(a) The nature of information flows

1. The working group recognises that there are several channels through which the home supervisor can receive information. Indeed, effective consolidated supervision relies on a clear hierarchy of information flows from the local banking activity to the home country supervisor. For example, information should be capable of flowing:

- from the subsidiary or branch to the head office or parent bank;

- from the parent bank or the head office to the home supervisor;

- from the subsidiary or branch to the host supervisor;

- from the host supervisor to the home supervisor.

2. In assessing the need for supervisory information, a distinction can usefully be drawn between:

- preliminary information needed to approve an authorisation;

- regular information required to perform ongoing supervision;

- exceptional information requirements in a "watch" or crisis situation.

In all of this, the emphasis is on developing and strengthening collaborative arrangements between the home and host authority over time.

3. As specified in the Minimum Standards, the opportunity arises at the time of authorisation to establish an understanding between home and host supervisors as to what information is required by each party and how it can be provided. In some cases, these understandings take the form of bilateral memoranda of understanding (MOUs) or exchanges of letters which formulate what each party expects from the relationship. The discussions establishing these understandings often help the parties to appreciate more fully the nature of each other's supervisory process, and the comfort that can be taken from it.

4. In seeking to pinpoint information requirements, the working group sees a need for home supervisors to distinguish between what information is essential and what is desirable, and between what is or is not material. In the past, home supervisors' access to supervisory information in host countries has on occasions been impeded by secrecy requirements designed to preserve the traditional confidence of customers that their affairs will be kept confidential.

5. While recognising that there are legitimate reasons for protecting customer privacy, the working group believes that secrecy laws should not impede the ability of supervisors to ensure safety and soundness in the international banking system. It also believes that the recommendations for strengthening the mechanism for exchanging information outlined in this paper will not pose a threat to banks' ability to protect the confidential relationships they have with customers not engaged in criminal activities. All the recommendations in Part III of this paper are subject to the exceptions described in section (d) where serious criminal activities are involved. Similar exceptions also apply to deliberate evasion of prudential limitations or supervisory rules.

(b) Characteristics of the information required by home supervisors for ongoing supervision

6. The working group notes that home supervisors require two principal types of information: quantitative and qualitative. The principal emphasis is on credit, market and other financial risks and good organisation and control in the context of ensuring that banks operate prudently and do not take excessive risks that threaten their solvency. In most cases, the risks arise on the assets side of the balance sheet and the predominant concern of home supervisors is therefore with loans and other assets.

7. Quantitative information which home supervisors need to have reported to them as a regular routine, on a consolidated basis, include data from the cross-border office needed to calculate, for example, the bank's capital adequacy ratios, large exposures or legal lending limits (including intra-group-exposures) and its funding and deposit concentrations. Home supervisors should be able to expect parent banks to have this information available and to be able to pass it on to them freely (including the number and amount of large deposits). In some jurisdictions, statute requires them to do so. However, home supervisors also need to be able to verify that quantitative information received from banking organisations in respect of subsidiaries and branches in other jurisdictions is accurate and to reassure themselves that there are no supervisory gaps.

8. In some host countries, national legislation poses impediments to the regular collection and verification of supervisory data by the home supervisor. Access to information on the assets side of the balance sheet poses fewer problems than the revelation of depositor information. Accordingly, if the home supervisor needs information about non-deposit operations, host supervisors are encouraged to assist in providing the requisite information to home supervisors if this is not provided through other supervisory means. The working group believes it is essential that national legislation that in any way obstructs the passage of non-deposit supervisory information be amended.

9. Where the liabilities side of the balance sheet is concerned, home supervisors do not routinely need to know the identity of individual depositors. Their interest in deposits is primarily related to liquidity; what they typically need to know is whether there are any global deposit concentrations and, if so, the amounts involved. Accordingly, aggregate information on deposits above a threshold which is significant in relation to the deposit base, balance sheet or capital base of the institution, along with some information on the geographic source of these deposits, would usually be sufficient. However, a home supervisor may wish to verify whether or not a given depositor is among the large depositors, in order to monitor deposit concentrations or the funding risk of the deposit being withdrawn or to track all the transactions made by or on behalf of a single client, which may include a group of related companies, in order to monitor the bank's exposure in a problematic situation. In such well-defined circumstances, home supervisors would need access to individual depositors' names and to deposit account information.

