Transcription
Notes to the consolidated financial statements – Part E – Information on risks and relative hedging policies1.5. OPERATIONAL RISKQUALITATIVE INFORMATIONA. General aspects, operational risk management processes and measurement methodsOperational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from externalevents. Operational risk includes legal risk and compliance risk, model risk, ICT risk and financial reporting risk; strategic andreputational risk are not included.The Intesa Sanpaolo Group adopts an undertaking and management strategy of operational risk based on prudentmanagement principles and aimed at guaranteeing long-term solidity and continuity for the company. In addition, the Grouppays particular attention to achieving an optimal balance between growth and profitability and the resulting risks.In line with these objectives, the Intesa Sanpaolo Group has long since established an overall operational risk managementframework, by setting up a Group policy and organisational processes for measuring, managing and controllingoperational risk.For regulatory purposes, the Group adopts the Advanced Measurement Approach (below also AMA or internal model), inpartial use with the standardised (TSA) and basic approaches (BIA), to determine the capital requirement. The AMA approachis adopted by the main banks and companies in the Banca dei Territori, Corporate and Investment Banking, Private Bankingand Asset Management Divisions, as well as by Intesa Sanpaolo Group Services, VUB Banka and PBZ Banka.Governance ModelThe monitoring of the Intesa Sanpaolo Group’s Operational Risk Management involves Bodies, Committees and structuresthat interact with different responsibilities and roles in order to create an effective operational risk management system that isclosely integrated into the decision-making processes and the management of company operations.Board of Directors, CEO, BoardCommittees (Risk Committee),Managerial Committees(Control Coordination,Operational and ReputationalRisk Committee)Chief Risk Officer GovernanceArea, Centralised Function forthe management of theoperational risk (Operationaland Reputational Risk)Individual Organisational Units(ORMD and ORMR Functions)Definition of objectives andpolicies for governingoperational risksCoordination of theimplementation ofguidelines and operationalrisk gov ernance policiesResponsible forOperational RiskManagement in theindiv idual OrganisationalUnitsSuperv ision and StrategicthrustDefinition, dev elopment,maintenance of theoperational riskmanagement frameworkResponsible for structuredcollection of information(operational ev ents, criticalissues, mitigation actions,Self-diagnosis)495
Notes to the consolidated financial statements – Part E – Information on risks and relative hedging policiesGroup Operational Risk Management ProcessThe Intesa Sanpaolo Group’s operational risk management process is divided into the following ementand AssessmentMonitoring andControlIdentificationThe identification phase involves: the structured collection and timely updating of the data on operational events, decentralised to the Organisational Units; the detection of critical issues; the performance of the annual Self-diagnosis process; the identification of potential operational risks arising from the introduction of new products and services, the launch ofnew activities and the entry in new markets, as well as risks associated with outsourcing; the analysis of operational events and indicators originating from external consortia (O.R.X. - Operational RiskdataeXchange Association); the identification of operational risk indicators (including ICT and cyber risks, compliance risks, etc.) by the individualOrganisational Units.Measurement and assessmentMeasurement is the transformation, using a dedicated model, of the elementary information (internal and external operationalloss data, Scenario Analyses and Business Environment Evaluations) into synthetic risk measures. These measures presentan adequate detail to allow complete knowledge of the Group's overall risk profile and to allow the quantification of capital atrisk for the Group's units.Monitoring and controlThe monitoring of operational risks consists of the analysis and structured organisation of the results obtained from theidentification and/or measurement in order to verify and control the evolution over time of the exposure to operational risk(including ICT and cyber risk) and to prevent the occurrence of harmful events.MitigationManagement activities and mitigation actions, defined on the basis of the results of the identification, measurement andmonitoring, consist of: the identification, definition and implementation of risk mitigation and transfer activities, in accordance with theestablished risk appetite; the analysis and acceptance of residual operational risks; the rationalisation and optimisation, from a cost/benefit perspective, of insurance coverage and any other forms of risktransfer adopted by the Group.In this regard, in addition to benefiting from a traditional insurance programme (to protect against offences such as employeeinfidelity, theft and damage, transport of valuables, computer fraud, forgery, cybercrimes, fire and earthquake, and third-partyliability), the Group stipulated an insurance coverage policy named Operational Risk Insurance Programme in compliancewith the requirements established by the regulations and to have access to the capital benefits provided for by the policy,which provides specific cover, significantly increasing the limits and transferring the risk of significant operational losses to theinsurance market.496
