Basel Committee on Banking Supervision

The Core Principles for effective banking supervision (Core Principles) are the de facto minimum standard for sound prudential regulation and supervision of banks and banking systems. The Core Principles are considered universally applicable and should be applied by national authorities in the supervision of banks within their jurisdictions.

The Committee issues the Core Principles as its contribution to strengthening the global financial system. Weaknesses in the banking system of a country, whether developing or developed, can threaten financial stability both within that country and internationally. The Committee believes that implementation of the Core Principles by all countries would be a significant step towards improving financial stability domestically and internationally and that it would provide a good basis for further development of effective supervisory systems. The vast majority of countries have endorsed the Core Principles and have committed to fully implement them.

The Core Principles are used by countries as a benchmark to assess the effectiveness of their supervisory systems, to identify future work to achieve a baseline level of sound supervisory practices and to upgrade supervisory systems and practices (as appropriate) in line with the evolution of their respective banking systems. They are also used by the International Monetary Fund (IMF) and the World Bank in the context of the Financial Sector Assessment Program (FSAP) to assess the effectiveness of countries' banking supervisory systems and practices.

Each iteration of the Core Principles builds upon the preceding versions and seeks to achieve the right balance in raising the bar for sound supervision while retaining the Core Principles as a flexible, globally applicable standard. To ensure the universal applicability of the Core Principles, reviews are conducted by a group composed of both Committee and non-Committee member countries and regional groups of banking supervisors, as well as the IMF and World Bank. The Committee also consults with industry and the public before finalising revisions to the standard.

Given the importance of consistent and effective standards implementation, the Committee is ready to encourage work at the national level to implement the Core Principles in conjunction with other supervisory bodies and interested parties. The Committee invites international financial institutions and donor agencies to use the Core Principles to assist individual countries to strengthen their supervisory arrangements. The Committee also remains committed to further enhancing its interaction with supervisors from non-member countries.

The Core Principles are conceived as a framework of minimum standards for sound supervisory practices. The Core Principles provide a comprehensive standard for establishing a sound foundation for the regulation, supervision, governance and risk management of the banking sector. They set out the powers that supervisors should have to address safety and soundness concerns, promote a forward-looking and risk-based approach to supervision, and encourage early intervention and timely supervisory actions to mitigate threats to the safety and soundness of banks and the banking system.¹

The Core Principles are considered universally applicable, irrespective of the complexity of banks and banking systems, and should be applied by national authorities in the supervision of banking organisations within their jurisdictions.² A high degree of compliance with the Core Principles should foster overall financial system stability; however, banking supervision cannot, and should not, provide an assurance that banks will not fail.

The Core Principles standard is structured as follows:

1. The remainder of this section explains how to read this document considering the broad objectives of the Core Principles;
2. The "Explanation of certain terms used in the Core Principles" lists common terms and clarifies how these should be interpreted within the context of this standard;
3. The "Assessment methodology" describes how the standard should be used by jurisdictions to gauge their level of adherence to the Core Principles and within the context of the FSAP;
4. The "Preconditions for effective banking supervision" sets out a number of external elements on which effective banking supervision is dependent, but which may not be within the direct jurisdiction of supervisors;
5. "The Core Principles and assessment criteria" sets out the 29 principles and their accompanying essential and additional criteria;
6. The "Update on Committee standards, guidelines and sound practices" lists the new and revised standards, guidelines and sound practices that have been published by the Committee since the last substantive review of the Core Principles; and
7. The "Structure and guidance for assessment reports prepared by the International Monetary Fund and the World Bank" provides practical guidance to jurisdictions and assessors for the purpose of the IMF and World Bank FSAPs.

The banking sector is only one, albeit important, part of a financial system. The Committee has sought to maintain consistency, where possible, between these Core Principles and, for example, the corresponding standards for securities and insurance, as well as the standards for anti-money laundering (AML) and combatting the financing of terrorism (CFT) and transparency. Differences will inevitably remain, however, as key risk areas and supervisory priorities differ from sector to sector.

At a minimum, the Committee expects its members to fully implement the Basel Framework for their internationally active banks. The Core Principles are also a Basel standard, but they are applicable to all banks in all jurisdictions.

Each Core Principle applies to the supervision of all banks and banking groups. The intensity of supervision will need to be commensurate with the risk profile and systemic importance of banks.

In supervising an individual bank which is part of a corporate group, it is essential that supervisors consider the bank and its risk profile from a number of perspectives: on a solo basis (but with both a micro and macro focus); on a consolidated basis (in the sense of supervising the bank as a unit together with the other entities within the "banking group") and on a group-wide basis (taking into account the potential risks to the bank posed by other group entities outside of the banking group). Group entities (whether inside or outside the banking group) may be a source of strength but they may also be a source of weakness capable of adversely affecting the financial condition, reputation and overall safety and soundness of the bank. Supervisors should carefully consider the risks posed to a bank where it is part of a group or financial conglomerate with a mix of regulated and unregulated entities across different sectors. In the discharge of their functions, supervisors must observe a broad canvas of risk, whether arising from an individual bank, from its associated entities (regulated or not) or from the prevailing macro-financial environment.

Banks will from time to time run into difficulties, so effective crisis preparation and management and orderly resolution frameworks and measures are required to minimise the adverse impact on the broader banking and financial sectors. These include measures to be adopted by banks, such as recovery plans, and those to be adopted by supervisory, resolution and other authorities to coordinate the orderly restructuring or resolution of a troubled bank. Compliance with the Core Principles does not require the supervisory authority to also be the resolution authority.

The concept of proportionality ensures that applicable rules and supervision practices are consistent with banks' systemic importance and risk profiles, as well as appropriate for the broader characteristics of a particular financial system. The objective of proportionality is not to dilute the robustness of standards but to reflect jurisdictions' circumstances and supervisory capacity.³

The Core Principles recognise that the appropriate intensity of supervision for banks varies, with more time and resources devoted to larger, more complex or riskier banks. Supervisors should assess the risk profile of banks in terms of the risks they run, the efficacy of their governance and risk management, and the risks they pose to banking and financial systems. This process focuses supervisory resources where they can be utilised optimally, concentrating on outcomes and moving beyond passive assessment of compliance with rules.

To fulfil their purpose, the Core Principles must be capable of application to a wide range of jurisdictions, whose banking sectors may include a broad spectrum of banks (from large internationally active banks to small, non-complex deposit-taking institutions). To accommodate this breadth of application, a proportionate approach is adopted, both in terms of expectations of supervisors in the discharge of their own functions and in terms of the requirements that supervisors impose on banks. The concept of proportionality underpins the assessment and implementation of the Core Principles, even if it is not always directly referenced.

While all banks must observe minimum capital and liquidity standards, and establish effective governance and risk management frameworks and practices, the principle of proportionality allows supervisors to better match the level of regulatory and supervisory requirements to different banks and banking systems. In the context of the Core Principles, this is reflected in the expectation that requirements imposed by supervisors on banks will be commensurate with the risk profile and systemic importance (including, but not limited to, size and complexity) of banks.

The Core Principles allow for different approaches to supervision, as long as the overriding goals are achieved. Specific country circumstances and the context in which supervisory practices are applied should be considered during implementation and assessments, and in the dialogue between assessors and country authorities.

The revised Core Principles reflect regulatory and supervisory developments, structural changes in banking, and lessons learnt in FSAP assessments since the last revision in 2012. The current review has been informed by several thematic topics: (i) financial risks; (ii) operational resilience; (iii) systemic risk and macroprudential supervision; (iv) new risks, such as climate-related financial risks and the digitalisation of finance; (v) non-bank financial intermediation; and (vi) risk management practices.

The post-Great Financial Crisis (GFC) period has seen banks continue to build their resilience to financial risks, underpinned by stronger regulatory and supervisory frameworks, including the Basel III standards. The Core Principles have been strengthened to reflect key elements of many of the post-GFC reforms introduced by the Committee. In particular, the importance of a non-risk-based measure to complement risk-based approaches in constraining leverage in banks and the banking system (eg a leverage ratio); enhancements to credit risk management practices; the introduction of expected credit loss approaches to provisioning; and more stringent requirements for managing large exposures and related party transactions. More recent crises, such as the Covid-19 pandemic and episodes of bank distress, have reinforced the importance of bank and banking system resilience to a range of different shocks, as well as the need for effective supervision.

Beyond financial risks, significant efforts have been directed at strengthening operational resilience to ensure that banks are better able to withstand, adapt to and recover from severe operational risk-related events, such as pandemics, cyber incidents, technology failures and natural disasters. The Core Principles enhance the focus on governance, operational risk management, business continuity planning and testing, the mapping of interconnections and interdependencies, third-party dependency management, incident management, and resilient cyber security and information and communication technology (ICT).

The last 10 years have reaffirmed the importance of applying a system-wide macro perspective to the supervision of banks to assist in identifying and analysing systemic risks and taking pre-emptive action to address them. Adopting a broad financial system perspective is integral to many of the Core Principles, and so the Committee has not included a specific standalone principle on macroprudential issues but has sought to strengthen the existing requirements based on lessons learnt. This includes the value of capital buffers that can be increased or released as risks build and crystallise or dissipate (eg a countercyclical capital buffer).

Climate change may result in physical and transition risks that could affect the safety and soundness of individual banks and have broader implications for the banking system and financial stability. Targeted changes have been introduced to explicitly reference climate-related financial risks and to promote a principles-based approach to improving supervisory practices and banks' risk management. Banks should understand how climate-related risk drivers may manifest through financial risks, recognise that these risks could materialise over varying time horizons (which may go beyond their traditional capital planning horizon), and implement appropriate measures to mitigate these risks. Supervisors are also expected to consider climate-related financial risks in their supervision of banks, to assess banks' risk management processes, and to require banks to submit information that makes it possible to assess the materiality of climate-related financial risks. Both bank and supervisory practices may consider climate-related financial risks in a flexible manner, given the degree of heterogeneity and evolving practices in this area.

Technology-driven innovation and the digitalisation of finance are changing both customer behaviours and the way that banking services are provided. New products, new entrants and the use of new technologies present both opportunities and risks for supervisors, banks and the banking system. Digitalisation may amplify traditional risks (eg liquidity, operational and strategic risks), while digital communication channels can more rapidly propagate banking stress. Banks are also increasingly relying on third parties for the provision of technology services, which creates additional points of cyber risk as well as potential system-wide concentrations and further highlights the importance of operational resilience. For supervision to remain effective, supervisors need to ensure that they can continue to access relevant information (irrespective of where records are located) and review the overall activities of the banking group, including those undertaken by third parties that are supporting critical operations of banks.

Financial intermediation has evolved significantly since the last revision of the Core Principles, prompted by rapid advances in financial technology and the proliferation of non-bank financial intermediation. Non-bank financial institutions supplement banks in providing financial services, but their activities can also affect the stability of the financial system and increase the potential for contagion risks through their interconnections with banks. While the Core Principles are designed to apply to those institutions designated as banks, supervisors should remain alert to the risks arising from non-bank financial institution activities and their potential impact on the banking system. The revised Core Principles reinforce the group-wide approach to supervision and strengthen requirements for supervisors to monitor risks to banks from the range of different non-bank financial institutions and for banks to manage their counterparty risks.

Reflecting evolving risks and broader medium- and long-term trends, it is critical that banks institute a sound risk culture, maintain strong risk management practices and adopt and implement sustainable business models. The concept of bank business model sustainability reflects the expectation that banks design and implement sound and forward-looking strategies that generate sustainable returns over time. Both bank risk management and supervisory approaches have been strengthened in this respect. While responsibility for designing and implementing sustainable business strategies lies with a bank's board, supervisors have an important role to play, as assessing the robustness of banks' risk culture and business models is a key component of effective supervision.

This section provides an explanation of certain key terms that are used throughout the Core Principles. These explanations should be read only in the context of this document, and they do not apply across, or modify any aspect of, the Basel Framework.

1. Applicable Basel standards: the references to "applicable Basel standards" in specific principles refer to the most recent Committee standard or guideline that is effective in relation to that principle.
2. Bank: when the Core Principles use the term "bank" this should be read as "bank and banking group", except where "bank" is explicitly referred to on a solo basis.
3. Banking group: includes the holding company, the bank and its offices, subsidiaries, affiliates and joint ventures, both domestic and foreign. Risks from other entities in the wider group, for example non-bank (including non-financial) entities, may also be relevant. This group-wide approach to supervision goes beyond accounting consolidation. The scope of consolidation used as the basis for all other Basel requirements is set out in the SCO standard.
4. Basel Framework: refers to those Committee standards that are applicable to internationally active banks and are consolidated in the Basel Framework.
5. Beneficial owner(s)/beneficial ownership: refers to the natural person(s) who ultimately owns or controls a customer and/or natural person on whose behalf a transaction is being conducted. It also includes those persons who exercise ultimate effective control over a legal person or arrangement.
6. Board and senior management: refer to the oversight function and the management function in general and should be interpreted throughout this standard in accordance with the applicable law within each jurisdiction. There are significant differences in the legislative and regulatory frameworks across countries regarding these functions. Some countries use a two-tier board structure, in which the supervisory function of the board is performed by a separate entity known as a supervisory board, which has no executive functions. Other countries, in contrast, use a one-tier board structure, in which the board has a broader role. Owing to these differences, this standard does not advocate a specific board structure.
7. Business model sustainability: when conducting business model analysis, the supervisor assesses the soundness of a bank's forward-looking strategies to generate sustainable returns over time, and its capacity to execute its business plan and strategy, considering potential changes in banks' operating environment.
8. Climate-related financial risk: refers to the potential risks that may arise from climate change or from efforts to mitigate climate change, their related impacts and their economic and financial consequences. Climate-related physical and transition risk drivers can translate into traditional financial risk categories such as credit, market, operational, liquidity, strategic and reputational risks. Climate-related financial risks can materialise over different time horizons, which may go beyond a bank's traditional capital planning horizon.
9. Compliance function: does not necessarily denote an organisational unit. Compliance staff may reside in operating business units or local subsidiaries and report up to operating business line management or local management, provided such staff also have a reporting line through to the head of compliance, who should be independent from business lines.
10. Counterparty credit risk: transactions that give rise to counterparty credit risk include: over-the-counter (OTC) derivatives, exchange-traded derivatives, long settlement transactions and securities financing transactions that are bilaterally or centrally cleared. Counterparty credit risk may result from (but is not limited to) transactions with banks, non-financial corporates and non-bank financial institutions (see also Principle 17 BCP40.39).
11. Country risk: is the risk of exposure to loss caused by events in a foreign country. The concept is broader than sovereign risk as all forms of lending or investment activity involving individuals, corporates, banks or governments are covered (see also Principle 21 BCP40.48).
12. Credit risk: may result from on-balance sheet and off-balance sheet exposures, including loans and advances; investments; interbank lending; derivative transactions; securities financing transactions; and trading activities (see also Principle 17 BCP40.39).
13. External experts: may include external auditors or other qualified external parties commissioned with an appropriate mandate, and subject to appropriate confidentiality restrictions.
14. Internal audit: does not necessarily denote an organisational unit. Some countries allow smaller banks to implement a system of independent reviews (eg conducted by external experts) of key internal controls as an alternative.
15. Macroeconomic environment: should be interpreted broadly and can include the phase of the business or credit cycle, conditions in financial markets and geopolitical developments.
16. Off-site work: is a tool to regularly review and analyse the financial condition of banks, follow up on matters requiring further attention, identify and evaluate developing risks and help identify the priorities, scope of further off-site and on-site work etc.
17. On-site work: is a tool to obtain independent verification that adequate policies, procedures and controls exist at banks, to determine that information reported by banks is reliable, to obtain additional information on the bank and its related companies that is needed for the assessment of the condition of the bank, to monitor the bank's follow-up on supervisory concerns etc.
18. Operational risk: is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. The definition includes legal risk but excludes strategic and reputational risk (see also Principle 25 BCP40.56).
19. Related parties: should include:
    1. the bank's subsidiaries and affiliates (including their subsidiaries, affiliates and special purpose entities) and any other party that the bank exerts control over or that exerts control over the bank;
    2. the bank's major shareholders, including beneficial owners;
    3. the bank's board members, senior management and key staff, and corresponding persons in affiliated companies, and parties that can exert significant influence on board members or senior management; and
    4. for the natural persons identified in (a) to (c), their direct and related interests, and their close family members (see also Principle 20 BCP40.46).
20. Related party transactions: include on-balance sheet and off-balance sheet credit exposures; dealings such as service contracts, asset purchases and sales; construction contracts; lease agreements; derivative transactions; borrowings; and write-offs. The term "transaction" should be interpreted broadly to incorporate not only transactions that are entered into with related parties but also situations in which an unrelated party (with whom a bank has an existing exposure) subsequently becomes a related party (see also Principle 20 BCP40.46).
21. Risk appetite: means the aggregate level and types of risk a bank is willing to assume, decided in advance and within its risk capacity (that is, the maximum amount of risk a bank is able to assume given its capital base, risk management and control capabilities as well as its regulatory constraints), to achieve its strategic objectives and business plan.
22. Risk culture: refers to a bank's norms, attitudes and behaviours related to risk awareness, risk-taking and risk management, and controls that shape decisions on risks. Risk culture influences the decisions of management and employees during their day-to-day activities and has an impact on the risks they assume.
23. Risk profile: refers to the nature and scale of the risk exposures assumed by a bank.
24. Service providers: include third parties, intragroup entities (ie entities within a group such as parent, subsidiary or affiliate companies)⁴ and (if applicable) other parties further along the supply chain.
25. Stress testing: comprises a range of activities from simple sensitivity analysis to more complex scenario analyses and reverse stress testing.
26. Supervisor: refers to each of the authorities involved in banking supervision (see Principle 1, essential criterion 1 BCP40.5(1)). Such authority is called "the supervisor" throughout this standard, except where the longer form "the banking supervisor" is necessary for clarification. Unless stated otherwise, the "supervisor" refers to the home country supervisor.
27. Systemic importance: is determined by the size, interconnectedness, substitutability, global or cross-jurisdictional activity (if any), and complexity of the bank, as set out in SCO40, SCO50 and RBC40.
28. Transfer risk: is the risk that a borrower will not be able to convert local currency into a foreign currency and so will be unable to make debt service payments in a foreign currency. The risk normally arises from exchange restrictions imposed by the government in the borrower's country (see also Principle 21 BCP40.48).

