Professional Documents
Culture Documents
Atty. Mickel M. Borigas, RSW, REB, REA, LPT, EnP, MAED , MBA, Th.D., J.D., FICD
Roles and responsibilities of the board of directors, senior management, and other stakeholders
in recovery planning
Establishing an effective governance structure for recovery planning
Ensuring accountability and oversight
Financial institutions are required to develop and maintain robust recovery plans to ensure the
continuity of their operations in the event of disruptions caused by various factors such as
natural disasters, technological failures, or other emergencies.
Recovery Planning is essential for financial institutions to ensure their resilience and ability to
continue serving customers and fulfilling their obligations, even in challenging circumstances.
Recovery planning in the banking sector, as mandated by BSP Circular 1158 issued by the
Bangko Sentral ng Pilipinas (BSP), involves adhering to specific guidelines and requirements set
forth by the central bank of the Philippines. Here's an overview of recovery planning in the
banking sector in line with BSP Circular 1158:
Comprehensive Risk Assessment: Financial institutions are required to conduct thorough risk
assessments to identify potential threats and vulnerabilities that could disrupt their operations.
This includes assessing risks related to natural disasters, technological failures, cyberattacks,
and other emergencies.
Business Impact Analysis (BIA): Banks must perform a BIA to evaluate the potential
consequences of disruptions on their critical business processes, services, and infrastructure.
This helps prioritize recovery efforts and resource allocation.
Development of Recovery Strategies: Based on the risk assessment and BIA, banks develop
recovery strategies to mitigate the impact of disruptions. BSP Circular 1158 emphasizes the
importance of having robust recovery strategies in place, including backup systems, alternate
facilities, and crisis communication protocols.
Business Continuity Planning (BCP): Financial institutions are required to develop and maintain
comprehensive BCPs that outline procedures for maintaining essential functions during
disruptions. This includes protocols for employee safety, data backup and recovery, customer
communication, and regulatory compliance.
Disaster Recovery Planning (DRP): BSP Circular 1158 also emphasizes the importance of DRP,
particularly for restoring IT systems and infrastructure following a disruptive event. Banks must
have procedures in place for data recovery, system restoration, and testing of backup systems.
Testing and Exercises: Financial institutions are required to conduct regular testing and
exercises to evaluate the effectiveness of their recovery plans. This includes tabletop exercises,
simulations, and full-scale drills to identify weaknesses and areas for improvement.
Regulatory Compliance: Banks must ensure that their recovery plans comply with the specific
requirements and standards outlined in BSP Circular 1158. Failure to comply with these
regulations can result in penalties and other regulatory actions by the BSP.
Collaboration and Coordination: BSP Circular 1158 also encourages collaboration and
coordination among financial institutions, government agencies, and industry partners. This
helps ensure a cohesive response to large-scale disruptions that may affect the entire financial
system.
SOME GUIDING PRINCIPLES IN CRAFTING RECOVERY PLAN FOR BANK BASED ON BSP
CIRCULAR
5. Banks are expected to adopt a recovery plan that is commensurate to their size,
nature and complexity of operations, overall risk profile, and systemic importance.
COMPONENTS OF RECOVERY PLAN AS MANDATED
c. Critical functions and services which cover the critical activities of the bank and
services enabling the performance of such critical activities;
d. Triggers and early warning indicators which discuss the set triggers and indicators
as well as the procedures related to monitoring, escalation, and approval process;
f. Recovery options which describe the menu of feasible and credible options based
on exogenous and entity-specific assumptions;
h. Preparatory measures which set out the operational and legal pre-positioning
needed to implement recovery options;
i. Testing and simulation exercises which set out the areas that should be covered
in the exercise and the type of assessments that may be conducted, including
reporting and corrective mechanisms; and
j. Review of the recovery plan which includes its elements, relevance and
applicability.
Under BSP Circular 1158, the Bangko Sentral ng Pilipinas (BSP) outlines supervisory
expectations regarding the governance arrangements for the preparation of the
recovery plan. Here are the key supervisory expectations related to governance
arrangements:
1. Board Oversight: The recovery plan should have oversight from the board of
directors or its equivalent governing body. The board should be actively involved in
the approval, review, and oversight of the recovery plan, ensuring that it aligns with
the institution's overall risk appetite and strategic objectives.