Notes to the consolidated financial statements – Part E – Information on risks and relative hedging policiesIn addition, with respect to risks relating to real property and infrastructure, with the aim of containing the impacts ofphenomena such as catastrophic environmental events, situations of international crisis, and social protest events, the Groupmay activate its business continuity solutions.CommunicationCommunication consists of setting up adequate information flows related to the management of operational risks between thevarious actors involved, in order to enable the monitoring of the process and provide adequate knowledge of the exposure tothose risks.Self-diagnosisThe self-diagnosis is the annual process through which the Organisational Units identify their level of exposure to operationalrisk by assessing the level of managemnt of the elements characterising their business environment (Business EnvironmentEvaluation, VCO) and estimating potential losses in the event of potentially harmful operational events (Scenario Analysis,SA). The assessment takes into account the critical issues identified and the operational events occurred. This assessmentdoes not replace the specific risk assessments carried out by the specialised and control functions within the scope of theirresponsibilities (e.g. assessments carried out by the Chief Audit Officer, by the Manager responsible for preparing theCompany’s financial reports and by the Chief Compliance Officer), but allows the assessments that emerge during theprocess to be brought to the attention of the functions concerned and to be discussed with the Head of the OrganisationalUnit concerned.The detection of critical issues enables the identification and definition of suitable mitigation actions, whose implementation ismonitored over time to reduce the exposure to operational risk.ICT RiskInformation Technology or ICT risk means the risk of incurring economic, reputational and market share losses, in relation tothe use of information and communication technology. In the integrated representation of business risks for prudentialpurposes, this type of risk is considered, according to the specific aspects, under the operational, reputational and strategicrisks and includes the risk of violation of the confidentiality, integrity or availability of the information.In line with the methodological framework established for the governance of corporate risks and, in particular, for operationalrisks, the Intesa Sanpaolo Group’s ICT Risk framework has been developed with a view to integrating and coordinating thespecific expertise of the structures involved.Every year, the Technical Functions (e.g. ICT Head Office Department, IT functions of the main Italian and internationalsubsidiaries) and the Cybersecurity Function identify the level of exposure to ICT risk (and to the Information Security riskincluded within it) of the information technology assets managed through the top-down assessment of the level ofmanagement of the relevant Risk Factors. In addition to this analysis, carried out for all the application assets and companyprocesses, when there are situations that may modify the overall level of risk or in the case of innovation projects or changesto significant components of the ICT System, the Technical Functions and the Cybersecurity Function identify the level ofexposure to ICT risk of the specific components of the ICT system.This assessment is accompanied, as part of the Self-diagnosis process, by the bottom-up assessment carried out by theindividual Group Organisational Units, which analyse their own exposure to ICT risk and provide an opinion on the level ofmanagement of the risk factors relevant for this purpose (e.g. relating to the adequacy of the software for the Unit’soperations, etc.).Internal model for the measurement of operational riskThe Intesa Sanpaolo Group’s internal model for calculating capital absorption is designed to combine all the main sources ofquantitative information (operational losses: internal and external events) and qualitative information (Self-diagnosis: ScenarioAnalysis and Business Environment Evaluation).Capital-at-risk is therefore identified as the minimum amount at Group level required to bear the maximum potential loss(worst case). It is estimated using a Loss Distribution Approach model (actuarial statistical model to calculate the Value-at-riskof operational losses), applied on quantitative data and the results of the scenario analysis assuming a one-year estimationperiod, with a confidence level of 99.90%. The methodology also applies a corrective factor, which derives from the qualitativeanalyses of the risk level of the business environment (VCO), to take into account the effectiveness of internal controls in thevarious Organisational Units.The internal model’s insurance mitigation component was approved by the Bank of Italy in June 2013 with immediate effect ofits benefits on operations and on the capital requirements.497
