Proposal to regulate 3 independent lines of protection in the internal control system of banks

The State Bank of Vietnam (SBV) is seeking comments on the Draft Circular regulating the internal control system (ICS) of commercial banks and foreign bank branches, replacing Circular No. 13/2018/TT-NHNN. This is an important adjustment step to synchronize the legal framework with the Law on Credit Institutions 2024, update Basel standards and enhance risk management capacity throughout the system.

According to the SBV's Explanatory Report, the new regulations are based on the 2024 Law on Credit Institutions and Decree 26/2025/ND-CP of the Government on the functions, tasks and organizational structure of the SBV. The new law has many changes in Articles 57 and 58 related to the internal control and internal audit systems, making the current Circular 13 no longer suitable.

In addition, during the implementation process, the SBV also noted a number of difficulties from commercial banks (CBs) and foreign bank branches regarding the control process, risk management and internal audit. On that basis, the Draft Circular is built in the direction of updating the new Basel standards, while supplementing missing contents such as model risk management, risk data requirements, stress testing and guidance on measuring interest rate risk in the banking book.

According to the State Bank, this is not just a technical amendment but a fundamental adjustment in structure and approach, aiming to approach international practices, increase transparency and ensure safety for the operations of the banking system.

Seeking opinions on the new Draft Circular regulating the internal control system (ICS) of commercial banks and foreign bank branches

One of the highlights of the Draft is the specific provisions on three independent lines of protection in the internal control system.

Specifically, the first line of defense is the risk-generating departments, including the revenue-generating department, the risk-making department, the risk-making department, the risk-limiting department for each specific business activity and operation; the department that builds, deploys, and uses models, and other risk-generating departments. The first line of defense has the function of identifying, implementing control measures, monitoring, and minimizing risks;

The second line of defense consists of at least the Compliance Department and the Risk Management Department. The second line of defense has the function of developing risk management policies, internal regulations on risk management; measuring and monitoring bank-wide risks and compliance with legal regulations; and the function of model verification;

The third line of defense has the internal audit function performed by the internal audit department in accordance with the provisions of the Law on Credit Institutions and this Circular.

The draft also emphasizes the role of control culture, considering it the foundation for all management activities in the bank. This culture is formed through professional ethics standards, internal regulations, reward and discipline mechanisms, thereby encouraging each individual to proactively identify and control risks at work.

In addition, the State Bank requires banks to establish a transparent and multi-dimensional information exchange mechanism, helping all levels of management to promptly grasp the situation of risks, violations or fraud incidents. The principle of “the higher the risk, the greater the frequency of information exchange” is included as a mandatory requirement for the internal management system.

The new draft Circular expands the scope of definitions and contents of types of risks, including credit risk, market risk, operational risk, liquidity risk, concentration risk and interest rate risk in the banking book.

In particular, interest rate risk in the banking book is detailed into three groups: Gap risk, arising from the mismatch between the maturity of assets and liabilities; Basis risk, arising from the difference between the valuation interest rates; Option risk, arising from customer behavior or product characteristics.

These are new points built on the basis of the Basel Committee's guidance, contributing to the completion of the risk management system according to international standards. In addition, the draft Circular also adds new concepts such as model risk, stress testing and economic capital, helping banks have better forecasting and response tools in market fluctuation scenarios.

Notably, the State Bank requires credit institutions to periodically report annually on the results of internal control, risk management, capital adequacy assessment and internal audit, and to keep complete records to serve inspection and supervision work.

According to the assessment of the drafting agency, the issuance of the new Circular not only aims to improve the self-control and risk management capacity of commercial banks, but also aims to build a safe, healthy, transparent and sustainable banking system.

Source: https://thoibaonganhang.vn/de-xuat-quy-dinh-3-tuyen-bao-ve-doc-lap-trong-he-thong-kiem-soat-noi-bo-ngan-hang-173059.html