79247 This volume is a product of the staff of the International Bank for Reconstruction and Development/The World Bank. The World Bank does not guarantee the accuracy of the data included in this work. The findings, interpretations, and conclusions expressed in this paper do not necessarily reflect the views of the Executive Directors of the World Bank or the governments they represent. The material in this publication is copyrighted. FINANCIAL SECTOR ASSESSMENT PROGRAM THAILAND DETAILED ASSESSMENT OF OBSERVANCE CPSS CORE PRINCIPLES FOR SYSTEMICALLY IMPORTANT PAYMENT SYSTEMS APRIL 2008 INTERNATIONAL MONETARY FUND THE WORLD BANK MONETARY AND CAPITAL MARKETS DEPARTMENT FINANCIAL AND PRIVATE SECTOR DEVELOPMENT VICE PRESIDENCY EAST ASIA AND PACIFIC REGION VICE PRESIDENCY i Contents I. General................................................................................................................................... 1 A. Information and methodology used for assessment ......................................................... 1 B. Institutional and market structure—Overview ................................................................. 1 C. Payment systems infrastructure ........................................................................................ 2 II. Assessment of the Observance of the CPSIPS and Central Bank Responsibilities ............. 3 III. Recommended actions and authorities’ response to the assessment ................................ 15 A. Recommended actions ................................................................................................... 18 B. Authorities’ response...................................................................................................... 19 ii Abbreviations ATM Automated Teller Machines BAHTNET Bank of Thailand Automated High-value Transfer Network BCP Business Continuity Plan BOT Bank of Thailand BT Baht CCP Central Counterparty CPSIPS Core Principles for Systemically Important Payment Systems CPSS Committee on Payment and Settlement Systems DF Deliver Free DVP Delivery versus Payment ECS Electronic Checks Clearing System ETC Electronic Transactions Commission EFS Electronic Financial Services ILF Intraday Liquidity Facility MOU Memorandum of Understanding PKI Public Key Infrastructure PSC Payment Systems Committee RF Receive Free RTGS Real-Time Gross Settlement RVP Receipt versus Payment SEC Securities and Exchange Commission SMART System for Managing Automated Retail Funds Transfer SSS Securities Settlement System SWIFT Society for Worldwide Interbank Financial Telecommunications TSD Thailand Securities Depository Co Ltd. 1 I. GENERAL 1. This assessment of the payment systems in Thailand was undertaken in the context of the International Monetary Fund (IMF) and the World Bank Financial Sector Assessment Program (FSAP) exercise for Thailand in January 2007. It covers the Bank of Thailand Automated High-value Transfer Network (BAHTNET), which is a real time gross settlement (RTGS) system. 2. The Bank of Thailand (BOT) conducted a comprehensive self-assessment of BAHTNET observance of the Core Principles for Systemically Important Payment Systems (CPSIPS). It was professionally done and was made available to the mission in advance. The Thai authorities were fully cooperative and all relevant documentation to fulfil the assessment of BAHTNET was provided on time and without difficulties. The logistical support and warm hospitality of the officials of the BOT are greatly appreciated. A. Information and methodology used for assessment 3. The methodology for the assessments was derived from the Guidance Note for Assessing Observance of Core Principles for Systemically Important Payment Systems of the IMF and the World Bank of August 2001. Prior to the mission, the BOT prepared the self- assessment and filled in the Questionnaire on Payment and Securities Settlement Systems. Much of the information in the BOT self-assessment has been incorporated into this assessment. Furthermore, the assessor studied laws, articles, brochures, guidelines, data provided during the mission, and attended several presentations provided by the BOT and the different private sector institutions. Moreover, the assessor had daily and thorough discussions with the BOT, other relevant public authorities and met representatives from the private sector. B. Institutional and market structure—Overview 4. The BOT operates under the Bank of Thailand Act B.E. 2485 (1942), which was amended in 1998, and most of its oversight power and function in the payment systems field are broadly derived from its responsibilities for monetary policy, banking supervision and provision of payment settlement services. The Payment Systems Committee (PSC) was set up to advise the BOT in formulating a national payment system policy and defining its oversight role. The PSC is chaired by the Governor and composed of internal BOT executive staffs as well as external senior experts. According to a revised draft of the Bank of Thailand Act, the PSC will be legally empowered to define and implement the BOT oversight responsibility in payment systems. 