(4) When the Registrar is of the opinion that a bank's—
| (a) | calculated aggregate risk exposure does not sufficiently reflect— |
| (i) | the bank's actual risk profile; |
| (ii) | the factors external to the bank, such as the effect of business cycles; |
| (iii) | the risk relating to a particular type of exposure such as credit risk, market risk or operational risk; |
| (iv) | the risk relating to a group of exposures such as corporate exposure or retail exposure, |
| (b) | qualifying capital and reserve funds are likely to be overstated due to, for example, reserves that are subject to material volatility as a result of short-term fair value gains or adjustment; |
| (c) | policies, processes and procedures relating to its risk assessment are inadequate; |
| (d) | policies, processes and procedures relating to compensation or remuneration are inadequate; |
For example, when the bank's compensation or remuneration policies, processes and procedures, particularly in respect of bonus or other discretionary payments, do not duly incorporate all relevant material types of risk, or when bonus or other discretionary payments are finalised over short periods without adequate regard for related material risk exposure carried by the bank over a longer period.
(e) internal control systems are inadequate;
the Registrar, among other things, may require the said bank—
| (i) | to maintain additional capital, calculated in such a manner and subject to such conditions as may be specified in writing by the Registrar; |
| (ii) | to deduct from its qualifying capital and reserve funds such amount calculated in such a manner and subject to such conditions as may be specified in writing by the Registrar; |
| (iii) | to strengthen the bank's risk management policies, processes or procedures; |
| (iv) | to duly align the bank's compensation or remuneration policies, processes or procedures with the bank's relevant exposure to risk; |
| (v) | to strengthen the bank's internal control systems. |