The Core Principles are intended mainly to help countries assess the quality of their systems and to provide input into their reform agenda. Assessing a country's compliance with the Core Principles is a useful tool for promoting the implementation of an effective system of banking supervision. To promote objectivity and comparability of compliance with the Core Principles in the different country assessments,⁵ supervisors and assessors should refer to this assessment methodology, which does not eliminate the need for both parties to use their judgment in assessing compliance. Such an assessment should identify weaknesses in the existing system of supervision and regulation, and form a basis for remedial measures by government authorities and banking supervisors.

While the publication of the assessments of jurisdictions affords transparency, an assessment of one jurisdiction will not be directly comparable with that of another. First, assessments have to reflect proportionality. Thus, a jurisdiction that is home to many systemically important banks will naturally have a higher hurdle to clear to obtain a "compliant" grading than a jurisdiction which only has small, non-complex deposit-taking institutions. Second, jurisdictions can elect to be graded against essential criteria only or against both essential criteria and additional criteria. Third, assessments will inevitably be country-specific and time-dependent to varying degrees. Therefore, the description provided for each Core Principle and the qualitative commentary accompanying the grading for each Core Principle should be reviewed to gain an understanding of a jurisdiction's approach to the specific component under consideration and the need for any improvements. Seeking to compare countries by simply referring to the number of "compliant" and "non-Compliant" grades they receive is unlikely to be informative.

From a broader perspective, effective banking supervision is dependent on a number of external elements, or preconditions, which may not be within the direct jurisdiction of supervisors. The review of the preconditions is qualitative and distinct from the assessment (and grading) of compliance with the Core Principles.

The assessment methodology can be used in multiple contexts:

1. self-assessments performed by banking supervisors themselves;
2. IMF and World Bank assessments of the quality and effectiveness of supervisory systems, for example in the context of the FSAP;⁶
3. reviews conducted by private third parties such as consulting firms; or
4. peer reviews conducted, for instance, within regional groupings of banking supervisors.

Whatever the context, the following factors are crucial:

1. A recent self-assessment of compliance with the Core Principles is an essential exercise for supervisors to have undertaken, since it will provide an important indicator of where techniques and practices need to be strengthened.
2. To promote objectivity, compliance with the Core Principles is best assessed by two suitably qualified external individuals with strong supervisory backgrounds who bring varied perspectives so as to provide checks and balances.
3. A fair assessment of the banking supervisory process cannot be performed without the genuine cooperation of all relevant authorities.
4. The process of assessing each of the 29 principles requires a judgmental weighing of various elements that only qualified assessors with practical, relevant experience can provide.
5. The assessment requires some legal and accounting expertise in the interpretation of compliance with the Core Principles in relation to the legislative and accounting structure of the relevant country.
6. The assessment must be comprehensive and in sufficient depth to allow a judgment on whether criteria are fulfilled in practice and not just in theory. Laws and regulations need to be sufficient in scope and depth, and they must be effectively enforced and complied with. Their existence alone does not provide sufficient indication that the criteria are met.

The primary objective of an assessment is to identify the nature and extent of any weaknesses in banking supervision. While the process of implementing the Core Principles starts with the assessment of compliance, assessment is a means to an end, not an objective in itself. The assessment allows the supervisory authority (and in some instances the government) to initiate a strategy to improve the banking supervisory system, as necessary.

The assessment methodology for the Core Principles includes both essential and additional assessment criteria:

1. Essential criteria are minimum baseline requirements for sound supervisory practices and are universally applicable to all countries. An assessment of a country against the essential criteria must recognise that its supervisory practices should be commensurate with the risk profile and systemic importance of the banks being supervised; that is, the assessment must consider the context in which the supervisory practices are applied.
2. Additional criteria are suggested best practices that countries with more complex banks should aim for. Effective banking supervisory practices are not static. They evolve over time as lessons are learnt and banking business continues to develop and expand. Supervisors are often swift to encourage banks to adopt "best practice" and should "practise what they preach" by seeking to move continually towards the highest supervisory standards. To reinforce this aspiration, the additional criteria in the Core Principles set out supervisory practices that exceed current baseline expectations but which contribute to the robustness of individual supervisory frameworks. As supervisory practices evolve, it is expected that upon each revision of the Core Principles, a number of additional criteria will become essential criteria, as expectations of baseline standards change. The use of essential criteria and additional criteria will, in this sense, contribute to the continuing relevance of the Core Principles over time.

Countries undergoing assessment by the IMF and/or the World Bank have the following three assessment options:

1. Unless the country explicitly selects another option, compliance with the Core Principles will be assessed and graded only with reference to the essential criteria;
2. A country may voluntarily choose to be assessed against the additional criteria to identify areas in which it could enhance its regulation and supervision further and benefit from assessors' comments on how this could be achieved. However, compliance with the Core Principles will still be graded only with reference to the essential criteria; or
3. To accommodate countries that seek to attain best supervisory practices, a country may voluntarily choose to be assessed and graded against both the essential and the additional criteria. It is anticipated that this will provide incentives to jurisdictions, particularly those that are important financial centres, to lead the way in the adoption of the highest supervisory standards.

For assessments of the Core Principles by external parties,⁷ the following four-grade scale will be used. A "not applicable" grading can be used under certain circumstances as described in BCP20.10.

1. Compliant – A country will be considered compliant with a principle when all essential criteria⁸ applicable for this country are met without any significant deficiencies. There may be instances in which a country can demonstrate that the principle has been achieved by other means. Conversely, due to the specific conditions in individual countries, the essential criteria may not always be sufficient to achieve the objective of the principle, and therefore evidence of other measures may also be needed in order for the aspect of banking supervision addressed by the principle to be considered effective.
2. Largely compliant – A country will be considered largely compliant with a principle if only minor shortcomings are observed that do not raise any concerns about the authority's ability and clear intent to achieve full compliance with the principle within a prescribed period of time. The assessment "largely compliant" can be used if the system does not meet all essential criteria but the overall effectiveness is sufficiently good and no material risks are left unaddressed.
3. Materially non-compliant – A country will be considered materially non-compliant with a principle if there are severe shortcomings (despite the existence of formal rules, regulations and procedures) and there is evidence that supervision has clearly not been effective, that practical implementation is weak, or that the shortcomings are sufficient to raise doubts about the authority's ability to achieve compliance. It is acknowledged that the "gap" between "largely compliant" and "materially non-compliant" is wide, and that the choice may be difficult. However, the intention is to force the assessors to make a clear statement.
4. Non-compliant – A country will be considered non-compliant with a principle if there has been no substantive implementation of the principle, several essential criteria have not been complied with, or supervision is manifestly ineffective.

In addition, a principle will be considered "not applicable" if, in the view of the assessor, the principle does not apply given the structural, legal and institutional features of the country. In some instances, countries have argued that in the case of certain embryonic or immaterial banking activities, which were not being supervised, an assessment of "not applicable" should have been given, rather than "non-compliant". This is an issue for judgment by the assessor, although activities that are relatively insignificant at the time of assessment may later assume greater importance and authorities need to be aware of and prepared for such developments. The supervisory system should permit such activities to be monitored, even if no regulation or supervision is considered immediately necessary. "Not applicable" would be an appropriate assessment if the supervisors are aware of the phenomenon and capable of taking action, but there is realistically no chance that the activities will grow sufficiently in volume to pose a risk.

Grading is not an exact science, and the Core Principles can be met in different ways. The assessment criteria should not be seen as a checklist approach to compliance but as a qualitative exercise. Compliance with some criteria may be more critical for effective supervision, depending on the situation and circumstances in a given jurisdiction. Hence, the number of criteria complied with is not always an indication of the overall compliance rating for any given principle. Emphasis should be placed on the commentary that should accompany each principle's grading, rather than on the grading itself. The primary goal of the exercise is not to apply a "grade" but rather to direct authorities towards areas needing attention to set the stage for improvements and develop an action plan that prioritises the improvements needed to achieve full compliance with the Core Principles.

The assessment should also include the assessors' opinion of how weaknesses in the preconditions for effective banking supervision, as discussed in BCP30, hinder effective supervision and of how effectively supervisory measures mitigate these weaknesses. In particular, the assessment of compliance with individual Core Principles should clearly mention how compliance is likely to be primarily affected by preconditions that are considered to be weak. This opinion should be qualitative rather than providing any kind of graded assessment. To the extent that shortcomings in preconditions are material to the effectiveness of supervision, they may affect the grading of the affected Core Principles.

While the Committee does not provide detailed guidelines on the preparation and presentation of assessment reports, it believes there are a few considerations that assessors should consider when conducting an assessment and preparing the assessment report.⁹

When conducting an assessment, the assessor must have free access to a range of information and interested parties. The required information may include not only published information, such as the relevant laws, regulations and policies, but also more sensitive information, such as any self-assessments, operational guidelines for supervisors and, where possible, supervisory assessments of individual banks. This information should be provided as long as it does not violate supervisors' legal obligations to keep such information confidential. Experience from assessments has shown that secrecy issues can often be solved through ad hoc arrangements between the assessor and the assessed authority. The assessor will need to meet a range of individuals and organisations, including the banking supervisory authority or authorities, other domestic supervisory authorities, any relevant government ministries, bankers and bankers' associations, auditors and other financial sector participants. Special note should be made of instances when required information is not provided and of the impact this might have on the accuracy of the assessment.

The assessment of compliance with each principle requires the evaluation of a chain of related requirements which, depending on the principle, may encompass laws, prudential regulations, supervisory guidelines, on-site examinations and off-site analyses, supervisory reporting and public disclosures, and evidence of enforcement or non-enforcement. The assessment must ensure that the requirements are put into practice, which entails assessing whether the supervisory authority has the necessary operational autonomy, skills, resources and commitment to implement the Core Principles. The assessment must confirm that the supervisor has the relevant powers and exercises them, where appropriate.¹⁰

It is important to bear in mind that some tasks, such as assessing the macroeconomic environment and detecting the build-up of dangerous trends, do not lend themselves to a rigid compliant/non-compliant structure. Although these tasks may be difficult to undertake, supervisors should aim for assessments that are as accurate as possible given the information available at the time and take reasonable actions to address and mitigate such risks.

Assessments should not focus solely on deficiencies but should also highlight specific achievements. This approach will provide a better picture of the effectiveness of banking supervision.

There are certain jurisdictions where non-bank financial institutions that are not part of a supervised banking group engage in some bank-like activities. These institutions may make up a significant portion of the total financial system and may be largely unsupervised. Since the Core Principles deal specifically with banking supervision, they cannot be used for formal assessments of these institutions. However, the assessment report should, at a minimum, mention any activities in which non-bank financial intermediation has an impact on supervised banks and the potential problems that may arise as a result of such activities.

The development of cross-border banking leads to increased complications when conducting Core Principles assessments. Improved cooperation and information-sharing between home and host country supervisors is of central importance, both in normal times and in crisis situations. The assessor must therefore determine whether such cooperation and information-sharing actually takes place to the extent needed, bearing in mind the size and complexity of the banking links between the two countries.

For the purposes of assessing risk management by banks in the context of Principles 15 to 25, a bank's risk management framework should take an integrated bank-wide perspective of its risk exposure, encompassing individual business lines and business units. Where a bank is a member of a group, the risk management framework should also cover the risk exposure across and within the banking group and take account of risks posed to the bank or banking group by other entities in the wider group.

Assessment of Principle 29 (Abuse of financial services) will, for some countries, involve a degree of duplication with the mutual evaluation process of the Financial Action Task Force (FATF). To address this overlap, where an evaluation has recently been conducted by the FATF on a given country, FSAP assessors may rely on that evaluation and focus their own review on the actions taken by supervisors to address any shortcomings identified by the FATF. In the absence of any recent FATF evaluation, FSAP assessors should continue to assess countries' supervision of banks' AML/CFT controls.

An effective system of banking supervision needs to be able to effectively develop, implement, monitor and enforce supervisory policies under normal and stressed economic and financial conditions. Supervisors need to be able to respond to external conditions that can negatively affect banks or the banking system. There are a number of elements or preconditions that have a direct impact on the effectiveness of supervision in practice. These preconditions are mostly outside the direct or sole jurisdiction of banking supervisors. Where supervisors have concerns that the preconditions could impact the efficiency or effectiveness of bank regulation and supervision, supervisors should make the government and relevant authorities aware of this and the actual or potential negative repercussions for supervisory objectives. Supervisors should work with the government and relevant authorities to address concerns that are outside the direct or sole jurisdiction of the supervisors. Supervisors should also, as part of their normal business, adopt measures to address the effects of such concerns on the efficiency or effectiveness of bank regulation and supervision.

The preconditions include:

1. sound and sustainable macroeconomic policies;
2. a well established framework for financial stability policy formulation;
3. a well developed public infrastructure;
4. a clear framework for crisis management, recovery and resolution;
5. an appropriate level of systemic protection (or public safety net); and
6. effective market discipline.

Sound macroeconomic policies (mainly fiscal and monetary policies) are the foundation of a stable financial system. Without sound policies, imbalances such as high government borrowing and spending or an excessive shortage or supply of liquidity may arise and affect the stability of the financial system. Furthermore, certain government policies¹¹ may specifically use banks and other financial intermediaries as instruments, which may inhibit effective supervision.

In view of the interplay between the real economy and banks and the financial system, it is important that there is a clear framework for macroprudential surveillance and financial stability policy formulation. Such a framework should set out the authorities or those responsible for identifying systemic and emerging risks in the financial system; for monitoring and analysing market and other financial and economic factors that may lead to accumulation of systemic risks; for formulating and implementing appropriate policies; and for assessing how such policies may affect the banks and the financial system. It should also include mechanisms for effective cooperation and coordination among the relevant agencies.

Inadequacies in public infrastructure can contribute to the weakening of financial systems and markets or make it difficult to improve them. A well developed public infrastructure needs to comprise the following elements:

1. a system of business laws, including corporate, bankruptcy, contract, consumer protection and private property laws, which is consistently enforced and provides a mechanism for the fair resolution of disputes;
2. an efficient and independent judiciary;
3. comprehensive and well defined accounting principles and rules that are widely accepted internationally;
4. a system of independent external audits to ensure that users of financial statements, including banks, have independent assurance that the accounts provide a true and fair view of the financial position of the company and that they are prepared according to established accounting principles, with auditors held accountable for their work;
5. availability of competent, independent and experienced professionals (eg accountants, auditors, lawyers and valuers), whose work complies with transparent technical and ethical standards set and enforced by official or professional bodies consistent with international standards, and who are subject to appropriate oversight;
6. well defined rules governing, and adequate supervision of, other financial markets and, where appropriate, their participants;
7. secure, efficient and well regulated payment and clearing systems (including central counterparties) for the settlement of financial transactions with counterparty risks effectively controlled and managed;
8. efficient and effective credit bureaus that make credit information available on borrowers and/or databases that assist in the assessment of risks; and
9. public availability of basic economic, financial and social statistics.

Effective crisis management frameworks and resolution regimes help to minimise potential disruptions to financial stability arising from banks and financial institutions that are in distress or failing. A sound institutional framework for crisis management and resolution requires a clear mandate and an effective legal basis for each relevant authority (such as banking supervisors, national resolution authorities, finance ministries and central banks). The relevant authorities should have a broad range of powers and appropriate tools set out in law to resolve a financial institution that is no longer viable and that has no reasonable prospect of becoming viable. There should also be agreement among the relevant authorities on their individual and joint responsibilities for crisis management and resolution, and how they will discharge these responsibilities in a coordinated manner. This should include the ability to share confidential information with each other to facilitate planning in advance to handle recovery and resolution situations and to manage such events when they occur.

Deciding on the appropriate level of systemic protection is a policy question to be addressed by the relevant authorities, including the government and central bank, particularly where it may result in a commitment of public funds. Supervisors will have an important role to play because of their in-depth knowledge of the financial institutions involved. In handling systemic issues, it is necessary to address the risks to confidence in the financial system and of contagion to otherwise sound institutions while minimising the distortion to market signals and discipline. A key element of the framework for systemic protection is a system of deposit insurance. Provided that such a system is transparent and carefully designed, it can contribute to public confidence in the system and thus limit contagion from banks in distress.

Effective market discipline depends in part on adequate flows of information to market participants, appropriate financial incentives to reward well managed institutions and arrangements that ensure that investors are not insulated from the consequences of their decisions. The issues to be addressed include corporate governance and ensuring that accurate, meaningful, transparent and timely information is provided by borrowers to investors and creditors. Market signals can be distorted and discipline undermined if governments seek to influence or override commercial decisions, particularly lending decisions, to achieve public policy objectives. In these circumstances, it is important that, if governments or their related entities provide or guarantee the lending, such arrangements are disclosed and there is a formal process for compensating financial institutions when such loans cease to perform.

The Core Principles establish 29 principles that are needed for a supervisory system to be effective and can be categorised into two groups:

1. Principles 1 to 13 focus on the powers, responsibilities and functions of supervisors;
2. Principles 14 to 29 focus on prudential regulations and requirements for banks.

This chapter lists the assessment criteria for each of the 29 Core Principles under two separate headings: "essential criteria" and "additional criteria".

The individual assessment criteria are based on international standards and sound supervisory practices that are already established, even if they have not yet been fully implemented. Where appropriate, the documents on which the criteria are founded have been cited as "reference documents". These documents include more detailed explanations of supervisory expectations and practices. There is the expectation that guidelines issued by the Committee will be observed by Committee member jurisdictions.

Principle 1:¹² An effective system of banking supervision has clear responsibilities and objectives for each authority involved in the supervision of banks and banking groups. A suitable legal framework for banking supervision is in place to provide each responsible authority with the necessary legal powers to authorise banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address safety and soundness concerns.

Essential criteria:

1. The responsibilities and objectives of each of the authorities involved in banking supervision are clearly defined in legislation and publicly disclosed. Where more than one authority is responsible for supervising the banking system, a credible and publicly available framework is in place to avoid regulatory and supervisory gaps.¹³
2. The primary objective of banking supervision is to promote the safety and soundness of banks and the banking system. If the banking supervisor is assigned broader responsibilities, these are subordinate to the primary objective and do not conflict with it.
3. Laws and regulations provide a framework for the supervisor to set and enforce minimum prudential standards for banks. The supervisor has the power to increase the prudential requirements for individual banks based on their risk profile and systemic importance.
4. Banking laws, regulations and prudential standards are updated as necessary to ensure that they remain effective and relevant to changing industry and regulatory practices. These are subject to public consultation, as appropriate, and published in a timely manner.
5. The supervisor has the power to:
   1. have full access¹⁴ to a bank's board, management, staff and records (including records that are held by relevant service providers and can be accessed either directly or through the supervised bank);
   2. review the overall activities of a bank (including activities performed by relevant service providers), whether domestic or cross-border; and
   3. supervise the foreign activities of banks incorporated in its jurisdiction.
6. When, in a supervisor's judgment, a bank is not complying with laws or regulations, or it is engaging or is likely to be engaging in unsafe or unsound practices or actions that have the potential to jeopardise the bank or the banking system, the supervisor has the power to:
   1. take (and/or require a bank to take) timely corrective action;
   2. impose a range of sanctions;
   3. revoke the bank's licence; and
   4. cooperate and collaborate with relevant authorities to achieve an orderly resolution of the bank, including triggering resolution where appropriate.
7. The supervisor has the power to review the activities of parent companies and of companies affiliated with parent companies to determine their impact on the safety and soundness of the bank. The supervisor has access, whether directly or through the supervised bank, to all necessary information for conducting such a review irrespective of where it is available.

Principle 2:¹⁵ The supervisor possesses operational independence, transparent processes, sound governance, budgetary processes that do not undermine autonomy, and adequate resources, and is accountable for the discharge of its duties and use of its resources. The legal framework for banking supervision includes legal protection for the supervisor.

Essential criteria:

1. The operational independence, accountability and governance of the supervisor are prescribed in legislation and publicly disclosed. There is no government or industry interference that compromises the operational independence of the supervisor. The supervisor has full discretion to set prudential policy and take any supervisory actions or decisions on banks under its supervision.
2. The process for the appointment and removal of the head(s) of the supervisory authority and members of its governing body is transparent. The head(s) of the supervisory authority is (are) appointed for a minimum term and is (are) removed from office during their term only for reasons specified in law or if they are not physically or mentally capable of carrying out the role or have been found guilty of misconduct. The reason(s) for removal is (are) publicly disclosed.
3. The supervisor publishes its objectives and is accountable through a transparent framework for the discharge of its duties in relation to those objectives. The supervisor regularly communicates its supervisory priorities publicly.
4. The supervisor has effective internal governance and communication processes that enable timely supervisory decisions to be taken at a level appropriate to the significance of the issue and expedited procedures in the case of an emergency. The allocation of responsibilities within the organisation as well as the delegation of authority for particular tasks or decisions are clearly defined. Supervisory processes include internal checks and balances to support effective decision-making and accountability. The governing body is structured to avoid any real or perceived conflicts of interest.
5. The supervisor and its staff have credibility based on their professionalism and integrity. There are rules on how to avoid conflicts of interest and on the appropriate use of information obtained through work, with sanctions in place if these are not followed.
6. The supervisor has adequate resources for the conduct of effective supervision and oversight. It is financed in a manner that does not undermine its autonomy or operational independence. This includes:
   1. a budget that provides for staff in sufficient numbers and with skills commensurate with the risk profile and systemic importance of the banks supervised;
   2. salary scales that allow it to attract and retain qualified staff;
   3. the ability to commission external experts with the necessary professional skills and independence to conduct supervisory tasks subject to the necessary confidentiality restrictions;
   4. a budget and programme for the regular training of staff;
   5. a technology budget sufficient to equip its staff with the tools needed to supervise the banking industry and assess individual banks; and
   6. a travel budget that allows appropriate on-site work, effective cross-border cooperation and participation in domestic and international meetings of significant relevance (eg supervisory colleges).
7. As part of their annual resource planning exercise, supervisors regularly take stock of existing staff skills and projected requirements/needs over the short and medium term, considering relevant emerging risks and practices as well as supervisory developments. Supervisors review and implement measures to bridge any gaps in numbers and/or skillsets identified.
8. In determining supervisory programmes and allocating resources, supervisors consider the risk profile and systemic importance of individual banks and the different risk mitigation approaches available.
9. Laws provide protection to the supervisor and its staff against lawsuits for actions taken and/or omissions made while discharging their duties in good faith. The supervisor and its staff are adequately protected against the costs of defending their actions and/or omissions made while discharging their duties in good faith.¹⁶

Principle 3: Laws, regulations or other arrangements provide a framework for cooperation and collaboration with relevant domestic authorities and foreign supervisors. These arrangements reflect the need to protect confidential information.¹⁷

Essential criteria:

1. Arrangements, whether formal or informal, are in place for cooperation, including analysis and sharing of information and undertaking collaborative work, with all domestic authorities with responsibility for the safety and soundness of banks, other financial institutions and/or the stability of the financial system. There is evidence that these arrangements work in practice, where necessary.
2. Arrangements, whether formal or informal, are in place for the supervisor to coordinate, within its mandate, with relevant authorities with responsibility for macroprudential policy when undertaking actions related to monitoring, identifying and addressing systemic risks that have the potential to affect the stability of the banking system.
3. Arrangements, whether formal or informal, are in place for cooperation, including analysis and sharing of information and undertaking collaborative work, with relevant foreign supervisors of banks. There is evidence that these arrangements work in practice, where necessary.
4. The supervisor may provide confidential information to another domestic authority or foreign supervisor but must take reasonable steps to determine that any confidential information so released will be used only for bank-specific or system-wide supervisory purposes and will be treated as confidential by the receiving party.
5. The supervisor receiving confidential information from other supervisors uses the confidential information for bank-specific or system-wide supervisory purposes only. The supervisor does not disclose to third parties confidential information received without the permission of the supervisor providing the information and is able to deny any demand (other than a court order or mandate from a legislative body) to disclose confidential information in its possession. If the supervisor is legally compelled to disclose confidential information it has received from another supervisor, it promptly notifies the originating supervisor, indicating what information it is compelled to release and the circumstances surrounding the release. Where consent to passing on confidential information is not given, the supervisor uses all reasonable means to resist such a demand or protect the confidentiality of the information.
6. Processes are in place for the supervisor to support resolution authorities (eg central banks and finance ministries as appropriate) undertaking recovery and resolution planning and actions.

Principle 4: The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined, and the use of the word "bank" in names is controlled.

Essential criteria:

1. The term "bank" is clearly defined in laws or regulations.
2. The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined either by supervisors, or in laws or regulations.
3. The use of the word "bank" and any derivations, such as "banking", in a name, including domain names, is limited to licensed and supervised institutions in all circumstances where the general public might otherwise be misled.
4. The taking of deposits from the public is reserved for institutions that are licensed and subject to supervision as banks.¹⁸
5. The supervisor or licensing authority publishes or otherwise makes available a current list of licensed banks, including branches of foreign banks, operating within its jurisdiction in a way that is easily accessible to the public.

Principle 5:¹⁹ The licensing authority has the power to set criteria for licensing banks and to reject applications where the criteria are not met. At a minimum, the licensing process consists of an assessment of the ownership structure and governance (including the fitness and propriety of board members and senior management) of the bank and its wider group, its strategic and operating plan, internal controls, risk management and projected financial condition (including capital base). Where the proposed owner or parent organisation is a foreign bank, the prior consent of its home supervisor is obtained.

Essential criteria:

1. The law identifies the authority responsible for granting and withdrawing a banking licence. The licensing authority could be the banking supervisor or another competent authority. If the licensing authority and the supervisor are not the same, the supervisor has the right to have its views on each application considered and its concerns addressed. In addition, the licensing authority provides the supervisor with any information that may be material to the supervision of the licensed bank. The supervisor imposes prudential conditions or limitations on the newly licensed bank, where appropriate.
2. Laws or regulations give the licensing authority the power to set criteria for licensing banks. If the criteria are not fulfilled or if the information provided is inadequate, the licensing authority has the power to reject an application. If the licensing authority or supervisor determines that the licence was based on false information, the licence can be revoked.
3. The licensing authority determines that the proposed legal, managerial, operational and ownership structures of the bank and its wider group will not hinder effective:Shell banks must not be licensed.
   1. supervision on both a solo and a consolidated basis; and
   2. implementation of corrective measures in the future.
4. The licensing authority identifies and determines the suitability of the bank's major shareholders²⁰ (including the beneficial owners) and others that may exert significant influence. It also assesses the transparency of the ownership structure, the sources of initial capital and the ability of shareholders to provide additional financial support, where needed.
5. A minimum initial capital amount is stipulated for all banks.
6. At authorisation, the licensing authority evaluates the bank's proposed board members and senior management in terms of their expertise and integrity, availability and time commitment to assume the responsibility, and any potential for conflicts of interest (fit and proper test). The fit and proper criteria include: skills and experience in relevant financial operations commensurate with the intended activities of the bank; and no record of criminal activities or adverse regulatory judgments that make a person unfit to hold important positions in a bank.²¹ The licensing authority determines whether the bank's board has collective sound knowledge of the material activities the bank intends to pursue, and the associated risks. The supervisor reassesses the suitability of board members in case of significant events (eg change of control or major acquisition) or upon receipt of information that impacts their fitness and propriety.
7. The licensing authority reviews the proposed strategic and operating plans of the bank. This includes determining that an appropriate system of corporate governance, risk management and internal controls, including those related to the detection and prevention of criminal activities²² as well as the oversight of proposed outsourced functions, will be in place. The operational structure is required to reflect the scope and degree of sophistication of the proposed activities of the bank.
8. The licensing authority reviews pro forma financial statements and projections of the proposed bank. This includes an assessment of the adequacy of the financial strength to support the proposed strategic plan as well as financial information on the principal shareholders of the bank.
9. In the case of foreign banks establishing a branch or subsidiary, before issuing a licence, the host supervisor establishes that no objection (or a statement of no objection) from the home supervisor has been received. For cross-border banking operations in its country, the host supervisor determines whether the home supervisor practises global consolidated supervision and uses this information to inform its approach to licensing and supervision.
10. The licensing authority or supervisor has policies and processes to monitor the progress of new entrants in meeting their business and strategic goals, and to determine that the supervisory requirements outlined in the licence approval are being met.
11. The criteria for issuing licences are consistent with those applied in ongoing supervision. The supervisor determines that banks continue to comply with the applicable criteria once they are licensed.

Principle 6:²³ The supervisor²⁴ has the power to review, reject and impose prudential conditions on any proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties.

Essential criteria:

1. Laws or regulations contain clear definitions of "significant ownership" and "controlling interest".
2. There are requirements to obtain supervisory approval or provide immediate notification with respect to proposed changes that would result in a change in ownership (including beneficial ownership), to the exercise of voting rights over a particular threshold or to a change in controlling interest.
3. The supervisor has the power to reject any proposal for a change in significant ownership (including beneficial ownership) or controlling interest, or prevent the exercise of voting rights in respect of such investments to ensure that any change in significant ownership meets criteria comparable with those used for licensing banks. If the supervisor determines that the change in significant ownership was based on false information, the supervisor has the power to reject, modify or reverse the change in significant ownership.
4. The supervisor obtains from banks, through periodic reporting or on-site examinations, the names and holdings of all significant shareholders or those that exert controlling influence, including the identities of beneficial owners of shares being held by nominees, custodians and through vehicles that might be used to disguise ownership.
5. The supervisor has the power to take appropriate action to modify, reverse or otherwise address a change of control that has taken place without the necessary notification to, or approval from, the supervisor.
6. Laws, regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest.

Principle 7: The supervisor has the power to: (i) approve or reject (or recommend to the responsible authority the approval or rejection of) and impose prudential conditions on major acquisitions or investments by a bank (including the establishment of cross-border operations), against prescribed criteria; and (ii) determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision.

Essential criteria:

1. Laws or regulations clearly define:
   1. what types and amounts (absolute and/or in relation to a bank's capital) of acquisitions and investments need prior supervisory approval; and
   2. cases for which notification after the acquisition or investment is sufficient. Such cases are primarily activities closely related to banking and where the investment is small relative to the bank's capital.
2. Laws or regulations provide criteria by which to judge individual bank proposals for acquisitions and investments.
3. The supervisor determines that any new acquisitions and investments will not expose the bank to undue risks or hinder effective supervision, and (where appropriate) that they will not hinder effective implementation of corrective measures in the future.²⁵ The supervisor can prohibit banks from making major acquisitions/investments (including the establishment of cross-border banking operations) in countries with laws or regulations prohibiting information flows deemed necessary for adequate consolidated supervision. In making this assessment, the supervisor considers the effectiveness of supervision in the host country and its own ability to exercise supervision on a consolidated basis.
4. The supervisor determines that the bank has, from the outset, adequate financial, managerial and organisational resources to manage the acquisition/investment.
5. The supervisor is aware of the risks that non-banking activities can pose to a bank and has the means to take action to mitigate those risks. The supervisor considers the ability of the bank to manage these risks prior to permitting investment in non-banking activities.
6. The supervisor reviews major acquisitions or investments by other entities in the banking group to determine that these do not expose the bank to any undue risks or hinder effective supervision. The supervisor also determines, where appropriate, that these new acquisitions and investments will not hinder effective implementation of corrective measures in the future. Where necessary, the supervisor is able to effectively address the risks to the bank arising from such acquisitions or investments.

Principle 8:²⁶ An effective system of banking supervision requires the supervisor to develop and maintain a forward-looking assessment of the risk profile of individual banks, proportionate to their systemic importance; identify, assess and address risks emanating from banks and the banking system as a whole; have a framework in place for early intervention; and have plans in place, in partnership with other relevant authorities, to take action to resolve banks in an orderly manner if they become non-viable.

Essential criteria:

1. The supervisor uses a well defined methodology and processes to determine and assess on an ongoing basis the nature, impact and scope of the risks which banks:
   1. are exposed to; and
   2. present to the safety and soundness of the banking system (including implications for and interlinkages with financial system stability).
2. The supervisor, in conjunction with relevant authorities where appropriate, uses a process to assess and identify which banks are systemically important in a domestic context. Supervisors publicly disclose information that provides an outline of the process employed to assess and determine systemic importance. The supervisor conducts these assessments sufficiently regularly to ensure they reflect the current state of the domestic financial system.
3. The supervisor assesses banks' compliance with prudential regulations and other legal requirements.
4. The supervisor considers the macroeconomic environment, climate-related financial risks and emerging risks in its risk assessment of banks. The supervisor also considers cross-sectoral developments, for example in non-bank financial institutions, through frequent contact with their regulators.
5. The supervisor, in conjunction with other relevant authorities, identifies, monitors and assesses:The supervisor incorporates this analysis into its assessment of banks and addresses proactively any serious threat to the stability of the banking system. The supervisor communicates any significant trends or emerging risks to other relevant authorities with responsibilities for financial system stability.
   1. the build-up and transmission of risks, trends and concentrations within and across the banking system as a whole;
   2. any emerging or system-wide risks which could impact banks and the banking system as a whole; and
   3. common behaviours by banks (eg procyclical actions), interlinkages and interconnections that may adversely affect the stability of the banking system, including implications for financial system stability.
6. Drawing on information provided by the bank and other domestic authorities, the supervisor, in conjunction with the resolution authority, assesses the bank's resolvability (where appropriate) having regard to the bank's risk profile and systemic importance. When bank-specific barriers to orderly resolution are identified, the supervisor requires banks to adopt appropriate measures, where necessary, such as changes to business strategies, managerial, operational and ownership structures, and internal procedures. Any such measures consider their effect on the soundness and stability of the bank's ongoing business.
7. The supervisor has a clear framework or process (eg identification of risk and early intervention) for handling banks in the build-up to and during times of stress, such that any decisions to require or undertake recovery or resolution actions are made in a timely manner.
8. Where the supervisor becomes aware of banks restructuring their activities to avoid the regulatory perimeter, the supervisor takes appropriate steps to address this. Where the supervisor becomes aware of bank-like activities being performed fully or partially outside the regulatory perimeter, the supervisor takes appropriate steps to draw the matter to the attention of the responsible authority to address regulatory arbitrage.

The methodology and processes address (among other things): banks' group structure (including risks posed by entities in the wider group); risks around banks' business models, including business model sustainability;²⁷ banks' risk profile with a forward-looking view;²⁸ their internal control environment; and their resolvability. The methodology permits relevant comparisons between banks, and the nature, frequency and intensity of supervision reflect the outcome of this analysis.

Principle 9:²⁹ The supervisor uses an appropriate range of techniques and tools to implement the supervisory approach and deploys supervisory resources on a proportionate basis, considering the risk profile and systemic importance of banks.

Essential criteria:

1. The supervisor employs an appropriate mix of on-site and off-site supervision to evaluate the condition of banks, their risk profile, their internal control environment and the corrective measures necessary to address supervisory concerns. The specific mix between on-site and off-site supervision may be determined by the particular conditions and circumstances of the country and the bank. The supervisor regularly assesses the quality, effectiveness and integration of its on-site and off-site functions and amends its approach, as needed.
2. The supervisor has a coherent process for planning and executing on-site and off-site activities. There are policies and processes to ensure that such activities are conducted on a thorough and consistent basis with clear responsibilities, objectives and outputs, and that there is effective coordination and information-sharing between the on-site and off-site functions.
3. The supervisor uses a range of information to regularly review and assess the safety and soundness of banks and the stability of the banking system, the evaluation of material risks, and the identification of necessary corrective and supervisory actions. This includes information such as prudential reports, statistical returns, information on a bank's related entities and publicly available information. The information received on banks is used by supervisors to form a holistic view and understanding of their risk profile. The supervisor determines that information provided by banks is reliable³⁰ and obtains, as necessary, additional information on banks and their related entities.
4. The supervisor uses a variety of tools to regularly review and assess the safety and soundness of banks and the stability of the banking system, including:The supervisor uses its analysis to determine follow-up work required, if any.
   1. analysis of financial statements and accounts;
   2. business model analysis;
   3. horizontal peer reviews;
   4. analysis of corporate governance, including risk management and internal control systems;
   5. reviews of the outcome of stress tests undertaken by the banks; and
   6. assessments of the adequacy of banks' capital and liquidity levels under adverse economic scenarios, which may include conducting supervisory stress tests on individual banks or on a system-wide basis.
5. Based on the information provided by banks and its own analysis, the supervisor communicates its findings to banks as appropriate and requires them to take action to mitigate any particular vulnerabilities that have the potential to affect their safety and soundness or the stability of the banking system (including implications for and interlinkages with financial system stability).
6. The supervisor evaluates the work of the bank's internal audit function (including those that are outsourced or co-sourced) and determines whether, and to what extent, it may rely on the internal auditors' work to identify areas of potential risk.
7. The supervisor engages sufficiently frequently with the bank's board, non-executive board members and senior and middle management (including heads of individual business units and control functions) to develop an understanding of and assess matters such as strategy, group structure, corporate governance, performance, capital adequacy, liquidity, asset quality, risk management systems and internal controls. Where necessary, the supervisor challenges the bank's board and senior management on the assumptions made in setting strategies and business models.
8. The supervisor communicates to the bank the findings of its on- and off-site supervisory analyses in a timely manner by means of written reports or through discussions or meetings with the bank's management. The supervisor meets with the bank's senior management and the board to discuss the results of supervisory examinations and external audits, as appropriate. The supervisor also meets separately with the bank's independent board members and external auditor, as necessary.
9. The supervisor undertakes appropriate and timely follow-up activities to check that banks have addressed supervisory concerns or implemented requirements communicated to them. This includes early escalation to the appropriate level of the supervisory authority and to the bank's board if action points are not addressed in an adequate or timely manner.
10. The supervisor requires banks to notify it in advance of any substantive changes in their activities, structure and overall condition, or as soon as they become aware of any material adverse developments, including breaches of legal or prudential requirements.
11. The supervisor may use independent third parties, including external experts, but it cannot outsource its prudential responsibilities to third parties. Where third parties are used, the supervisor:
    1. clearly defines and documents their roles and responsibilities, including the scope of work where they are appointed to conduct supervisory tasks;
    2. assesses their suitability for the designated task(s), the quality of their work and whether their output can be relied upon to the degree intended;
    3. ensures that they are subject to appropriate confidentiality restrictions;
    4. considers the biases that may influence them; and
    5. requires that they promptly bring to its attention any material shortcomings identified during the course of any work undertaken by them for supervisory purposes.
12. The supervisor has an adequate information system which facilitates the processing, monitoring and analysis of prudential information. The system aids the identification of areas requiring follow-up action.

Additional criterion:

1. The supervisor has a framework for periodic independent reviews, for example by an internal audit function, internal risk function or third-party assessor, of the adequacy and effectiveness of the range of its available supervisory tools and the effectiveness of their use, and makes changes as appropriate. The supervisory approach should be reviewed at periodic intervals and improved as necessary to ensure it remains effective and fit for purpose.

Principle 10:³¹ The supervisor collects, reviews and analyses prudential reports and statistical returns³² from banks on both a solo and a consolidated basis, and independently verifies these reports through either on-site examinations or use of external experts.

Essential criteria:

1. The supervisor has the power to require banks to submit information, on both a solo and a consolidated basis, on their financial condition, performance and risk exposures, on demand and at regular intervals. These reports provide information such as on- and off-balance sheet assets and liabilities, profit and loss, capital adequacy, liquidity, large exposures, risk concentrations (including by economic sector, geography and currency), asset quality, loan loss provisioning, related party transactions, interest rate risk, market risk and information that allows for the assessment of the materiality of climate-related financial risks and emerging risks to banks.
2. The supervisor provides reporting instructions that clearly describe the standards to be used in preparing supervisory reports. Such standards are based on accounting principles and rules that are widely accepted internationally.
3. The supervisor requires banks to have sound governance structures and control processes for methodologies that produce valuations. The measurement of fair values maximises the use of relevant and reliable inputs which are consistently applied for risk management and reporting purposes. The valuation framework and control procedures are subject to adequate independent validation and verification, either internally or by an external expert. The supervisor assesses whether the valuation used for regulatory purposes is reliable and prudent. Where the supervisor determines that valuations are not sufficiently prudent, the supervisor requires the bank to adjust its reporting for capital adequacy or regulatory reporting purposes.
4. The supervisor collects and analyses information from banks at a frequency commensurate with the nature of the information requested and the risk profile and systemic importance of the bank.
5. To make meaningful comparisons between banks, the supervisor collects data from all banks and all relevant entities covered by consolidated supervision on a comparable basis and for the same dates (stock data) and periods (flow data).
6. The supervisor has the power to request and receive any relevant information from banks, as well as any entities in the wider group, irrespective of their activities, where the supervisor believes that it is:This includes, but is not limited to, internal management information, corporate governance information, transactions with the wider group (eg any non-bank entities) and related party transactions.
   1. material to the condition of the bank;
   2. material to the assessment of the risks of the bank; or
   3. needed to support resolution planning.
7. The supervisor has a means of enforcing compliance with the requirement that the information be submitted on a timely and accurate basis. The supervisor determines the appropriate level of the bank's senior management that is responsible for the accuracy of supervisory returns, imposes sanctions for misreporting and persistent errors, and requires that inaccurate information be amended.
8. The supervisor utilises policies and procedures to determine the validity and integrity of supervisory information. This includes a programme for the periodic verification of supervisory returns either by the supervisor's own staff or by external experts.
9. The supervisor has a process in place to periodically review the information collected to determine that it satisfies a supervisory need.

Principle 11:³³ The supervisor acts at an early stage to address unsafe and unsound practices or activities that could pose risks to banks or to the banking system. The supervisor has at its disposal an adequate range of supervisory tools, that it can apply at its discretion, to bring about timely corrective actions. This includes the ability to revoke the banking licence or to recommend its revocation.

Essential criteria:

1. The supervisor raises supervisory concerns with the bank's management or, where appropriate, the bank's board, at an early stage, and requires that these concerns be addressed in a timely manner. Where the supervisor requires the bank to take significant corrective actions, these are addressed in a written document to the bank's board. The supervisor requires the bank to submit regular written progress reports, and it checks that corrective actions are completed satisfactorily. The supervisor follows through conclusively and in a timely manner on matters that are identified.
2. The supervisor uses an appropriate range of supervisory tools³⁴ in a timely manner when, in the supervisor's judgment, a bank is not complying with laws, regulations or supervisory actions, is engaged in unsafe or unsound practices or in activities that could pose risks to the bank or the banking system, or when the interests of depositors are otherwise threatened.
3. The supervisor uses its powers to act where a bank falls below established regulatory threshold requirements, including prescribed regulatory ratios or measurements. The supervisor intervenes at an early stage to require a bank to take action to prevent it from breaching its regulatory threshold requirements. Laws or regulations guard against the supervisor unduly delaying appropriate corrective actions, without limiting the supervisor's discretion to act.
4. The supervisor uses a broad range of possible measures to address, at an early stage, such scenarios as described in BCP40.26(2) above. These measures include the ability to impose sanctions expeditiously or require a bank to take timely corrective action. In practice, the range of measures is applied in accordance with the gravity of a situation. The supervisor provides clear prudential objectives or sets out the actions to be taken, which may include restricting the current activities of the bank, imposing more stringent prudential limits and requirements, withholding approval of new activities or acquisitions, restricting or suspending payments to shareholders or share repurchases, restricting asset transfers, barring individuals from the banking sector, replacing or restricting the powers of managers, board members or controlling owners, facilitating a takeover by or merger with a healthier institution, providing for the interim management of the bank, and revoking or recommending the revocation of the banking licence.
5. The supervisor applies sanctions not only to the bank but, when and if necessary, also to management and/or the board, or relevant individuals. The supervisor has the power to apply corrective measures and sanctioning measures simultaneously, including financial penalties.
6. The supervisor exercises its power to take corrective actions, including ring-fencing the bank from the actions of parent companies, subsidiaries, parallel-owned banking structures and other related entities in matters that could impair the safety and soundness of the bank or the banking system.
7. Laws, regulations or the supervisor establish a clear policy on whether imposed sanctions are made a matter of public knowledge and, in that case, what to disclose and when. The decision to publish sanctions or corrective measures applied to banks and individuals (eg senior managers, board members, directors, officers and other employees) may be subject to confidentiality considerations and it must not jeopardise other supervisory objectives or prejudice another case pending before the supervisor. While transparency of enforcement measures is encouraged, the decision to disclose sanctions can be made on a case by case basis, depending on their seriousness and the frequency of their occurrence, among other considerations.
8. The supervisor cooperates and collaborates with relevant authorities in deciding when and how to effect the orderly resolution of a problem bank (which could include closure, assisting in restructuring, or merger with a stronger institution).
9. Where appropriate, when taking formal corrective action in relation to a bank, the supervisor informs the supervisor of related non-bank financial entities of its actions and coordinates its actions with them.

Principle 12:³⁵ The supervisor supervises the banking group on a consolidated basis, adequately monitoring and, as appropriate, applying prudential standards to all aspects of the business conducted by the banking group worldwide.

Essential criteria:

1. The supervisor understands the overall structure of the banking group and is familiar with all the material activities (including non-banking activities) conducted by entities in the wider group, whether domestic or cross-border. The supervisor understands and assesses how group-wide risks are managed and takes action when risks arising from the banking group and other entities in the wider group, in particular contagion and reputational risks, may jeopardise the safety and soundness of the bank and the banking system.
2. The supervisor imposes prudential standards and collects and analyses financial and other information on a consolidated basis for the banking group, covering areas such as capital adequacy, liquidity, large exposures, exposures to related parties, lending limits and group structure.
3. The supervisor reviews whether the oversight of a bank's foreign operations by management (of the parent bank or head office and, where relevant, the holding company) is adequate having regard to their risk profile and systemic importance. The supervisor determines that parent banks have unimpeded access to all material information from their foreign branches and subsidiaries. The supervisor also determines that banks' policies and processes require the local management of any cross-border operations to have the necessary expertise to manage those operations in a safe and sound manner, and in compliance with supervisory and regulatory requirements. The home supervisor considers the effectiveness of supervision conducted in the host countries in which its banks have material operations.
4. The home supervisor visits the foreign offices of the bank periodically. The location and frequency of these visits are determined by the risk profile and systemic importance of the bank's foreign operations. The supervisor meets the host supervisors during these visits. The supervisor has a policy for assessing whether it needs to conduct on-site examinations of a bank's foreign operations or require additional reporting, and it has the power and resources to take those actions as and when appropriate.
5. The supervisor reviews the main activities of parent companies and of companies affiliated with the parent companies that have a material impact on the safety and soundness of the bank and takes appropriate supervisory action.
6. The supervisor limits the range of activities the consolidated group may conduct and the locations in which activities can be conducted (including the closing of foreign offices) if it determines that:
   1. the safety and soundness of the bank is compromised because the activities expose it to excessive risk and/or are not properly managed;
   2. the supervision by other domestic authorities is not adequate relative to the risks the activities present; and/or
   3. the exercise of effective supervision on a consolidated basis is hindered.
7. In addition to supervising on a consolidated basis, the responsible supervisor supervises individual banks in the group. The responsible supervisor supervises each bank on a solo basis and understands its relationship with other members of the group.³⁶

Additional criterion:

1. For countries which allow corporate ownership of banks, the supervisor has the power to establish and enforce fit and proper standards for senior management of parent companies.

Principle 13:³⁷ Home and host supervisors of cross-border banking groups share information and cooperate for effective supervision of the group and group entities, and effective handling of crisis situations. Supervisors require the local operations of foreign banks to be conducted to the same standards as those required of domestic banks.

Essential criteria:

1. The home supervisor establishes bank-specific supervisory colleges for banking groups with material cross-border operations to enhance its effective oversight, considering the risk profile and systemic importance of the banking group and the corresponding needs of its supervisors. In its broadest sense, the host supervisor which has a relevant subsidiary or a significant branch in its jurisdiction and a shared interest in the effective supervisory oversight of the banking group is included in the college. The structure of the college reflects: (i) the nature of the banking group, including its scale, structure and complexity, and its significance in host jurisdictions; and (ii) the opportunity to enhance mutual trust and meet the needs and responsibilities of both home and host supervisors.
2. Home and host supervisors share appropriate information on a timely basis in line with their respective roles and responsibilities, both bilaterally and through colleges. This includes information on:Informal or formal arrangements (such as memoranda of understanding and confidentiality agreements) are in place to enable the timely exchange of confidential information.
   1. the material risks (including those arising from the respective macroeconomic environments) and risk management practices of the banking group; and
   2. the supervisors' assessments of the safety and soundness of the relevant entity under their jurisdiction.
3. Home and host supervisors coordinate and plan supervisory activities or undertake collaborative work if common areas of interest are identified to improve the effectiveness and efficiency of supervision of cross-border banking groups.
4. The home supervisor develops an agreed communication strategy with the relevant host supervisors. The scope and nature of the strategy reflects the risk profile and systemic importance of the cross-border operations of the banking group. Home and host supervisors also agree on the communication of views and outcomes of joint activities and college meetings to banks, where appropriate, to ensure the consistency of messages on group-wide issues.
5. Where appropriate, given the banking group's risk profile and systemic importance, the home supervisor, working with its national resolution authorities, develops a framework for cross-border crisis cooperation and coordination among the relevant home and host authorities. The relevant authorities share information on crisis preparations from an early stage, subject to rules on confidentiality, in a way that does not materially compromise the prospect of a successful resolution.
6. Where appropriate, given the banking group's risk profile and systemic importance, the home supervisor, working with its national resolution authorities and relevant host authorities, develops a group resolution plan. The relevant authorities share any information necessary for the development and maintenance of a credible resolution plan. Supervisors also notify and consult relevant authorities and supervisors (both home and host) promptly when taking any recovery and resolution measures.
7. The host supervisor's national laws or regulations require that the cross-border operations of foreign banks are subject to prudential, inspection and regulatory reporting requirements similar to those for domestic banks.
8. The home supervisor is given on-site access to local offices and subsidiaries of a banking group to facilitate its assessment of the group's safety and soundness and compliance with customer due diligence requirements. The home supervisor informs host supervisors of intended visits to local offices and subsidiaries of banking groups.
9. The host supervisor supervises booking offices in a manner consistent with internationally agreed standards. The supervisor does not permit shell banks or the continued operation of shell banks.
10. A supervisor that takes action based on information received from, or that is consequential for the work of, another supervisor consults that supervisor, to the extent possible, before taking such action.

Principle 14:³⁸ The supervisor determines that banks have robust corporate governance policies and processes covering, for example, corporate culture and values, strategic direction and oversight, group and organisational structure, the control environment, the suitability assessment process, the responsibilities of the banks' boards and senior management, and compensation practices. These policies and processes are commensurate with the risk profile and systemic importance of the bank.

Essential criteria:

1. Laws, regulations or the supervisor establish the responsibilities of a bank's board and senior management with respect to corporate governance to ensure there is effective control over the bank's entire business. The supervisor provides guidance to banks on expectations for sound corporate governance.
2. The supervisor regularly conducts comprehensive evaluations of a bank's corporate governance policies and practices, and their implementation, and determines that the bank has robust corporate governance policies and processes commensurate with its risk profile and systemic importance. The supervisor requires banks to correct deficiencies in a timely manner.
3. The supervisor determines that board membership comprises individuals with a balance of skills, diversity and expertise, who collectively possess the necessary qualifications commensurate with the size, complexity and risk profile of the bank. Board membership includes a sufficient number of experienced independent directors.³⁹ Board members are qualified (individually and collectively) for their positions, effective and exercise their "duty of care" and "duty of loyalty".⁴⁰
4. The supervisor determines that governance structures and processes for nominating and appointing board members are appropriate for the bank. Boards regularly assess the performance of the board as a whole, its committees and individual board members (including their ongoing suitability). Board membership is regularly renewed to refresh skills and independence. Commensurate with the bank's risk profile and systemic importance, board structures include audit, risk, compensation and other board committees with experienced, independent directors.
5. The supervisor determines that the bank's board approves and oversees implementation of the bank's strategic direction, risk appetite and strategy, and related policies, establishes and communicates corporate culture and values (eg through a code of conduct),⁴¹ and establishes conflicts of interest policies and a strong control environment.
6. The supervisor determines that the bank's board, except where required otherwise by laws or regulations:
   1. has established fit and proper standards in selecting senior management and heads of the control functions;
   2. has developed effective processes to allocate authority, responsibility and accountability within the bank;
   3. maintains plans for succession; and
   4. actively and critically oversees senior management's execution of board strategies, including monitoring the performance of senior management and heads of the control functions against the standards established for them.
7. The supervisor determines that the bank's board actively oversees the design and operation of the bank's compensation system and that it has appropriate incentives, which are aligned with prudent risk-taking and effective in addressing misconduct that potentially results in losses. The compensation system and related performance standards, policies and procedures are non-discriminatory and consistent with the long-term objectives and financial soundness of the bank and are rectified if there are deficiencies.
8. The supervisor determines that the bank's board and senior management know and understand the bank's operational structure and its risks, including those arising from the use of structures that impede transparency (eg special purpose or related structures). The supervisor determines that risks are effectively managed and mitigated, where appropriate.
9. Laws, regulations or the supervisor require banks to notify the supervisor or publicly disclose as soon as they become aware of any material and bona fide information that may negatively affect the fitness and propriety of a bank's board member or a member of the senior management.
10. The supervisor has the power to require changes in the composition of the bank's board if it believes that any individuals are not fulfilling their duties related to the satisfaction of these criteria.

Principle 15:⁴² The supervisor determines that banks have a comprehensive risk management process (including effective board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate all material risks⁴³ (which can include risks related to digitalisation, climate-related financial risks and emerging risks) on a timely basis and to assess the adequacy of their capital, their liquidity and the sustainability of their business models in relation to their risk profile and market and macroeconomic conditions. This extends to the development and review of contingency arrangements (including robust and credible recovery plans where warranted) that consider the specific circumstances of the bank. The risk management process is commensurate with the risk profile and systemic importance of the bank.⁴⁴

Essential criteria:

1. The supervisor determines that banks have appropriate risk management strategies that have been approved by the bank's board, and that the board establishes an effective risk appetite statement and framework to define the level of risk the bank is willing to assume or tolerate. The supervisor also determines that the board ensures that:
   1. a sound risk culture is established throughout the bank, to promote the development and execution of its strategy;
   2. policies and processes are developed for risk-taking that are consistent with the risk management strategy and the established risk appetite;
   3. uncertainties attached to risk measurement are recognised;
   4. appropriate limits are established that are consistent with the bank's risk appetite, risk profile, capital strength and liquidity needs. These limits are understood by, and regularly communicated to, relevant staff; and
   5. senior managers take the steps necessary to monitor and control all material risks consistent with the approved strategies and risk appetite.
2. The supervisor requires banks to have comprehensive risk management policies and processes to identify, measure, evaluate, monitor, report and control or mitigate all material risks.⁴⁵ The supervisor determines that these processes are adequate:
   1. to provide a comprehensive bank-wide view of risk across all material risk types;
   2. for the risk profile and systemic importance of the bank;
   3. to assess risks arising from the macroeconomic environment affecting the markets in which the bank operates and to incorporate such assessments into the bank's risk management process; and
   4. to assess risks that could materialise over longer time horizons (including risks related to digitalisation, climate-related financial risks and emerging risks). Where appropriate, banks use scenario analysis as a tool.
3. The supervisor determines that risk management strategies, policies, processes and limits are properly documented and aligned with the bank's risk appetite statement and framework; regularly reviewed and appropriately adjusted to reflect changing risk appetites, risk profiles and market and macroeconomic conditions; and communicated within the bank. The supervisor determines that adequate procedures are in place for breaches of risk limits and significant deviations from established policies, ensuring they receive prompt attention and authorisation from the appropriate level of management and the bank's board (where necessary) and are adequately followed up with proportionate and timely remedial action.
4. The supervisor determines that the bank's board and senior management obtain sufficient information on and understand the nature and level of risk being taken by the bank and how this risk relates to adequate levels of capital and liquidity. The supervisor also determines that the board and senior management regularly review and understand the implications and limitations (including the risk measurement uncertainties) of the risk management information that they receive.
5. The supervisor determines that banks have an appropriate internal process for assessing their overall capital and liquidity adequacy and the sustainability of their business models in relation to their risk appetite, risk profile⁴⁶ and forward-looking business strategies. The supervisor reviews and evaluates banks' internal capital and liquidity adequacy assessments and strategies.
6. Where banks use models to measure components of risk, the supervisor determines that the following conditions are met:In addition, the supervisor assesses whether the model outputs appear reasonable as a reflection of the risks assumed.
   1. banks comply with supervisory standards on the use of models;
   2. the banks' boards and senior management understand the limitations and uncertainties relating to the output of the models and the risk inherent in their use; and
   3. banks perform regular and independent validation and testing of the models. In addition, the supervisor assesses whether the model outputs appear reasonable as a reflection of the risks assumed.
7. The supervisor determines that banks have information systems that are adequate (both under normal circumstances and in periods of stress) for measuring, assessing and reporting on the size, composition and quality of exposures on a bank-wide basis across all risk types, products and counterparties. The supervisor also determines that these reports reflect the bank's risk profile and capital and liquidity needs, and that they are provided on a timely basis to the bank's board and senior management in a form suitable for their use.
8. The supervisor determines that banks develop and maintain appropriate risk data aggregation and reporting capabilities commensurate with the risk profile and systemic importance of the bank. The supervisor also determines that the board and senior management review and approve the bank's risk data aggregation and risk reporting framework, and that they ensure that adequate resources are deployed to support these efforts.
9. The supervisor determines that banks have adequate policies and processes to ensure that the banks' boards and senior management understand the risks inherent in new products,⁴⁷ material modifications to existing products, and major management initiatives (such as changes in systems, processes, business models and major acquisitions). The supervisor determines that the bank's board and senior management monitor and manage these risks on an ongoing basis. The supervisor also determines that the bank's policies and processes require the undertaking of any major activities of this nature to be approved by the board or a specific committee of the board.
10. The supervisor determines that banks have risk management functions covering all material risks with sufficient resources, independence, authority and access to the banks' boards to perform their duties effectively. The supervisor determines that their duties are clearly segregated from risk-taking functions in the bank and that they report on risk exposures directly to the board and senior management. The supervisor also determines that the risk management function is subject to regular review by the internal audit function.
11. The supervisor requires larger and more complex banks to have a dedicated risk management unit overseen by a chief risk officer (CRO) or equivalent function. If the CRO of a bank is removed from their position for any reason, this should be done with the prior approval of the board and generally should be disclosed publicly. The bank should also discuss the reasons for such removal with its supervisor.
12. The supervisor issues standards related to, in particular, credit risk, market risk, liquidity risk, interest rate risk in the banking book, operational risk and large exposures.
13. The supervisor requires banks to have appropriate contingency arrangements, as an integral part of their risk management process, to address risks that may materialise and actions to be taken in stress conditions (including those that will pose a serious risk to their viability). If warranted by its risk profile and systemic importance, the contingency arrangements include robust and credible recovery plans that consider the specific circumstances of the bank. The supervisor, working with resolution authorities as appropriate, assesses the adequacy of banks' contingency arrangements given their risk profile and systemic importance (including reviewing any recovery plans) and their likely feasibility during periods of stress. The supervisor seeks improvements if deficiencies are identified.
14. The supervisor requires banks to have forward-looking stress testing programmes covering all material risks commensurate with their risk profile and systemic importance as an integral part of their risk management process. At a minimum, banks' stress testing programmes cover credit risk, market risk, interest rate risk in the banking book, liquidity risk, country and transfer risk, operational risk and significant risk concentrations. The supervisor regularly assesses a bank's stress testing programme and determines that it captures all material sources of risk and adopts plausible adverse scenarios. The supervisor also determines that the bank integrates the results into its decision-making, risk management processes (including contingency arrangements) and the assessment of its capital and liquidity levels. The supervisor requires corrective action if material deficiencies are identified in a bank's stress testing programme or if the results of stress tests are not adequately considered in the bank's decision-making process. Where appropriate, the scope of the supervisor's assessment includes the extent to which the stress testing programme:
    1. promotes risk identification and control on a bank-wide basis;
    2. adopts suitably severe assumptions and seeks to address feedback effects and system-wide interaction between risks;
    3. benefits from the active involvement of the board and senior management; and
    4. is appropriately documented and regularly maintained and updated.
15. The supervisor assesses whether banks appropriately account for risks (including liquidity impacts) in their internal pricing, performance measurement and new product approval process for all significant business activities.

Principle 16:⁴⁸ The supervisor sets prudent and appropriate capital adequacy requirements for banks that reflect the risks undertaken and presented by a bank in the context of the markets and macroeconomic conditions in which it operates.⁴⁹ The supervisor defines the components of capital, bearing in mind their ability to absorb losses. At least for internationally active banks, capital requirements are not less stringent than the applicable Basel standards.

Essential criteria:

1. Laws, regulations or the supervisor require banks to calculate and consistently observe prescribed capital requirements, including thresholds with reference to which a bank might be subject to supervisory action. Laws, regulations or the supervisor define the qualifying components of capital, ensuring that emphasis is given to those elements of capital permanently available to absorb losses on a going concern basis.
2. At least for internationally active banks,⁵⁰ the definition of capital, the risk coverage, the method of calculation and thresholds for the prescribed requirements are not lower than those established in the applicable Basel standards.
3. The supervisor has the power to impose a specific capital charge and/or limits on all material risk exposures, if warranted, including in respect of risks that the supervisor considers not to have been adequately transferred or mitigated through transactions (eg securitisation transactions) entered into by the bank. Both on-balance sheet and off-balance sheet risks are included in the calculation of prescribed capital requirements.
4. The prescribed capital requirements reflect the risk profile and systemic importance of banks in the context of the markets and macroeconomic conditions in which they operate, constrain the build-up of leverage in banks and the banking sector, and reduce the risk of contagion. In assessing the adequacy of a bank's capital levels given its risk profile, the supervisor focuses, among other things, on:Consequently, capital requirements may vary from bank to bank to ensure that each bank is operating with the appropriate level of capital to support its risk profile. Laws, regulations or the supervisor in a particular jurisdiction may set higher overall capital adequacy standards than the applicable Basel requirements.
   1. the potential loss absorbency of the instruments included in the bank's capital base;
   2. the appropriateness of risk weights as a proxy for the risk profile of its exposures;
   3. the adequacy of provisions and reserves to cover expected losses; and
   4. the quality of its risk management and controls.
5. The use of banks' internal assessments of risk as inputs to the calculation of regulatory capital is approved by the supervisor. If the supervisor approves such use:
   1. such assessments adhere to rigorous qualifying standards;
   2. any cessation of such use or any material modification of the bank's processes and models for producing such internal assessments are subject to the approval of the supervisor;
   3. the supervisor has the capacity to evaluate a bank's internal assessment process to determine that the relevant qualifying standards are met and that the bank's internal assessments can be relied upon as a reasonable reflection of the risks undertaken;
   4. the supervisor has the power to impose conditions on its approvals if the supervisor considers it prudent to do so; and
   5. if a bank does not continue to meet the qualifying standards or the conditions imposed by the supervisor on an ongoing basis, the supervisor has the power to revoke its approval.
6. The supervisor has the power to require banks to adopt a forward-looking approach to capital management (including the conduct of appropriate stress testing). The supervisor has the power to require banks:
   1. to set capital levels and manage available capital and planned capital expenditures in anticipation of possible business cycle effects, market conditions and changes in factors specific to the bank that could have an adverse effect; and
   2. to have in place feasible contingency arrangements to maintain or strengthen capital positions in times of stress, as appropriate given the risk profile and systemic importance of the bank.
7. Laws or regulations require, or the supervisor has the power to impose a simple, transparent, non-risk-based measure that captures all on- and off-balance sheet exposures to supplement risk-based capital requirements to constrain the build-up of leverage in banks and in the banking sector.

Additional criteria:

1. For non-internationally active banks, capital requirements, including the definition of capital, the risk coverage, the method of calculation, the scope of application and the capital required, are broadly consistent with the principles of the applicable Basel standards relevant to internationally active banks.
2. The supervisor requires adequate distribution of capital within different entities of a banking group according to the allocation of risks.⁵¹
3. Laws or regulations permit the supervisor or relevant authorities to require banks to maintain additional capital (which may include sectoral capital requirements) in a form that can be released when system-wide risk crystallises or dissipates.

Principle 17:⁵² The supervisor determines that banks have an adequate credit risk management process that considers their risk appetite, risk profile, market conditions, macroeconomic factors and forward-looking information. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate credit risk⁵³ (including counterparty credit risk⁵⁴) on a timely basis. The full credit life cycle is covered, including credit underwriting, credit evaluation and the ongoing management of the bank's loan and investment portfolios.

Essential criteria:

1. Laws, regulations or the supervisor require banks to have sound credit risk management processes that provide a comprehensive bank-wide view of all credit risk exposures, including a robust methodology for the early identification and appropriate measurement of credit losses. The supervisor determines that the processes are consistent with the risk appetite, risk profile, systemic importance and capital strength of the bank, that they consider current and forward-looking market and macroeconomic factors, and that they result in prudent standards of underwriting, evaluation, administration, monitoring, measurement and control of credit risk.
2. The supervisor determines that a bank's board approves and regularly reviews the credit risk management strategy and significant policies for identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating credit risk (including counterparty credit risk) and that these are consistent with the risk appetite set by the board. The supervisor also determines that the board oversees management in a way that ensures that these policies are implemented effectively and fully integrated into the bank's overall risk management process.
3. The supervisor requires and regularly determines that such policies and processes establish an appropriate and properly controlled credit risk environment, including:
   1. a well documented and effectively implemented strategy and sound policies and processes for assuming credit risk, without undue reliance on external credit assessments;
   2. well defined criteria and policies and processes for:
      (i)

      approving new exposures (including prudent underwriting standards), and ensuring a thorough understanding of the risk profile and characteristics of the borrowers (and in the case of securitisation exposures all features of securitisation transactions)⁵⁵ that would materially impact the performance of these exposures;

      (ii)

      renewing and refinancing existing exposures; and

      (iii)

      identifying the appropriate approval authority for the size and complexity of the exposures;

   3. effective credit administration policies and processes, including: continued analysis of a borrower's ability and willingness to make all payments associated with the contractual arrangements (including reviews of the performance of underlying assets, eg for securitisation exposures or project finance); monitoring of documentation, legal covenants, contractual requirements, collateral and other forms of credit risk mitigation; and an appropriate exposure grading or classification system;
   4. effective information systems for accurate and timely identification, aggregation and reporting of credit risk exposures to the bank's board and senior management on an ongoing basis;
   5. prudent and appropriate credit limits consistent with the bank's risk appetite, risk profile and capital strength, which are understood by and regularly communicated to relevant staff;
   6. exception tracking and reporting processes that ensure prompt action at the appropriate level of the bank's senior management or board where necessary; and
   7. effective controls (including in respect of the quality, reliability and relevance of data and in respect of validation procedures) around the use of models to identify and measure credit risk and set limits.
4. The supervisor determines that banks have policies and processes to monitor the total indebtedness of obligors to which they extend credit and any risk factors that may result in default, including significant unhedged foreign exchange risk.
5. The supervisor requires that banks make credit decisions free of conflicts of interest and on an arm's length basis.
6. The supervisor requires that the credit policy prescribes that major credit risk exposures exceeding a certain amount or percentage of the bank's capital must be decided by the bank's board or senior management. The same requirement applies to credit risk exposures that are especially risky or are otherwise not aligned with the bank's core business activities.
7. The supervisor has full access to information in the credit and investment portfolios and to the bank officers involved in assuming, managing, controlling and reporting on credit risk.

Principle 18:⁵⁶ The supervisor determines that banks have adequate policies and processes for the early identification and management of problem exposures⁵⁷ and the maintenance of adequate provisions⁵⁸ and reserves.⁵⁹

Essential criteria:

1. Laws, regulations or the supervisor require banks to formulate policies, processes and methodologies for grading, classifying and monitoring all credit exposures (including off-balance sheet and forborne exposures⁶⁰) and identifying and managing problem exposures. In addition, laws, regulations or the supervisor require regular reviews by banks of their credit exposures (at an individual level or at a portfolio level for credit exposures with homogeneous characteristics) to ensure appropriate exposure classification, detection of deteriorating exposures and timely identification of problem exposures.
2. Laws, regulations or the supervisor require banks to formulate policies, processes and methodologies for consistently establishing provisions and ensuring appropriate and robust provisioning levels.⁶¹ In addition, laws, regulations or the supervisor require banks to formulate policies and processes for writing off problem exposures where recovery is unlikely or where the exposures have very little recovery value.
3. The supervisor determines that the bank's board approves and regularly reviews significant policies for classifying exposures, determining provisions and managing problem exposures and write-offs. The supervisor also determines that the board oversees management in a way that ensures that these policies are implemented effectively and fully integrated into the bank's overall risk management process.
4. The supervisor determines that banks have adequate and appropriate policies, processes, methodologies and organisational resources for establishing provisions and write-offs. The supervisor determines that policies, processes and methodologies for the measurement of provisions are appropriate to ensure that provisions and write-offs are timely and reflect realistic repayment and recovery expectations and, where relevant, include appropriate expectations about future credit losses based on reasonable and supportable information. The supervisor determines that banks' credit loss provisions and write-off methodologies and levels are subject to an effective review and validation process conducted by a function independent of the relevant risk-taking function.
5. The supervisor determines that banks have adequate and appropriate policies, processes and organisational resources for:
   1. reviewing and classifying exposures;
   2. the early identification of deteriorating exposures;
   3. ongoing oversight of problem exposures; and
   4. collecting past due obligations.
6. The supervisor obtains information on a regular basis and in relevant detail or has full access to information concerning the classification of exposures, collateral and other risk mitigants, provisions and write-offs. The supervisor requires banks to have adequate documentation to support their classification and provisioning.
7. The supervisor assesses whether banks' classification of exposures is appropriate and whether their determination of provisioning levels is adequate for prudential purposes. The supervisor evaluates banks' treatment of exposures with a view to identifying any material circumvention of the classification and provisioning standards (eg forbearance). If policies, processes or methodologies are inadequate, or if exposure classifications are inaccurate or provisions are deemed to be inadequate for prudential purposes (eg if the supervisor considers existing or anticipated deterioration in exposure quality to be of concern, or if the provisions do not fully reflect losses expected to be realised), the supervisor has the power to take appropriate action, for example through requiring the bank to:Assessments supporting the supervisor's opinion in relation to this and other essential criteria under this principle may be conducted by external experts, with the supervisor reviewing the work of the external experts, including to determine the adequacy of the bank's policies, processes and methodologies for classifying exposures and determining provisions.
   1. revise its policies, processes or methodologies for classification and provisioning;
   2. adjust its classifications of exposures;
   3. increase its levels of provisioning, reserves or capital; or
   4. if necessary, impose other remedial measures.
8. The supervisor requires banks to have appropriate mechanisms in place for regularly assessing the value of risk mitigants, including guarantees, credit derivatives and collateral. The valuation of collateral reflects the net realisable value, considering prevailing market conditions and the time required for realisation.
9. Laws, regulations or the supervisor establish criteria for an exposure to be:
   1. identified as a problem exposure;
   2. identified as non-performing (exposures where full repayment is unlikely or which are 90 days past due for a material amount, or defaulted exposures under either the Basel Framework or the applicable prudential regulation, or credit-impaired exposures according to the applicable accounting framework);
   3. reclassified as performing (the counterparty does not have any material exposure more than 90 days past due, repayments have been made when due over a continuous repayment period, the counterparty's situation has improved so that full repayment of exposure is likely in accordance with the contractual terms, and the exposure is no longer defaulted or impaired); and
   4. classified as a forborne exposure.
10. The supervisor determines that the bank's board obtains timely and appropriate information on the condition of the bank's credit portfolio, including classification of exposures, the level of provisions and reserves, and major problem exposures. The information includes, at a minimum, summary results of the latest credit exposure review process, comparative trends in the overall quality of problem exposures, and measurements of any existing or anticipated deterioration in exposure quality and losses expected to be realised.
11. The supervisor requires that valuation, classification and provisioning, at least for significant exposures, are conducted on an individual item basis. For this purpose, supervisors require banks to set an appropriate threshold for the purpose of identifying significant exposures and to regularly review the level of the threshold.
12. The supervisor regularly assesses any trends and concentrations in risk and risk build-up across the banking sector in relation to banks' problem exposures and considers any observed concentration in the risk mitigation strategies adopted by banks and the potential effect on the efficacy of the mitigant in reducing loss. The supervisor considers the adequacy of provisions and reserves at the bank and banking system level given this assessment.

Principle 19:⁶² The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate concentrations of risk on a timely basis. Supervisors set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties.⁶³ At least for internationally active banks, large exposure requirements are not less stringent than the applicable Basel standard.

Essential criteria:

1. Laws, regulations or the supervisor require banks to have policies and processes that provide a comprehensive bank-wide view of significant sources of concentration risk.⁶⁴ Exposures (including counterparty credit risk exposure) arising from off-balance sheet as well as on-balance sheet items included in both the banking book and trading book are captured. At least for internationally active banks, large exposure requirements are not less stringent than the applicable Basel standard.
2. The supervisor determines that a bank's information systems identify and aggregate on a timely basis exposures creating risk concentrations and large exposure to single counterparties or groups of connected counterparties and facilitate active management of such exposures.⁶⁵
3. The supervisor determines that a bank's risk management policies and processes establish thresholds for acceptable concentrations of risk, reflecting the bank's risk appetite, risk profile and capital strength, which are understood by and regularly communicated to relevant staff. The supervisor also determines that the bank's policies and processes require all material concentrations to be regularly reviewed and reported to the bank's board.
4. The supervisor regularly obtains information that enables concentrations within a bank's portfolio, including sectoral, geographical and currency exposures, to be reviewed.
5. For credit exposure to single counterparties or groups of connected counterparties, laws or regulations explicitly define, or the supervisor has the power to define, a group of connected counterparties to reflect actual risk exposure. The supervisor may exercise discretion in applying this definition on a case by case basis.
6. Laws, regulations or the supervisor set prudent and appropriate requirements to control and constrain large credit exposures to a single counterparty or a group of connected counterparties. "Exposures" for this purpose include all claims and transactions (including those giving rise to counterparty credit risk exposure), whether on-balance sheet or off-balance sheet. The supervisor also determines that banks assess connectedness between counterparties through control relationships and economic interdependence based on objective and qualitative criteria. The supervisor determines that senior management monitors these limits and that they are not exceeded on a solo or consolidated basis.

Additional criterion:

1. In respect of credit exposure to single counterparties or groups of connected counterparties, non-internationally active banks are required to adhere to the limits below:Minor deviations from these limits may be acceptable, especially if they are explicitly temporary or related to very small or specialised banks.
   1. 10% or more of a bank's Tier 1 capital is defined as a large exposure; and
   2. 25% of a bank's Tier 1 capital is the limit for an individual large exposure to a private sector non-bank counterparty or a group of connected counterparties.

Principle 20:⁶⁶ To prevent abuses arising in transactions with related parties⁶⁷ and to address the risk of conflicts of interest, the supervisor requires banks to: enter into any transactions with related parties on an arm's length basis;⁶⁸ monitor these transactions; take appropriate steps to control or mitigate the risks; and write off exposures to related parties in accordance with standard policies and processes.

1. Laws, regulations or the supervisor set out a comprehensive definition of "related parties" that should at least consider all of the elements detailed in footnote 56. The supervisor may exercise discretion in applying this definition on a case by case basis.
2. Laws, regulations or the supervisor require that transactions with related parties are not undertaken on more favourable terms (eg in credit assessment, tenor, interest rates, fees, amortisation schedules, requirements for collateral) than corresponding transactions with non-related counterparties.⁶⁹
3. The supervisor requires that transactions with related parties and the write-off of related party exposures exceeding specified amounts or otherwise posing special risks are subject to prior approval by the bank's board. The supervisor requires that board members with conflicts of interest are excluded from the approval process for granting and managing related party transactions.
4. The supervisor determines that banks have policies and processes to prevent persons benefiting from the transaction (and/or persons related to such a person) or who otherwise have a conflict of interest from being part of the process of granting and managing the related party transaction.
5. Laws or regulations establish, or the supervisor sets on a general or case by case basis, limits for exposures to related parties⁷⁰ or require such exposures to be collateralised or deducted from capital.⁷¹ When limits are only set on aggregate exposures to related parties, those are at least as strict as those for single counterparties or groups of connected counterparties under Principle 19.
6. The supervisor determines that banks have policies and processes to:The supervisor determines that exceptions to policies, processes and limits are reported to the appropriate level of the bank's senior management and, if necessary, to the board, for timely action. The supervisor also determines that senior management monitors related party transactions on an ongoing basis, and that the board also provides oversight of these transactions.
   1. identify individual exposures to and transactions with related parties as well as the total amount of exposures; and
   2. monitor and report on them through an independent credit review or audit process.
7. The supervisor obtains and regularly reviews information on aggregate exposures to related parties. Supervisors require banks to report (or the supervisor acquires this information through other means) individual related party transactions that are material (eg those exceeding a specified amount or a percentage of the bank's Tier 1 capital).

Principle 21:⁷² The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate country risk⁷³ and transfer risk⁷⁴ in their international lending and investment activities on a timely basis.

1. The supervisor determines that a bank's policies and processes adequately consider the identification, measurement, evaluation, monitoring, reporting and control or mitigation of country risk and transfer risk. The supervisor also determines that the processes are consistent with the risk profile, systemic importance and risk appetite of the bank, consider market and macroeconomic conditions, and provide a comprehensive bank-wide view of country and transfer risk exposure. Exposures (including, where relevant, intragroup exposures) are identified, monitored and managed on a regional and an individual country basis (in addition to the end-borrower/end-counterparty basis). Banks are required to monitor and evaluate developments in country risk and in transfer risk and apply appropriate countermeasures.
2. The supervisor determines that a bank's strategies and policies for the management of country and transfer risks have been approved and are regularly reviewed by the bank's board. The supervisor also determines that the board oversees management in a way that ensures that these policies are implemented effectively and fully integrated into the bank's overall risk management process.
3. The supervisor determines that banks have information systems, risk management systems and internal control systems that accurately aggregate, monitor and report country exposures on a timely basis; and ensure adherence to established country exposure limits.
4. There is supervisory oversight of the setting of appropriate provisions against country risk and transfer risk, which may include the following:
   1. The supervisor (or relevant authority) decides on appropriate minimum provisioning by regularly setting fixed percentages for exposures to each country, considering prevailing conditions. The supervisor reviews minimum provisioning levels where appropriate.
   2. The supervisor (or relevant authority) regularly sets percentage ranges for each country, considering prevailing conditions, and the banks may decide, within these ranges, which provisioning to apply for their individual exposures. The supervisor reviews percentage ranges for provisioning purposes where appropriate.
   3. The bank itself sets percentages or guidelines or even decides on the appropriate provisioning for individual exposures. The adequacy of the provisioning will then be judged by the external auditor and/or by the supervisor.
5. The supervisor regularly obtains and reviews sufficient and timely information on the country risk and transfer risk of banks. The supervisor has the power to obtain additional information, as needed (eg in crisis situations).

Principle 22:⁷⁵ The supervisor determines that banks have an adequate market risk management process that considers risk appetite, risk profile, market and macroeconomic conditions, and the risk of a significant deterioration in market liquidity. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate market risks on a timely basis.

Essential criteria:

1. Laws, regulations or the supervisor require banks to have appropriate market risk management processes that provide a comprehensive bank-wide view of market risk exposure. The supervisor determines that the processes are consistent with the risk appetite, risk profile, systemic importance and capital strength of the bank; that they consider market and macroeconomic conditions and the risk of a significant deterioration in market liquidity; and that they clearly articulate the roles and responsibilities for identifying, measuring, monitoring, reporting and controlling market risk.
2. The supervisor determines that a bank's strategies and policies for the management of market risk have been approved and are regularly reviewed by the bank's board. The supervisor also determines that the board oversees management in a way that ensures that these policies are implemented effectively and fully integrated into the bank's overall risk management process.
3. The supervisor determines that the bank's policies and processes establish an appropriate and properly controlled market risk environment including:
   1. comprehensive risk measurement systems for the accurate and timely identification, aggregation, monitoring and reporting of market risk exposures to the bank's board and senior management;
   2. appropriate market risk limits, which are consistent with the bank's risk appetite, risk profile, capital strength and management's ability to manage market risk and which are understood by and regularly communicated to relevant staff;
   3. exception tracking and reporting processes that ensure prompt action at the appropriate level of the bank's senior management or board, where necessary;
   4. effective controls around the use of models to identify and measure market risk, and set limits; and
   5. sound policies and processes for the allocation of exposures to the trading book.
4. The supervisor determines that there are systems and controls to ensure that banks' marked to market positions are revalued frequently. The supervisor also determines that all transactions are captured on a timely basis and that the valuation process uses consistent and prudent practices and reliable market data verified by a function independent of the relevant risk-taking business units (or, in the absence of market prices, internal or industry-accepted models). To the extent that the bank relies on modelling for the purposes of valuation, the bank is required to ensure that the model is validated regularly by a function independent of the relevant risk-taking business units. The supervisor requires banks to establish and maintain policies and processes for considering valuation adjustments for positions that otherwise cannot be prudently valued, including concentrated, less liquid and stale positions.
5. The supervisor determines that banks hold appropriate levels of capital against unexpected losses and make appropriate valuation adjustments for uncertainties in determining the fair value of assets and liabilities.

Principle 23:⁷⁶ The supervisor determines that banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk in the banking book on a timely basis.⁷⁷ These systems consider the bank's risk appetite, risk profile and market and macroeconomic conditions.

Essential criteria: 

1. Laws, regulations or the supervisor require banks to have an appropriate interest rate risk strategy and interest rate risk management framework that provides a comprehensive bank-wide view of interest rate risk. This includes policies and processes to identify, measure, evaluate, monitor, report and control or mitigate material sources of interest rate risk. The supervisor determines that the bank's strategy, policies and processes are consistent with the risk appetite, risk profile and systemic importance of the bank, that they consider market and macroeconomic conditions, and that they are regularly reviewed and appropriately adjusted, where necessary, in line with the bank's changing risk profile and market developments.
2. The supervisor determines that a bank's strategies and policies for the management of interest rate risk have been approved and are regularly reviewed by the bank's board. The supervisor also determines that the board oversees management in a way that ensures that these policies are implemented effectively and fully integrated into the bank's overall risk management process.
3. The supervisor determines that a bank's policies and processes establish an appropriate and properly controlled interest rate risk environment, including:
   1. comprehensive risk measurement systems for the accurate and timely identification, aggregation, monitoring and reporting of interest rate risk exposures to the bank's board and senior management;
   2. a regular review and independent (internal or external) validation of any models used by the functions tasked with managing interest rate risk (including a review of key model assumptions, eg regarding optional elements (whether implicit or explicit) embedded in a bank's assets, liabilities and/or off-balance sheet items, in which the bank or its customer can alter the level and timing of their cash flows);
   3. appropriate limits, approved by the bank's board and senior management, that reflect the bank's risk appetite, risk profile and capital strength and that are understood by and regularly communicated to relevant staff; and
   4. effective exception tracking and reporting processes which ensure prompt action at the appropriate level of the bank's senior management or board, where necessary.
4. The supervisor obtains from banks the results of their internal interest rate risk measurement systems, expressed in terms of the threat to both economic value and earnings, using standardised interest rate shocks on the banking book.
5. The supervisor assesses whether the internal capital measurement systems of banks adequately capture interest rate risk in the banking book.

Principle 24:⁷⁸ The supervisor sets prudent and appropriate liquidity requirements (which can include either quantitative or qualitative requirements or both) that reflect the liquidity needs of banks. The supervisor determines that banks have a strategy that enables prudent management of liquidity risk and compliance with liquidity requirements. The strategy considers the bank's risk profile, market and macroeconomic conditions, and includes prudent policies and processes, consistent with the bank's risk appetite, to identify, measure, evaluate, monitor, report and control or mitigate liquidity risk over an appropriate set of time horizons. At least for internationally active banks, liquidity (including funding) requirements are not lower than the applicable Basel standards.

Essential criteria: 

1. Laws, regulations or the supervisor require banks to consistently observe prescribed liquidity requirements, including thresholds with reference to which a bank is subject to supervisory action. At least for internationally active banks, the prescribed requirements are not lower than those prescribed in the applicable Basel standards, and the supervisor uses a range of liquidity monitoring tools no less extensive than those prescribed in the applicable Basel standards.
2. The prescribed liquidity requirements reflect the liquidity risk profile of banks (including on- and off-balance sheet risks) in the context of the markets and macroeconomic conditions in which they operate.
3. The supervisor determines that banks have a robust liquidity management framework that requires them to maintain sufficient liquidity to withstand a range of stress events and that includes appropriate policies for managing liquidity risk, which have been approved by the bank's board. The supervisor also determines that these policies and processes provide a comprehensive bank-wide view of liquidity risk and are consistent with the bank's liquidity risk tolerance, risk profile and systemic importance.
4. The supervisor determines that a bank's liquidity strategy, policies and processes establish an appropriate and properly controlled liquidity risk environment, including:
   1. clear articulation of an overall liquidity risk appetite that is appropriate for the bank's business and its role in the financial system, and that is approved by the bank's board;
   2. sound day-to-day and intraday liquidity risk management practices;
   3. comprehensive risk measurement systems for the accurate and timely identification, aggregation, monitoring, reporting and control of liquidity risk exposures and funding needs (including active management of collateral positions) bank-wide;
   4. adequate oversight by the bank's board to ensure that management effectively implements policies and processes for the management of liquidity risk in a manner consistent with the bank's liquidity risk appetite; and
   5. regular review by the bank's board (at least annually) and appropriate adjustment of the bank's strategy, policies and processes for the management of liquidity risk given the bank's changing risk profile and external developments in the markets and macroeconomic conditions in which it operates.
5. The supervisor requires banks to establish, and regularly review, funding strategies, policies and processes for the ongoing measurement and monitoring of funding requirements and the effective management of funding risk. The policies and processes include consideration of how other risks (eg credit, market, operational and reputational risks) may impact the bank's overall liquidity strategy, and include:
   1. an analysis of funding requirements under alternative scenarios;
   2. the maintenance of a cushion of high-quality, unencumbered, liquid assets that can be used, without impediment, to obtain funding in times of stress;
   3. diversification in the sources (including counterparties, instruments, currencies and markets) and tenor of funding, and regular review of concentration limits;
   4. regular efforts to establish and maintain relationships with liability holders; and
   5. regular assessment of the capacity to monetise assets.
6. The supervisor determines that banks have robust liquidity contingency funding plans to handle liquidity problems. The supervisor determines that the bank's contingency funding plan is formally articulated, adequately documented and sets out the bank's strategy for addressing liquidity shortfalls in a range of stress environments without placing reliance on lender of last resort support. The supervisor also determines that the bank's contingency funding plan establishes clear lines of responsibility, includes clear communication plans (including communication with the supervisor) and is regularly tested and updated to ensure it is operationally robust. The supervisor assesses whether the bank's contingency funding plan is feasible (given its risk profile and systemic importance) and requires the bank to address any deficiencies.
7. The supervisor requires banks to include a variety of short-term and protracted bank-specific and market-wide liquidity stress scenarios (individually and in combination), using conservative and regularly reviewed assumptions, into their stress testing programmes for risk management purposes. The supervisor determines that the results of the stress tests are used by the bank to adjust its liquidity risk management strategies, policies and positions and to develop effective contingency funding plans.
8. The supervisor identifies those banks carrying out significant foreign currency liquidity transformation. Where a bank's foreign currency business is significant, or the bank has significant exposure in a given currency, the supervisor requires the bank to undertake separate analysis of its strategy and monitor its liquidity needs separately for each such significant currency. This includes the use of stress testing to determine the appropriateness of mismatches in that currency and, where appropriate, the setting and regular review of limits on the size of its cash flow mismatches for foreign currencies in aggregate and for each significant currency individually. In such cases, the supervisor also monitors the bank's liquidity needs in each significant currency, and evaluates the bank's ability to transfer liquidity from one currency to another across jurisdictions and legal entities.
9. The supervisor determines that a bank's level of encumbered balance sheet assets is managed within acceptable limits to mitigate the risks in terms of the impact on the bank's cost of funding and the implications for the sustainability of its long-term liquidity position. The supervisor requires banks to commit to adequate disclosure and to set appropriate limits to mitigate identified risks.

