Compliance Framework for Non-Stock Savings and Loan Association

BANOKO SeNrnaL NG PILIPtNAS OFFICE OF THE GOVERNOR ctRcuLAR NO. LCIt6 Series of 2018 Subject: Compliance Framework for Non-Stock Savings and Loan Associations The Monetary Board, in its Resolution No. 1562 dated 20 September 2018, approved the adoption of a compliance framework for Non-Stock Savings and Loan Associations (NSSLA). Section 1. Section 41805 on the Selection, Appointment, Reporting Requirements and Delisting of External Auditors and/or Auditing Firm, and Sanction is renumbered as the new Section 41895 of the Manual of Regulations for Non-Bank Financial Institutions (MORNBFI). Section 41805 is hereby amended to read as follows: Sec. 41805 Compliance Risk Management. lt is the policy of the Bangko Sentral to promote the safety and soundness of operations and activities of Non-Stock Savings and Loan Associations (NSSLAs). Toward this end, the trustees and officers of the NSSLA, who are expected to conduct and manage the affairs of the NSSLA in a laMul and orderly manner, shall establish a dynamic and responsive compliance risk management system, prescribed in this Section, as an integral part of the culture and risk governance framework of the NSSLA. In this respect, the compliance risk management system shall be the responsibility and shared accountability of all personnel, officers, and the board of trustees. The compliance risk management system shall be designed to specifically identify and mitigate risks that may erode the franchise value of the NSSLA, such as risk of legal or regulatory sanctions, material financial loss, or loss to reputation, an NSSLA may suffer as a result of its failure to comply with laws, rules and regulations, and codes of conduct applicable to its activities. Said risk may also arise from failure to manage conflict of interest, treat members fairly, comply with agreements with and internal policies of the finance centers andlor mother company, or effectively manage risks arising from money laundering and terrorist financing activities. As such, a compliance risk management system found to be materially inadequate may be construed as an act, practice or omission prejudicial to the interest of members. Subsec. 41805.1 Compliance function. The compliance function shall have a formal status within the organization. lt shall be established by a charter or other formal document approved by the board of trustees that defines the compliance function's A. Mqbini St., Molofe 1004 Monilo, Philippines . (6321708-7701 * www.bsp.gov.ph * [email protected]

standing, authority, and independence. The compliance function shall have the right to obtain access to information necessary to carry out its responsibilities, conduct investigations of possible breaches of the compliance policy, and shall have direct access to the board of trustees or appropriate board-levelcommittee. The compliance function shall facilitate effective management of compliance risk by: 4. Advising the board of trustees and senior management on relevant laws, rules and regulations, and standards, including keeping them informed on developments in the area; b. Apprising NSSLA personnel on compliance issues, and acting as a contact point within the NSSLA for compliance queries from NSSLA personnel; c. Establishing written guidance to staff on the appropriate implementation of laws, rules and regulations, and standards through policies and procedures and other documents contained in compliance manuals, internal codes of conduct, and practice guidelines; d. ldentifying, documenting, and assessing the compliance risks associated with the NSSLA's business activities, including new products and business units; e. Assessing the appropriateness of the NSSLA's compliance procedures and guidelines, promptly following up any identified deficiencies, and where necessary, formulating proposals for amendments; f. Monitoring and testing compliance by performing sufficient and representative compliance testing; and 9. Maintaining a constructive working relationship with the Bangko Sentral and other regulators. Subsec.4180S.2 Compliance program. The compliance program shall set out the planned activities of the compliance function, such as the review of the implementation of specific policies and procedures; conduct of compliance risk assessment and compliance testing; educating staff on compliance matters; and monitoring compliance risk exposures. The program shall espouse a risk based approach and shall have appropriate coverage across businesses and units. For this purpose, the compliance program shall be updated on a regular basis or at least annually. Subsec.4180S.3 Chief Compliance Officer (CCOI. The CCO should have the necessary qualifications, experience, and professional background and should have a sound understanding of relevant laws and regulations and their potential impact on the NSSLA's operations. The CCO should be up-to-date with the developments in laws, rules and regulations maintained through continuous training. The CCO shall serve on a full-time basis and shall functionally report to the board of trustees or board- levelcommittee.