5. The Electronic Transactions Commission (ETC) has the legal power in accordance with Electronic Transactions Act B.E. 2544 (2001), to supervise and promote electronic transactions in Thailand. It is chaired by the Minister of Information and Communication Technology and composed of 12 members appointed by the cabinet. The Electronic Transactions Act B.E. 2544 (2001) does not delegate this responsibility to BOT directly. The Act’s subordinate legislation, Royal Decree Regulating the Business of Electronic Payment 2 Services, which is going to be enacted assigned the BOT to license and supervise electronic payment business subject to the approval of the Commission. 6. The Securities and Exchange Commission (SEC) regulates the securities business in Thailand. It is empowered to regulate, supervise and develop the capital markets as well as securities firms. According to the Securities and Exchange Act B.E. 2535 (1992), the SEC is responsible to regulate the securities clearing and settlement systems. At present, the BOT does not have any formal responsibility for securities clearing and settlement activities. However, in the revised draft of the Bank of Thailand Act, one of the BOT main objectives is to maintain financial stability. Therefore, the securities are the vital instruments for the central bank’s open market operation and providing liquidity in BAHTNET system. Consequently, the oversight of the securities settlement systems will be a crucial task for the BOT in order to achieve this objective. At the same time, the SEC will, of course, continue to act as the regulator of the securities settlement systems. C. Payment systems infrastructure 7. BAHTNET is the only systemically important payment system that operates in Thailand. It was introduced as a real time gross settlement system in May 1995. The system is owned and operated by the BOT. Transactions are processed and settled continuously and irrevocably in real-time. Final settlement of obligations between BAHTNET participants is executed by entries to their settlement or current account at the books of the BOT. The bulk of large value interbank transfers is channeled through the SWIFT network and a smaller number of transactions are transmitted via the BOT web-based network. 8. BAHTNET accepts payment instructions for interbank payments and for the settlement of interbank obligations of the net clearing arrangements of the low-value payment transactions and those equities transactions. BAHTNET also settles on a real time gross basis the cash leg of the transactions in government bonds deposited at Thailand Securities Depository Co., Ltd. (TSD). There is no minimum amount for a payment to be made through BAHTNET, so that it handles time-critical low-value payments as well as large-value transfers. 9. In 2006, BAHTNET had 65 participants. On average the system settled daily 7,200 transactions and the daily average value was BT 595 billion. At present, the participants in BAHTNET are 34 commercial banks, six specialized financial institutions, 14 finance companies and securities companies, TSD, two government agencies and eight internal BOT departments. 10. In addition to BAHTNET, the BOT owns and operates three low value payment systems; the Electronic Checks Clearing (ECS) system, the System for Managing Automated Retail Fund Transfer (SMART) and Inter-provincial Checks Collection (B/C) system. Online Retail Funds Transfer (ORFT) is owned by National ITMX Co., Ltd. These systems are not considered systemically important by the Thai authorities, since the volume and value of the transactions settled through these systems are still relatively low. 3 11. Cash transactions are still the most important payment instrument for small retail transactions and for transfers of value between individuals, which account for 9 percent of GDP. According to the preliminary data in 2006, this figure is 17 percent of the total non- cash payment transactions. The use of card payments has been increasing in recent years. In 2006, the number of issued ATM cards is 30 million, which is 55 percent of total saving accounts. However, the value of transactions is still modest, about 2 percent of the total electronic payments. II. ASSESSMENT OF THE OBSERVANCE OF THE CPSIPS AND CENTRAL BANK RESPONSIBILITIES CP I - The system should have a well-founded legal basis under all relevant jurisdictions. a. Completeness and reliability of framework legislation There is no explicit legislation for payment systems in Thailand. However, the legal basis for BAHTNET and payment transfers executed in this system is defined by a set of laws, regulations, and contractual arrangements. The acts, regulations and contractual arrangements that are important for the payment system’s legal basis are: - The Bank of Thailand Act, B.E. 2485 (1942) stipulates the roles of the BOT in issuing, managing, and printing of notes and bank notes; and the management of the country’s reserves. - The Royal Decree Regulating the Affairs of the Bank of Thailand B.E. 2485 (1942) authorizes the BOT to “administrate inter-bank clearing systems”. - The Commercial Banking Act, B.E. 2505 (1962) empowers BOT to directly supervise commercial banks and local foreign bank branches. - The Currency Act, B.E. 2501 (1958) governs issue and management of banknotes. - The Civil and Commercial Code, B.E. 2468 (1925) covers other financial papers used as means of payments such as checks, bills of exchange, and promissory notes (the Law relating to Legal instruments, Contracts