10. In order to provide legitimate protection for bank customers, it is important that the information obtained by home supervisors, especially that relating to depositors' or investors' names, is subject to strict confidentiality. In the absence of adequate assurances that the information will be protected, customer confidence will be damaged and host supervisors will understandably be reluctant to allow home supervisors' access. Accordingly, the working group recommends that those host jurisdictions whose legislation allows foreign supervisors to have access to banks' depositor or investor information should subject such access (at the host country's discretion) to the following conditions, which are largely consistent with those laid down in the 1990 Supplement to the Concordat, namely:

- the purpose for which the information is sought should be specific and supervisory in nature;

- information received should be restricted solely to officials engaged in prudential supervision and not be passed to third parties without the host supervisor's prior consent;

- there is assurance that all possible steps will be taken to preserve the confidentiality of information received by a home supervisor in the absence of the explicit consent of the customer;

- there should be a two-way flow of information between the host and home supervisors, though perfect reciprocity should not be demanded;

- before taking consequential action, those receiving information will undertake to consult with those supplying it.

11. In quite a large number of countries, to a greater or lesser extent, supervisors can be compelled by court order, especially in criminal cases, to reveal information to which they have access, including any information which may have been received from a foreign supervisor or acquired during an on-site examination abroad. In a few countries, parliamentary Committees have similar legal or statutory powers to subpoena the supervisory authority to reveal information obtained in confidence. In such circumstances, the supervisory authority as a matter of routine is expected to advise the host supervisor and seek prior consent. If the host supervisor is unable to consent, it is suggested that the home authority should point out to the court or Committee requisitioning the information that insisting on such revelation could severely damage the future ability of the home supervisor to obtain information necessary for effective supervision, not only in the host country but in other countries too, as well as jeopardising its ability to conduct cross-border inspections. If a host supervisor has good cause to doubt a home supervisor's ability to limit the use of information obtained in confidence solely for supervisory purposes, the host would retain the right not to provide such information.

12. In a few countries, national legislation does not permit a host supervisor, even in well-defined circumstances, to reveal depositor-specific information, whatever assurances the home supervisor is able to give about the confidentiality of the information. The working group recommends that host supervisors whose legislation does not allow a home supervisor to have access to depositor information use their best endeavours to have their legislation reviewed and if necessary amended to provide for a mechanism whereby in exceptional cases a home supervisor, with the consent of the host supervisor, will gain access to depositor information subject to the same conditions as outlined in paragraph 10.

13. Many banks manage investments for customers at the customer's risk. Such funds do not appear on the balance sheet of the bank and do not necessarily involve solvency or liquidity risks, though they may involve legal, reputational and operational risks. It should not normally be necessary for the home supervisor to know the identity of the investors involved, although the home supervisor will wish to check that the bank's systems for managing and recording the investments are adequate. However, in certain exceptional circumstances such as those described in section (d), home supervisors would need access to individual investors' names and to investment account information subject to the safeguards in paragraph 10.

14. In order to carry out effective comprehensive consolidated supervision, home supervisors also need information on certain qualitative aspects of the business undertaken in other jurisdictions by branches and subsidiaries of banking organisations for which they are the home supervisor. In particular, they need to be assured that:

- the banking group has an appropriate risk management system covering the whole of its global activities;

- the internal controls and internal audit procedures for controlling the group's overseas operations are of a sufficiently rigorous quality;

- changes in ownership and control of partly owned subsidiaries are monitored;

- the reporting process by which the home supervisor receives information through the channels set out in paragraph 1 is reliable;

- the quality of management is adequate, with a "fit and proper" test for individuals where appropriate;

- the quality of assets and the levels of concentrations are known, and are within appropriate parameters;

- the liquidity of the institution is being monitored and there is no excessive reliance on a single third-party source (or a small number of sources) of funding;

- the statutory laws and supervisory regulations of both the host and home countries are being complied with.

15. The working group agrees that it is essential for effective consolidated supervision that there are no impediments to the passing of such qualitative information to the home supervisor. Host supervisors would therefore be expected to respond freely to any questions posed by a home supervisor and to inform the home supervisor if any area of concern comes to their notice.

