Law on credit institutions requires non-bank credit organizations to establish an internal control system appropriate to their operations. Previously, the State Bank of Vietnam issued Circular 44/2011/TT-NHNN dated December 29, 2011, regulating the internal control system and internal audit applicable to credit institutions in general, and Circular 13/2018/TT-NHNN dated May 18, 2018, regulating the internal control system of commercial banks ("Circular 13").
Recently, on November 20, 2023, the State Bank of Vietnam continued to issue Circular 14/2023/TT-NHNN on the internal control system of non-bank credit organizations ("Circular 14"). Based on ATA's assessment, the provisions of Circular 14 for non-bank credit organizations ("NBCOs") are simpler than those for commercial banks under Circular 13.
Below, ATA will summarize and analyze some notable contents of Circular 14 as follows:
1. NBCOs must establish and maintain an internal control system to ensure strict control and effective risk management
- In principle, similar to commercial banks, Circular 14 requires the internal control system of NBCOs to have three independent protection lines, including:
+ The first protection line is responsible for identifying, controlling, and minimizing risks by both revenue-generating departments, risk control departments, and human resources and accounting departments.
+ The second protection line is responsible for developing content related to risk management, internal regulations on risk management, monitoring risks, and compliance with legal regulations by the compliance and risk management departments.
+ The third protection line is responsible for internal audit by the internal audit department.
2. Organizational structure of the internal control system of NBCOs: It includes independently organized units with a balanced distribution of power between the management - operation - control blocks:
+ Risk Management Committee, Human Resources Committee, and other committees (if necessary) under the Board of Directors;
+ Compliance department, risk management department under the CEO/Director; and
+ Internal audit department under the Control Board.
Compared to commercial banks, the organizational structure of the internal control system of NBCOs is simpler as it does not require the establishment of councils such as the Risk Council, Capital Management Council, and Asset/Liability Management Committee.
3. Scope and object of internal control activities at NBCOs
While Circular 13 guides the establishment and implementation of internal control activities for commercial banks, focusing on (i) controlling lending and proprietary trading activities, and (ii) risk management activities: credit risk, market risk, operational risk, liquidity risk, interest rate risk, and concentration risk.
In contrast, the scope and object of internal control activities at NBCOs are required to be simpler, focusing mainly on controlling lending activities and risk management: credit risk, operational risk.
4. Reporting regime on internal control activities of NBCOs
In addition to requiring the establishment of an internal control system, maintaining organizational structure, and implementing internal control activities at the unit level, Circular 14 also requires NBCOs to prepare and submit reports on the internal control system to the State Bank of Vietnam according to the following schedule:
a) Annual report on internal control and risk management: to be submitted within 45 days from the end of the fiscal year.
b) Annual report on internal audit: to be submitted within 60 days from the end of the fiscal year.
c) Ad-hoc report on internal audit: to be submitted within 15 days from the end of the ad-hoc internal audit.
In which, the report on the internal control system must update the existence, limitations, and arising risks (if any) throughout the entire NBCO (including departments at the main office, branches, and other dependent units).
Circular 14 takes effect from October 1, 2024.
Comment: