1. Presentation on Compliance Assessment under RESERVE BANK OF INDIA

2. Compliance Review under SPARC –Where does it fit ? Compliance Review Assessed Capital Calculation (Point in Time) Forward Looking Elements of Capital Capital Assessment under SPARC Internal generation of Capital Leverage Ratio Earnings Volatility Ability to infuse Capital Declassification of capital instruments Additional RWA determination Compliance Breaches (PSL) Vs. Compliance Breaches leading to increased risks (IRAC) Compliance breaches – Financial Impact Non-Financial Impact EXPECTED LOSSES UNEXPECTED LOSSES Gaps in recognition of expected losses by the bank will feed into Assessed CRAR Example: Understatement of liabilities Standardised Unexpected Losses

3. Background: Optimization in the Compliance Review Large number of compliance requirements Parameters changed from 283 to 158 to 171 FEMA guidelines included Compliance risk assessment captured in the aggregate risk for the bank Objective Inherent Risk indicator based on ‘Compliance Score’ included in Risk Assessment. Scoring tool provided. Scoping Method provided- Full coverage in three years 171 guidelines to be covered in the period of two years Guidelines related to highest risk area to be covered every year Changes in Compliance Template: 4 Columns to be completed by SSM Sample Checked Exception Samples Recommendations Remarks *Sampling methodology, test plan etc. left to the discretion of SSM

4. Compliance v/s Controls Bank Level Controls (Governance & Oversight) BANK Business Level Controls (Risk Wise) Prescriptive Regulatory Guidelines Bank’s Internal Controls System wide minimum prescription by the regulator for considering certain business activities, Governance issues Bank specific based on complexity, size, volumes and nature of business activities

5. Objective: Under SPARC, risks due to Control Gaps are an assessment of internal control environment in a bank so as to determine the extent of gap in the desired level of inherent risk mitigation Compliance v/s Controls No Control Regulatory requirements Internal Controls based on Bank risk appetite Emerging practices in industry Process for identification, measurement & monitoring of credit concentration risk SBL & GBL limits fixed in line with regulatory ceilings Limits for SBL & GBL as per risk rating of borrower + RAROC based exception matrix Concentration limits at 80% of per SBL & GBL regulatory ceilings + escalation matrix thereafter 5

6. Principles of Compliance Review under SPARC Principle 1: Regulatory guidelines included in the assessment template are not exhaustive. Mandatorily scoped guidelines viz. NOOP, CRR, SLR, Capital, PSL etc. not included in the template SSM to add new guidelines for assessment depending on the bank profile and business model Principle 2: Transaction testing to be undertaken for compliance risk assessment. Sample size and methodology left to the SSM team and his experience- understanding of the risk profile of the bank Principle 3: Compliance functions to verify compliance with the regulatory guidelines In terms of Para 6.3 (ii) of RBI Circular DBS.CO.PP.BC 6/11.01.005/2006-07 dated April 20, 2007 on Compliance in Banks Principle 4: Non compliance with the regulatory guidelines will be taken as negative – Control Design Defect or Control Implementation Defect Principle 5: Control functions would be assessed separately under business risk assessment. Banks are expected to put in place control functions commensurate with the business model and the risks undertaken

7. Assessment of Compliance Environment Tranche III Regulatory Guidelines (171) Compliance Regulation wise information on control environment in the bank, internal audit assurance, compliance check provided in a format to SSM Assessment through compliance tool using information provided in compliance format Discussion with management Compliance Score Compliance Culture Assessment SPARC – Assessment of Compliance Data upload by banks Data Processing and Presentation (Outside IRISc Model) Risk Capital Assessment – Model Inputs (Risk Discovery by SSM) Assessment Sources Assessment

8. Assessment of Compliance Bank’s control Environment Assurance of Internal/External Audit on control environment Compliance department check on audit assurance SSM’s- Risk based Testing Compliance Assessment Compliance Risk Assessment: Input for Inherent risk & risk from control gap Governance & OversightAssessed Capital Action Plan Key RBI Guidelines At bank-controls & assessment of their effectiveness by the bank By SSM-Risk based testing & Mandatory compliance testing

9. Assessment of Compliance: Illustration of information given by bank Bank’s exposure to leasing/hire purchase/factoring ( each of these activities) should not exceed 10 percent of total advances. (DBOD. No.Dir.BC.12/13.03.00/ 2014-15 dated July 1, 2014, Master Circular – Exposure Norms) Policy: Bank's Credit policy states that bank’s exposure to leasing/hire purchase/factoring should not exceed 9% of total advances and same is to be monitored on an ongoing basis. Process: Operations Team attaches checklist to every new deal which includes a point about total exposure as on sanction date being less than 9%. Credit Manager approves this checklist at time of authorizing every deal. Review: Head of Product team obtains the details of portfolios at month end for all the products and checks if exposure guidelines are complied across various products/facilities as per guidelines Internal Audit obtains the month-end balances of portfolios and checks compliance to this guideline and undertakes the following check also: Sampling Methodology: Select Top 5 deals (by amount) from leasing/ hire purchase/ factoring. Testing: For samples selected, verified if the checklist is authorized and portfolio balances on the date of approval of deal obtained to confirm that new deal has not resulted in breach of limits. Compliance team selects the departments/areas to be selected for review so that a large no. of departments are covered under compliance review over period of 3 years. Sampling Methodology and Testing: Sample of 2 smallest deals and 2 largest (by amount) deals are selected for sample and verified that the exposure limit as on sanction date is not breached. Bank Control Environment Assurance of Internal/ External Audit on control environment Guideline Compliance department check on audit assurance

10. Compliance Scoping SSM may scope-in the guidelines reported by bank as NON-COMPLIANT to assess the extent of Non-compliance and identify trends as regards the same. Other Minimum Expectations- Mandatory Scoping SSM should, at a minimum, assess and comment upon bank’s adherence on CRR, SLR, NOOP, Capital Adequacy, Provisions based on IRAC for Advances and Investments in order to assess the solvency of the bank. Guidelines - Non-compliant Status

11. Outcomes of Compliance Review Targeted Scrutiny Commission Audit Thematic Review No Action- Compliance No Action The recommendation should be indicated after considering the controls framework in place (based on controls description provided by bank), number of deviations observed and nature of the deviations/exceptions and other data / information available as part of offsite risk discovery process. Deviation percentage (35% or more, 20%, 10%, 5% etc) Seriousness or intensity of the guideline breached Instances of risk reflection- Focused area – Deep Drive- Targeted Scrutiny Transaction level intensive checking covering complete portfolio  Commissioned Audit

12. Impact of Compliance Assessment Compliance assessment influences the overall risk of failure score assigned to the Bank The following key areas are directly impacted by compliance assessment: Role of Compliance Assessment in SPARC Framework Within operational risk, an assessment of: Score going into one inherent risk indicator Assignment of scores for Governance and Oversight categories of Board, Senior Management and Internal Audit at the Bank Level Assessment of capital levels under SREP after determining the level of non-compliance with key guidelines Under-statement of liabilities Under-provisioning Ineligible capital instruments Determination of the Monitorable Action Plan for the banking entity