Notes to the consolidated financial statements – Part E – Information on risks and relative hedging policiesQUANTITATIVE INFORMATIONTo determine its capital requirements, the Group uses a combination of the methods allowed under applicable regulations.The capital absorption resulting from this process amounted to 1,414 million euro as at 31 December 2018.The following shows the breakdown of capital requirement relating to the Advanced Measurement Approach (AMA) by eventtype.Breakdown of capital requirement (Advanced Measurement Approach - AMA) by event typeClients, products & business practices 47.8%Disaster and other events 4.7%Information technologies and utility services 5.0%Execution, delivery and process management 18.1%Internal illegal activities 11.7%External illegal activities 10.4%Employment practices and workplace safety 2.3%With regard to the sources of operational risk, the chart below shows the impact of the operational losses accounted duringthe year, based on event type.In 2018, the most significant event type was Clients, Products and Business Practices, which included losses related todefaults connected with professional obligations towards customers, suppliers or outsourcers and to the provision of servicesand products to customers performed improperly or negligently.The Execution, delivery and process management category is also particularly significant, which reports the losses relating tounintentional errors in the management of operational and support activities, or to contractual disputes with counterpartiesthat cannot be qualified as customers, suppliers or outsourcers.Breakdown of operational losses recorded in 2018, by event typeClients, products & business practices 49.2%Disaster and other events 0.7%Information technologies and utility services 0.2%Execution, delivery and process management 29.6%Internal illegal activities 5.8%External illegal activities 7.9%Employment practices and workplace safety 6.7%498
Notes to the consolidated financial statements – Part E – Information on risks and relative hedging policiesLEGAL RISKSLegal risks are thoroughly and individually analysed by the Parent Company and Group companies. Specific and appropriateprovisions have been made to the Allowances for risks and charges in the event of disputes for which it is probable that fundswill be disbursed and where the amount of the disbursement may be reliably estimated.As at 31 December 2018, there were a total of about 18,000 disputes were pending (excluding those involving RisanamentoS.p.A. and Autostrade Lombarde S.p.A., which are not subject to management and coordination by Intesa Sanpaolo) with atotal remedy sought of 5,571 million euro and allowances of around 653 million euro.In further detail, the most important of these are: bankruptcy revocatory disputes, with remedy sought of 392 million euro and allowances of 58 million euro; insolvency compensation disputes, with remedy sought of 524 million euro and allowances of 8 million euro; disputes concerning investment services, with remedy sought of 374 million euro and allowances of 58 million euro; disputes concerning anatocism and other conditions, with remedy sought of 1.018 million euro and allowances of 138million euro; disputes concerning bank products, with remedy sought of 347 million euro and allowances of 25 million euro; disputes concerning loan positions, with remedy sought of 1,322 million euro and allowances of 46 million euro; disputes concerning lease contracts, with remedy sought of 180 million euro and allowances of 17 million euro; credit recovery disputes, with remedy sought of 192 million euro and allowances of 91 million euro; other civil and administrative disputes, with remedy sought of 917 million euro and allowances of 82 million euro.In addition to brief remarks on the disputes relating to anatocism and investment services, the following paragraphs provideconcise information about the dispute connected to the transaction concerning the former Venetian banks, as well as thesignificant individual disputes (those with a remedy sought of more than 100 million euro and where the risk of an outlay iscurrently deemed probable or possible).Disputes relating to anatocism and other current account and credit facility conditions - For many years, this type of disputehas been a significant part of the civil disputes brought against the Italian banking industry and therefore