Corporate governance

Corporate Governance Statement of Arion Bank for 2016

Good corporate governance helps to foster open and honest relations between the Board of Directors, shareholders, customers and other stakeholders, such as the Bank’s employees and the general public. Corporate governance also provides the foundations for responsible management and decision-making, with the objective of generating lasting value. The Board of Directors places great importance on good corporate governance and re-evaluates its governance practices annually on the basis of recognized guidelines on corporate governance.

The Corporate Governance Statement of Arion Bank hf. (Arion Bank or the Bank) is based on the legislation, regulations and recognized guidelines which are in force at the time the Bank’s financial statement is adopted by the Board of Directors.

Corporate governance statement of Arion Bank

Excellence in corporate governance

In December 2015 Arion Bank was recognized as a company which has achieved excellence in corporate governance following a formal assessment based on the Icelandic Guidelines on Corporate Governance issued by the Icelandic Chamber of Commerce, SA – Business Iceland and Nasdaq Iceland. Arion Bank received this recognition following an in-depth survey of corporate governance at the Bank, including governance by the Board of Directors, sub-committees and management, performed by KPMG ehf. in the autumn of 2015. The recognition applies for three years unless significant changes are made to the Bank’s management or ownership.

Compliance with guidelines on good corporate governance

According to the Financial Undertakings Act No. 161/2002 Arion Bank is obliged to comply with recognized guidelines on good corporate governance. The Bank complies with the fifth edition of the Icelandic Guidelines on Corporate Governance issued by Iceland Chamber of Commerce, SA – Business Iceland and Nasdaq Iceland, published in May 2015 and viewable on the website www.leidbeiningar.is. According to the guidelines a company shall state whether it has deviated from the guidelines, if so, which parts and also explain why it has done so. The Bank complies with the guidelines but because of the current shareholder structure certain deviations have been made from the guidelines. The section below specifies in which instances the Bank has deviated from the guidelines.

Article 1.1.6 states that the board of a company shall post certain information on the candidates to the board on the company’s website. Given the current shareholder structure the information in question has been sent directly to shareholders before the AGM and posted on the company’s website following the AGM. The company will seek to post the information in question on its website in the future.

Article 1.5. states that a shareholders’ meeting shall appoint a nomination committee or decide how it should be appointed. The Bank’s majority shareholder appoints seven out of eight Board members and the minority shareholder appoints the eighth member. The Bank has not considered it necessary to appoint a nomination committee given the current shareholder structure.

Article 5.1.2. states that the rules of procedure of sub-committees of the Board shall be posted on the Bank’s website. The rules of the Board Credit Committee have not been published on the Bank’s website with respect to their nature.

Legal framework for the Bank’s operation

Arion Bank is a financial institution which operates in accordance with the Financial Undertakings Act No. 161/2002. Acts of law which apply to the Bank’s operations include the Financial Undertakings Act No. 161/2002, the Securities Transactions Act No. 10/2007 and Public Limited Companies Act No. 2/1995. The Bank is a universal bank which provides a comprehensive range of financial services relating to savings, loans, asset management, corporate finance and capital markets. The Bank has issued financial instruments which have been admitted for trading on regulated securities markets in Iceland, Norway and Luxembourg, and is therefore subject to the disclosure requirements of issuers pursuant to the Securities Transactions Act No. 108/2007 and the rules of the relevant stock exchanges.

The Financial Supervisory Authority (FME) supervises the operations of Arion Bank in accordance with the provisions of Act No. 87/1998 on the Official Supervision of Financial Operations. Further information on the FME and an overview of the legal and regulatory framework applicable to the Bank, and the FME’s guidelines, can be seen on the FME’s website, www.fme.is. Numerous other pieces of legislation apply to the operations of financial undertakings.

Internal controls, auditing and accounting

Internal control
Internal control at Arion Bank is organized into three lines of defence with the aim of ensuring effectiveness, defining responsibility and coordinating risk management. This structure is also designed to foster a sense of risk awareness and responsibility among all employees of the Bank

The set-up distinguishes between the following roles:

• People who bear responsibility for risk and manage risk
• People who monitor and check internal controls
• People who perform independent surveys of the effectiveness of internal controls

The first line of defence is made up of people who have day-to-day supervision of operations and its organization. They are responsible for establishing and maintaining effective internal controls and managing risk in day-to-day operations. This involves identifying and evaluating risk and putting in place appropriate countermeasures to reduce risk. The first line of defence is responsible for supervising the implementation of internal rules and processes in compliance with the law, regulations and the Bank’s strategy and it must ensure that all actions are in compliance with established procedures and that corrective action is taken if any deficiencies are detected.