3. Clear Roles and Responsibilities: The recovery plan should define clear roles and
responsibilities for individuals and departments involved in its development and
implementation. This includes specifying the duties of key personnel, such as the
recovery plan coordinator and members of the crisis management team.
6. Regular Reporting to the Board: Senior management should provide regular updates
and reports to the board on the status of the recovery plan, including any significant
developments or changes in the institution's risk profile. Adoption and
implementation of communication plan is necessary to ensure that the board
remains informed and can provide appropriate guidance and oversight.
7. Recovery planning process: These processes should fully be integrated into the
bank's business-as usual risk management framework. This is to ensure that the
recovery plan
shall be designed as a comprehensive document that will complement
the existing capital, liquidity, and business contingency plans but shall
have an end view of the bank recovering from extreme stress situations.
The plan shall also cover the established contingency arrangements that
would allow the bank to continue to operate and maintain critical
functions and services as it implements the recovery measures, The
recovery plan shall be consistent with the bank's existing stress testing
exercises as required under Sec.l5l and other risk management guidelines
covering specific risk areas
1. In developing the recovery plan, the bank needs to identify core information crucial
for recovery planning purposes:
a. Critical Functions and Services: The bank must identify and describe critical functions
and services, mapping them to specific entities or units. It should outline actions
necessary to operate and maintain them during plan activation. Additionally, the
bank must ensure compliance with any additional requirements to maintain
membership in financial market infrastructures during crisis situations.
Critical services shall refer to internally and externally provided services needed
to enable the performance of critical functions and management of the bank.
Critical services may include but not limited to internal processes, lT systems,
clearing and settlement facilities, supplier and employee contracts, and
outsourced services.
b. Material Entities: This involves providing detailed descriptions of material entities and
their activities, along with criteria for determining their materiality.
c. Core Business Lines and Operating Model: The bank should give an overview of the
business model of its material entities, identify core business lines, and assess the
viability of these lines in a recovery scenario. It must also identify processes for
determining the value and marketability of these business lines, operations, and assets.
d. Dependencies: The bank must outline key dependencies of material entities, including
internal and external dependencies, and describe governing contractual arrangements.
Key dependencies are those whose sudden and disorderly failure would seriously
impede critical functions and services.
Additionally, the bank should identify linkages between its parent company (if
applicable) and its material entities, as well as operational data such as asset
encumbrance, liquid assets, and off-balance sheet activities.
3. The bank shall maintain up-to-date details of financial contracts entered into by
the bank, including records of counterparties. Similarly, the bank shall maintain
up-to-date details of non-financial contracts pertaining to its critical functions
and services.
4. The bank shall establish appropriate contingency arrangements that will enable
its critical functions and services to continue to operate while recovery measures
are being implemented. Such arrangements may include, but are not limited to
arrangements that would enable the continuous functioning of internal
processes, lT systems, clearing and settlement facilities, and supplier and
employee contracts; and ensure continued rights of use and access to
operational assets such as property and office space.
5 . The bank shall put in place adequate measures such that outsourcing
arrangements, which support critical functions and services can be maintained
in crisis situations and in the recovery process. The underlying contracts should
include provisions that prevent termination from being triggered by recovery
events and facilitate the transfer of the contract to a bridge institution or a third-party
acquirer where necessary should some form of the resolution be required
in the bank cannot restore itself to viability.
1. Preemptive Actions: The recovery plan should facilitate preemptive actions by the bank
at an early stage of stress to prevent breaching minimum regulatory requirements.
2. Activation Triggers: The recovery plan may be activated when specific triggers related to
capital, liquidity, asset quality, profitability, or credit rating are breached. These triggers
are set above minimum regulatory requirements but below or at more severe levels
than those for activating capital and liquidity contingency plans.
3. Notification and Evaluation: Banks must notify the Bangko Sentral in case of a breach of
internally set triggers. Senior management evaluates the situation and decides whether
to take action under the recovery plan or not. The recovery plan should define
operational procedures, monitoring, escalation, and approval processes clearly.
