The Reserve Bank has published the second consultation paper on the standards to be introduced under the Deposit Takers Act 2023 (DT Act). The consultation follows the previous consultation on the core standards that closed on 16 August (see our previous insight here) and represents the next stage in a significant multi-year work programme by the Reserve Bank to implement the DT Act.
In this insight, we summarise the Reserve Bank's policy proposals for locally incorporated deposit takers to be set out in the non-core standards.
The consultation closes on 22 November 2024.
If you have any questions on the consultation paper, please get in touch with one of our experts below.
Non-core standards
Under the DT Act, standards will replace the prudential requirements that are currently set out in:
- the Banking (Prudential Supervision) Act 1989 (BPS Act);
- banks' conditions of registration (CoRs);
- the Banking Supervision Handbook (ie the BSs);
- the Banking Prudential Requirements (BPRs);
- the Orders in Council (OiCs);
- section 93 information requests;
- the Non-bank Deposit Takers Act 2013 (NBDT Act); and
- the regulations made under the NBDT Act.
Standards will apply to deposit takers via their conditions of licence. The standards will apply once the DT Act is fully implemented, which is expected to be from July 2028.
The second consultation paper covers 9 non-core standards:
- governance standard (currently contained in banks' CoRs, BS10 and BS14);
- lending standard (currently contained in banks' CoRs, BS19 and BS20);
- risk management standard (a new standard);
- operational resilience standard (a new standard);
- Open Banking Resolution (OBR) pre-positioning standard (currently contained in banks' CoRs and BS17);
- outsourcing standard (currently contained in banks' CoRs and BS11);
- restricted activities standard (currently contained in banks' CoRs and BS1); and
- branch standard (currently contained in banks' CoRs and BS1).
Broadly speaking, the Reserve Bank is proposing that the lending standard, the related person exposure standard, the outsourcing standard, the restricted activities standard and the branch standard will largely carry over existing prudential requirements or (in the case of the branch standard) implement policy decisions that have recently been consulted on.
The more significant changes that the Reserve Bank is consulting on relate to the governance standard, the OBR pre-positioning standard, the risk management standard and the operational resilience standard, which will impose new prudential requirements on deposit takers. However, other than in the case of the OBR pre-positioning standard, the Reserve Bank expects that the cost to comply with the more significant changes will be relatively low as many deposit takers will already be substantively complying with many of the proposed requirements.
Proportionality Framework
The proposals in the consultation paper have been informed by the Proportionality Framework that the Reserve Bank published in March 2024, which requires the Reserve Bank to articulate how it will give effect to the proportionality principle when developing standards under the DT Act.
Under the Proportionality Framework, the Reserve Bank has grouped locally incorporated deposit takers based on their size:
- Group 1 deposit takers (those with assets greater than $100 billion, ie the four largest domestic systemically important banks (D-SIBs));
- Group 2 deposit takers (those with assets less than $100 billion but more than $2 billion, ie the non-D-SIBs, other than the two smallest registered banks); and
- Group 3 deposit takers (those with assets less than $2 billion, ie the current NBDTs and the two smallest registered banks).
In the Proportionality Framework, the Reserve Bank provides that it will give effect to the proportionality principle when developing standards by considering both the strength and the comprehensiveness of the prudential requirements that apply to each group of deposit takers.
Governance standard
The governance standard will set out minimum governance requirements for deposit takers. The standard will replace the relatively limited requirements that are currently set out in banks' CoRs, BS10 and BS14. The policy proposals have been informed by the governance thematic review that was jointly undertaken by the Reserve Bank and the Financial Markets Authority.
Because the requirements will apply to all deposit takers, the proposed requirements will be principles-based requirements. The Reserve Bank intends to publish guidance to accompany the standard that will set out its expectations of how deposit takers can comply with the requirements, which is intended to support a proportional approach. The Reserve Bank intends to consult on guidance when it consults on the exposure draft of the governance standard, which is expected to be in early 2026.
The governance standard will address three areas: responsibilities of boards, structural and compositional requirements for boards, and fit and proper requirements for directors and senior managers. The Reserve Bank expects that most deposit takers will already be substantively meeting the requirements being proposed.
