA can assess prospective board or and support required for individuals taking up roles. The MFSA can refuse approval for those who are not deemed to have the required level of skills and experience for the roles they are proposed for; o The MFSA can oblige banks to undertake reviews using third parties where it believes additional support or independent input is required; o The MFSA can take enforcement action, where appropriate, to achieveits objectives. The collaboratively across the banking supervision, conduct, financial crime, and operational risk functions. During the course of 2021, the MFSA will enhance its internal mechanisms for co￾operation with a view to further improving co-ordination and risk prioritisation. International Cooperation The ECB directly regulates three banks in Malta and, through its country desk, monitors the The MFSA works hematic issues arising from the supervision of LSIs. The MFSA reports to the EBA, which is an independent EU Authority, which works to ensure effective and consistent prudential regulation and supervision across the European banking decision-making body, the Resolution Committee as well as in all six Standing Committees. 5 The MFSA also participates in various other working groups and task forces set up to tackle specific areas of banking regulation. To ensure the effective supervision of banks with an international presence from outside the EU, the MFSA has signed MoUs with and various foreign regulators. The MFSA cooperates with SM via the ECB. The Authority cooperates and exchanges information with all international regulators and 5 EBA Standing Committees: [i] Standing Committee on Anti-Money Laundering and Countering Terrorist Financing (AMLSC) jointly with the FIAU; [ii] SC on Accounting, Reporting and Auditing (SCARA); [iii] SC on Consumer Protection and Financial Innovation (SCConFin); [iv] SC on Oversight and Practices (SCOP); [v] SC on Payment Services (SCPS) jointly with the Central Bank of Malta; and [vi] SC on Regulation and Policy (SCRePol)

Page 8 of 16 authorities as part of the authorisation process, particularly with respect to due diligence and background checks. Future Significant Developments in the Regulatory Framework Several changes in the supervisory framework are expected during 2021. These will include:

1. Capital Requirements D V the main requirements are 6 : i. Leverage Ratio: a mandatory 3% ratio to on- and off-balance sheet exposures. Banks will be required to report their ratios; ii. Net Stable Funding Ratio (NSFR): a requirement to ensure stable funding of balance sheets in the medium term; iii. Large exposures: improvements required to the quality of capital used to mitigate risks posed by large loans on bank balance sheets; iv. Pillar 2 Capital: requirements that banks meet Pillar 2 requirements set by the ECB or the MFSA with Tier 1 and CET1 capital in line with CRDV thresholds. This measure is designed to align capital requirements to risks where a quantitative methodology is not set in CRDV. It will also put in place requirements to hold capital buffers against stress events to improve balance sheet resilience and support bank lending in an economic crisis; v. SME Supporting factor: a special arrangement to support lending to SMEs is introduced with an extension to the number of exposures benefiting from lower capital requirements; vi. Infrastructure Supporting factor: lower capital requirements for infrastructure projects to help support investment in EU infrastructure; vii. (Mixed) Financial Holding Companies: approval for such holding companies is now required; viii. Anti-Money Laundering: Enhancing cooperation and exchange of information between prudential supervisors, Financial Intelligence Units (FIUs) and other competent authorities; to strengthen the AML dimension in authorisation, fit and proper checks and SREP.
2. Banking Rule (BR) on Internal Governance: this will take into consideration EBA Guidelines on Internal Governance and will specify internal governance arrangements, processes, and mechanisms to ensure the effective and prudent management of credit institutions;
3. Revision of BR09 which implements EBA Guidelines on the management of non￾performing and forborne exposures; 6 The MFSA is currently transposing this into local legislation.

Page 9 of 16 4. capitalised for the risks in their business models; 5. The development of a local covered bonds framework that will enable banks to issue covered bonds locally to support their funding strategies; 6. Amendments to local legislation transposing PSD2 as part of the Retail Payments payments industry. Alongside these legislative and rules-based changes, the Authority is also developing its supervisory approach. the MFSA intends to enhance its outreach and communications with regulated banks through roundtable discussions and briefings, presentations to bank boards and enhanced individual and collective engagement to support non-executive directors so they can fulfil their responsibilities for oversight of business strategies and establishing appropriate control environments for their firms. Conduct Supervision Complementing its prudential supervision, the MFSA also carries out conduct supervision of its licensed institutions. A variety of supervisory tools are used including focused on-site inspections, mystery shopping exercises, thematic reviews and very recently, virtual/remote on￾site inspections. ternal governance arrangements to ensure that these are in line with relevant legislation, guidelines, and best practices. Close attention is paid to the design and implementation of controls targeted at addressing conduct risks across the three lines of defence. To effectively understand how institutions are managing conduct risks, the MFSA reviews the whole consumer journey, from the product design stage through to the sales process and post￾sales handling. Product Oversight and Governance assessments are carried out to ensure that products are developed and brought to the market in a way that focuses on the needs and interests of consumers, thus minimising mis-selling and contributing to increased market confidence. The Authority pays due regard to the fair treatment of consumers ensuring that their information needs are being respected by institutions and that such information is being provided in a clear, fair way and in good time. The same principle is also extended to financial promotions carried out by licensed institutions. Consumer protection is at the heart of conduct supervision and the MFSA carries out inspections to ensure that institutions develop internally and follow policies and procedures that are in line with the applicable regulatory frameworks. Additional desk-based supervisory activity is exercised to identify and address potential/actual harm by, for instance, reviewing consumer complaints, social media posts, press articles and third-party information and reviewing disclosure documentation.

