Regulatory Roadmap Paul Young Rob Checkley Regulations Strategy

Profile – Paul Young • Paul leads the Finance and Risk Management function within Business Risk Services with particular emphasis on Regulatory programmes including Senior Manager Regime • Paul has had previous senior/global roles as CFO/Risk Head within Financial Services including appointments in the UK, USA and Australia • The team advises on organisational re-engineering to achieve best in class ERM structures. This has included advisory roles concerned with Regulatory Risk, Risk and Finance frameworks © 2016 Grant Thornton UK LLP. All rights reserved.

Profile – Kiran Sudhakar • Kiran is the head of our Compliance Assurance team within Business Risk Services • His team provides audit and Compliance resource support and subject matter expertise to a wide range of financial services clients. We work throughout front office, Compliance, and internal audit functions with particular focus on fraud and financial crime control • Kiran has held leading audit and assurance roles in a number of financial institutions, ranging from global banking groups to niche service providers. This experience has involved regulatory audit and advisory work in many of the worlds major financial centres © 2016 Grant Thornton UK LLP. All rights reserved.

Agenda 1. Regulatory snapshot 2. Prudential 3. Accounting 4. Governance 5. Your next steps

To put things into context… Book equity ratios across sectors (2012 data) Utilities 29. 8% Consumer 33. 8% Telecom 35. 3% IT 38. 4% Energy 43. 1% Materials 43. 8% Healthcare 47. 3% Financials 6. 4% *Source: Capital. IQ, own calculations, 3238 EU companies with balance sheets >1 billion Average balance sheet size top 10 companies per sector, 2012 data, euros (millions) Utilities 1, 160, 89 Energy 103, 008 Consumer 99, 352 Telecom 75, 505 Materials 56, 987 Healthcare 35, 529 IT 17, 306 Financials *Source: Capital. IQ, own calculations © 2016 Grant Thornton UK LLP. All rights reserved. 1, 698, 049

1. Regulatory snapshots Prudential Accounting Governance Infrastructure Recovery & resolution planning Prudential valuation Senior Managers' Regime/ Corporate Governance Fraud & Financial Crime Intraday liquidity Wind down plans / Living wills Pillar 3 Disclosure FCA / PRA Conduct rules Structural Reform NSFR Stress tests XVA SREP Market Reform Operational risk IFRS 9 Benchmarking Consumer Protection Market risk / FRTB COREP/ FINREP/ BOE Capital Liquidity Contingency Pillar 2 LCR STD – CCR Credit risk Conduct & Culture IRRBB Data Security CVA Funds Regulation Leverage ratio TLAC / MREL UK EU US Ro. W © 2016 Grant Thornton UK LLP. All rights reserved.

2. Prudential - Capital Pillar 2 STD – CCR Credit risk • Transparent and sensitive approach • Assesses firm’s risk management and governance to absorb losses that may arise under a severe, but plausible stress in line with the CRD IV rules • PRA buffer is to be met by CET 1 capital by all firms but with phased implementation out to 2019 (starting from 1 January 2016) • Pillar 2 returns in conjunction with their ICAAP submission (annually for significant banks). • New assessment of counterparty credit risk exposure associated with OTC derivatives, exchange-traded derivatives and long settlement transactions designed to improve risk sensitivity measures without undue complexity • Replaces Current Exposure Method (CEM) and Standardised Method ( SM) • IMM shortcut method will also be eliminated once the SA-CCR takes effect. • Implementation will require more data inputs, calculation challenges and granular drilldowns across business lines • The standardised approach for measuring counterparty credit risk exposures will become effective on 1 January 2017 Tackles weaknesses in current approach: • over-reliance on external credit ratings • lack of granularity and risk sensitivity • out-of-date calibration • lack of comparability across different banks and jurisdictions • misalignment of treatment between the current CRSA and exposures risk weighted under the internal ratings • consultation document issued in Dec 2015 for comments by March 2016 © 2016 Grant Thornton UK LLP. All rights reserved.

2. Prudential - Capital Operational risk Market risk / FRTB IRRBB • Remove AMA: complexity and the lack of comparability have increased variability in RWA calculations • New Standardised Measurement Approach - single non-model-based method for the estimation of operational risk capital • Consultation document was issued in March 2016 for comments by June 2016 (during the course of 2016 BCBS will provide further details on the withdrawal of the AMA, and the implementation of the SMA) • • • A revised boundary between the trading book and banking book A revised Internal Models Approach (IMA) for market risk A revised Standardised Approach for market risk A shift from value-at-risk to an expected shortfall measure of risk under stress Incorporation of the risk of market illiquidity National supervisors are expected to finalise implementation of the revised market risk standards by January 2019, and to require their banks to report under the new standards by the end of 2019. • Revised standards issued in April 2016 for implementation by banks by 2018. , which provide: • BCBS has concluded that IRRBB is more appropriately captured under Pillar 2 framework • greater guidance on shock and stress scenarios, key behavioural and modelling assumptions and internal validation • banks must disclose interest rate shocks on their change in economic value of equity and net interest income © 2016 Grant Thornton UK LLP. All rights reserved.