Some of the proposals that the Reserve Bank is consulting on for Group 1 and 2 deposit takers include:
- The requirement for a deposit taker to have separate audit, risk and remuneration committees (currently a bank is only required to have an audit committee).
- The requirement that the majority of a deposit taker's board be independent (currently at least half of a bank's board must be independent).
- A number of possible enhancements to the criteria for independence, including that a director will not be considered independent if they have served more than 3 terms totalling 9 years and whether a chair that also sits on the board of a deposit taker's parent should be considered to be independent.
- The requirement to have a board-approved fit and proper policy and to assess potential directors and senior managers against that policy and the minimum fit and proper requirements in the standard.
The Reserve Bank proposes that the structural and compositional requirements that apply to Group 3 deposit takers will be simpler (eg no requirement for separate audit, risk and remuneration committees), to recognise that their size and scale may not warrant the additional complexity and cost.
Before a deposit taker appoints a new director or senior manager, it will need to obtain the Reserve Bank's approval. The application must be accompanied by a fit and proper certificate that complies with the requirements of the governance standard. Deposit takers will also have an ongoing duty to notify the Reserve Bank if any fit and proper concerns arise.
Under the DT Act, directors of a deposit taker will have a duty to exercise due diligence to ensure that the deposit taker complies with its prudential obligations. The Reserve Bank is required to publish guidance on the due diligence duty and the respective roles and responsibilities of directors and senior managers. The Reserve Bank is not consulting on the guidance as part of this consultation paper.
OBR pre-positioning standard
OBR was developed to ensure that customers of a failed deposit taker maintain access to a portion of their deposits and to provide a credible alternative to the use of public funds to resolve a failed bank. The Reserve Bank is consulting on changes to the OBR pre-positioning requirements to integrate the OBR regime with the depositor compensation scheme (DCS).
The OBR policy requires banks to be pre-positioned so that a statutory manager of a failed bank can close the bank, prevent customers from accessing their deposits, apply a freeze to a portion of customers' deposits, and re-open the bank the next business day with customers having access to the unfrozen portion of their deposits (which would be guaranteed by the government).
One of the most significant changes introduced by the DT Act is the DCS, under which up to $100,000 per depositor, per deposit taker will be protected against losses. The default use of DCS funds is to directly reimburse depositors of a failed deposit taker. However, the DT Act also allows the Reserve Bank to use DCS funds to support the resolution of a failed deposit taker.
In the consultation paper, the Reserve Bank proposes a number of changes to the OBR pre-positioning policy to integrate with the DCS. Under the proposed changes, DCS funds could be used to provide depositors with next day access to 100% of their insured direct balances. Depositors may also receive a portion of any uninsured direct balances and balances held in look-through accounts. DCS funds would be used to make a payment to the failed deposit taker equal to the expected losses that would have otherwise been attributable to the depositor's insured balance.
The Reserve Bank is proposing the following changes to the pre-positioning requirements:
- Deposit takers must be pre-positioned to be able to determine each depositor's direct insured balances, direct uninsured balances, and look-through accounts and estimate each depositor's notional entitlement under the DCS. This estimated notional entitlement would then form the basis for making account balances available to depositors the next calendar day.
- Deposit takers would need to be pre-positioned to be able to provide depositors with access to 100% of their insured direct balances and a portion of any uninsured direct balances and/or balances held in look-through accounts. The de minimis amount in BS17 would no longer be required.
- Deposit takers would need to be able to provide the RBNZ with customer-level reporting on the amounts depositors were given access to while in resolution and to reconcile these amounts against their DCS entitlements using the Single Depositor View data.
The Reserve Bank sees OBR as forming part of a range of possible "open bank" resolution strategies by ensuring continuity of access to deposits while a longer term resolution plan can be implemented (ie a stabilisation tool). The Reserve Bank is considering whether the OBR functionality should be renamed to better reflect its intended role to support continuity of access to deposits.
Under the DT Act, the Reserve Bank is required to prepare resolution plans for each deposit taker. The Reserve Bank proposes that the OBR pre-positioning standard would only apply to a deposit taker where OBR is expected to form a part of the deposit taker's resolution plan.
Risk management standard
The Reserve Bank is consulting on the requirements for a new risk management standard that will impose minimum requirements for risk management. Currently, there are only limited requirements that relate to a deposit taker's risk management practices. For example, a bank's directors must attest in disclosure statements to the adequacy of systems to manage material risks, while an NBDT is required to prepare and comply with a risk management programme. There are also risk management requirements that relate to specific risks (eg banks are required to prepare and comply with internal capital adequacy programmes) and the Reserve Bank has also published guidance documents on cyber and climate-related risks.
The risk management standard will apply generally to all of a deposit taker's material risks. Because the risk management standard will apply to all deposit takers, the proposed requirements will be principles-based. Some of the requirements will not apply to Group 3 deposit takers where there may be more fixed costs (eg Group 3 deposit takers will only be required to undertake stress testing for capital, liquidity and operational risks). The Reserve Bank intends to publish guidance to accompany the risk management standard that will set out its expectations of how deposit takers can comply with the requirements, which is intended to support a proportional approach.
Operational resilience standard
The Reserve Bank is consulting on the requirements for a new operational resilience standard that will impose minimum requirements for managing operational risk. Currently, there are few specific requirements for banks to adequately manage their operational risks (eg for banks that are accredited to use the advanced measurement approach to calculate their operational risk capital charge). The Reserve Bank expects that most deposit takers will already be substantively meeting the requirements in the standard as part of their existing risk management processes.
The standard will set minimum requirements in 4 key areas:
- Operational risk management: including the requirements to have a board-approved operational risk management framework, to be subject to annual review by internal or external auditors and reviewers, and to notify the Reserve Bank of any material operational incident.
- Material service providers: including the requirements to have a board-approved service provider management policy, to maintain a register a material service providers, to conduct due diligence and regular risk assessments of material service provider arrangements, and to notify the Reserve Bank of new (or material changes to) material service provider arrangements.
- Information and communication technology (ICT): including the requirements to have a board-approved ICT strategy and framework, to set out the processes for information security control assurance, and to notify the Reserve Bank of any material ICT incidents.
- Business continuity planning (BCP): including the requirements to have a board-approved BCP that complies with minimum requirements set out in the standard, to maintain the capabilities required to execute the BCP, to have a programme for testing the BCP, and to review and update the BCP (at least annually).
There will also be a new concept of "critical operations". Deposit takers will need to identify the activities, functions and services undertaken by the deposit taker or its service providers which, if disrupted or suddenly discontinued, could be reasonably expected to have a material adverse impact on the continued operation of the deposit taker and its role in the financial system. This is similar to the "critical service providers" concept in the outsourcing standard.
The operational resilience requirements will apply to all deposit takers and will be principles-based requirements. The Reserve Bank intends to publish guidance to accompany the standard that will set out its expectations of how deposit takers can comply with the requirements, which is intended to support a proportional approach.
The operational resilience standard will differ from the outsourcing standard, with the outsourcing standard focussed on ensuring that a deposit taker's outsourcing arrangements do not undermine the Reserve Bank's ability to deal with a deposit taker in resolution, while the operational resilience standard will be concerned with the operational risk posed to the deposit taker from third party providers that provide the deposit taker with critical services.
Other non-core standards
Lending standard
The lending standard will set out the requirements for the 2 borrower-based macroprudential tools that the Reserve Bank uses to manage systemic risk arising from household lending: loan-to-value (LVR) restrictions and debt-to-income (DTI) restrictions.
The lending standard is proposed to only apply to Group 1 and 2 deposit takers. Group 3 deposit takers would be excluded on the basis that they do not currently pose a systemic risk.
The Reserve Bank is proposing to implement the same requirements that are currently set out in BS19 and BS20 with a few technical changes:
- The measurement period for Group 1 deposit takers will be a rolling 3-month period, while the measurement period for all Group 2 deposit takers will be a rolling 6-month period (currently the applicable measurement period is determined by reference to a deposit taker's monthly lending flows).