The second line of defence is set up to ensure that the first line of defence has established adequate internal controls which work as intended. Risk Management and Compliance are the main participants in the second line of defence, although other units may also be assigned specific monitoring roles.

The third line of defence is Internal Audit, which keeps the Board and management informed of the quality of corporate governance, risk management and internal controls, including by performing independent and objective audits.

The Compliance unit is an independent control function which reports directly to the CEO, in accordance with the Compliance Charter issued
by the Board of Directors. The role of Compliance is to ensure that Arion Bank operates in accordance with law, rules and good business conduct, using efficient pre-emptive measures and endorsing a good corporate culture in that regard.

• Compliance provides oversight of regulatory requirements and responsibility, and assists employees in understanding applicable requirements at any given time, by providing access to appropriate training, advice and information
• Compliance contributes to ensuring efficient internal controls, and to ensuring that appropriate actions are taken to address any deficiencies
• Compliance safeguards the Bank from the possible abuse of its services, and ensures that the Bank knows its counterparties, the nature of each business relationship, and its obligations thereto
• Compliance promotes transparency, and the providing of adequate information to customers, investors and authorities
• Compliance promotes the responsible handling of confidential information

Compliance had seven full-time employees at the end of 2016.

A central feature of the activities of all financial companies is carefully calculated risk-taking according to a predetermined strategy. Arion Bank thus takes risk compatible with its risk appetite, which is regularly reviewed and approved by the Board of Directors. The Bank’s risk appetite, set by the Board, is translated into exposure limits and targets that are monitored by Risk Management. The Board is responsible for Arion Bank’s internal capital adequacy assessment process, the main objective of which is to ensure that Arion Bank understands its risk profile and has systems in place to assess, quantify and monitor its total risk exposure.

The Bank’s Risk Management division is headed by the Chief Risk Officer. It is independent and centralized and reports directly to the CEO. Risk Management comprises four departments whose role is to analyze, monitor and regularly report to the CEO and Board of Directors on the risks faced by the Bank.

Further information on risk management and capital management is contained in the section on Risk Management and in the Bank’s risk report.

The Internal Auditor is appointed by the Board of Directors and reports directly to the Board. The Board sets the Internal Auditor a charter which lays out the responsibilities associated with the position and the scope of the work. The mission of the Internal Auditor is to provide independent and objective assurance and advice designed to add value and improve the Bank’s operations. The scope of the audit is the Bank, its subsidiaries and pension funds serviced by Arion Bank.

The audit is governed by the audit charter, directive No. 3/2008 issued by the FME on the internal audit function in financial institutions and international standards on internal auditing. All audit work is completed by issuing an audit report with deadlines for the implementation of audit findings. Implementations are followed up by the Internal Audit every quarter.

Internal Audit had eight employees at the end of 2016.

The Bank’s Finance division is responsible for preparing the accounts and this is done in accordance with the International Financial Reporting Standards (IFRS). The Bank publishes its financial statement on a quarterly basis and management statements are generally submitted to the Board ten times a year. The Board Audit Committee examines the annual financial statement and interim financial statements, while the external auditors review and audit the accounts twice a year. The Board Audit Committee gives its opinion on the accounts to the Board of Directors, which then approves and endorses the accounts.

The Customers’ Ombudsman is appointed by the Chief Executive Officer. The role of the Ombudsman is to ensure fairness and objectivity, prevent discrimination against the customer and make certain that the process for handling cases is transparent and documented. The Customers’ Ombudsman examined 160 cases in 2016, compared with 185 cases in 2015 and 202 cases in 2014.

Cornerstones, code of ethics and corporate social responsibility

Arion Bank’s cornerstones is the name used to describe the Bank’s core values. The cornerstones are designed to provide guidance when making decisions and in everything else employees say and do. They refer to the Bank’s role, attitude and conduct. Arion Bank’s cornerstones are: We make a difference. We get things done. We say what we mean.

The management and employees of Arion Bank are conscious of the fact that the Bank’s activities affect different stakeholders and society at large. The Bank’s code of ethics is designed to serve as a key to responsible decision-making at Arion Bank. The code of ethics is approved by the Board of Directors.

Arion Bank underlines its status as a sustainable bank by making a difference to its customers and performing its role as a financial institution conscientiously and responsibly. Arion Bank takes an active role in its society and development. Financial institutions are one of the pillars of society and their role is to help our customers, both individuals and companies, reach their goals. Arion Bank places great importance on doing things fairly with the interests of its customers, employees, shareholders and the community at heart. In December the Board of Directors of Arion Bank adopted a new policy on sustainability which, like the Bank’s cornerstones, is based on the culture which has evolved at the Bank over the last few years. The policy is entitled Together we make good things happen. At the end of 2016 the Bank also applied to become in the UN Global Compact initiative.

