Banking in Luxembourg 2024

• Resilience to Immediate Macro-Financial and Geopolitical Shocks: CEOs should take the lead in devising new strategies for liquidity and funding to manage risks stemming from interest rate changes and customer behaviour changes. They should develop an understanding of their banks’ exposure to the Interest Rate Risk in the Banking Book (IRRBB) and ensure regular reviews and evaluations of the IRRBB framework.

• Managing Governance and ESG Risks: CEOs and the chairpersons of the boards of directors should promote a culture of openness and constructive dialogue, whereby both the senior management and the board constructively challenge one another. The CEO should also guide efforts towards establishing or refining the bank’s net-zero transition plan, as well as reviewing the quality of the bank’s disclosures on climate-related and environmental risks.

• Progress in Digital Transformation and Digital Operational Resilience: CEOs should set general objectives for the digital transformation strategy, ensuring alignment with the bank’s strategic objectives and risk appetite. They should oversee the implementation of the EU’s Digital Operational Resilience Act (DORA) and the bank’s emergency response and disaster recovery plan.

• Tax-related Risks and Opportunities: CEOs should consider establishing a department dedicated to managing tax affairs or weigh potential outsourcing arrangements as this could unlock a host of tax-related opportunities for the bank. In addition, they should direct efforts towards understanding how the Luxembourgish government’s digital and ecological transformation (DET) tax credit can benefit the bank.

• Coping with Heightened Financial Crime Risks: CEOs should regularly consult with the Chief Compliance Officer (CCO), the Chief Risk Officer (CRO), and the Chief Operating Officer (COO) regarding the bank’s Anti-Money Laundering (AML) processes and procedures. They should not hesitate to take necessary actions to remediate any identified shortcomings.

These actions are aimed at enhancing the resilience, governance, digital transformation, tax management, and financial crime prevention in the banking sector. CEOs are encouraged to take a proactive and strategic approach in implementing these recommendations to navigate the evolving financial landscape.

• Governance and ESG Risks and Opportunities: The CCO should work closely with the CRO, the COO and the internal audit function to understand the multifaceted risks – ESG and non-ESG alike – that the bank faces and ensure that the regulatory watch reaches the board so that the latter is periodically informed about major regulatory developments and how they will impact the bank. The CCO should also collaborate with the CRO and the CSO to identify ESG-related opportunities and regularly communicate them to the rest of the senior management and the board of directors to inform the bank’s long-term strategy.

• Digital Operational Resilience: In-line with the Digital Operational Resilience Act (DORA), and in collaboration with the CRO, the CCO is responsible for maintaining the register of information of ICT third-party providers, ensuring that it is up-to-date and that it is part of the bank’s broader outsourcing register.

• Financial Crime Risks and AML: The CCO should keep abreast of the European Commission’s AML Package and oversee the development of AML policies, procedures and controls in-line with the latest regulatory developments. Together with the CRO and CIO, the CCO should also play a role in determine what is the best way forward with regards to implementing GenAI solutions in the bank’s AML procedures and processes.

These actions are integral to the CCO's role in ensuring the bank's compliance and effective risk management.

• Loan Origination and Monitoring (LOM): CROs should develop a deep understanding of the European Banking Authority’s guidelines on LOM and take the lead in the bank’s stress tests and reverse stress tests, consulting with the Chief Sustainability Officer (CSO) for ESG risks and the Chief Financial Officer (CFO) for the necessary data.

• Asset and Liability Management: CROs need to envision scenarios that could lead to rapid withdrawal of deposits by institutional and high-net worth clients, testing the reliability of the bank’s asset and liability management frameworks. These scenarios should form the basis of the stress tests and reverse stress tests.

• Risk Data Aggregation and Reporting (RDARR): Collaborative efforts by the CRO, the Chief Information Officer (CIO) and the CFO, or assigning responsibility to a data officer or Chief Data Officer, are essential to address deficiencies in RDARR. This will greatly benefit the board of directors as RDARR data can be used to better inform the bank’s strategy.

• ESG-related Risks: CROs should determine the ESG-related risks confronting the bank, and develop and enforce climate-related risk policies. They should collaborate with the CSO to ensure the bank’s green asset ratio is increasing and identify ESG-related opportunities. 

• Digital Transformation and Cyber Risks: CROs should ensure that the design and implementation of the digital transformation strategy is fully in line with the bank’s risk appetite, with adequate mechanisms for cyber-related risk monitoring and reporting.

• Digital Operational Resilience: CROs should oversee ICT third-party providers, ensuring transparency in the outsourcing chain and maintaining the register of information on ICT third-party service providers as prescribed by DORA.

• Financial Crime Risks: CROs should keep abreast of the European Commission’s Anti-Money Laundering (AML) package, ensure the bank’s AML policies are up-to-date, and work closely with the CCO and CIO to determine what processes should be prioritised for Generative Artificial Intelligence (GenAI) applications in AML operations.

These actions are crucial for CROs to manage risks effectively and ensure the bank's resilience and compliance with regulatory requirements.  

• Loan Origination and Monitoring (LOM): CFOs should provide the necessary data for the bank's stress tests and reverse stress tests, ensuring compliance with the European Banking Authority’s guidelines on LOM. They should also ensure that the bank abides by IFRS 9.

• Asset and Liability Management: CFOs should collaborate with the CRO to test the reliability of the bank’s asset and liability management frameworks, envisioning scenarios that could lead to rapid withdrawal of deposits by institutional and high-net worth clients.

• Risk Data Aggregation and Reporting (RDARR): CFOs should work with the CRO, CIO, or a Chief Data Officer to address deficiencies in RDARR, delineating responsibilities at a granular level for data input used for KPIs, stress tests, and reverse stress tests.

• Digital Transformation and Financial Risks: CFOs should proactively identify any financial risks that might arise from the digital transformation and communicate them to the rest of the C-Suite. They should ensure that the digital strategy aligns with the bank’s risk appetite. 

• Tax-related Risks and Opportunities: Alongside the CEO, CFOs should consider the merits of establishing a department dedicated to managing tax affairs or weigh outsourcing arrangements. They should also take the lead in understanding how the digital and ecological transformation (DET) tax credit can benefit the bank.

• Implementation of the EU’s Central Electronic System of Payment Information (CESOP): CFOs should cooperate and coordinate closely with the COO, the CIO, and, if applicable, the Head of Tax Affairs, to ensure that the adequate ICT processes and reporting mechanisms are in place.

These actions are essential for CFOs to effectively manage financial risks, ensure compliance, and contribute to the bank's strategic objectives. 

• Managing governance risks: COOs should work closely with the CCO, the CRO and the internal audit function to ensure that the board of directors has a thorough understanding of the multifaceted risks the bank faces, the upcoming regulatory changes, and how the bank may benefit from them.

• Digital Transformation and Operational Resilience: COOs should ensure that back offices are adequately prepared for the bank's digital transformation and, when a cyber-attack occurs, should ensure that it is communicated effectively to all internal and external stakeholders. They must also take the lead in defining what the priorities of the recovery plan should be.

• Oversight of ICT Third-Party Providers: Alongside CROs, COOs should oversee ICT third-party providers and ensure that the outsourcing chain is transparent. They are also responsible for maintaining the register of information on ICT third-party service providers as prescribed by DORA and ensure that it is up-to-date.

• Implementation of CESOP: In banks without a Head of Tax Affairs, COOs will need to cooperate and coordinate closely with the CFO and CIO to ensure that the adequate ICT processes and reporting mechanisms are in place for the implementation of the EU’s Central Electronic System of Payment Information (CESOP). 

• Financial Crime Risks: COOs should work closely with the CCO and/or the CRO to understand the bank’s AML-related operational deficiencies and how they can be resolved. They should also cooperate with the CCO, the CRO and the CIO to determine what processes should be prioritised for GenAI applications in AML operations.

These actions are crucial for COOs to manage operational aspects effectively and ensure the bank's resilience and compliance with regulatory requirements.

• Digital Transformation and Cyber Risks: In partnership with CROs and CISOs, CIOs need to ensure that the bank's overarching digital transformation is subject to rigorous risk assessments covering all potential cyber-related risks. Risk management should be fully embedded in the design and implementation of the digital transformation strategy, with adequate mechanisms for cyber-related risk monitoring and reporting.

• Digital Operational Resilience: CISOs play a strategic role in defining the bank's cybersecurity objectives and goals, coordinating cyber resilience stress tests, and ensuring that the bank’s cybersecurity measures are effective. Both the CISO and the CIO play crucial roles in the bank’s DORA journey.

• Emergency Response and Disaster Recovery Plan: While CISOs propose disaster recovery plans and regularly evaluate their effectiveness, CIOs are responsible for ensuring that the ICT assets needed for the recovery plan are in place.

• Oversight of ICT Third-Party Providers: CIOs determine which ICT Third-Party providers can ensure long-term resilience and whether the current setup can guarantee the bank’s digital operational resilience. They also maintain the register of information on ICT third-party service providers as prescribed by DORA. 

These actions are essential for CIOs and CISOs to effectively manage digital and cybersecurity risks, ensure operational resilience, and comply with regulatory requirements.