(c) Inspections by home country supervisors

16. Under the Minimum Standards, home supervisors are required to exercise comprehensive consolidated supervision of the global activities of their banking organisations. To carry out this responsibility, the home supervisor must be able to make an assessment of all significant aspects of their banks' operations that bear on safety and soundness, wherever those operations are conducted. This can be done through a variety of means, including on-site examinations, access to audit reports and prudential returns, or through the review of other pertinent information.

17. Among the principal areas of concern for home supervisors are internal controls, management competence and other qualitative factors listed in paragraph 14. The lack of appropriate internal controls at an important overseas office can have profound implications for the entire organisation. Consequently, without adequate access to information on the operating and control environment at such offices, home authorities can have no assurance that the overall organisation is being operated in a safe and prudent manner. While the potential for fraud or other improprieties can never be fully eliminated, the risks of wrongdoing can be narrowed by a strong, global operating and control environment.

18. With respect to the overseas operations of the banking groups for which they are responsible, home supervisors should have the ability to implement whatever evaluative techniques are central to their supervisory process. This means that if supervisory inspections are central to their supervisory process, home supervisors should be able to gather information on-site, with appropriate regard to the conditions listed in paragraph 10. In the past this has presented difficulties in some host countries with strict secrecy legislation or sovereignty principles, particularly if the inspection involves access to the names of individual depositors. Balancing the needs of the home supervisor and the interests of the host supervisor, the group has identified the following means, whereby a home supervisor at its discretion might, following consultation with the host supervisor, gather on-site the information necessary for effective comprehensive consolidated supervision:

- independent on-site examination by a home supervisor, accompanied by the host supervisor at the option of the host supervisor;

- on-site examination conducted jointly with the host supervisor, where agreed "sensitive portions" of activity are carried out by the host supervisor and evaluated jointly to protect customer confidentiality;

- on-site examination by a host supervisor under the direction of a home supervisor;

- on-site examination by a host supervisor with a copy of the report of the results of the examination being made available to the home supervisor;

- on-site examination undertaken by an approved external auditor (preferably where the external auditor of the foreign establishment is the same as that of the parent bank) on the basis of detailed instructions from the home supervisor with the concurrence of the host supervisor and with results submitted to both;

- on-site examination undertaken by an internal auditor from the bank's head office whose report is made available to the home and/or host supervisor.

19. In many cases the information required by home supervisors can be obtained on their behalf by the host supervisors, or by the external or internal auditors. Equally, however, there are some things which home supervisors would need to verify for themselves. There are no hard and fast rules as to which information falls into which category; a case by case assessment of the situation is considered appropriate. However, the working group agrees that, subject to appropriate protection for the identity of customers, home supervisors should be able at their discretion, and following consultation with the host supervisor, to carry out on-site inspections in other jurisdictions for the purposes of carrying out effective comprehensive consolidated supervision. This ability should include, with the consent of the host supervisor and within the laws of the host country, the right to look at individual depositors' or investors' names and relevant deposit or investment account information if the home supervisor suspects serious crime as defined in section (d) or an exceptional liquidity situation as in paragraph 9. It is recognised that, if a host supervisor has reason to believe that the visit is for non-supervisory purposes, it should have the right to prevent the visit taking place or to terminate the inspection.

20. Although not all supervisors conduct on-site inspections as part of their regular supervisory arrangements, many do and the working group believes it would avoid potential misunderstandings if a standard routine were to be laid down for cross-border inspections. A proposed routine designed to arrive at a mutually agreeable procedure is set out in Annex A.

21. In certain countries, the laws as they stand at present do not allow for on-site inspections by supervisors from other jurisdictions. Where this is the case, the working group advocates that host supervisors use their best endeavours to have their legislation amended. In the meantime, host supervisors should, within the limits of their laws, be willing to cooperate with any home supervisor that wishes to make an inspection in order to see that the latter obtains the information required (e.g. by appointing an external auditor to carry out an inspection on the home supervisor's behalf). Alternatively, limited inspections might be permitted subject to the home supervisor being bound by any secrecy provisions applying in the host country. Areas where access restrictions apply (e.g. information on individual customers) would be identified by the host when considering the inspection plan. In all cases the working group believes that the host supervisor should have the option to accompany the home supervisor throughout the inspection, irrespective of whether the home supervisor wishes to delegate responsibility for the inspection (or any part of the process) to the host. In the case of regular contacts, all these procedures could usefully be laid down in a MOU or exchange of letters.

