Enterprise Risk Management for US Operations of International Banks Communication and Education

1. Enterprise Risk Management for US Operations of International Banks Communication and Education

2. Enterprise Risk Management Challenge: Effectively managing all risks of US Operations while meeting both regional and enterprise requirements concurrently • Market Risk • Credit Risk • Operational Risk • Legal and Regulatory Risk

3. Market and Credit Risk Management Enterprise level market and credit risk management programs in force are generally well established • Market Risk • Credit Risk • Operational Risk • Legal and Regulatory Risk It is a core competency of financial institutions to effectively manage market and credit risks. The recent challenges have been marked by liquidity issues and lack of reliable market data, highlighting continued dependency on human judgment factors and the need for greater transparency.

4. Operational and Legal/Regulatory Risk Management Increasing emphasis on operational and legal/regulatory risk management have increased the urgency to addressing human aspects of these risk programs • Market Risk • Credit Risk • Operational Risk • Legal and Regulatory Risk US legal framework and regulatory oversight has placed much greater emphasis on operational (Sarbanes-Oxley) and legal/regulatory (BSA and Patriot Acts) risks, forcing financial institutions to enhance these enterprise programs to encompass these new requirements.

5. “Indifference” Risks The risks of home office not understanding and integrating US market issues and requirements can potentially result in cost and/or reputational consequences Continue operating under existing enterprise risk management program Insufficient controls from US regulatory perspective will risk reputation exposure – written orders and fines Failure to integrate US issues and requirements in the enterprise risk program Create supplemental risk management programs customized to meet US issues and requirements Duplicate expenses • Compliance • Administration • Technology

6. A key challenge for management of US Operations is to communicate and help educate home office where US issues and requirements may differ from the existing enterprise risk management framework Two-Way Education

7. Key to Success – Education Strategy A well designed education strategy will improve the effectiveness of the enterprise risk programs and ensure the programs evolve as requirements change • Not just training, but educating staff to make informed decisions • Understanding both process and policy issues • Continuous education to meet rapid market changes • Top down and bottom up input into program content • On-the-ground findings from operating staff • Front-line feedback from the market and regulators • Integration of education program across home office and all regions • Program consistency across the enterprise • Ensuring staff understand relationship between local and enterprise requirements The goal of an effective education program is to make the staff the key component of a successful enterprise risk management program

8. Education Program Example “Outside the box” thinking of how to develop and effectively manage an education strategy for the enterprise risk programs • Using social networking construct • Wiki based education modules to permit dynamic updating • Blogs to inform on latest market and regulatory issues • Personal pages of staff informing key areas of expertise • “Latest news” for ongoing communication between regions and home office on key areas of interest and concern • Topic examples • Global economic risks • Risk and pricing models • BSA/AML regulatory findings and issues • Operational risks and losses

9. Issue Example (1) Lack of understanding by home office of importance placed in US on accurate and detailed customer typing, results in US regulatory finding of inaccuracies for home office customers conducting business in the US Home Office Customer Typing Information BSA/AML Customer Identification Program N, C, S America Management and Financial Reporting Europe Regulatory Reporting Asia

10. Issue Example (2) An un-integrated education program, where training provided to staff was limited to local region procedures for collection of KYC verification documentation, results in US regulatory action because US clients originating elsewhere were not adequately on-boarded originally, or re-boarded in the US, to meet US KYC requirements. Region A Region B Region C Credit Know-Your-Customer Documentation

11. Madison Consulting Group 30 Montgomery Street Jersey City, NJ 07302 201-434-5678 Bernard Chen Partner bchen@madisoncg.com 646-645-1593 (c)