1 OSFI’s Approach to Consolidated Supervision OSFI International Advisory Group 3rd SEACEN-OSFI Seminar on Consolidated Supervision Hosted by the State Bank of Vietnam May 5 - 9, 2008 Da Nang, Vietnam Leo Querel International Advisory Group 附件三

2 2 Risk Based Supervision Discussion Points OSFI’s Approach to Consolidated Supervision OSFI’s Supervisory Framework Key Principles Significant Activities Supervisory Assessment of Risks and Risk Management Oversight in regulated FIs

3 3 OSFI’s Approach to Consolidated Supervision OSFI’s Guide for Incorporating Banks and Federally Regulated Trust and Loan Companies and Guide to Foreign Bank Branching each emphasize the importance of regulatory co-operation and the “supervisibility” of all affiliates within a corporate group. As part of the licensing of a foreign bank subsidiary or branch, OSFI will consider the nature and degree of supervision of the foreign bank in its home jurisdiction. As part of such a bank’s application, it is asked to provide information on the type and scope of supervision in its home jurisdiction, thereby demonstrating that the bank’s subsidiary or branch is subject to comprehensive supervision and regulation. A key consideration is to determine whether (and the quality) the home country supervisor practices comprehensive consolidated supervision over the global operations of its banks.

4 4 OSFI’s Approach to Consolidated Supervision In the case of a foreign bank branch, OSFI only supervises the foreign bank’s business in Canada and is not the primary regulator of that foreign bank. OSFI expects that the home supervisor, in exercising its oversight of the global operations of the foreign bank, will seek information about the local operations of that bank. OSFI will take the necessary steps to advise the home country supervisor of any remedial actions with respect to the local operations of the foreign bank.

5 5 OSFI’s Approach to Consolidated Supervision OSFI has access to all the records of a bank. The provisions of the Bank Act require a bank to allow access to the records of corporate bodies controlled by the bank. This includes any non-domestic operations, subsidiaries or affiliated companies of the bank. OSFI is empowered under Canadian law to examine all the assets of a bank, regardless of location, on a consolidated basis. Banks are required to provide assurances to provide access to records of controlled domestic and foreign subsidiaries and the Superintendent is authorized to enter into agreements with foreign regulators in that regard. OSFI has the authority to impose prudential standards on a consolidated basis for the banking organization. OSFI uses its authority to establish prudential standards on a consolidated basis to cover such areas as capital adequacy, large exposures and lending limits. The capital standards are applied on a consolidated basis, as well as to each deposit-taking entity in the consolidated group

6 6 OSFI’s Approach to Consolidated Supervision All regulatory filings are prepared on a consolidated basis. OSFI’s powers of supervision are on a bank-consolidated basis. The Bank Act, its regulations, and the guidelines issued by OSFI identify the limits of the activities into which a bank may enter. This authority extends to wherever the bank’s activities are located. OSFI will extend its supervisory activities into the major risk areas of the bank in other jurisdictions, to the extent concluded to be necessary. In addition, OSFI monitors the relationships of banks with regulatory bodies in other jurisdictions to ensure that the bank is in compliance with all regulatory requirements, on a global consolidated basis.

7 7 OSFI’s Approach to Consolidated Supervision OSFI utilizes a risk-based approach to supervision. It is the responsibility of OSFI to understand the organizational structure and business profile of each bank or banking group, which is a precondition to the development of the risk profile of a bank. “Significant activities” are identified as the first step in the risk assessment process. Where the bank has corporate bodies responsible for activities that are concluded to be of significance in relation to the risk profile of the consolidated group, OSFI will extend its supervisory processes to those corporate bodies. OSFI’s risk-based approach to its supervisory activities includes the evaluation of all significant activities of the bank regardless of whether the respective activity takes place in a foreign branch, joint venture or subsidiary. OSFI applies the same expectations with respect to the bank’s risk management control functions in an overseas operation as would be applied to a domestic operation. The same risk-based supervisory approach is applied toward assessing the adequacy of the offshore risk management control functions as would be applied to a domestic operation.

8 8 OSFI’s Approach to Consolidated Supervision Because FIs are supervised on a consolidated basis, risk assessments are generally made and documented at the group level If the parent and subsidiary are regulated by OSFI, only one supervisory file would be prepared at the consolidated entity level Standalone assessment of a regulated subsidiary may be necessary if: The subsidiary represents a significant part of the consolidated entity and operates independently from the group The subsidiary’s risk management and control practices are distinct from those of the group The subsidiary’s supervisory ratings are materially different from those of the consolidated entity There is need for more in depth review to assess subsidiary’s impact on the consolidated entity

9 9 OSFI’s Approach to Consolidated Supervision OSFI has entered into arrangements with various domestic regulators that include the requirement to provide OSFI with results of any examinations of the regulated securities subsidiaries of the banks. OSFI has formal agreements in the form of Memoranda of Understanding (MoU) with a number of banking supervisors (representing a significant proportion of the domestic banks’ international exposures), covering information exchange and the promotion of regular contact. Other than in accordance with current formal MoU arrangements, information sharing and exchange is on an “on-request”, case-by-case basis and where OSFI is satisfied that the other supervisor(s) will treat the information as confidential and that the information will be used only for supervisory purposes.

