Year 2000 Compliance and Directives on the Management of Related Risks

# BANK OF NAMIBIA

## CIRCULAR - BIA 1/99

**TO:** ALL BANKING INSTITUTIONS
**DATE:** 10 JUNE 1999

### "YEAR 2000" COMPLIANCE AND DIRECTIVES ON THE MANAGEMENT OF RELATED RISKS

---

### 1. Background

To date, this Office has issued two Circulars relating to Year 2000 ("Y2K") compliance, namely, Circulars 2/98 dated 3 April 1998 and 11/98 dated 21 October 1998. These circulars were aimed at raising awareness of the Y2K problem, giving guidance on remedial actions to be implemented and prescribing reports to be submitted by banking institutions on progress made towards Y2K compliance of their mission-critical systems.

---

### 2. Responsibility for mitigation

This Office wishes to stress that it is the responsibility of each individual banking institution to take timely steps in order to mitigate the risks associated with the Y2K computer problem in respect of its own computer systems and data.

In particular, the following should be noted:

#### 2.1
The circulars issued by this Office, including this circular, do not purport to provide an exhaustive checklist of all reasonable steps that could be taken in order to achieve such risk mitigation. The circulars also do not purport to guarantee a successful elimination of all risks associated with the Y2K computer problem if the guidelines implicit in these circulars are followed.

#### 2.2
Neither this Office nor the Bank of Namibia ("the BON") is empowered to assume any liability in respect of the consequences of any Y2K-related failure of any computer-based solution employed by any banking or other institution. Furthermore, neither this Office nor the BON purports to assume, by virtue of the guidance provided in this or any other circular, any such liability.

---

### 3. Liquidity risk

This Office wishes to highlight the additional liquidity risk emanating from any real or perceived concerns of depositors, and wishes to urge banks to take this into account for the period spanning the Y2K date change in their projections of liquidity needs. This Office believes that the measures taken to ensure sufficient liquidity should be based on a formal assessment of the likely volatility of the different classes of deposits held.

---

### 4. Credit risk

As stated in point 5 of Circular 11/98 dated 21 October 1998, each banking institution should have a programme in place for the review of its loans and advances in order to establish whether a borrower’s current level of Y2K preparedness increases the risk of non-payment in respect of a loan or advance to that borrower, with a view to enabling the banking institution to take the necessary measures to manage these risks.

In this regard, each banking institution is required to:

- Evaluate the potential impact of Y2K on its major borrowers’ business and creditworthiness.
- Engage in discussion with borrowers in order to assess the credit risk. This assessment should be beyond mere information technology compliance in order to establish whether borrowers have considered other risks, such as:
    (i) Vulnerability of the borrower’s key suppliers and clients and the effect on the borrower should any of these fail.
    (ii) Whether legal and contingent liability to clients have been identified, and
    (iii) Contingency planning.
- Classify and rank borrowers in terms of Namibia Dollar value relative to the impact on the banking institution in the event of default resulting from non-compliance with Y2K. (For purposes of establishing Namibia Dollar value, only the uncollateralised portion of the loan should be considered, unless the collateral itself is in jeopardy because of foreseeable Y2K problems).
- Price a particular loan or advance at an appropriate level in accordance with the risk assessment as per the above three points.
- Increase its provisions for doubtful debts as required in accordance with the risk assessment.

---

### 5. Disclosure

As emphasised in all previous Y2K compliance circulars issued by this Office, it is of the utmost importance that banking institutions implement measures to counter any potentially negative perceptions, in order to minimise the risk of the business sector and the public in general losing confidence in the banking sector’s ability to be Y2K compliant. Such negative perceptions may in themselves be sufficient to introduce systemic risk to the industry.

Each banking institution must have a programme in place to inform its shareholders, clients, business partners, suppliers and the general public of its Y2K preparedness. Such a programme of disclosure should be implemented as early as possible in 1999, but by no later than June 1999. There should be ongoing publicity of the preparedness of each banking institution during 1999.

