Revised Compliance Framework for Quasi-Banks (QBs)

BANGKo SENTRAL NG PILIPINAS OFFICE OF THE GOVERNOR ctRcutAR No.8e3 Series of 2015 Subject: Revised Compliance Framework for Quasi-Banks {QBs} The Monetary Board (MB), in its Resolution No. 1758 dated 22 October 2075, approved the revisions to the compliance framework for quasi-bank amending: (i) the entirety of Section 4180Q (2008 - 4197Q/ Compliance System; Compliance Officer) of the Manual of Regulations for Non-Bank Financial lnstitutions (MORNBFI); and (ii) Subsection X180.4 (2011-X180.2) Chiet Compliance Officer of the Manual of Regulations for Banks. t. Section 4180Q is amended to include a statement of policy that shall read as follows: Section 4180Q. Compliance System; Complionce Officer. The Bangko Sentral ng Pilipinas (BSP) actively promotes the safety and soundness of the Philippine banking system through an enabling policy and oversight environment. Such an environment is governed by the high standards and accepted practices of good corporate governance as collectively defined by the BSP and its supervised institutions. Towards this end, a robust, dynamically-responsive and distinctly- appropriate compliance system shall be put in place as an integral component of an institution's internal controls. Subject to the provisions of Subsection 4180Q.4, a Chief Compliance Officer (CCO) shall be appointed to oversee the design of its compliance system and promote its effective implementation. 2. Subsection 4180Q.1 (2008 - 4191Q.1) Compliance System shall focus on the mitigation of business risk and is amended to read as follows: Subsection 4180Q.1 Definition of Business Risk. A compliance system shall be designed to specifically identify and mitigate business risks which may erode the franchise value of the QB. Business risk refers to conditions which may be detrimental to a QB's business model and its ability to generate returns from operations, which in turn erodes its franchise value. Combining business risk with the financial risks arising from the use of borrowed funds generates total corporate risk of the QB. Business risks shall include, but shall not be limited to, the following: l],.itr|ti i1 !;:.,,;:':.t: tiit)1 i'i,

a. Risks to reputation that arise from internal decisions that may damage a QB's market standing; b. Risks to reputation that arise from internal decisions and practices that ultimately impinge on the public's trust of the eB; c. Risks from the actions of a QB that are contrary to existing regulations and identified best practices and reflect weaknesses in the implementation of codes of conduct and standards of good practice; d. Legal risks to the extent that changes in the interpretation or provisions of regulations directly affect a eB's business model. 3. Subsection 4180Q.5 (2008 - 41,91e.5) Storus of the Complionce Function is renumbered as the new Subsection 4180Q.2 and amended to read as follows: Subsection 4180Q.2 Stotus of the Complionce Function. The compliance function shall have a formal status within the organization. lt shall be established by a charter or other formal document approved by the board of directors (BoD) that defines the compliance function's standing, authority and independence, and addresses the following issues: measures to ensure the independence of the compliance function from the business activities of the eB; b. the organizational structure and responsibilities of the compliance unit or department administering the compliance program; c. the relationship of the compliance unit/department with other functions or units of the organization, including the delineation of responsibilities and lines of cooperation; d. its right to obtain access to information necessary to carry out its responsibilities; e. its right to conduct investigations of possible breaches of the compliance policy; f. its formal reporting relationships to senior management (sM) the , BOD, and the appropriate board-level committee; and g. its right of direct access to the BoD and to the appropriate board- levelcommittee. The compliance charter or other formal document defining the status of the compliance function shall be communicated throughout the organization.

a 4. Subsection 4180Q.1 (2008 - 4191Q.11 Compliance System is renumbered as the new Subsection 4180Q.3 and amended to read as follows: Subsection 4180Q.3 Complionce System. The compliance system shall have the following basic elements: a. A formal written document (i.e., Compliance Manual) that reflects the compliance program approved by the BOD. (1) The compliance program shall be distinguished from the risk program and the internal audit program. While compliance mitigates business risks as defined in Subsection 4180Q.1, the risk program covers financial risks that arise from the balance sheet exposures of the institution. The internal audit program, on the other hand, shall review on an ex-post basis whether prescribed guidelines of the QB were followed in administering transactions, handling procedures, making decisions, and undertaking related activities. (2) The compliance program shall take into account the size and complexity of operations of the QB. It must clearly identify the avenues through which business risks may occur for the QB. Correspondingly, compliance measures effectively suited to the operations of the QB in order to mitigate said business risks shall be institutionalized in the QB through the compliance p rogra m. (3) An appropriate organizational structure must be in place to manage the compliance function and execute the approved compliance program. The compliance function shall be manned by full-time officers/ staff either embedded in operating departments, or in a department operating on its own. Coordination with the respective department heads shall be the responsibility of the CCO. (4) In addition to the organizational structure, the duties and responsibilities of the CCO and other personnel involved in the compliance function must be defined explicitly. (5) A compliance system which does not consistently ensure the integrity and the accuracy of documentary submissions shall be deemed as a basis to assess a QB as involved in unsafe and unsound practices.

