OBB cheat sheet

Banking supervision rests on three pillars: minimum capital requirements, supervisory review of capital adequacy, and public disclosure of risk information.

Regulators grant charters, set permissible activities, and can revoke authority; operating without authorization is an enforcement matter, not a civil dispute.

Supervisory tools include on-site examination, off-site reporting analysis, thematic reviews, and formal enforcement actions such as cease-and-desist orders.

Capital adequacy ratios compare regulatory capital to risk-weighted assets; leverage ratios use total exposure without risk weighting.

Liquidity standards require a minimum stock of high-quality liquid assets to cover short-term outflows and a stable funding profile over a longer horizon.

Supervisory review evaluates governance, risk appetite, internal controls, and management of credit, market, operational, and concentration risk.

Cross-border operations trigger host and home country supervision; consolidated supervision covers the group including subsidiaries and affiliates.

Enforcement escalation typically runs from supervisory findings and remediation plans to restrictions, penalties, and license revocation.

Regulatory change requires institutions to track rulemaking, assess impact, and update policies, systems, and disclosures before effective dates.

The board sets strategy and risk appetite and is accountable for oversight; management executes within delegated limits and reports upward.

Three lines of defense: business units own risk, an independent risk and compliance function monitors, and internal audit provides assurance.

Board committees typically include audit, risk, and compensation; independence and financial literacy requirements apply to audit committee members.

Risk appetite statements translate into limits, thresholds, and escalation triggers that cascade to business lines and legal entities.

Segregation of duties prevents one person from initiating, authorizing, recording, and reconciling the same transaction.

Internal control frameworks cover control environment, risk assessment, control activities, information and communication, and monitoring.

Conflict-of-interest rules require identification, disclosure, recusal, and where necessary removal from decision-making.

Internal audit reports to the board or audit committee and must be independent of the activities it reviews.

Compensation structures must align incentives with prudent risk-taking and avoid rewarding excessive short-term risk.

Customer due diligence identifies the customer, beneficial owners, and the nature and purpose of the relationship before or during onboarding.

Enhanced due diligence applies to higher-risk customers such as politically exposed persons, correspondent relationships, and high-risk jurisdictions.

Suspicious activity must be reported to the financial intelligence unit; tipping off the customer about a report is prohibited.

Transaction monitoring systems flag patterns against expected activity; alerts require documented investigation and disposition.

Recordkeeping rules require retention of identification records and transaction data for a defined period after the relationship ends.

Complaint handling must be timely, documented, and escalated; unresolved complaints feed into regulatory reporting.

Vulnerable customers require adjusted processes, clear communication, and protections against unsuitable product sales.

Outsourcing and third-party arrangements remain the institution's responsibility; due diligence, contracts, and exit plans are required.

Business continuity planning addresses disruption to critical operations, with tested recovery objectives and alternate arrangements.

Deposit products carry insurance coverage limits and disclosure requirements; advertising must state terms accurately and not misleadingly.

Credit products require affordability assessment, clear disclosure of rates and fees, and fair treatment throughout the lifecycle.

Securities activities distinguish advice from execution; suitability and best-execution duties depend on the service provided.

Derivatives and structured products require counterparty eligibility checks, risk disclosure, and mark-to-market valuation.

Payment services impose authorization, fraud monitoring, error resolution, and consumer liability rules.

Investment funds disclose objectives, risks, fees, and past performance with required caveats about future results.

Insurance-linked and protection products sold by banks are subject to distribution rules, disclosure of commissions, and cooling-off rights.

Product governance requires defining target markets, testing products before launch, and reviewing performance after launch.

Insider dealing prohibits trading on material non-public information and communicating it to others.

Market manipulation includes false or misleading orders, wash trades, and practices that distort price discovery.

Front-running and personal account dealing restrictions require pre-clearance and holding periods for staff.

Conflicts of interest must be identified, managed, and disclosed; inducements must not impair duties to clients.

Gifts and entertainment policies set monetary thresholds, approval requirements, and prohibitions on cash or inappropriate benefits.

Whistleblowing arrangements provide confidential channels, protection from retaliation, and escalation to the board.

Codes of conduct address integrity, confidentiality, fair dealing, and compliance with law and regulation.

Fitness and propriety assessments cover honesty, competence, and financial soundness of approved persons.

Culture and conduct risk is measured through indicators such as complaints, breaches, and misconduct cases.

Regulatory reports must be accurate, complete, and submitted by deadline; late or erroneous filings can trigger penalties.

Financial statements follow applicable accounting standards with disclosures of significant judgments and risk exposures.

Pillar 3 disclosure covers capital, risk-weighted assets, and risk management practices at prescribed frequency.

Recordkeeping must be tamper-evident, retrievable, and retained for the required period, including electronic communications.

Data governance assigns ownership, quality controls, and lineage for data used in reporting and decision-making.

Material events such as breaches, fraud, and operational failures require prompt notification to the regulator.

Audit trails document who changed what and when; changes to reported data must be logged and justified.

Confidential supervisory information must be protected and not disclosed except as permitted by law.