- The Reserve Bank proposes to remove the ability to apply different restrictions to different geographic regions (currently different LVR restrictions may apply to the Auckland region and the rest of the country).
- The Reserve Bank says that the default approach under the DT Act will be for regulatory settings to be set out in the standard. The Reserve Bank proposes to write a set of possible LVR and DTI thresholds and speed limits into the lending standard, with the specific requirements set out in each deposit taker's conditions of licence.
- The Reserve Bank has signalled that other technical changes to terminology may be made when the BPRs, BS19 and BS20 are converted into standards.
Related party exposures standard
The related party exposure standard will implement the Reserve Bank's connected exposures policy that is currently set out in BS8. Given BS8 was recently consulted on, the Reserve Bank is proposing to implement the current requirements unchanged for Group 1 and 2 deposit takers (except for a change in terminology from "connected persons" to "related persons").
The Reserve Bank is proposing that Group 3 deposit takers comply with the same related party exposure requirements as Group 1 and Group 2 deposit takers. NBDTs are currently subject to similar (but different) requirements under the NBDT regulations. The Reserve Bank recognises that the proposed change for Group 3 deposit takers will likely involve a one-off cost, but prefers that a consistent approach is taken across all deposit takers.
Outsourcing standard
The outsourcing standard will implement the Reserve Bank's outsourcing policy that is currently set out in BS11, which requires that large banks put in place certain risk mitigations (eg robust back-ups, alternative arrangements, prescribed contractual terms etc) for outsourcing arrangements to ensure that the banks can be effectively administered in statutory management while continuing to provide basic banking services to customers.
The Reserve Bank is proposing to implement the same requirements that are currently set out in BS11 with a few technical changes:
- Large banks must be able to achieve the settlement outcomes (eg meeting their daily clearing, settlement and other time-critical obligations) by the start of the next calendar day given the recent implementation of SBI365 (currently this is the next business day).
- The Reserve Bank intends to publish guidance to accompany the outsourcing standard that will consolidate the guidance that the Reserve Bank has issued to date, which is currently set out across multiple documents (eg BS11, the FAQs, guidance on separation plans etc).
- The outsourcing standard will set out the matters that the Reserve Bank will have regard to when considering whether or not to exercise its discretion to grant an approval required under the standard.
The Reserve Bank proposes that the outsourcing standard will continue to only apply to large banks (those with net external liabilities greater than $10 billion), which is currently the 4 Group 1 deposit takers and the largest Group 2 deposit taker. In the issues paper on crisis management powers that was published alongside the consultation paper on non-core standards, the Reserve Bank provides that it is considering the potential for a new crisis preparedness standard that may apply to smaller Group 2 deposit takers.
Restricted activities standard
The restricted activities standard will set out the current restrictions on deposit takers conducting insurance underwriting and non-financial activities and issuing covered bonds, which are currently set out in banks' CoRs and BS1. These restrictions will apply to all deposit takers, including Group 3 deposit takers (which are not currently subject to these restrictions). The Reserve Bank considers that it is unlikely that Group 3 deposit takers will be affected as none of them currently undertake any of these activities.
One change that the Reserve Bank is proposing is a new approval process for deposit takers wanting to establish an overseas branch or subsidiary. The process would require the New Zealand deposit taker to first notify the Reserve Bank before seeking approval of the host supervisor, and then to seek the Reserve Bank's approval once approval from the host supervisor has been granted. The Reserve Bank is also proposing to develop an approvals regime, which would set out the factors that would determine whether the Reserve Bank grants approval.
The Reserve Bank notes that there are several registered banks that currently have branches and overseas subsidiaries. As regulatory approvals were granted under the BPS Act regime, the Reserve Bank provides that these approvals would need to be reassessed in light of the criteria for the proposed approvals regime.
Earlier this year, the Reserve Bank became the home supervisor of an international banking group for the first time. The Reserve Bank does not currently have a comprehensive group supervision framework and is considering the need for a separate licensing regime for groups.