10 OVERVIEW OF OSFI’s RISK- BASED SUPERVISORY FRAMEWORK Risk Based Supervision

11 Supervisory Framework Objective to provide an effective process to assess the safety and soundness of regulated FIs Achieved by evaluating FI’s risk profile financial condition risk management processes compliance with applicable laws and regulations

12

13 Supervisory Framework Key Principles Applies to all FIs Consolidated Supervision Risk Focused Reliance on Oversight Functions Conduct Benchmarking Studies, Peer group and ratio analyses Use of Specialists

14 Timely Reporting Intervention Commensurate with Risk Profile of the Institution Provide Supervisory Ratings to FIs Reliance on third parties (e.g. External Auditors) Exercise of Sound Judgment Supervisory Framework Key Principles

15 Focus on significant activities Risk assessment determines degree/frequency of supervision not all areas of an FI will be reviewed each year Supervisory Framework Key Principles

FINANCIAL INSTITUTION RISK MATRIX AS AT Significant Activities MaterialityInherent RisksQuality of Risk Management Net Risk Direction Of Risk Activity 1 Activity 2 Activity 3 Etc… Credit Market Liquidity Insurance Operational Legal & Regulatory Strategic Operational Management Board Oversight Senior Management Risk Management Internal Audit Compliance Financial Analysis Overall Rating CapitalEarnings Composite RatingDirection of RiskTime Frame

Inherent Risk Mitigated by Quality of Risk Management Equals Net Risk/ Direction of Risk Significant Activity Risk Equation

18 Supervisory Framework Track 1 Significant Activities (S.A.) Inherent Risks by S.A. Quality of Risk Management by S.A. (Operational Management + Oversight) Materiality by S.A Overall Net Risk Capital/ Earnings Adequacy of/Access to Capital Earnings Performance Composite Risk Rating Net Risk by S.A. Inherent Risks mitigated by Quality of Risk Management = Net Risk

19 Supervisory Framework Significant Activity Types Major Lines of Business Corporate Lending, Mortgages, Credit Card Process (enterprise-wide) Asset/Liability Management, Investment Management, Strategic Management Unit Geographic unit Subsidiary

20 Materiality Materiality is in relation to the context (structure, size, complexity) of the institution. Materiality of an activity is in terms of the current and/or future impact on the institution’s capital and earnings. Supervisory Framework

21 Materiality Examples of Quantitative Criteria Assets represented by the activity compared to total assets Revenue by activity compared to total revenue Net income before tax for the activity compared to total net income before tax Internal allocation of capital to the activity

22 Supervisory Framework Inherent Risk Categories Inherent Risk is intrinsic to a business activity and arises from exposures and uncertainty from potential future events. (S.F., s.4.2) Risk Categories are: –Credit– Market –Insurance– Operational –Liquidity– Legal and –Strategic Regulatory

23 Supervisory Framework Quality of Risk Management Operational Management Operational Management is responsible for planning, directing and controlling the day-to-day operations of the institution’s business activities. Supervisors assess the effectiveness of operational management for the significant activities.

24 Quality of Risk Management Control Functions Control Functions Board Senior Management Risk Management Internal Audit Compliance Financial Analysis

25 OSFI Senior Management Board Risk Management Internal Audit Compliance E -commerce Wealth Management Financial Analysis Operational Management Line of Business Independent ….Oversight Risk Management Processes Significant Activities Risk Management Oversight Responsibility

Ratings of Risk Management Control Functions (Oversight) Characteristics of the Function Performance of the Function Overall Effectiveness of the Function Performance Indicators Essential Elements Criteria Strong Acceptable Needs Improvement Weak

FINANCIAL INSTITUTION RISK MATRIX AS AT Significant Activities MaterialityInherent RisksQuality of Risk Management Net Risk Direction Of Risk Activity 1 Activity 2 Activity 3 Etc… Credit Market Liquidity Insurance Operational Legal & Regulatory Strategic Operational Management Board Oversight Senior Management Risk Management Internal Audit Compliance Financial Analysis Overall Rating CapitalEarnings Composite RatingDirection of RiskTime Frame

INSTITUTION NAME RISK MATRIX as at [date] Significant ActivitiesMaterialityInherent Risks Operational Management Oversight FunctionsNet RiskDirection of Risk S.A. № 1 S.A. № 2 S.A. № 3 Net Risk & Overall Net Risk Inherent Risks mitigated by Quality of Risk Management = Net Risk ONR

29 Low Moderate Above Average High Overall Net Risk Rating

30 Overall Net Risk Rating Low: The institution has risk management that substantially mitigates risks inherent in its significant activities down to levels that collectively have lower-than-average probability of a material adverse impact on its capital and earnings in the foreseeable future.

31 Supervisory Framework Capital and Earnings Overall Net Risk Earnings Capital Composite Risk

32 Earnings Ratings Strong Acceptable Needs Improvement Weak

33 Earnings Rating Definition Strong: The institution has consistent earnings performance, producing returns that significantly contribute to its long term viability, and there is no undue reliance on non-recurring sources of income to enhance earnings. The earnings outlook for the next 12 months continues to be positive.

34 Capital Ratings Strong Acceptable Needs Improvement Weak

35 Capital Rating Definition Strong: Capital adequacy is strong for the nature, scope, complexity, and risk profile of the institution, and meets OSFI’s target levels. The trend in capital adequacy over the next 12 months is expected to remain positive. Capital management policies and practices are superior to generally accepted industry practices.

36 Supervisory Framework Composite Risk Ratings Low Moderate Above Average High

37 Composite Risk Rating Definition Low: A strong, well-managed institution. The combination of its overall net risk and its capital and earnings makes the institution resilient to most adverse business and economic conditions without materially affecting its risk profile. Its performance has been consistently good, with most key indicators in excess of industry norms, allowing it ready access to additional capital. Any supervisory concerns have a minor effect on its risk profile and can be addressed in a routine manner.

38 Composite Risk Rating Stage Rating Correlation Stage 0 Stage 0 or 1 Stage 1 or 2 Stage 2 and above Composite Risk Ratings Low Moderate Above Average High Intervention Stages

39 Thank You