菲律宾：制定运营弹性监管框架

HighLevel Summary Technical Assistance ReportMonetary and capital Markets DepartmentDeveloping a Regulatory and Supervisory Framework for Operational ResiliencePrepared by Rangachary Ravikumar and Chris Wilson (STX)TheHighLevel Summary Technical Assistance Reportseries provides highlevel summaries of theassistance provided to IMF capacity development recipients, describing the highlevel objectives,findings, and recommendations.ABSTRACT: Monetary and Capital Markets (MCM) department delivered a hybrid technical assistance(TA) mission to assist the Bangko Sentral ng Pilipinas (BSP) in developing a supervisory framework foroperational resilience. An earlier mission in 2022 assisted BSP to develop a regulatory framework foroperational resilience. The virtual mission focused on taking stock of developments since the regulationwas developed. The inperson mission developed concepts and thinking on operational resiliencesupervisory framework and imparted training to supervisors. The mission is supported by seniormanagement well. Recommendations included reflecting Basel Core Principle 25 (BCP25) in the draftregulation, developing internal guidance for supervisors, adjusting risk rating methodology and leveragingthe experience of the working group.JEL Classification NumbersG18, G28, G29, M15 (consulthttps://www.aeaweb.org/econlit/jelCodes.phpKeywords:Cybersecurity, ICT risks, Operational Risk, Operational ResilienceThe contents of this document constitute a highlevel summary of technical advice provided by the staff ofthe International Monetary Fund (IMF) to the authorities of a member country or international agency (the"CD recipient") in response to their request for capacity development. Unless the CD recipient specificallyobjects within 30 business days of its transmittal, the IMF will publish this highlevel summary on IMF.org(seeStaff Operational Guidance on the Dissemination of Capacity Development Information).International Monetary Fund, IMF PublicationsP.O. Box 92780, Washington, DC 20090, U.S.A.T. +(1) 202.623.7430 • F. +(1) 202.623.7201publications@IMF.orgIMF.org/pubs IMFBackgroundMCM delivered a TA mission assisting BSP in developing a regulatory framework for operationalresilience in December 2022. The authorities have since developed the draft regulation leveraging onexisting policies on operational risk management, business continuity management, IT risk andoutsourcing, among others. The draft regulation has been exposed for comments of regulators and theindustry. A follow up hybrid mission during May 2024 addressed developing a supervisory framework foroperational resilience. While a virtual mission took stock of developments since the development ofregulation, an inperson mission engaged with the Technical Working Group on Operational Risk(TWGOR), provided training inputs to supervisors, provided feedback on the selfassessment carried outby BSP for the inclusion of provisions contained in core principle 25 and delivered a sensitization sessionfor the senior management.Summary of FindingsAn outcome from the first mission was for BSP to review the draft circular to determine if it adequatelycovers the criteria in the revisedBCP25. The second mission provided feedback. BSP will need to closelymanage the communication strategy with its supervised institutions to clarify the potential areas ofadditional effort to implement operational resilience. In its onsite examinations, the BSP has establishedseveral touchpoints where operational risk management is assessed which it can leverage to includeassessment of operational resilience. There are benefits leveraging the ongoing role of the TWGOR tohelp smooth implementation and integration into the supervisory framework. The mission enjoyed thesupport of the senior management and BSP is adopting an outward looking philosophy of learning fromother supervisors.Summary of RecommendationsThe mission’s recommendations included: (i) improving the draft regulation by reflecting the expectationsfrom BCP 25; (ii) integrating operational resilience into the risk rating methodology; (iii) developing aninternal supervision guideline on how to assess operational resilience; (iv) integrating operationalresilience assessment as part of riskbased supervisory framework; and (v) conducting thematic reviewsfocusing on domestic systemically important banks. HighLevel Summary Technical Assistance Report | 3