'a The President and the CCO shall execute an affidavit, under oath, that the compliance system has been approved by the BOD and that the Compliance Manual reflects said approved system. The program shall be updated at least annually to incorporate changing responses to evolving internal and external cond itions. b. A constructive working relationship between the QB and Bangko Sentral. The QB, through its CCO and/or other authorized compliance officers, may consult the Bangko Sentral for clarifications on specif ic provisions of related laws and regulations. Similarly, the Bangko Sentral may initiate a dialogue with a QB to discuss the compliance program of the QB and its record of implementation of the same. The QB is enjoined to discuss clarifications of pertinent laws and regulations with other appropriate agencies that issue market regulations and/or tax guidelines. c. Clear and open communication lines within the QB to educate and address compliance matters Officers and staff shall be trained in the normal course of QB operation with respect to the compliance program of the QB and the identified business risks. The processes for imparting to QB personnel and its affiliated parties the necessary appreciation of the QB's compliance culture shall form part of the Compliance Manual. 5. Subsection 4180Q.2 (2008 - 4191Q.2) Complionce Officer is renumbered as the new Subsection 4180Q.4 and amended to read as follows: Subsection 4180Q.4 Chief Complionce Officer a. The CCO is the lead senior officer for purposes of administering the compliance program and interacting with the Bangko Sentral on compliance-related issues. The principal function of the CCO is to oversee the design of an appropriate compliance system, promote its effective implementation and address breaches that may arise. The CCO shall also be responsible for ensuring the integrity and accuracy of all documentary submissions to the Bangko Sentral. b. QBs are deemed operating on a simple business model. As such, QBs shall designate either a full-time CCO or a non-executive

, a, director to serve as the CCO in a concurrent capacity, subject to Subsection X180.4(d) of the Manual of Regulations for Banks. A non-executive director is a member of the board of directors who is not part of the executive committee or day-to-day management of banking operations. Such appointment/designation shall require prior approval of the MB. The CCO's qualifications shall be subject to the provisions of Section 4I42Q of the MORNBFI enumerating the qualifications of QB officers, particularly considering fit and proper criteria such as integrity/probity, competence, education, diligence and experience/ training. The CCO shall have commensurate skills and expertise to provide appropriate guidance and direction to the QB on the development, implementation and maintenance of the compliance program. d. QBs with subsidiaries under Bangko Sentral supervision, ffidv appoint a CCO for the group; Provided, that the parent QB can show to the Bangko Sentral that the compliance function is conducted on a group-wide basis. 6. Su bsection 4180Q.3 (2008 - 419LQ3l Compliance Risk shall be deleted. 7. Subsection 4l-80Q.4 (2008 - 4191Q.4) Responsibilities of the Board of Directors and Senior Monogement on Complionce is renumbered as the new Subsection 4180Q.5 and amended to read as follows: Subsection 4180Q.5 Responsibilities of the board of directors ond senior manogement on complionce, Aside from the duties and responsibilities of the board of directors mentioned under Subsection 4141Q.3, the board shall ensure that a compliance program is defined for the QB and that compliance issues are resolved expeditiously. For this purpose, a board-level committee, chaired by a non-executive director, shall oversee the compliance program. Ensuring that QB personnel and affiliated parties adhere to the pre- defined compliance standards of the QB rests collectively with senior management, of which the CCO is the lead operating officer on compliance. Senior management, through the CCO, should periodically report to the board of directors or its designated committee matters that affect the design and implementation of the compliance program. Any changes, updates and amendments to the compliance program must be approved by the board of directors. However, any material breaches of the compliance program shall be reported to and promptly addressed by the CCO within the mechanisms defined by the compliance manual. 8. Subsection 4180Q.6 (2008 - 4191Q.6) lndependence of Compliance Function shall be deleted.

a' l, ' .r' 3', 9. Subsection 4180Q.7 (2008 - 4191Q.7) Role and responsibilities oI the complionce function shall be deleted. l0.subsection 4180Q.8 (2008 - 4191Q.8) cross-border issues shall be re- numbered as the new Subsection 4180Q.6. - 1L. Subsection 4180Q.9 (2008 4191Q.9) Outsourcing of amplionce function shall be renumbered asthe newSection 4180Q.7 and shall be amended as follows: Subsection 4180Q.7 Outsourcing ol ampliance risk osressment ond testing. The review, asessment and testing of the compliance program may be outsourced to qualified third parties. The handling and management of this outsourcing arrangement shall be governed by Section 4162Q of the MORNBFI. 12. Subsection X180.4 (2011 - X180.2) of the Manual of Regulations for Banks shall be amended to read as follows: "Subsection X180.4 (20L1- XL80.2) Chief Compliance Officer a. The CCO is the lead senior officer for purposes of administering the compliance program and interacting with the BSP on compliance-related issues. xxx xxx d, Banks with subsidiary banks and quasi-banks may appoint a CCO for the banking group; Provided, that the parent bank can show to the BSP that the compliance function is conducted on a group-wide basis. xxx" This Circular shall take effect fifteen (L5) days following its publication in the Official Gazette or in any newspaper of general circulation in the Philippines. FOR THE MONETARY BOARD: AMAN M. TETANGCO, JR. t6 November 2015