Further information can be found in the chapter on strategy and sustainability.

Board of Directors and committees

The main duty of the Board of Directors of Arion Bank is to manage the Bank between shareholders’ meetings according to applicable laws, regulations and articles of association. The Board tends to those operations of the Bank which are not considered part of the day-to-day business, i.e. it makes decisions on issues which are unusual or of a significant nature. One of the Board’s main duties is to supervise the Bank’s activities. The Board’s work, duties and role are defined in detail in the rules of procedure of the Board of Directors, which have been established on the basis of Article 54 of the Financial Undertakings Act, Article 70 of the Public Limited Companies Act No. 2/1995, FME Guidelines No. 1/2010, and the articles of association of the Bank. The rules of procedure of the Board of Directors can be found on the Bank’s website.

The Board of Directors appoints a Chief Executive Officer who is responsible for the day-to-day operations in accordance with a strategy set out by the Board. The Board of Directors and the Chief Executive Officer shall carry out their duties with integrity and ensure that the Bank is run in a sound and reasonable manner in the interests of the customers, the community, the shareholders and the Bank itself, cf. Article 1 (1) of the Financial Undertakings Act. The Chief Executive Officer shall ensure that the Board receives sufficient support to carry out its duties.

The Board of Directors is generally elected for a term of one year at the company’s annual general meeting. At Arion Bank’s annual general meeting on 17 March 2016, seven Directors and three Alternates were elected to the Board of Directors. At the Bank’s shareholders’ meeting on 15 September 2016 it was decided to add an extra member to the Board and the Board currently consists of eight members. The Bank’s majority shareholder, Kaupskil, appoints seven out of eight Board members and the Icelandic state, as a minority shareholder appoints the eighth member. When electing the Board care is taken to ensure at least 40% representation of each gender among directors and alternates. The elected Board Directors have diverse backgrounds and extensive skills, experience and expertise.

Information on the independence of Directors was sent to shareholders before the shareholders’ meeting and the information was published on the Bank’s website after the general meeting. The minutes of the AGM and shareholders’ meetings are sent to the shareholders following the meeting but have not been published on the Bank’s website because of the current shareholder structure.

The Board of Directors meets at least ten times a year. In 2016 the Board met on 13 occasions. The Chairman directs and is responsible for the work of the Board. The Chairman chairs Board meetings and ensures that there is enough time allocated to the discussion of important issues and that strategy issues are discussed thoroughly. The Chairman is not permitted to undertake any other work for the Bank unless part of the normal duties of the Chairman.

According to the Board’s Rules of Procedure the Board is permitted to establish committees to discuss particular areas of the Bank’s operations. At the first scheduled meeting of the new Board following the AGM the Board appoints members to each of its sub-committees and assesses whether it is necessary to appoint external members to certain committees in order to bring in a greater level of expertise. One of the committee members in the Board Audit Committee and Risk Committee, Lúdvík Karl Tómasson, is not a Board Director and is independent of the Bank and its shareholders. The Board sub-committees are as follows:

• Board Audit Committee: Its main task is, inter alia, to try and guarantee the quality of the financial statement and other financial information from the Bank and the independence of its auditors.
• Board Risk Committee: The Committee’s main role is, inter alia, to evaluate the Bank’s risk policy and risk appetite and to have a thorough knowledge of the risk assessments and methods used to manage risk employed by the Bank.
• Board Credit Committee: Its main task is to attend to credit issues which exceed the credit limits of its sub-committees.
• Board Remuneration Committee: The Committee’s main task is to advise the Board on the terms of remuneration to the Chief Executive Officer and other employees hired directly by the Board. Regular tasks at committee meetings are to review the remuneration policy, the human resources policy, salary distribution and the incentive system if one is in place. The Bank’s remuneration policy shall be examined and approved by a shareholders’ meeting annually.

Sub-committees regularly inform the Board of their activities. Furthermore, the Board has access to all material used by the sub-committees. The Board Audit and Risk Committee met four times during the year before the committee was divided into two committees in March 2016; the Board Audit Committee, which met four times during the year, and the Board Risk Committee, which met seven times during the year. The Board Credit Committee met 10 times during the year, and the Board Remuneration Committee met seven times. Below is an overview of the attendance of individual Directors.

The Board and its sub-committees carry out an annual performance appraisal, at which it assesses its work, the necessary number of Board Directors, the Board structure, achievements and work of the sub-committees with respect to the aforementioned. This appraisal was last performed by the Board and its sub-committees at their meetings and between meetings during the period 16 November 2016 to 26 January 2017.

¹John P. Madden was appointed as a Board Director at a shareholders’ meeting on 15 September 2016.

Arion Bank Governance overview