also the Groupbanks20. The overall economic impact of lawsuits in this area remains at insignificant level in absolute terms.Disputes relating to investment services - In general, in 2018, the number of disputes relating to investment servicesdecreased both in terms of number and in terms of the total value of the claims. There was only an increase in the number ofdisputes concerning OTC derivatives and equities, but the amounts involved were insignificant.ENPAM lawsuit - In June 2015 ENPAM sued Cassa di Risparmio di Firenze, along with other defendants such as JP MorganChase & Co and BNP Paribas, before the Court of Milan.ENPAM’s allegations related to the trading (in 2005) of several complex financial products known as “JP Morgan 69.000.000”and “JP Morgan 5.000.000”, and the subsequent “swap” (in 2006) of those products with other similar products known as“CLN Corsair 74.000.000”; the latter were credit-linked notes, i.e. securities whose repayment of principal at maturity was tiedto the credit risk associated with a tranche of a synthetic CDO. Due to the defaults on the CDO portfolio, the investmentallegedly resulted in significant losses, for which compensation is sought.In the writ of summons, ENPAM submitted several petitions for enquiries and rulings, in particular for contractual and tortliability and breach of Articles 23, 24 and 30 of the Consolidated Law on Finance, asking for the repayment of an amount ofaround 222 million euro and compensation for damages on an equitable basis; the part relating to Cassa di Risparmio diFirenze’s position should be around 103 million euro (plus interest and purported additional damages).Cassa di Risparmio di Firenze was sued as the transferee of the Italian branch of Cortal Consors S.A. (subsequently mergedinto BNP Paribas), which had provided ENPAM with the investment services within which the above-mentioned securities hadbeen subscribed.20 With specific regard to the subject of “anatocism”, the disputes mainly concern relationships opened before 1999, when the amendment of Article 120of the Consolidated Law on Banking legitimised the capitalisation of debtor and creditor interest, provided they were carried out with equal frequency. Atthe beginning of 2014, Article 120 of the Consolidated Law on Banking, which governs the compounding of interest in banking transactions, wasamended with the establishment of the ban on anatocism and the delegation of the CICR (Interdepartmental Committee for Credit and Savings) toregulate this matter. In the absence of the CICR resolution, Intesa Sanpaolo considered this ban not to be applicable and that the 1999 provisionscontinued to apply, which allowed the compounding of debit and credit interest on debtors and creditors provided it was applied at the same frequency.In 2016, Article 120 of the Consolidated Law on Banking was amended again. Without prejudice to the requirement of the same frequency of calculationof the interest, it was established that the frequency must not be “less than one year” (with calculation at 31 December of each year and, in any event, atthe end of the relationship) and that debt interest accrued could not in general give rise to interest other than arrears interest. In addition, for currentaccount credit facilities and overdrafts it was established that: the debt interest is calculated at 31 December and becomes due on 1 March of the year after the year when it accrued; if the account is closed, theinterest becomes due immediately; the customer can provide authorisation, also beforehand, for the interest to be charged to their account (and therefore for its compounding) when itbecomes due; this authorisation can be revoked at any time, provided it is before the charge has been made.The implementing resolution by the CICR was published in August 2016. It establishes, among other things, that the new regulations apply to interestaccrued from 1 October 2016.In February 2017, the Italian Antitrust Authority initiated proceedings against Intesa Sanpaolo for alleged unfair business practices involving, amongother things, the methods used to request the above-mentioned authorisation from customers for the charging of the interest to the account.The Authority completed the proceedings in October 2017, ruling that Intesa Sanpaolo had implemented an “aggressive” policy aimed at acquiring theauthorisation, by soliciting the customers through various means of communications and without putting them in a position to consider the consequencesof that choice in terms of the interest calculation on the compounded debt interest. As a result, the Authority issued a fine of 2 million euro against IntesaSanpaolo. Intesa Sanpaolo has submitted an appeal with the Lazio Regional Administrative Court, on the grounds that the ruling was unfounded. Theproceedings are still pending.No significant disputes have yet emerged specifically regarding the 2014-2016 legislation.499
Notes to the consolidated financial statements – Part E – Information on risks and relative hedging policiesAt a preliminary stage, Cassa di Risparmio di Firenze raised various objections (including a lack of standing to be sued andthe time bar). On the merits, it argued, among other positions, that the provisions of the Consolidated Law on Finance citedwere not applicable and that there was no evidence of the damages. It also disputed their calculation and, in the alternative,that ENPAM had contributed to causing the damages. If an unfavourable judgement is rendered, Cassa di Risparmio diFirenze has requested that the court determine its internal share of the total liability of the defendants and that the otherdefendants be ordered to hold it harmless.During the proceedings, it emerged from the analysis of the 2016 financial statements of ENPAM that the securities subject ofthe allegations against Cassa di Risparmio di Firenze had been “sold back” to JP Morgan at a price of around 206 million euroand this circumstance was emphasised in further defence pleadings by Cassa di Risparmio di Firenze, highlighting theresulting lack of the alleged damages and perhaps even the presence of a capital gain.In February 2018, the judge ordered a court-appointed expert’s review aimed at determining, among other matters: whether during the pre-contractual phase the structure, value and costs of the securities at issue were properlyrepresented to ENPAM; whether the securities were fit for the purpose indicated in the entity's Charter and Investment Guidelines; the performance achieved by ENPAM as at the date of conclusion of the individual transactions; the difference, if any, between the performance achieved by ENPAM and the performance that would have resulted ifother investments consistent with the entity's Charter and Investment Guidelines had been undertaken (also consideringthe need for diversification of the risk).The case was deferred until April 2019 for a review of the expert report, which is currently being prepared. Once the expertreport has been filed, it should be possible to provide an assessment of the risk inherent in the proceedings.Disputes regarding tax-collection companies - In the context of the government’s decision to re-assume responsibility for taxcollection, Intesa Sanpaolo sold to Equitalia S.p.A., now the Italian Revenue Agency - Collections Division, full ownership ofGest Line and ETR/ESATRI, companies that managed tax-collection activities, undertaking to indemnify the buyer against anyexpenses associated with the collection activity carried out up to the time of purchase of the equity interests.In particular, such expenses refer to liabilities for disputes (with tax authorities, taxpayers and employees) and out-of-periodexpenses and capital losses with respect to the financial situation at the time of the sale.A technical roundtable has been formed with the Italian Revenue Agency - Collections Division in order to assess the parties’claims.Administrative and judicial proceedings against Banca IMI Securities Corp. of New York – The SEC proceedings wereconcluded in 2017 through the payment of a total sum of approximately 35 million dollars – entirely covered by provision –levied on the basis of violations of Articles 15(b)(4)(E) of the Exchange Act and 17(a)(3) of the Securities Act.With regard to the investigation started in October 2016 by the Antitrust Division of the Department of Justice (DoJ), afterhaving submitted documents and information with a view to full co-operation, details are being awaited on the DoJ’s position.Offering of diamonds - In October 2015, the Bank signed a partnership agreement with Diamond Private Investment (DPI)governing how diamond offerings were made by DPI to the customers of Intesa Sanpaolo and of the banks of the Banca deiTerritori Division. The aim of this initiative was to provide customers with a diversification solution with the characteristics of a“safe haven asset” in which to allocate a marginal part of their assets over the long term. Diamonds had already been sold forseveral years by other leading national banking networks.This activity primarily generated transactions in 2016, with a significant fall starting from the end of that year. A total of around8,000 customers purchased diamonds, for a total of around 130 million euro. The marketing process was based on criteria oftransparency, with safeguards progressively enhanced over time, including quality controls on the diamonds and the fairnessof the prices applied by DPI.In February 2017, the AGCM (the Italian Competition Authority) brought proceedings against companies that marketeddiamonds, (DPI and other companies), for alleged conduct in breach of the provisions on unfair business practices. In April,those proceedings were extended to the banks that carried out the recommendation of the services of those companies.At the end of those proceedings, on 30 October 2017, the AGCM notified the penalties imposed for the alleged breach of theof Consumer Code through the conduct of DPI and of the banks which the proceedings had