2. Prudential - Capital CVA • • • Capture all CVA risks and better recognition of CVA hedges Alignment with industry practices for accounting purposes Alignment with proposed revisions to the market risk framework consideration of Corporates, Sovereigns and Pension Fund exemptions consultation in July 2015 for comments by October 2015. Recently, during Quantitative Impact Survey (QIS) in March 2016, the Committee revealed that it has eliminated the internal model approach for CVA. Leverage ratio • PRA-regulated banks and building societies with total retail deposits of £ 50 billion or more • 3% minimum leverage ratio requirement. • Firms to assess they hold an amount of Common Equity Tier 1 (CET 1) capital that is greater than or equal to their countercyclical leverage ratio buffer (CCLB) and, if the firm is a global systemically important institution (G-SII), its G-SII additional leverage ratio buffer (ALRB) • Firms in scope will be subject to leverage ratio reporting and disclosure requirements. • Public disclosure of the ratio started from Jan 2015; BCBS has proposed changes in April 2016 for comments by July 2016 and implementation by Jan 2018. TLAC / MREL • Provisions on MREL taking effect from 1 January 2016 • In Dec 2015, Bo. E consultation on MREL: • applies to all firms in scope of the BRRD • approach is aligned with that of the FSB's TLAC standard for G-SIB's • Firms with >40, 000 transaction accounts subject to a modified insolvency • between 40, 000 transaction accounts and a balance sheet of £ 15 -25 billion may expect partial transfer • balance sheets above £ 15 -25 billion can expect a bail-in to resolution strategy • a 4 -year transition period is proposed (3 years for G-SIBs) to enable firms to restructure their debt and/or equity issuance. © 2016 Grant Thornton UK LLP. All rights reserved.

2. Prudential - Liquidity LCR Intraday liquidity NSFR • • • HQLA breakdown and portfolio mix Caps & haircuts Stress testing impact Regulatory Reporting & requirements LCR came into effect from 1 October 2015 • Firms to demonstrate robust analysis of their intraday liquidity risk profile both in business-as-usual and under stress scenarios • Firms to ensure sufficient liquidity at all times to maintain normal payment activity if: • Incoming payments are delayed by several hours or until close to the payment cut off times • Credit lines are withdrawn and/or require full collateralisation • Large individual clients default on their payments • from 22 April 2016, the FSA has switched its liquidity returns (FSA 050 -053) with the EU's additional liquidity monitoring metrics (ALMM) • Revised NSFR disclosure requirements using a common template to improve transparency of regulatory funding requirements, reinforce the Principles for sound liquidity risk management and supervision, strengthen market discipline, and reduce uncertainty in the markets as the NSFR standard is implemented. • NSFR disclosure template includes the major categories of sources and uses of stable funding. • BCBS issued NSFR disclosure standards in June 2015, banks required to comply from 1 January 2018 © 2016 Grant Thornton UK LLP. All rights reserved.

2. Prudential - Contingency Recovery & resolution planning The EU [Bank] Recovery and Resolution Directive (RRD) regime (January 2015): • to prepare for situations that could lead to financial stress or failure, two plans must be drawn up. • Recovery plan: firms must submit a recovery plan to their competent authority for their review. The plan will then be reviewed by that authority. • Resolution plan: the resolution authority will draw up a resolution plan for each firm based on the information which firms must provide Wind down plans / living wills Larger firms required to produce the following: • recovery plans (identification of options to recover from a stress scenario) • a solvent trading book wind-down analysis • resolution packs (information to support resolution by the authorities) • PRA has suggested that firms with a trading book must provide a fully supported assessment of the process and impact of unwinding their trading books • these rules are effective from 19 January 2015, except bail in rules which come into effect during 2015 and 2016 Firms to develop a range of firm-wide scenarios including some based on macroeconomic and financial market shocks for the purposes of their own stress testing. A firm will need to consider • the nature, scale and complexity of its business and of the risks that it bears • its risk appetite • the cycles it is most exposed to and whether these are general economic cycles or Stress tests specific to particular markets, sectors or industries • the behaviour of counterparties, and of the firm itself, including the exercise of choices (for example, options embedded in financial instruments or contracts of insurance) • amplitude and duration of the relevant cycle which should include a severe downturn scenario based on forward-looking hypothetical events, calibrated against the most adverse movements in individual risk drivers experienced over a long © 2016 Grant Thornton UK LLP. All rights reserved. historical period.