The disclosure should include the following for each individual banking institution:

- The particular banking institution’s plan of action (including its plans for testing), steps taken and to be taken and expenditure incurred and to be incurred, in order to ensure that the banking institution is prepared for the information technology-related problems expected to occur on or after 1 January 2000 and other problem dates.
- Any material operational difficulties that may be experienced or expected as a result of the problems associated with the advent of the year 2000, as well as details of the likely impact of these difficulties on the particular banking institution’s performance should all or part of the banking institution’s systems not be year 2000 compliant.
- The particular banking institution’s internal and external testing (end-to-end) programmes.
- Contingency plans in order to ensure the particular banking institution’s continued operation until, on and after 1 January 2000.
- The dependencies and risks posed to the particular banking institution by sectors and organisations outside of its control.
- The likelihood of the particular banking institution facing liability claims directly or indirectly arising from a failure to address or overcome the problems associated with the advent of the year 2000.
- The state of Y2K compliance of the particular banking institution’s agents/branches and subsidiaries (including transfer secretaries) and the banking institution’s plan of action if its agents/branches and subsidiaries are not or will not be Y2K compliant.
- The extent to which credit facilities have been reviewed, and the measures that have been taken in order to reduce credit risk.
- The target date by which the particular banking institution will be Y2K compliant (inclusive of external testing).

It is suggested that banks make use of comments on customer statements and other documents to inform their customers that their Mission Critical Systems are compliant and Y2K ready.

Each banking institution must submit a written report, signed by the Chairman of the Board, to this Office by 30 June 1999, setting out details of its programme to inform its shareholders, clients, business partners/suppliers and the general public of the institution’s Y2K preparedness.

---

### 6. Testing

As emphasised in Banks Act Circular 11/98, thorough Y2K testing is critical to readiness. By all accounts, banking institutions have substantially completed their internal testing and are now engaged in external testing. This phase of testing is generally scheduled to be completed by the end of June 1999. You are reminded to submit your report to Bank of Namibia in terms of paragraph 6 of Circular 11/98 not later than 16 July 1999.

This Office wishes to emphasise that given the diminishing time and resources available, each banking institution has to consider what range of testing is achievable in the time remaining and has to focus on testing that is likely to deliver the greatest returns. Based on the experience of many firms, the hierarchy of testing in terms of pay-off is:

#### 6.1 Internal testing.
#### 6.2 Testing with key counterparties and utilities (for example, large clients, exchanges, clearing houses, and payment systems).
#### 6.3 Industry-wide testing.

Banking institutions should therefore balance the costs and likely gains of various tests. Appropriate emphasis should be placed on internal testing (which is effective in identifying problems and is also flexible) and bilateral external testing with financial market infrastructure providers (which is essential for building confidence in mission-critical systems).

---

### 7. Contingency planning

In addition to the continuation of efforts in the areas of remediation, testing and information sharing, it is believed that the focus in the second half of 1999 would have to be on contingency-planning efforts. The reason for this is that the remediation and testing processes currently under way involve risks and uncertainties, whereas the smooth functioning of the financial markets is critical to the economy. The success of addressing the Y2K problem will be measured by the ability of the system, and the public’s confidence therein, to continue to conduct business operations effectively on the first business days of 2000, and thereafter. Contingency planning is critical in order to overcome any disruption that may emerge and to continue business operations. Therefore, contingency planning should be recognised as a legitimate exercise, and not as an admission of expected failure in the core effort of preparing for the year 2000.

There are two types of contingency measure. The first addresses the contingency measures to be put in place for those systems that will not be Y2K compliant by 1 January 2000. The second type addresses the contingency and business-resumption measures that need to be put in place in order to overcome operational problems experienced with “Y2K compliant” systems on or after 1 January 2000.

It is therefore imperative that banking institutions develop comprehensive contingency plans in order to ensure the continuous functioning of the banking sector under all possible circumstances.

In this regard, guidance and discussion papers can be found at the following Web sites:

FFIEC: Guidance concerning contingency planning in connection with year 2000 readiness, May 1998, and Q & As concerning year 2000 contingency planning, December 1998) (www.ffiec.gov).

Federal Reserve System: Proceedings from FRS Contingency Planning, Conference, December 1998) (www.federalreserve.org).

Global 2000 Co-ordinating Group: Year 2000 business risk management, June 1998, and Current challenges and suggested approaches, September 1998 (www.global2k.com).

Joint Year 2000 Council: Year 2000 business continuity, planning for financial institutions (www.bis.org).

8. Acknowledgement of receipt

Two additional copies of this circular are enclosed for the use of your institution’s independent auditors. The attached acknowledgement of receipt, duly completed and signed by both the chief executive officer of the institution and the said auditors, should be returned to this Office at the earliest convenience of the aforementioned signatories.

ROGER LAWRENCE
SENIOR MANAGER
BANK SUPERVISION DEPARTMENT