Page 10 of 16 The MFSA is also actively involved in raising consumer awareness by carrying out financial education initiatives on a regular basis on various topics to address the different information needs of financial consumers. COVID-19 Measures Over the past months, the Authority has taken measures in relation to COVID-19 to safeguard , the MFSA has issued various notices to licensed institutions to ensure that business contingency measures have kicked in to ensure continuity of services. Credit institutions were forced to close a number of branches and consumers were encouraged to bank digitally. In this scenario the MFSA made it a priority to ensure the protection of the vulnerable groups in the society. This was exercised, for instance, by confirming that an adequate number of branches remained open for the public, management of queues in line with social distancing guidelines and providing useful tips to online banking users on cybersecurity threats, fraudulent schemes and financial scams. In terms of supervision, the MFSA adapted to a new way of conducting visits to licence holders by holding virtual on-site inspections and increasing desk-based reviews.

Page 11 of 16 Supervisory Engagement, Findings, Risks and Recommendations During 2020, the function has conducted a number of on-site visits and held meetings with board members and management of credit institutions. This section provides general feedback to the industry on findings, prevailing risks and puts forward recommendations that boards should use to inform their work plans. Business Models and Stress Testing Banks face profitability challenges from legacy non-performing loans, conducting business in a low or negative interest rate environment, competing in an environment where there are potential over-capacities and rising costs associated with implementing revised regulatory frameworks. They will face an additional challenge of managing the balance sheet impact of COVID-19 on their asset portfolios. on-site reviews have drawn two conclusions that boards of banks in Malta should consider when developing their business plans for 2021:

1. Boards should ensure their business planning includes sufficient resources for adequate oversight of their business models. The MFSA has, however, observed instances where banks have sought to mitigate the cost pressures by merging responsibilities of risk, compliance, MLROs and other staff responsible for legal compliance. Where this is the case, the MFSA observes that it results in a significant gap in the understanding of board members of the risk profile of their bank. It has also led to situations where boards have not ensured policies are reviewed in line with regulatory expectations, backlogs in customer due diligence reviews are resolved, or their ICAAPs cover the required risk analysis.
2. Some boards need to improve their understanding of the resilience of their business model in a stress scenario. Good business planning requires an assessment of risks in different scenarios integrated into business planning. The MFSA believes banks in Malta need to improve the quality of their financial resilience planning. Internal Governance rnal organisation of a credit institution and the way it conducts and manages its business and controls the risks it is exposed to. The internal governance framework should include the definition of the roles and responsibilities of the relevant persons, functions, and committees and how they cooperate.

Page 12 of 16 In this respect boards must ensure the effectiveness of the internal control framework, including risk management, compliance, and internal audit functions. The three lines of defence form one of the main pillars for good governance. Each function must complement the other and it is of paramount importance that these functions are provided with the appropriate number of staff, expertise and support from senior management and the board. The Authority came across instances where this model was not attaining its purpose which is aimed at serving as a basis to structure roles and responsibilities when it comes to decision-making, effective risk management and control. This was mainly the result of two main issues: primarily, the lack of vision and ongoing support from the board and executive management in terms of direction and resources; and secondly, some banks are trying to mitigate cost pressures by merging the responsibilities of the first and second line or by not undertaking sufficient coverage of their audit universe on an annual basis by their third line. The Authority also came across instances whereby institutions did not have documented policies and procedures in place, and, at times, the documented policies were missing ownership and version control. Record keeping failures are also widely noticed especially when it comes to important decision-taking and minuting outcomes of different committee meetings. As a result of these observations, boards need to do more to ensure they maintain effective control environments by ensuring sufficient resources are devoted to risk management, compliance and audit, and by reducing the turnover in key posts. The MFSA understands this can be a challenge in a competitive labour market, but the quality and responsiveness of the control environment can be undermined by a lack of resources or significant levels of change in the leadership of key control functions. Board Chairs need to keep the skills mix of the board under review to ensure effective The MFSA has noted instances where a more active approach to board composition is required and will examine the approach the Board Chair is taking to this during the SREPs of 2020 and 2021. The MFSA also believes that boards need to improve the challenge they provide to business plans presented by management. In some cases, these plans are overly optimistic and are not supported by past records of delivery. Boards should ensure they present the regulator with tested and realistic planning assumptions and plans to ensure appropriate development Risk and Compliance functions. eworks, the MFSA focuses on the adequacy and appropriateness of internal governance, risk management and controls frameworks that credit institutions have in place. This includes an assessment of how credit institutions monitor their risk exposures, identify mitigating measures that need to be taken and assess the adequacy of their internal policies and limits frameworks.

Page 13 of 16 Quality of Workforce Some employees lack the expertise and knowledge required to enable them to carry out their roles in an effective and efficient manner. Institutions are, at times, not investing sufficient resources to address the training requirements of their employees. Shortcomings in training programmes can lead to regulatory failures even where the controls environment is strong, by for example, creating the risk that staff may provide misinformation to customers. Credit Risk The board of directors it should not have direct day-to-day responsibility for credit risk management, it is, however, expected to set the tone for senior management and the lending team by establishing clear credit standards, as well as by applying sound risk governance oversight to the lending process. The MFSA has examined Credit Risk as part of its inspections which identified a mixed outcome when it comes to findings, specifically these reviews exposed instances where:

1. The board of directors lacked the information required to challenge and oversee the evolution of credit risk. It is important that boards ensure they have sufficient reporting to mitigate the risks that will be posed by economic circumstances in late 2020 and
3. As part of its reviews, the Authority noted inadequate monitoring processes, with inappropriate early warning systems and missing key indicators.
4. Weaknesses were also identified in the collateral management process. There were instances of valuations that did not exhibit the methodology applied, whilst outdated valuations were also relatively common. This situation would, in turn, have a direct impact on the quality of regulatory reporting and adequacy of provisioning. AML and CFT Risk Oversight Firms are expected to establish proportionate and efficient financial crime controls, thus ensuring compliance and safe operation. Whilst the MFSA has noted the efforts put in place to ensure that systems and controls are appropriate, some areas which board risk committees, MLROs and compliance officers need to consider were also observed, as follows:
5. Deficiencies in the quality of oversight by the board of directors have led to a disconnect

Page 14 of 16 of controls within the firm. Boards of directors need to give careful consideration as to how they assess the effectiveness of their controls on an ongoing basis. 2. The MFSA believes that boards of directors need to ensure their MLROs are adequately trained and involved in the AML/CFT risk management of firms in which they work. It was observed in some cases that MLROs lacked strategic knowledge and were thus not able to properly articulate emerging AML or CFT risks. In many cases, the MLRO did not have the necessary stature within the organisation to influence or deliver effective mitigation for risks. Board risk committees should examine whether their organisational structures and cultures properly support the mitigation of AML and CFT risks. 3. The MFSA also identified that boards of directors need to do more to ensure those at the business end understand their AML/CFT obligations. Instances of a low number or insufficient quality of STRs being generated from the business lines were also noted. The Authority will review the extent to which firms are delivering AML/CFT training to mitigate this weakness as part of SREPs in 2020 and 2021. 4. The MFSA also observed that some institutions are still carrying out certain elements of their AML/CFT process using manual procedures. The MFSA encourages firms to invest in their IT systems to ensure comprehensiveness and limit subjectivity in reporting. The MFSA implementation of the international standards of transparency and exchange of information As a follow-up on the transposition of the 5th AML Directive, obliging credit institutions to confirm that they are obtaining proof that Beneficial Ownership information of clients has been registered with the beneficial ownership register in their home country, the MFSA is currently undertaking a review of bank account relevant controls in this area. The MFSA will follow this with on-site file reviews in 2021 to seek evidence that controls are working as intended.

Page 15 of 16 The MFSA 2021 Banking Supervisory Focus To ensure that banks address these key challenges effectively, the MFSA has identified areas of focus for 2021 and these will be used for the annual Supervisory Review of banks to deliver improvements in their risk management. In this respect, the Authority will be placing particular emphasis on:

1. the quality of strategic planning, volumes, costs, and revenues;
2. stress testing capabilities as part of the ICAAP and capital planning,
3. the impact of the COVID-19 pandemic on credit risk profiles of credit institutions,
4. from the conduct perspective, the extent of support given to consumers who were particularly affected by COVID-19;
5. continued focus on adequacy of internal governance, compliance, and risk management functions;
6. a review of funding composition and stability with a particular focus on non-domestic growth strategies.
7. AML/CFT controls, including specific measures to control correspondent banking relationships.
8. examination of measures taken and controls in place to mitigate the IT and cyber security risks.

Page 16 of 16 Concluding Remarks The MFSA expects boards of banks in Malta to benchmark themselves against the findings set out in this publication and to take remedial action where appropriate. This should accompany any specific actions set out in supervisory feedback to individual banks. The Authority will engage with, and assess, the approach taken by boards as part of its supervisory assessments in 2021.

Page 17 of 16 Malta Financial Services Authority Triq L-Imdina, Zone 1 Central Business District, Birkirkara, CBD 1010, Malta communications@mfsa.mt www.mfsa.mt