3. Accounting Prudential valuation Pillar 3 Disclosure • Capital Requirements Regulation (CRR) requires financial institutions to apply prudent valuation to all fair value positions. • The difference between the prudent value and the fair value, called additional valuation adjustment (AVA), is directly deducted from the Common Equity Tier 1 (CET 1) capital. • EBA final draft Regulatory Technical Standards (Jan 2015) provide two approaches for implementing the prudent valuation requirements: • Simplified approach: Institutions may apply the simplified approach provided the sum of the absolute value of fair-valued assets and liabilities is less than EUR 15 billion. • Core approach: The core approach is compulsory for institutions that are above threshold of the simplified approach, but may also be implemented by institutions that are below this threshold. • Prudential Valuation is disclosed in the COREP schedules • • Rebalancing quarterly, semi-annually and annually disclosures Streamlining disclosure of credit risk exposures and credit risk mitigation techniques Clarifying and streamlining securitisation exposures Aims to promote market discipline through greater disclosure. New hierarchy of disclosures effective for 31 December 2016 year-ends. Mandatory templates, together with additional qualitative/judgemental disclosures. Requires formal Board-approved disclosure policy. Sound controls to support accurate information, together with appropriate audit and validation processes. • Banks are required to publish their first Pillar 3 report under the revised framework, with their year end 2016 financial report. © 2016 Grant Thornton UK LLP. All rights reserved.

3. Accounting XVA IFRS 9 COREP/ FINREP/ BOE • • • Credit Valuation Adjustment Debit Valuation Adjustment Funding Valuation Adjustment Margin Valuation Adjustment Capital Valuation Adjustment • Significant update to classification and measurement for financial instruments, impairment and hedging rules • Replaces IAS 39, introduces some differences versus the FASB approach in the US • Business Model and Contractual Cashflow tests for debt instruments. • In addition to Amortised Cost and FV-PL, introduces new category of FV-OCI. • Includes fair value of liabilities – “own credit” • effective from 1 January 2018 • Changing data gathering expectations • BOE: statistical reporting, particularly Pillar 2 setting © 2016 Grant Thornton UK LLP. All rights reserved.

4. Governance Senior Managers' Regime Oversight Conduct Culture FCA / PRA Conduct rules SMs, Certification & Other Rules 1. Integrity 2. Due skill, care and diligence 3. Co-operate with the regulator 4. Treat customers fairly 5. Market Conduct Benchmarking • EU regulation on indices used as benchmarks • financial instruments/contracts pricing • accuracy/ integrity of benchmarks determination processes • conflicts of interest • cases of benchmark manipulation • consumer/ investor losses © 2016 Grant Thornton UK LLP. All rights reserved. SREP • Holistic approach to SREP assessments, both in individual risk categories as well as on an overarching level, results in a graded scoring of an institution • Determination of whether an institution is 'failing or likely to fail', • Supervisors to provide quantitative estimate of the capital adequacy and liquidity risks of a financial institution

4. Governance – SMR: board responsibilities PRA sets out in March 2016 PRA Supervisory statement SS 5/16 that board responsibilities include: • Setting the firm's strategy • Articulating and maintaining a culture of risk awareness • Defining risk appetite, risk management and internal controls • Balancing allocated responsibilities between executives and non-executives • Knowledge and experience of non-executives and allocation of time and resources • Management information must be actively managed by the chairman and non-executives • Maintaining succession plans • Overseeing the design and operation of the firm's remuneration system "Between them the non-executive directors need to have sufficient current and relevant knowledge and experience…to provide effective challenge across the major business lines of the firm. The PRA expects to see evidence of effective challenge, particularly in relation to key strategic decisions. It is the role of the chairman to ensure that all views are heard and that the executives are not able to control the board discussion. " SS 5/16 © 2016 Grant Thornton UK LLP. All rights reserved.