and Obligations). Description - The Securities and Exchange Act, B.E. 2535 (1992) regulates securities business and securities market infrastructure. - The Electronic Transaction Act, B.E. 2544 (2001) provides the legal recognition of electronic data messages intended for promoting the reliability of electronic transactions to enable them to have the same legal effect as given to those made by traditional means. - Consumer Protection Law, B.E. 2522 (1979) provides consumer protection, including payment transactions. - The Bankruptcy Act, B.E. 2483 (1940) governs insolvency and bankruptcy issues, including the liquidation of financial institutions as well as branches or agencies of foreign banks. b. Enforceability of laws and contracts The contractual arrangements within the framework of BAHTNET between the different parties involved are fully enforceable under the Civil and Commercial Code. In particular, each member of BAHTNET signs a contract with the BOT, which binds the participant to the BAHTNET Regulations. The BAHTNET Regulations can be enforced through a legal action. 4 c. Definition of timing and legal protection of irrevocability and finality The timing of final and irrevocable settlement is specifically defined in BAHTNET Regulation. According to articles 40 and 41 of the BOT Regulation on BAHTNET services of 2006, “funds transfer via BAHTNET will be completed when BOT has debited funds from an account of a funds transferring institution and has credited funds to an account of a funds receiving institution in the amount stated on the funds transfer order”... and “when funds transfer via BAHTNET is completed, the funds transferring institution cannot revoke the funds transfer”. However, there is no explicit legal protection for settlement finality. It can not be ruled out that transactions settled in BAHTNET will be reversed under a court decision in the event a participant becomes insolvent, although this has never happened in the past. d. Netting arrangements BAHTNET is an RTGS system and netting does not occur. However, for the other netting systems there is no explicit legal protection for the finality of multilateral netting. At present, a special Committee was set up in order to revise the Bankruptcy Law and see whether an explicit provision on settlement netting should be introduced. e. Zero hour rules or any similar rules There is no explicit Zero Hour Rule in the legal framework of Thailand. However, as mentioned under (c), it is not excluded that a court decision may deem transactions already settled in BAHTNET invalid. Based on a request by BOT, the Official of the Council of State provides an opinion stating that the receivership order in the case of bankruptcy shall be effective from the time it has been read without having retrospective effect from 0.01 hour of the day that the court has given such an order. Nevertheless, it is theoretically possible that a court may not consider itself bound by this opinion. It is important to keep in mind that the protection of settlement finality of securities transactions in TSD is also crucial to protect the collateral used for intraday liquidity and to reduce the settlement risk in the money and capital markets. f. Enforceability of collateral arrangements for intrad ay and overnight credit The BOT accepts only repurchase agreements (repos) as a mechanism to provide intraday liquidity to the system’s participants. The repo transactions are recognised and protected by BOT Regulation on Purchase of Debt Instruments under Repurchase Contract for Intraday Liquidity Facilities B.E. 2549. (2006). g. Legal support of electronic processing The Electronic Transactions Act B.E. 2544 (2001) provides a legal framework for, among other things, electronic signatures, electronic record maintenance and giving information electronically. It also regulates when the settlement, valid electronic authorization and the allocation of rights and obligations occurs. h. Relevant provisions of banking and central banking law In addition to the laws and regulations mentioned above, the Commercial Banking Act B.E. 2505 (1962) covers the legal requirements necessary to be an authorized deposit-taking institution. Only authorized deposit-taking institutions can carry out banking business. i. Relevance of laws outside the domestic jurisdiction BAHTNET is regulated according to the Thai laws and, hence, an overseas court order is not enforceable in Thailand. BAHTNET provides access to financial institutions established outside Thailand. These institutions participate in the system via a branch or a subsidiary. However, according to the BOT, both branches and subsidiaries having legal capacity under the Civil and Commercial Code are regulated and subjected to the Thai regulations. 