22. It is important that the confidentiality of information obtained during the course of an inspection be maintained. Home supervisors should use their best endeavours to have their legislation modified if it does not offer sufficient protection that information obtained for the purposes of effective consolidated supervision is limited to that use as defined in paragraphs 10 and 11.

(d) Serious criminal activities

23. In most countries, national legislation now provides for bank secrecy laws to be overridden when the law enforcement authorities or the courts have prima facie evidence that a serious crime has been committed, such as terrorism, theft, kidnapping, drug-trafficking, extortion, money-laundering or fraud (whether it was committed within a bank, by outsiders against the bank or by the bank itself against third parties). In such cases, there are normally clear legal procedures to enable the courts or law enforcement authorities to obtain information, either domestically or cross-border. For example, an investigation into serious criminal activities may often be initiated by a home country law enforcement authority and proceed with a formal request to the host country judicial authorities for information supported by prima facie evidence that an offence has been committed. This procedure will not normally involve the home or host supervisory authority.

24. The working group believes that supervisory authorities in all countries need to ensure that their banks remain vigilant for evidence of such criminal activities and that all supervisors should be required to report such evidence acquired in the course of their supervisory activities to the appropriate authorities. While the working group recognises that banking supervisors are not criminal law enforcement authorities and should normally not be expected to undertake formal investigations into matters that involve apparent violations of criminal law, in some circumstances exceptions will be necessary where such matters are directly related to the performance of their legitimate ongoing supervisory responsibilities.

25. Although home supervisors do not routinely need access to individual depositors' or investors' names, exceptions would be justified when the home supervisor suspects serious criminal activity or circumvention of prudential requirements which would endanger the financial stability or reputation of the bank. In such cases, the home supervisor has a legitimate reason to have access to the names of individual depositors or investors and to relevant deposit or investment account information. The home supervisor should provide specific information to justify the access, if required to do so by the host supervisor.

26. In the event that a home supervisor, during an on-site inspection in a host country, detects a serious criminal violation of home country law, the home supervisor may be under a strict legal obligation to pass the information immediately to the appropriate law enforcement authorities in its home country. In these circumstances, the home supervisor should inform the host supervisor of the action it intends to take.

(e) Information flows from home supervisor to host supervisor

27. Ensuring adequate information flows from the home to the host authority also raises sensitive issues. There are essentially three types of information the home supervisor may provide which can assist the host authority to exercise effective host country supervision. First, the host authority will obviously be interested in information specific to the local office that it supervises. Second, the host supervisor needs to be informed about the overall framework of supervision in which its banking group operates, i.e. the specific techniques being used by the home country supervisor. Third, it is important that to the extent possible the host supervisor be aware of any significant problem that arises in the head office or in the group as a whole, especially if the local operation is one that is significant in the jurisdiction of the host supervisor.

28. The topic that will be of most immediate concern to the host supervisor will be information which is specific to the local entity. Through its relationship with the parent bank, a home country supervisor may obtain information which reveals a problem in an overseas office. Such information may appear relatively minor, such as the incorrect reporting of a position to head office or the belief that certain types of business are being booked in an overseas entity. However, an early sharing of information in such cases may be important in enabling a potential problem to be resolved before it becomes serious. The home supervisor should therefore consult the host supervisor in such cases and the latter should report back on its findings. In particular, it is essential that the home supervisor inform the host supervisor immediately if the former has reason to suspect the integrity of the local operation, the quality of its management or the quality of internal controls being exercised by the parent bank.

29. So far as more general information on a banking group is concerned, host supervisor awareness of the regulatory requirements applied by the home supervisor can improve the host supervisor's ability to supervise a local entity and, where appropriate, to assist in reinforcing these regulatory requirements. A home supervisor should also have on its regular mailing list for relevant material all foreign supervisors which act as hosts to its banks.

30. A more sensitive problem relates to the importance of host supervisors being informed of material adverse changes in the global condition of banking groups operating in their jurisdictions. While the Working Group agrees that home supervisors should endeavour to keep host supervisors appraised of such changes to the extent appropriate consistent with their responsibilities, the Group recognises that this will typically be a highly sensitive issue for home supervisors (both with respect to substance and timing) and that decisions on information-sharing necessarily will have to be made on a case-by-case basis taking into account all relevant factors.