Principle 25:⁷⁹ The supervisor determines that banks have an adequate operational risk⁸⁰ management framework and operational resilience⁸¹ approach that considers their risk profile, risk appetite, business environment, tolerance for disruption to their critical operations,⁸² and emerging risks. This includes prudent policies and processes to: (i) identify, assess, evaluate, monitor, report and control or mitigate operational risk on a timely basis; and (ii) identify and protect themselves from threats and potential failures, respond and adapt to, as well as recover and learn from, disruptive events to minimise their impact on delivering critical operations through disruption.

Essential criteria:

1. Laws, regulations or the supervisor require banks to have appropriate operational risk management and operational resilience strategies, policies, procedures, systems, controls and processes to:These strategies, policies, procedures, systems and controls are consistent with the bank's risk profile, systemic importance, risk appetite, tolerance for disruption and capital strength, and consider market and macroeconomic conditions and emerging risks.
   1. identify, assess, evaluate, monitor, report and control or mitigate operational risk; and
   2. identify and protect themselves from threats and potential failures, respond and adapt to, as well as recover and learn from, disruptive events to minimise their impact on their delivery of critical operations.
2. The supervisor determines that a bank's board approves and periodically reviews the strategies and policies for its:The supervisor also requires that the board oversee senior management to ensure that these policies are implemented effectively and fully integrated into the overall framework for managing risks across the bank. The supervisor determines that banks have adequate functions⁸³ for the management of operational risk to identify external and internal threats and potential failures in people, processes and systems on an ongoing basis.
   1. management of operational risk for all material products, activities, processes and systems (including the bank's risk appetite for operational risk); and
   2. operational resilience approach (including tolerance for disruption to critical operations).
3. The supervisor determines that the bank has identified its critical operations (consistent with its operational resilience approach) and mapped the people, technology, processes, data, facilities, third parties or intragroup entities and the interconnections and interdependencies among them that are necessary for the delivery of critical operations through disruption.
4. The supervisor determines that banks develop and implement response and recovery plans to manage incidents that could disrupt the delivery of critical operations in line with the bank's risk appetite and tolerance for disruption and that they continuously improve their incident response and recovery plans by incorporating the lessons learnt from previous incidents.
5. The supervisor requires that banks conduct business continuity exercises under a range of severe but plausible scenarios to test their ability to deliver critical operations through disruption. The supervisor reviews the quality and comprehensiveness of the bank's business continuity and disaster recovery plans to assess their ability to deliver critical operations. In doing so, the supervisor determines that the bank can operate on an ongoing basis and minimise losses and interruptions to service provision in the event of a severe business disruption or failure (including but not limited to disruption at a service provider and disturbances in payment and settlement systems).
6. Laws, regulations or the supervisor require banks to implement a robust information and communication technology (ICT)⁸⁴ framework (including cyber security) within their operational risk management framework and operational resilience approach. The supervisor determines that banks have established appropriate policies and processes to identify, assess, mitigate, monitor and manage ICT risks.⁸⁵ These policies and processes also require the board to regularly oversee the effectiveness of the bank's ICT risk management and senior management to routinely evaluate the design, implementation and effectiveness of the bank's ICT risk management. The supervisor also determines that banks have resilient ICT that is subject to protection, detection, response and recovery processes that are regularly tested, incorporate appropriate situational awareness of vulnerabilities and convey relevant timely information for risk management and decision-making processes to fully support and facilitate the delivery of the bank's critical operations.
7. The supervisor assesses whether banks have appropriate processes and effective information systems to:
   1. regularly monitor operational risk profiles and material operational exposures;
   2. compile and analyse operational risk event data, which include internal loss data, and, when feasible, external operational loss event data; and
   3. facilitate appropriate reporting mechanisms at the level of the bank's board, senior management, the independent risk function and the business units that support proactive management of operational risk and operational resilience.
8. The supervisor requires banks to have appropriate reporting mechanisms to keep the supervisor apprised of developments affecting their operational risk, including reporting of incidents that disrupt critical operations, and their severity.
9. Laws, regulations or the supervisor require the board and senior management to understand the risks associated with bank activities performed by service providers and ensure that effective risk management policies and processes are in place to manage these risks. The supervisor determines that banks have established appropriate policies and processes to assess, manage and monitor bank activities performed by service providers. The supervisor determines that banks' third-party risk management policies cover:
   1. procedures for determining whether and how activities can be provided by service providers, and conducting appropriate due diligence for selecting potential service providers;
   2. sound structuring of the service providers' provision, including ownership and confidentiality of data, as well as termination rights;
   3. managing and monitoring the risks associated with the service provider arrangement, including the financial condition of the service provider;
   4. maintaining an effective control environment at the bank over the service provider, which includes a register of outsourced activities, metrics and reporting to facilitate service provider oversight;
   5. managing dependencies on arrangements, including (but not limited to) those of service providers, for the delivery of critical operations;
   6. maintaining viable contingency planning and developing exit strategies to demonstrate the bank's operational resilience in the event of a failure or disruption at a service provider impacting the provision of critical operations.⁸⁶ The bank's business continuity plans should assess the substitutability of the service providers that it uses for critical operations and other viable alternatives that may facilitate operational resilience in the event of an outage at a service provider, such as bringing the activity back in-house;
   7. execution of comprehensive contracts and/or service level agreements that ensure a clear allocation of responsibilities between the service provider and the bank; and
   8. the bank's right to inspect the service provider's books and records and ability to request reporting (eg audit reports), and permission for the bank's supervisor to access, directly or via the supervised bank, documentation, data and any other information related to the provision of the activity to the bank.
10. The supervisor determines that senior management has established a change management process⁸⁷ that is comprehensive, appropriately resourced, adequately divided up between the risk management and control functions, and conducive to the assessment of potential effects on the delivery of critical operations and on their interconnections and interdependencies.

Additional criteria:

1. The supervisor regularly identifies any common points of exposure across banks to operational risk or potential vulnerability (eg reliance of many banks on a common service provider, disruption to service providers of payment and settlement activities, exposures to losses from physical risks or from geopolitical events).
2. The supervisor assesses concentration risk-related arrangements, and potential systemic risks arising from the concentration of services provided by specific service providers to banks within its jurisdiction.

Principle 26:⁸⁸ The supervisor determines that banks have adequate internal control frameworks to establish and maintain an effectively controlled and tested operating environment for the conduct of their business, considering their risk profile. These include clear arrangements for delegating authority and responsibility; separation of the functions that involve committing the bank, paying away its funds, and accounting for its assets and liabilities; reconciliation of these processes; safeguarding the bank's assets; and appropriate independent⁸⁹ internal audit (including those that are outsourced or co-sourced), compliance and other control functions to test adherence to and effectiveness of these controls as well as applicable laws and regulations.

Essential criteria:

1. Laws, regulations or the supervisor require banks to have internal control frameworks that are adequate to establish an effectively controlled and tested operating environment for the conduct of their business, considering their risk profile with a forward-looking view.⁹⁰ These controls are the responsibility of the bank's board and/or senior management and deal with organisational structure, accounting policies and processes, checks and balances, and the safeguarding of assets and investments (including measures for the prevention and early detection and reporting of misuse, such as fraud, embezzlement, unauthorised trading and computer intrusion). More specifically, these controls address:
   1. organisational structure: definitions of duties and responsibilities, including clear delegation of authority (eg clear loan approval limits), decision-making policies and processes, separation of critical functions (eg business origination, payments, reconciliation, risk management, accounting, audit and compliance);
   2. accounting policies and processes, such as but not limited to: reconciliation of accounts, control lists, information for management;
   3. checks and balances (or "four-eyes principle"): segregation of duties, cross-checking, dual control of assets, double signatures; and
   4. safeguarding assets and investments: including physical control and computer access.
2. The supervisor determines that there is an appropriate balance in the skills and resources of the back office, control functions and operational management relative to the business origination units. The supervisor also determines that the staff of the back office and control functions have sufficient expertise and authority within the organisation (and, where appropriate, in the case of control functions, sufficient access to the bank's board) to be an effective check and balance to the business origination units.
3. The supervisor determines that banks have an adequately staffed, permanent and independent compliance function that assists senior management in managing effectively the compliance risks faced by the bank. The supervisor determines that staff within the compliance function are suitably trained, have relevant experience and have sufficient authority within the bank to perform their role effectively. The supervisor determines that the bank's board exercises oversight of the management of the compliance function.
4. The supervisor determines that banks have an independent, permanent and effective internal audit function (including those that are outsourced or co-sourced) charged with:
   1. assessing whether existing policies, processes and internal controls (including risk management, compliance and corporate governance processes) are effective and appropriate and remain sufficient for the bank's business; and
   2. ensuring that policies and processes are complied with.
5. The supervisor determines that the internal audit function:
   1. has sufficient resources and that staff are suitably trained and have relevant experience to understand and evaluate the business they are auditing;
   2. has appropriate independence and is accountable to the bank's board or to an audit committee of the board, and its status within the bank ensures that senior management reacts to and acts upon its recommendations;
   3. is kept informed in a timely manner of any material changes made to the bank's risk management strategy, policies or processes;
   4. may communicate with any member of staff and has full access to records, files or data of the bank and its affiliates, whenever relevant to the performance of its duties;
   5. employs a methodology that identifies the material risks run by the bank;
   6. prepares an audit plan, which is reviewed regularly, based on its own risk assessment and allocates its resources accordingly; and
   7. has the authority to assess any outsourced functions.

Principle 27:⁹¹ The supervisor determines that banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance with accounting policies and practices that are widely accepted internationally and annually publish information that fairly reflects their financial condition and performance and bears an independent external auditor's opinion. The supervisor also determines that banks and parent companies of banking groups have adequate governance and oversight of the external audit function.

1. The supervisor⁹² holds the bank's board and management responsible for ensuring that financial statements are prepared in accordance with accounting policies and practices that are widely accepted internationally and for ensuring that these are supported by recordkeeping systems to produce adequate and reliable data.
2. The supervisor holds the bank's board and management responsible for ensuring that the financial statements issued annually to the public bear an independent external auditor's opinion as a result of an audit conducted in accordance with internationally accepted auditing practices and standards.
3. The supervisor determines that banks use valuation practices consistent with accounting standards widely accepted internationally. The supervisor also determines that the framework, structure and processes for fair value estimation are subject to independent verification and validation, and that banks document any significant differences between the valuations used for financial reporting purposes and for regulatory purposes.
4. Laws, regulations or the supervisor set out the scope of external audits of banks and the standards to be followed in performing such audits. These should be aligned with internationally accepted standards and require the use of a risk- and materiality-based approach in planning and performing the external audit.
5. Supervisory guidelines or local auditing standards determine that audits cover several areas, including but not limited to the loan portfolio, loan loss provisions, non-performing exposures, asset valuations, trading and other securities activities, derivatives, asset securitisations, consolidation of off-balance sheet vehicles and other involvement with such vehicles, and the adequacy of internal controls over financial reporting.
6. The supervisor has the power to reject and rescind the appointment of an external auditor who is deemed to have inadequate expertise or independence or who is not subject to or does not adhere to established professional standards.
7. The supervisor determines that banks rotate their external auditors (either the firm or individuals within the firm) from time to time.
8. The supervisor meets periodically with external audit firms to discuss issues of common interest relating to bank operations.
9. The supervisor requires the external auditor, directly or through the bank, to report to the supervisor matters of material significance, for example: failure to comply with the licensing criteria or breaches of banking or other laws; significant deficiencies and control weaknesses in the bank's financial reporting process; or any other matters that they believe are likely to be of material significance to the safety and soundness of the bank. Laws or regulations provide that auditors who make any such reports in good faith cannot be held liable for breach of the duty of confidentiality.

Additional criterion:

1. The supervisor has the power to access external auditors' working papers, where necessary.

Principle 28:⁹³ The supervisor determines that banks and banking groups regularly publish information on a consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects their financial condition, performance, risk exposures, risk management strategies and corporate governance policies and processes (including compensation practices). At least for internationally active banks, disclosure requirements are not less stringent than the applicable Basel standards.

1. Laws, regulations or the supervisor require periodic public disclosures⁹⁴ of information by banks on a consolidated and, where appropriate, solo basis that adequately reflect the bank's true financial condition and performance, and adhere to standards promoting comparability, relevance, reliability and timeliness of the information disclosed.
2. The supervisor determines that the required disclosures include both qualitative and quantitative information on a bank's financial performance, financial position, risk management strategies and practices, risk exposures (including information that will help in understanding a bank's risk exposures during a financial reporting period), aggregate exposures to related parties, transactions with related parties, accounting policies, business models, management, governance (including major share ownership and voting rights) and compensation practices. The scope and content of the information provided and the level of disaggregation and detail are commensurate with the risk profile and systemic importance of the bank. At least for internationally active banks, disclosure requirements are not less stringent than the applicable Basel standards.
3. Laws, regulations or the supervisor require banks to disclose all material entities in the group structure.
4. The supervisor or another authority effectively reviews and enforces compliance with disclosure standards.
5. The supervisor or other relevant authorities regularly publish information on the banking system in aggregate to facilitate public understanding of the banking system and the exercise of market discipline. Such information includes aggregate data on balance sheet indicators and statistical parameters that reflect the principal aspects of banks' operations (balance sheet structure, capital ratios, income earning capacity and risk profiles).

Principle 29:⁹⁵ The supervisor determines that banks have adequate policies and processes, including robust and risk-based⁹⁶ customer due diligence (CDD) rules and effective compliance functions to promote high ethical and professional standards in the financial sector and prevent the bank from being used intentionally or unintentionally for criminal activities.⁹⁷

Essential criteria:

1. Laws or regulations establish the duties, responsibilities and powers of the supervisor related to the supervision of banks' internal controls and enforcement of compliance with the relevant laws and regulations regarding criminal activities.
2. The supervisor determines that banks have adequate policies and processes that promote high ethical and professional standards and prevent the bank from being used intentionally or unintentionally for criminal activities. This includes the monitoring, detection and prevention of criminal activity, and reporting of such suspected activities to the appropriate authorities.
3. In addition to reporting to the financial intelligence unit or other designated authorities, banks report suspicious activities and incidents of fraud to the banking supervisor if such activities/incidents are material to the safety, soundness or reputation of the bank.⁹⁸
4. If the supervisor becomes aware of any additional suspicious transactions, it informs the financial intelligence unit and, if applicable, other designated authorities of such transactions. In addition, the supervisor directly or indirectly shares information related to suspected or actual criminal activities with relevant authorities, in a timely manner.
5. The supervisor determines that banks establish CDD policies and processes that are well documented and communicated to all relevant staff. The supervisor also determines that such policies and processes are integrated into the bank's overall risk management and include appropriate steps to identify, assess, monitor, manage and mitigate the risks of money laundering, terrorist financing and proliferation financing with respect to customers, countries and regions, as well as to products, services, transactions and delivery channels on an ongoing basis. The CDD management programme, on a group-wide basis, has as its essential elements:
   1. a customer acceptance policy that identifies business relationships that the bank will not accept (or will be terminated) based on identified risks;
   2. an ongoing customer identification, verification and due diligence programme, which encompasses verification of beneficial ownership, understanding the purpose and nature of the business relationship, and risk-based reviews to ensure that CDD information is updated and relevant;
   3. policies and processes to monitor transactions on an ongoing basis and identify unusual or potentially suspicious transactions as well as those individuals or entities subject to the United Nations sanctions related to terrorism and proliferation financing;
   4. enhanced due diligence on high-risk accounts (eg escalation to the bank's senior management of decisions on entering into business relationships with these accounts or maintaining such relationships when an existing relationship becomes high-risk);
   5. enhanced due diligence on politically exposed persons (including their family members and close associates) encompassing, among other things, escalation to the bank's senior management of decisions on entering into business relationships with these persons; and
   6. clear rules on what records must be kept on CDD and individual transactions and their retention period. Such records have at least a five-year retention period.
6. The supervisor determines that banks have specific policies and processes regarding correspondent banking and other similar relationships, in addition to normal due diligence. Such policies and processes include:
   1. gathering sufficient information about their respondent banks to understand fully the nature of their business and customer base, their reputation, how they are supervised and whether they have been subject to money laundering, terrorism financing or proliferation financing investigations or regulatory actions;
   2. prohibitions on establishing or continuing correspondent banking relationships with those banks that do not have adequate controls to manage the risk of criminal activities, that are not effectively supervised by the relevant authorities, or that are considered to be shell banks; and
   3. senior management approval for entering into new correspondent banking relationships.
7. The supervisor determines that banks have sufficient controls and systems to prevent, identify and report potential abuses of financial services, including money laundering, terrorism financing and proliferation financing.
8. The supervisor has adequate powers to take action against a bank that does not comply with relevant laws and regulations regarding criminal activities.
9. The supervisor determines that banks have:
   1. requirements for internal audit and/or external experts to independently evaluate the relevant risk management policies, processes and controls. The supervisor has access to their reports;
   2. effective policies and processes to designate a compliance officer at the bank's management level to manage the financial crimes compliance programme, and a dedicated officer to whom potential abuses of the bank's financial services (including suspicious transactions) are reported;
   3. a compliance function with adequate powers, reporting independence, staff and other resources;
   4. adequate screening policies and processes to ensure high ethical and professional standards when hiring staff or when entering into an agency or outsourcing relationship;
   5. ongoing training programmes for their staff, including on CDD and methods to monitor and detect criminal and suspicious activities; and
   6. policies and processes to report criminal activities by staff to competent authorities.
10. The supervisor determines that banks have and follow clear policies and processes for staff to report any issues related to the abuse of the banks' financial services to local management and/or the relevant dedicated officer. The supervisor also determines that banks have and utilise adequate management information systems to provide the banks' boards, management and dedicated officers with timely and appropriate information on such activities.
11. Laws provide that a member of a bank's staff who reports suspicious activity in good faith either internally or directly to the relevant authority cannot be held liable.
12. The supervisor, directly or indirectly, cooperates with relevant domestic and foreign financial sector authorities or exchanges information with them regarding suspected or actual criminal activities present in banks, where this information is for supervisory purposes.
13. Unless another authority is responsible, the supervisor has in-house resources with specialist expertise for addressing criminal activities detected in banks. In this case, the supervisor regularly provides information on the risks of money laundering, terrorism financing and proliferation financing to the banks.
14. The supervisor determines that banks have in place group-wide programmes to address money laundering, terrorist financing and proliferation financing, including policies and procedures for sharing information within the group for these purposes.