5. Infrastructure What is driving the changes? • Protecting depositors • Improving resilience • Defining accountability • Prohibiting risky activities • Promoting competition • Combatting too big to fail • Changing conduct and culture • Planning for resolution • Digitisation in banking • Closer regulatory scrutiny What are the impacts? Cost Capital Returns © 2016 Grant Thornton UK LLP. All rights reserved. Regulatory fatigue Regulatory divergence Complexity Fines

5. Infrastructure Who is involved? Who is affected? Supranationals Global bodies - OECD - IMF - World Bank Regional bodies - EBA - ESMA - EIOPA © 2016 Grant Thornton UK LLP. All rights reserved. National Regulators • FCA • PRA • Bank of England • FASB • SEC Delivering reforms influenced by the government of the day Market Participants • Originators • Distributors • Intermediaries • Investors • Depositors • Borrowers Everyone else – the real economy

5. Infrastructure – Market Reform Mi. FID II Markets in Financial Instruments Directive II (3 Jan 2017) and Markets in Financial Instruments Regulation (applicable now) Transparency and transaction reporting Rules for non-EU countries accessing EU Rewrites market conduct rules markets Commodities pricing and limits now Defines market structures – RM, MTF, captured OTF, SI, OTC Market Abuse Directive II and Market Abuse Regulation (MAR) – both effective from 3 July 2016 – alongside Criminal Sanctions for Market Abuse Directive (CSMAD) MAD II Banking Structural Reform New rules to fundamentally update the largely irrelevant parts of the original MAD rules Broadens and adds to the list of market abuse offences Interaction with Mi. FID II – MAR will become wider with new instruments US Prohibiting risky activities The Dodd Frank Act / Volcker Rule – stops proprietary trading activities Audit must support CEO attestations and the Compliance Programmes © 2016 Grant Thornton UK LLP. All rights reserved. brought in when Mi. FID II becomes effective Captures market soundings, HFT, whistleblowing, benchmark submissions, and many more front and middle office activities UK Ringfencing retail banking UK banks with £ 25 bn+ of core deposits must split out their retail/SME deposit taking businesses HSBC, Lloyds Banking Group, Barclays, Royal Bank of Scotland, Santander UK and the Co-operative Bank Europe Liikanen and related proposals feature similarities to other reform measures like Glass. Steagall Limitations on risky activities – and a drive to move these to isolated subsidiaries

5. Infrastructure – Fraud & Financial Crime 4 th EU Anti Money Laundering Directive AML Bribery & Corruption Synchronised with the FATF guidelines Firms will have to check to see if a client is a politically exposed person anywhere in the EU. Requires identification of Beneficial Owner as of a 25% ownership threshold Inclusion of tax crimes in the scope Risk assessment work should be carried out on a supra-national level Enhanced due diligence must be conducted in certain situations of high risk Panama papers have put corruption back at the top of company agendas Various global initiatives (US, UN, OECD, etc. ), but no unified guidelines Difficult to quantify risk and difficult to audit New UK rules announced by Cameron 1. The creation of a beneficial ownership register 2. The creation of a new Anti-Corruption Co-ordination Centre 3. Plans for a brand new offence of failure to prevent economic crime Information security continues to be a significant challenge with the complexity driven by Number of systems Complicated permission structure Toxic combinations Cyber Crime Audit challenges Understanding the effectiveness of preventative controls on granting access permissions Provide opinions on encryptions and authentication effectiveness Penetration and perimeter testing Sophisticated analysis of cyber risk controls requires specialised subject matter experts © 2016 Grant Thornton UK LLP. All rights reserved.

5. Infrastructure – Organisational culture The challenges - as seen by the FCA Poor cultures in firms drive behaviours that result in poor outcomes for consumers and markets Firms’ strategies, business models and governance arrangements not aligned with firms’ values and conduct Incentive structures and performance management do not reward behaviours that act in the long-term interests of customers and market integrity Weak governance and lack of accountability create poor oversight of risks to customer and market integrity risks in how firms are run When to consider culture Cultural transformation - the culture in my organisation needs to change and I need a gap analysis Merger of two cultures - we are merging two differing cultures and need support Assurance and measurement - I need assurance over the structured culture plans that are in place in my organisation Assessment of current position - the culture in my organisation is not currently owned or managed and I need to understand it better Auditing Culture There are four key stages to culture audit 1. Examine your firm's strategy 2. Look for alignment with people management and leadership practices 3. Assess alignment across resource and process management 4. Observe behaviours © 2016 Grant Thornton UK LLP. All rights reserved. Define the behaviours that drive culture Stories Control systems Symbols Core beliefs and assumptions Rituals and routines Organisational structures Power structures

5. Infrastructure – Impacts for audit • Methodology Auditing cultural change Supervision and accountability Assurance for compliance with new rules • Stakeholder management Committee reporting Reliance on audit for attestations Defining audits role in the three lines model • Technical skills Capital and liquidity planning IT and cyber risks Finance and accounting © 2016 Grant Thornton UK LLP. All rights reserved.

5. Your next steps • Reading • Scoping • Planning and coordination • Resourcing • Regulatory relationship • Reviewing • Benchmarking • Governance structure • Regulatory pipeline © 2016 Grant Thornton UK LLP. All rights reserved.