DNB thematic investigation into at trust offices: preparation and points for consideration

The Dutch Central Bank (DNB) is going to conduct thematic investigations into the compliance and audit function at trust offices. In this news item, we will explain what the thematic investigation entails, how best to prepare for it and how Projective Group can support you.

Background compliance and audit function at trust offices

Trust offices are expected to organise and conduct their business operations with integrity and control. The compliance and audit function play a crucial role in this.

The compliance function mainly focuses on monitoring and ensuring that the organisation complies with its legal and internal regulations. The Decree on the Supervision of Trust Offices 2018 (Btt 2018) fleshes out the requirements regarding the compliance function. For instance, in any case, compliance must be sufficiently independent and effectively fulfilled. It is not allowed to outsource the compliance function.

The main task of the audit function is to monitor the trust office's compliance with the relevant legal obligation and the performance of the compliance function. This involves examining the existence, design and operation of the policies and procedures that the trust office follows to manage potential integrity risks. The audit function should have sufficient knowledge and skills. It is up to the trust office to determine, reasoned, whether this is the case.

Process of thematic investigation DNB

For a thematic investigation, a number of trust offices are selected and usually the investigation starts by asking a number of relevant documents for the investigation. After that, a selection of trust offices is given, possibly in-depth questions based on the data obtained by DNB. DNB has the option of visiting institutions on-site and continuing the investigation there. The method of investigation depends on the purpose of the investigation.

At the end of the investigation, feedback is given to the trust office.
The trust office is thereby given the opportunity to react to those preliminary findings. After this, the final findings are shared with, if necessary, measures. As soon as the thematic investigation is completed, DNB also publishes, in some cases, general guidance and good practices for the entire sector whereby other trust offices are also expected to take note of them and act on them where necessary.

Preparation and points for attention

Preparation

To properly prepare for a DNB thematic investigation, it is important that the trust office can fall back on good filing and has the documentation in order. This could include policies & procedures, the compliance and audit charter and programme, relevant reports (e.g. compliance and audit reports), board minutes and the most recent SIRA.

Good coordination between the business, compliance and audit helps to answer DNB's request for information properly and timely. It is also very important to communicate clearly and transparently with the regulator.

It may be beneficial to engage external expertise to assess the current control framework and prepare for the upcoming thematic review.

Points of attention

Supervision is particularly focused on determining the extent to which a trust office has established an independent and effective compliance and audit function.

Independence

When discussing independence of the compliance and audit function, DNB will consider, among other things, the extent to which:

• The compliance function has access to all necessary information and sufficient resources to perform the function.
• The person performing the compliance function is not involved in the implementation of the supervised policy and can operate independently from the business.
• The audit function is able to function completely independently. Thus, the audit function should be separate from the day-to-day business and the person performing the audit will not perform any operational or compliance activities. This is particularly important if the audit function is invested internally.

Effectiveness

When assessing effectiveness, both the design, existence and operation of the compliance and audit function are considered. For instance, DNB will in any case assess whether:

• The legally required components are sufficiently embedded policies and procedures.
• The compliance function draws up an annual risk-based work programme.
• The compliance function has sufficient capacity. This available capacity must be able to be substantiated. The trust office must therefore be able to provide a solid substantiation of this capacity in relation to, among other things, the nature of the services, the number of clients/target companies and the associated integrity risks.
• The audit function has a detailed audit plan and the activities are sufficiently geared to the risk profile of the trust office.
• The audit report touches on a number of minimum required topics.
• The findings identified by audit are recorded, reported and translated into concrete actions.

Support

Want to know whether your firm is adequately prepared for a potential thematic investigation?

Projective Group's consultants have in-depth knowledge and experience of the trust sector and the relevant legal framework and can assist you in preparing for a thematic investigation.

We can help you collect and review the relevant information and documentation and prepare you for a possible interview with the regulator. Additionally, we can help you resolve any deficiencies identified during the initial assessment or following the feedback from DNB.

Even if your firm is not (yet) selected for a thematic review, we can support you by timely assessing your governance structure or performing a validation with respect to, for instance, client due diligence or transaction monitoring. Where necessary, we will advise you on areas for improvement and, if required, help you with implementation.

Would you like to know more about what Projective Group can do for you? Feel free to contact us for an introductory meeting.