4. Early Warning Indicators (EWIs): The recovery plan utilizes EWIs with specific levels for
each trigger, including quantitative and possibly qualitative indicators. EWIs provide
early-stage indicators of stress set above trigger levels, which may not necessarily
activate the recovery plan. Breach of EWIs allows the bank to take remedial actions such
as adjusting risk tolerance, modifying risk behavior, tightening risk controls, and
preparing for potential activation of recovery options. Regular calibration of EWIs
ensures they remain robust to alert the bank of stress or adverse circumstances and
enable appropriate recovery actions.
Banks should emphasize the importance of having mechanisms in place to detect and
respond to early signs of stress, allowing banks to take proactive measures to mitigate risks and
maintain stability.
D. RESTORATION POINTS
1. Minimum Restoration Points and Timeline: The recovery plan must specify minimum
restoration points and timelines for key indicators, covering areas such as capital
(e.g., CET1, Tier 1 capital, or capital adequacy ratios) and liquidity (e.g., ratio of high-
quality liquid assets, Liquidity Coverage Ratio). Restoration points indicate the level
to which selected key indicators should be restored post-recovery.
3. Guidance for Recovery Actions: Restoration points guide the extent and nature of
recovery actions. They are determined based on the desired risk appetite for each
key indicator and are set above the defined quantitative Early Warning Indicators
(EWIs). This ensures reasonable assurance that future breaches of triggers are
prevented and maintains stakeholder confidence in the bank.
Banks should highlight the importance of setting clear restoration points and timelines
in the recovery plan to guide recovery actions effectively, ensuring the restoration of
key indicators and maintaining stakeholder confidence in the bank's stability and
resilience.
E. RECOVERY POINTS
Recapitalization: Injecting additional capital into the bank to bolster its financial
position and meet regulatory requirements.
Spin-off of Business Units: Creating separate entities for specific business units to
enhance efficiency and focus resources on core operations.
3. Inclusion of Capital and Liquidity Shortfall Solutions: Recovery options should always
address capital and liquidity shortfalls. The selection of options depends on the
stress scenario's type and severity. The plan should discuss estimated benefits,
negative effects, long-term impacts, preparatory actions, implementation processes,
potential impediments, and disposal conditions for assets or businesses.
b. Negative Effects:
Analysis of any adverse effects on the bank's financial condition, franchise value,
credit ratings, and relevant stakeholders.
Consideration of potential disruptions to normal business operations and services
resulting from the deployment of each recovery option.
c. Long-term Impact:
Assessment of the long-term viability of the bank/group to ensure that the chosen
recovery option offers more than just a short-term solution.
Examination of whether the option addresses underlying issues or merely provides a
temporary fix.
d. Preparatory Actions:
e. Implementation Process:
Description of the process to implement or carry out each recovery option, including
escalation procedures, authorization levels, and decision-making processes.
Identification of the responsible owner of the process to establish accountability and
ensure responsibility during times of stress.
4. Focus on Direct Actions: Recovery options should primarily focus on actions that
banks or their material entities can directly take, with conditions specified for
execution. The plan should estimate the prioritization, sequencing, and
implementation time of recovery actions, considering a combination of options may
be necessary.
Analysis of the reporting structure and frequency for communicating review results
to the board and key stakeholders.
Discussion on the content and format of the report, ensuring transparency and
clarity.
Consideration of the timeline for reporting, balancing the need for timely
communication with the thoroughness of the review process.
Exploration of the actions taken or proposed to address the identified underlying
causes, including timelines and responsibilities.
Examination of mechanisms for feedback and follow-up to ensure accountability and
effectiveness of remedial measures.
7. Exclusion of Government/Public Financial Support Assumptions: The recovery plan
should not assume access to government/public financial support to preserve or
restore viability, solvency, or liquidity. This ensures the plan focuses on internal
measures and avoids reliance on external support.
F. SCENARIOS
In identifying and adopting scenarios, the following must be considered in the recovery
plan:
Consideration of plausible but severe stress scenarios that could threaten the bank's
viability.
Use of scenarios to inform recovery triggers, estimate adverse impacts, and establish
recovery actions.
Discussion on how scenarios reflect the bank's risk profile, complexity of operations, and
business strategy.
b. Types of Scenarios:
Analysis of entity-specific and system-wide stress scenarios and their impact on capital,
liquidity, profitability, and asset quality.
Consideration of relevant events for designing scenarios, both entity-specific and
system-wide.
c. Designing Scenarios:
Discussion on the relevance and potential impact of various events for designing stress
scenarios.
Consideration of existing stress testing programs and adoption of multiple scenarios for
testing.
In designing scenarios, the bank may consider the relevance ol but not be
limited to, the following events:
a. Entity-specific events:
I ) failure of significant counterparties;
2l damage to the bank's or banking group's reputation;
5) stress in the operations of the parent bank/head office abroad;
4) severe outflow of liquidity;
5) adverse movements in the prices of assets to which the bank or
banking group is predominantly exposed;
6) significant credit losses;
7) major cyber-security breach; or
8) severe operational risk event/loss.
b. System-wide events:
l) failure of significant counter parties affecting financial stability;
2) decrease in liquidity available in the interbank lending market;
3) increased country risk and generalized capital outflow from a
significant country of operation of the institution or the banking
group;
4l significant falls in financial markets;
5) significant changes in the interest rate environment; or 6) high-impact events (e.9.,
pandemic, or climate-related events) and a
severe macroeconomic downturn.
e. Testing Scenarios:
Assessment of recovery capacity for each recovery option under different scenarios.
Measurement of recovery capacity in quantitative terms to determine aggregate
impact.
2. Identification of Impediments:
Identification of potential legal and operational impediments that could hinder the
implementation of recovery options.
Discussion on measures to overcome these impediments, such as developing
documentation for capital issuance or legal procedures for accessing funding.
Consideration of the complexity and feasibility of overcoming identified impediments
within the specified timeline.
H. TESTING/SIMULATION EXERCISES
Banks are required to establish a framework for regularly testing the feasibility and
effectiveness of their recovery plan.
The aim is to ensure that recovery plans are operational and can be implemented
effectively during stress situations.
2. Key Areas Covered in Testing/Simulation Exercises:
Annual desktop testing: Tabletop exercises conducted at least annually to evaluate the
recovery plan's feasibility and effectiveness.
Live simulation exercise: Full-scale live simulations undertaken at least once every five
years, involving relevant senior management.
Regular independent review or assessment: Internal audit function or other
independent units perform periodic assessments of the recovery plan and testing
processes.
4. Follow-Up Mechanisms for Deficiencies:
Adequate and timely follow-up mechanisms are required to address any deficiencies
identified during testing/simulation exercises.
Necessary improvements should be incorporated into the recovery plan based on the
findings.
Banks should engage an independent observer, such as units from the bank's self-
assessment functions or external auditors, during testing/simulation exercises.
This ensures a more objective assessment of the exercise outcome.
Frequency of Updating:
Review Process:
The updating process involves a review of both exogenous (external) and bank-specific
assumptions underlying the recovery plan.
Exogenous assumptions may include economic conditions, regulatory changes, or
market dynamics.
Bank-specific assumptions pertain to factors like organizational structure, operational
processes, and risk management practices.
J. COMMUNICATION STRATEGY
The recovery plan shall contain a communication strategy with supervisory
authorities/regulators, the public, financial markets, employees, and other
stakeholders, which shall be tailored based on the specific communication
needs of each recovery option.
Stakeholders Identification:
The recovery plan should outline a communication strategy tailored to address the
specific needs of each stakeholder group.
Different stakeholders may require different types and levels of information,
transparency, and engagement.
Supervisory Authorities/Regulators:
Communication with the public and financial markets should focus on maintaining
transparency, credibility, and confidence.
Disclosure of relevant information should be balanced to avoid causing panic or
instability in financial markets.
Employees:
Communication with employees should ensure clarity regarding the activation of the
recovery plan, its implications for the organization, and any necessary actions they need
to take.
Employees should be kept informed about the organization's situation to maintain
morale and trust.
Other Stakeholders: