Changes to corporate governance in banking groups: impacts of the Banking Executive Accountability Regime (BEAR)

On 19 October 2017 the Government introduced into Parliament the Treasury Laws Amendment (Banking Executive Accountability and Related Measures) Bill 2017, otherwise known as the "Banking Executive Accountability Regime" (BEAR).

While political outcomes are generally uncertain in Federal politics, given the policy rhetoric of all parties is for increased accountability in the banking sector, ADIs should plan for the BEAR to become law in the first half of next year. The bill currently contains a commencement date of 1 July 2018.

The BEAR applies to authorised deposit-taking institutions (ADIs) and their subsidiaries. These organisations will need to take the following steps to prepare for commencement of the BEAR:

• Update Policies, Systems and Training: understand the new set of BEAR obligations to be met by ADIs and "accountable persons" (described below), update their governance policies, procedures and systems to reflect the BEAR and ensure that their accountable persons understand those obligations;
• Identify and register all "accountable persons": identify each "accountable person" within their organisation, being a director or senior executive who exercises significant influence over conduct of and behaviour within the ADI, so that their names and roles can be registered with APRA on commencement of the BEAR;
• Review Governance Structures and prepare Accountability Statements and Maps: review their governance structures and prepare accountability statements and accountability maps which will need to be provided to APRA and kept updated; and
• Revise Remuneration Policies and Deeds of Indemnity: revise their remuneration policies and procedures (and Deeds of Indemnity) for "accountable persons", including to reflect the mandatory four year deferral of a component of remuneration required by the BEAR.

Which organisations will be affected?

The BEAR applies to all entities within a group with an ADI parent. Where a group has a non-ADI parent but ADI subsidiaries, BEAR will apply to the subgroup(s) under the control of the ADI(s).

This means that a number of APRA-regulated entities that are not ADIs, such as insurance companies and superannuation funds, will not be covered by BEAR unless they have an ADI parent. This point has attracted some criticism for its potential to distort business structures and competition, but although the Treasurer has the power to exempt certain ADIs from the operation of the BEAR, this approach remains a feature of the regime.

The BEAR will only apply to foreign ADIs to the extent of the operations of a branch of the foreign ADI in Australia.

In addition to the "big four" banks there are over 140 medium and small ADIs that will be affected by the regime.

Which bank directors and executives will be affected - who are the "accountable persons"?

The BEAR introduces the concept of an "accountable person", being a director, executive or other person considered to exercise significant influence over conduct of and behaviour within an ADI (accountable person). Accountable persons will be identified using a combination of prescriptive and in-principle criteria.

The in-principle criteria provide that an individual is an accountable person if they have senior executive responsibility for management or control of the ADI, or of a significant or substantial part or aspect of its operations.

The positions that are then further prescribed as accountable persons include the members of the board of the ADI, the CEO, CFO, COO, CIO (or CTO), Chief Risk Officer, Head of Compliance/Chief Compliance Officer, Head of Internal Audit, Head of Human Resources and the Anti Money Laundering Officer.

Under the BEAR, persons holding positions in Australian branches of foreign ADIs will be exempt from the prescriptive test of an accountable person, but foreign ADIs will still be subject to the in-principle test - so a person who has senior executive responsibility for the conduct of all of the activities of an Australian branch of the foreign ADI, or of a significant or substantial part or aspect of its operations, will be an accountable person.

Registration of "accountable persons" and "accountability statements" with APRA

Under BEAR, prior to appointing any person to an office where they could be deemed an accountable person, ADIs will be required to:

• advise APRA of the potential appointment; and
• provide APRA with an "accountability statement" which would detail the roles and responsibilities of the individual within the ADI.

APRA would then add this person's information to a non-public register, which it could use to determine whether a prospective appointee had any disciplinary record which might affect their suitability.

Importantly, the BEAR prohibits a person from being an accountable person if the person has not registered with APRA. If an application meets APRA's requirements for registration (discretion for which is given to APRA), APRA has 14 days from the date an application for registration is made to register the person as an accountable person.

Preparing and maintaining "Accountability Maps" - and reporting requirements

In addition to accountability statements, ADIs will also be required to provide an "accountability map" to APRA. This map must identify accountable persons in the ADI and their responsibilities, details of reporting lines and lines of responsibility, and must include "sufficient information" to identify the relevant accountable persons for specific issues and obligations.

ADIs will need to notify APRA within 14 days of any change to an accountability statement or map, as well as for a range of prescribed events (including if the ADI suspects that it has breached the broad accountability obligations referred to below).

New "accountability obligations" for ADIs and individuals

In addition to their existing obligations under the APRA Prudential Standards and the Corporations Act, accountable persons will be subject to a new set of "accountability obligations".

For ADIs, the obligations include taking reasonable steps to:

• conduct their business with "honesty and integrity, and with due skill, care and diligence";
• "in conducting its business, prevent matters from arising that would adversely affect the ADI's prudential standing or prudential reputation";
• deal with APRA in an "open, constructive and cooperative way"; and
• ensure that BEAR is complied with by the ADI's subsidiaries and by each of its accountable persons.

The personal obligations of individual accountable persons largely mirror or complement those of the ADI itself.

Noting that the new expectations have been criticised for being vaguely worded and subjective, ADIs will nonetheless need to:

• modify current, or create new, internal processes for ensuring compliance with the new expectations; and
• determine whether certain planned actions or conduct would be in breach of the new expectations.

Civil penalties, removal and disqualification

ADIs that fail to meet the new obligations under BEAR will face significant penalties, with maximum civil pecuniary penalties ranging from $10.5 million to $210 million depending on the size of the ADI, with ADIs to be classified as either small, medium or large pursuant to regulation.

Accountable persons will face similarly significant penalties should they fail to meet the obligations. In addition to APRA's extant power to direct an ADI to remove a director or senior manager under threat of losing authority to carry on banking practices, the BEAR grants APRA power to summarily disqualify accountable persons from acting in their positions within ADIs.

This enhances APRA's current disqualification powers, which only allow it to apply to the Federal Court for a disqualification order; and would also extend the scope of these powers from directors and senior managers to all persons falling within the broader definition of accountable persons.

That being so, APRA will be required to notify the relevant person in writing before disqualifying them, and to grant them an opportunity to make submissions related to the proposed disqualification. The BEAR also provides for merits review of a decision by APRA to disqualify an individual.

Mandatory four-year deferral of a portion of remuneration for "accountable persons"

The BEAR requires that the lesser of 60% of bank CEOs' variable remuneration, and 40% of their total remuneration, be deferred for a specified period. These requirements fall to and 40% of variable remuneration or 20% of total remuneration for other accountable persons in large and medium ADIs, and 40% of variable remuneration or 10% of total remuneration for small ADIs.

For all of these individuals, the relevant proportion of their remuneration will be required to be deferred for at least four years; the rationale being that this period is sufficient to cause ADIs and their stakeholders to fully realise the impact of risk-taking behaviour and to adjust variable remuneration accordingly.

The BEAR provides that these changes need to be reflected in remuneration policies from 1 July 2018 - which will require a significant review of remuneration within the organisation to be undertaken.

Insurance restrictions

An ADI is prohibited from taking out insurance against any consequences of breaching the BEAR.

In addition the BEAR prohibits ADIs from:

• indemnifying accountable persons against the consequences of breaching BEAR; or
• paying for insurance against such consequences.

However, the prohibition does not apply to liability for legal costs.

ADIs will need to review their insurance policies and any deeds of indemnity with directors and officers to reflect the BEAR.