been extended to, consisting - inshort - of having provided partial, deceptive and misleading information on the characteristics of the diamond purchases, themethods used to calculate the price - presented as being the market price - and the performance of the market. The Authorityissued a fine of 3 million euro against Intesa Sanpaolo, reduced from the initial fine of 3.5 million euro, after the Authority hadrecognised the value of the measures taken by the Bank from 2016 to strengthen the safeguards on the offering processaimed, in particular, at ensuring proper information to customers.Following the order by the AGCM, the Bank paid the amount of the fine and filed an appeal with the Lazio RegionalAdministrative Court against the order. There were no developments regarding this appeal during 2018.From November 2017, the Bank:terminated the partnership agreement with Diamond Private Investment (DPI) and ceased the activity, which had alreadybeen suspended in October 2017;started a process that provides for the payment to customers of the original cost incurred for the purchase of thediamonds and the withdrawal of the stones, in order to satisfy the customers’ resale needs which, due to the illiquiditythat had arisen in the market, are not met by DPI within the contractually-agreed period of 30 days;sent a communication in January 2018 to the diamond-holding customers reiterating the nature of the stones as durablegoods, and also confirming the Bank’s willingness to intervene directly in relation to any realisation needs expressed bythe customers and not met by DPI.As at 31st December 2018, a total of 4,430 repurchase requests had been received from customers and met by the Bank, fora total value of 77.4 million euro.500
Notes to the consolidated financial statements – Part E – Information on risks and relative hedging policiesThe risk of potential losses connected to the diamonds for which the Bank may be required to pay the original cost incurredfor their purchase is covered by a prudential provision. The assessment of this risk is carried out and updated taking intoaccount the current appraisal values of the diamonds sold (retail prices) and their estimated wholesale prices.In February 2019 an order for preventive criminal seizure of 11.1 million euro was served, corresponding to the fee andcommission income paid by DPI to the Bank.The preliminary investigations initiated by the Public Prosecutor’s Office of Milan also concern four other banks (moreinvolved) and two companies that sell diamonds.ISP is accused of an administrative offence pursuant to Legislative Decree 231/2001 in relation to the alleged offence of selflaundering.In this regard, the Bank is confident that the correctness of its actions will emerge and that the aforementioned initiativestowards customers will be appreciated.Disputes connected with the acquisition of certain assets, liabilities and legal relationships of Banca Popolare di VicenzaS.p.A. in compulsory administrative liquidation and Veneto Banca S.p.A. in compulsory administrative liquidation - With regardto the risks connected with the possible outcomes for the Intesa Sanpaolo Group of the lawsuits relating to Banca Popolare diVicenza and Veneto Banca (and/or their directors and top management), the following is noted:a)based on the agreements between the two Banks in compulsory administrative liquidation and Intesa Sanpaolo (salecontract of 26 June 2017 and Second Acknowledgement Agreement of 17 January 2018), two distinct categories ofdisputes can be identified (also relating to the subsidiaries of the former Venetian banks included in the sale):- the Previous Disputes, included among the liabilities of the Aggregate Set transferred to Intesa Sanpaolo, whichinclude civil disputes relating to judgements already pending at 26 June 2017, with some exceptions, and in anycase different from those included under the Excluded Disputes (see the point below);- the Excluded Disputes, which remain under the responsibility of the Banks in compulsory administrative liquidationand which concern, among other things, disputes brought (also before 26 June 2017) by shareholders andconvertible and/or subordinate bondholders of one of the two former Venetian banks, disputes relating to nonperforming loans, disputes relating to relationships terminated at the date of the transfer, and all disputes (whatevertheir subject) arising after the sale and relating to acts or events occurring prior to the sale;b)the relevant allowances were transferred to Intesa Sanpaolo along with the Previous Disputes; in any case, if and to theextent the allowances transferred prove insufficient, Intesa Sanpaolo wil
OPERATIONAL RISK QUALITATIVE INFORMATION A. General aspects, operational risk management processes and measurement methods . applied on quantitative data and the results of the scenario analysis assuming a one-year estimation period, with a confidence level of 99.90%. The methodology also applies a corrective factor, which derives from the .