NSSLAs operating on a business model deemed "simple"l by the Bangko Sentral, by virtue of their scale and complexity of activities, may designate its Internal Auditor to serve as the CCO in concurrent capacity. "Simple" NSSLAs may also designate a non- executive trustee to serve in a concurrent capacity as the CCO or Internal Auditor but not as both CCO and InternalAuditor. An appointed CCO has the burden to prove that he/she possesses all the minimum qualifications and none of the disqualifications of an officer. The CCO shall submit to the Bangko Sentral proof of such qualifications2. Non-submission of complete documentary requirements within the prescribed period shall be construed as his/her failure to establish his/her qualifications for the positions and results in his/her removal as CCO. The Bangko Sentral shall also consider its own records in determining the qualifications of CCO. The CCO shall oversee the identification and management of the NSSLA's compliance risk and shall supervise the compliance function staff. The CCO is expected to liaise with the Bangko Sentral on compliance related issues and shall also be responsible for ensuring the integrity and accuracy of all documentary submissions to the Bangko Sentral. The CCO shall functionally meet/report to the board of trustees or board-level committee and such meetings shall be duly minuted and adequately documented. In this regard, the board of trustees/ board-level committee shall review and approve the performance and compensation of the CCO, and budget of the compliance function. Subsec. 41805.4 Responsibilities of the board of trustees and senior management. Aside from the duties and responsibilities of the board of trustees mentioned under Section 41415 and its Subsections, the board of trustees shall, among others, ensure that it is aware of and understands the relevant laws, rules and regulations affecting the NSSLA's operations; approve and regularly review the compliance risk strategy and policy; and ensure that the compliance function has proper status in the organization, has adequate staff and resources, and carry out its responsibilities independently, objectively and effectively. The board of trustees shall ensure that a compliance program is defined for the NSSLA and that compliance issues are resolved expeditiously. For this purpose, a board-level committee such as Audit Committee, chaired by a non-executive trustee, shall oversee the compliance program. Simple NSSLAS shall refer to NSSLAs which, due to operational limitations, are not classified as Complex NSSLAS. Complex NSSLAs shall refer to institutions declared by the Bangko Sentral as such with total assets of at least P5 billion and having at least any one (1) of the following characteristics: (l)Extensive membership base such as those which membership extends to employees/retirees of two or more companies/agencies/institutions, and/or their relatives, and/or with serious issue on the "well-defined" group requirement under R.A. No. 8367; or (2)Use of non-conventional business model, such as those using non-traditional delivery platform such as electronic platforms and agents. Using the list in Appendix Q-57 as a guide

Senior management, with the CCO as lead operating officer, shall be responsible for the consistent implementation and adherence of personnel among others, to the pre-defined compliance standards. Senior management, through the CCO, should periodically report to the board of trustees or board-level committee matters that affect the design and implementation of the compliance program. Any changes, updates and amendments to the compliance program must be approved by the board of trustees. However, any material breaches of the compliance program shall be reported to and promptly addressed by the CCO within the mechanisms defined by the compliance manual. Subsec.4180S.5 (Reservedf Subsec. 41805.6 Outsourcing of compliance risk assessment and testing.' The review, assessment and testing of the compliance program may be outsourced to qualified third parties. The handling and management of this outsourcing arrangement shall be governed by Section 41905. Section 2. The reference to Section 41805 in the title of Appendix S-8 of the MORNBFI is hereby changed to Section 41895, as follows: Appendix Existing Title New Title Appendix S-8 Guidelines to Govern the Guidelines to Govern the Selection, Appointment, Selection, Appointment, Reporting Requirements and Reporting Requirements and Delisting of External Auditors Delisting of External Auditors and/or Auditing Firm of and/or Auditing Firm of Covered Entities (Appendix Covered Entities (Appendix to Secs. 41805 and 41905) to Secs. 41895 and 41905) Section 3. Effectivity. This Circular shall take effect fifteen (15) calendar days following its publication either in the Official Gazette or in a newspaper of general circulation. lo"\"t ln^ DIWA GUINIGUNDO 4- a/t 2018