Supervision and supervisory practices are not static. The Committee frequently issues new (and revises existing) standards, guidelines and sound practices. These are designed to strengthen regulatory and supervisory regimes, particularly for internationally active banks in Committee member jurisdictions. Supervisors are encouraged to move towards the adoption of updated and new international supervisory standards as they are issued.

Any standards that are consolidated in the Basel Framework are automatically incorporated into the Basel Core Principles when "Basel Framework" is referred to in the text. Similarly, when the Basel Core Principles refer to "applicable standards", this refers to the most recent BCBS standard or guideline that is effective.

The Committee has included this annex as a resource on supervisory practices and emerging risks that have evolved since the last review of the Basel Core Principles. When the next review of the Basel Core Principles is conducted, it will consider whether and how to embed any specific requirements or learnings from these publications within the text of the Core Principles.

This list is updated biennially.

This section presents guidance and a format recommended by the IMF and the World Bank for the presentation and organisation of the Basel Core Principles (BCP) assessment reports by assessors in the context of the FSAP and standalone assessments. A self-assessment⁹⁹ conducted by the country's authorities prior to IMF-World Bank assessments is an essential element in the process and should also follow this guidance and format.

The BCP assessment report should be divided into eight parts:

1. a "summary and main findings" section;
2. a general section providing background information and information on the methodology used;
3. an overview of institutional setting and market infrastructure;
4. a review of preconditions for effective banking supervision;
5. detailed principle-by-principle assessments;
6. a compliance table summarising the results of the assessment;
7. recommended actions; and
8. the authorities' response.

The following paragraphs provide a brief description of each of the eight parts.

A short "summary and main findings section" should provide an overview of the main findings and main recommendations of the report. It should read as an executive summary, with the main findings for several principles aggregated in a few paragraphs under subtitles. For example, assessors may choose to consolidate findings and recommendations under the subtitles of Responsibility, objectives, powers, independence and accountability (principles 1–2), Ownership, licensing and structure (principles 4–7), Methods of ongoing supervision (principles 8–10), Corrective and sanctioning powers of supervisors (principle 11), Cooperation, consolidated, and cross-border banking supervision (principles 3, 12–13), Corporate governance (principle 14), Prudential requirements, regulatory framework, accounting and disclosure (principles 15–29).

A brief introduction and methodology section which provides background information on the assessment conducted, ie the context in which the assessment is being conducted and the methodology used. This section should:

1. Indicate that the scope of the assessment has been selected with the authorities' agreement, mentioning in particular whether the authorities agreed to be assessed and graded on the basis of only the essential criteria or on the basis of additional criteria too. The names and affiliations of the assessors should be mentioned in this section.
2. Mention the sources used for the assessment such as any self-assessments, questionnaires filled out by the authorities, relevant laws, regulations and instructions, and other documentation, such as reports, studies, public statements, websites, unpublished guidelines, directives, supervisory reports and assessments.
3. Identify counterparty authorities and mention, in a generic way, senior officials¹⁰⁰ with whom interviews were held and meetings with other domestic supervisory authorities, private sector participants, other relevant government authorities or industry associations (such as bankers' associations, auditors and accountants).
4. Mention factors that impeded or facilitated the assessment. In particular, information gaps (such as lack of access to supervisory materials or translated documents) should be mentioned, and an indication should be given of the extent to which these gaps may have affected the assessment.¹⁰¹

The third section should provide an overview of the supervisory environment for the financial sector, with a brief description of the institutional and legal setting, in particular the mandate and oversight roles of the different supervisory authorities, the existence of unregulated financial intermediaries and the role of self-regulatory organisations. Furthermore, it should provide a general description of the structure of the financial markets and, in particular, the banking sector, mentioning the number of banks, total assets to gross domestic product, a basic review of banking stability, capital adequacy, leverage, asset quality, liquidity, profitability and risk profile of the sector, and information on ownership, ie foreign versus domestic, state-owned versus privately owned, the existence of conglomerates or unregulated affiliates, and similar information. If the assessment is part of an FSAP, this section can be shorter, summarising and cross-referencing other FSAP documents.

The fourth section should provide an overview of the preconditions for effective banking supervision, as described in this BCP standard. Experience has shown that insufficient implementation of the preconditions can seriously undermine the quality and effectiveness of banking supervision. Assessors should aim to give a factual review of preconditions so that the reader of the report is able to clearly understand the environment in which the banking system and the supervisory framework are operating. This will provide the perspective for a better appreciation of the assessment and grading of individual principles. The review normally should take up no more than one or two paragraphs for each type of precondition and should follow the headings indicated below.

1. Sound and sustainable macroeconomic policies: the review should describe those aspects that could affect the structure and performance of the banking system and should not express an opinion on the adequacy of policies in these areas. It may make reference to analyses and recommendations in existing IMF and World Bank documents, such as Article IV and other Bank and Fund programme-related reports.
2. A well established framework for financial stability policy formulation: the review should indicate the existence or otherwise of a clear framework for macroprudential surveillance and stability policy formulation. It should cover clarity of roles and mandates of the relevant agencies; the mechanisms for effective inter-agency cooperation and coordination; and communication of macroprudential analyses, risks and policies, and their outcomes. Assessors may rely on independent assessments of the adequacy and effectiveness of the framework, where available.
3. A well developed public infrastructure: a factual review of the public infrastructure should focus on elements relevant to the banking system and, where appropriate, it should be prepared in coordination with other specialists on the mission and the IMF-World Bank country teams. This part of the review of the preconditions could cover issues such as the presence of a good credit culture, a system of business laws, including corporate, bankruptcy, contract, consumer protection and private property laws, that is consistently enforced and provides a mechanism for the fair resolution of disputes; the presence of well trained and reliable accounting, auditing and legal professions; an effective and reliable judiciary; an adequate financial sector regulation; and efficient payment, clearing and settlement systems.
4. A clear framework for crisis management, recovery and resolution: the review should cover the availability of a sound institutional framework for crisis management and resolution of banks, and the clarity of the roles and mandates of the relevant agencies. While evidence of effectiveness may be observed in the actual management and resolution of past crises, it may be also available from documentation of the outcomes of crisis simulation exercises conducted in the jurisdiction. Assessors may rely on independent assessments of the adequacy and effectiveness of the framework, where available.
5. An appropriate level of systemic protection (or public safety net): an overview of the safety nets or systemic protection could, for instance, include the following elements: an analysis of the functions of the various entities involved, such as supervisory authorities, the deposit insurer and the central bank. This would be followed by a review of the existence of a well defined process for dealing with crisis situations, such as the resolution of a failed financial institution. This would be combined with a description of the coordination of the roles of the various entities involved in this process. Additionally, in connection with the use of public funds (including central bank funds), a review of whether sufficient measures are in place to minimise moral hazard would be conducted. Moreover, the mechanisms to meet banks' temporary short-term liquidity needs, primarily through the interbank market, but also from other sources, would need to be described.
6. Effective market discipline: a review of market discipline could, for instance, cover issues such as the presence of rules on corporate governance, transparency and audited financial disclosure; appropriate incentive structures for the hiring and removal of managers and board members; protection of shareholders' rights; adequate availability of market and consumer information; disclosure of government influence in banks; tools for the exercise of market discipline, such as the mobility of deposits and other assets held in banks; adequate periodicity of interest rate and other price quotes; an effective framework for mergers, takeovers and acquisitions of equity interests, the possibility of foreign entry into the markets, and foreign-financed takeovers.

BCP assessors should not assess preconditions themselves, as this is beyond the scope of the individual standard assessments. Assessors should rely to the greatest extent possible on official IMF and World Bank documents and seek to ensure that the brief description and comments are consistent. Where relevant, assessors should attempt to include in their analysis the linkages between these factors and the effectiveness of supervision. As described in the next section, the assessment of compliance with individual Core Principles should mention clearly how it is likely to be primarily affected by preconditions that are considered to be weak. If shortcomings in preconditions are material to the effectiveness of supervision, they may affect the grading of the affected Core Principles. Any suggestions aimed at addressing deficiencies in preconditions are not part of the recommendations of the assessment but can be made into general FSAP recommendations within the scope of the FSAP exercise.

The fifth section contains a detailed principle-by-principle assessment, providing a "description" of the system with regard to each criterion within a principle; a grading or "assessment"; and "comments". The template for the detailed assessment is structured as follows.

The "description and findings" section of each criterion should provide information on the practice as observed in the country being assessed. It should cite and summarise the main elements of the relevant laws and regulations. This should be done in such a way that the relevant law or regulation can be easily located, for instance by reference to URLs, official gazettes and similar sources. Insofar as possible and relevant, the description should be structured as follows:

1. banking laws and supporting regulations;
2. prudential regulations, including prudential reports and public disclosure;
3. supervisory tools and instruments;
4. the institutional capacity of the supervisory authority; and
5. evidence of implementation and/or enforcement or the lack of it.

Evidence of implementation and/or enforcement is essential: without the effective use of the powers vested in the supervisor and implementation of rules and regulations, even a well designed supervisory system will not be effective. Examples of practical implementation should be provided by the authorities, reviewed by the assessors and mentioned in the report.¹⁰²

The "assessment" section of the template should contain only one line, stating whether the system is "compliant", "largely compliant", "materially non-compliant", "non-compliant" or "not applicable" as described in BCP20.9 and BCP20.10. There are three assessment options:

1. Unless the country explicitly selects another option, compliance with the Core Principles will be assessed and graded only with reference to the essential criteria.
2. A country may voluntarily choose to be assessed against the additional criteria, in order to identify areas in which it could enhance its regulation and supervision further and benefit from assessors' comments on how this could be achieved. However, compliance with the Core Principles will still be graded only with reference to the essential criteria.
3. To accommodate countries that seek to attain best supervisory practices, a country may voluntarily choose to be assessed and graded against both the essential and the additional criteria. It is anticipated that this will provide incentives to jurisdictions, particularly those that are important financial centres, to lead the way in the adoption of the highest supervisory standards.

The essential criteria set out minimum baseline requirements for sound supervisory practices and are universally applicable in all countries. An assessment of a jurisdiction against the essential criteria must, however, recognise that its supervisory practices should be commensurate with the risk profile and systemic importance of the banks being supervised. In other words, the assessment must consider the context in which the supervisory practices are applied. As with the essential criteria, any assessment against additional criteria should also adopt the principle of proportionality. This principle should underpin assessment of all criteria even if it is not always explicitly referred to in the criteria. For example, a jurisdiction with many systemically important banks or banks that are part of complex mixed conglomerates will naturally have a higher hurdle to clear to obtain a "compliant" grading as compared to a jurisdiction which only has small and non-complex banks that are primarily engaged in deposit-taking and extending loans.

The "comments" section of the template should be used to explain why a particular grading was given. In case of a grading below "compliant", this section should be used to highlight the materiality of the observed shortcomings and indicate which measures would be needed to achieve full compliance or a higher level of compliance. This should also be included in the table on "recommended actions" (see below). This reasoning could be structured as follows:

1. the state of the laws and regulations and their implementation;
2. the state of the supervisory tools and instruments, for instance reporting formats, early warning systems and inspection manuals;
3. the quality of practical implementation;
4. the state of the institutional capacity of the supervisory authority; and
5. enforcement practices.

The "comments" should explain the cases where, despite the existence of laws, regulations and policies, weaknesses in implementation contributed to the principle being graded as less than "compliant". Conversely, when a "compliant" grading was given, but observance was demonstrated by the country through different mechanisms, this should be explained. The "comments" section should also highlight when and why compliance with a particular criterion could not be adequately reviewed, such as where certain information was not provided or where key individuals were unavailable to discuss important issues. Requests for information or meetings should be documented in the "comments" section to clearly demonstrate the assessor's attempts to adequately assess a principle.

Assessors may also include "comments" where they find particularly good practices or rules in some field that might serve as examples and best practice to other countries. Planned initiatives aimed at amending existing or adopting new regulations and practices but which are not yet in effect can receive favourable mentions in this section. Recent legislative, regulatory or supervisory initiatives for which implementation could not be verified should be mentioned in this section as well.

The assessment and accompanying grades should solely be based on the regulatory framework and supervisory practices in place at the time of the assessment and should not reflect planned initiatives aimed at amending existing regulations and practices or adopting new ones. This would be applicable in the case where actions are in process that would result in a higher compliance rating but have not yet been effected or implemented.

When linkages between particular principles are evident, or between preconditions and principles, this section should be used to caution the reader that, although the regulation and practices in principle (x) seem compliant, a "compliant" grading cannot be given because of material deficiencies in the implementation of principle (y) or precondition (z).¹⁰³ While recognising that there could be common deficiencies which are both relevant and material enough to affect the rating of more than one principle, assessors should avoid double-counting as far as possible. If the deficiencies found in linked principles or preconditions are not material enough to warrant a downgrade, this should still be brought out in this section of the template.

Grading should be given to a principle regardless of the level of development of a country. If certain criteria are not applicable given the size, nature of operations and complexity of a country's banking system, grading of the principle should be based on the level of compliance with the applicable criteria only. This must be clearly explained in the relevant section of the report so that a future review can reconsider the grading if the situation changes. The same applies to a "not applicable" grading of a principle.

The sixth section of the report comprises a compliance table, summarising the assessments, principle by principle. This table has two versions: the one that does not include explicit grading (Table 2) is to be used in reports on the observance of standards and codes (or ROSCs; see BCP99.22,¹⁰⁴ the version with grading (Table 1) is to be used in the detailed assessment only. This table should convey a clear sense of the degree of compliance, providing a brief description of the main strengths and, especially, weaknesses with respect to each principle. The template is as follows:

The seventh section comprises a "recommended actions" table providing principle-by-principle recommendations for actions and measures to improve the regulatory and supervisory framework and practices. This section should list the suggested steps for improving the compliance and overall effectiveness of the supervisory framework. Recommendations should be proposed on a prioritised basis in each case where deficiencies are identified. The recommended actions should be specific in nature. An explanation could also be provided as to how the recommended action would assist in improving the level of compliance and strengthening the supervisory framework. The institutional responsibility for each suggested action should also be clearly indicated to prevent overlaps or confusion. Recommendations can also be made regarding deficiencies in compliance with the additional criteria and to principles which are fully compliant but where supervisory practice can still be improved. The table should indicate only those principles for which specific recommendations are being made. The template for the recommended actions is as follows.

The eighth section describes the authorities' response to the assessment.¹⁰⁵ The assessor should provide the supervisory authority or authorities being assessed with an opportunity to respond to the assessment findings, which would include providing the authorities with a full written draft of the assessment. Any differences of opinion on the assessment results should be clearly identified and included in the report. The assessment should allow for greater dialogue, and therefore the assessment team should have had a number of discussions with the supervisors during the assessment process so that the assessment should also reflect the comments, concerns and factual corrections of the supervisors. The authority or authorities should also be requested to prepare a concise written response to the findings ("right of reply"). The assessment should not, however, become the object of negotiations, and assessors and authorities should be willing "to agree to disagree", provided the authorities' views are represented fairly and accurately.

The presentation of assessment results in ROSCs is different from the presentation of the outcome of the DAR described above. The ROSC should comprise all of Section 1 and summaries of Sections 2, 3, 4, 7 and 8. There should be no Section 5 (detailed assessment), and the summary table in Section 6 should be amended to remove the "grades" column. All sections should remove references to the grades. An ROSC is a mandatory attachment to the FSAP reports if a full DAR is not published.