5 Consequently, a bankruptcy decision of a foreign court in the home country of the main institution would not affect the debtor’s assets in the territory of Thailand. Under the Civil and Commercial Code, branch of foreign bank shall have domicile in Thailand as to the acts there performed. Therefore, a foreign bank branch, although it is not a separate legal entity from its main institution, has the capacity to undertake the business and enter into the contract on behalf of its head office. Such foreign branch can be a party to the court proceeding. Nevertheless, according to Bankruptcy Act, its assets in territory of Thailand would not be affected by a bankruptcy decision of a foreign court in the home country of the main institution. Assessment Broadly Observed The operations of BAHTNET as well as payment transfers through the system have a sound and a relatively solid legal basis. However, it can not be ruled out that a transaction settled in the system can be revoked by a court order in the event of insolvency of a participant. Comments Recommendations: While the opinion provided by the official of the Council of State helps to eliminate the risk that payment transactions settled in BAHTNET and securities transactions settled in TSD can be revoked in the event of insolvency, it would be better to amend the Bankruptcy Law in order to provide greater certainty in this regard. CP II – The system’s rules and procedures should enable participants to have a clear understanding of the system’s impact on each of the financial risks they incur through participation in it. Description Rules and Procedures The BAHTNET regulations and contractual arrangements identify the obligations and rights of the members and the system operator. It also sets out the features and the operations of the system, including arrangements for settlement, queuing mechanism, provision of intraday liquidity, operating time. It also details procedures for handling abnormal situations. The User Manual covers all relevant step of operation in the system, including queuing mechanism, the optimization facility and the transaction status. It describes also the daily settlement session and close settlement sessions. When changes are made to the BAHTNET regulation and procedures, updated documents are circulated to all participants. Details of amendments are also generally notified electronically through email. Updated documents are also generally posted for download through BOT website. Furthermore, the BOT provides training to all new BAHTNET members and training is also available on request. New members are given access to the test environment from their own offices prior to going live to enable them to perform more testing and familiarization with the system. A general round of refresher training is offered to all members periodically that allows them to send new staff for training. Understanding of risk BAHTNET regulation and agreements with the participants clearly provide information on risk management and procedures. The regulation has detailed provisions on the type of risks exposures and the risks management procedures. Moreover, the system provides real time information to the participants in order to allow them to control their exposures to financial risks. In particular, the participants are able to monitor on a real time basis their ingoing and outgoing transactions at the queuing facility and their settlement or current account positions. Participants in BAHTNET are clearly in a position to understand the procedures for the settlement of the payments when they enter them into the system. They are also in a position to understand the procedure to handle abnormal situations such as lack of liquidity. In the event of any liquidity problem, the BOT 6 notifies the senior management of the concerned participant to ensure that the institution realizes the importance of the issue and takes appropriate action in a timely manner. Furthermore, when developing new functionality, the BOT regularly notifies all members the principles of financial and operational risks as well as the management of those risks that they may incur in the payment systems. Availability and public access All participants in BAHTNET are provided with the relevant documents when they sign the appropriate contracts with the BOT. All rules and regulations relating to BAHTNET are published on the BOT Website. Relevant information is provided to participants via SWIFT and BOT Electronic Financial Services. Participants can also inquire information from the system on a real time basis. Assessment Observed Comments The contractual arrangements, the available documentation and the publications of the BOT enable participants to understand the system’s impact on each of the financial risks they bear through participation in BAHTNET. CP III - The system should have clearly defined procedures for the management of credit risks and liquidity risks, which specify the respective responsibilities of the system operator and the participants and which provide appropriate incentives to manage and contain those risks. Description Management of credit risk BAHTNET is an RTGS system with a queuing facility and optimizing procedure. It settles in central bank money and allows access to unlimited intraday credit provided against collateral. No interest rate or other fees are charged on intraday liquidity provision. The participants in BAHTNET are protected against credit risk as funds transfer is settled by funds held in settlement or current account at the BOT with immediate finality. The BOT is also protected against credit risk, since the settlement and current accounts can not be overdrawn. Management of liquidity risk BAHTNET minimizes the risk of liquidity shortage that could cause payments to be blocked in the system through a number of mechanisms and instruments such as a centralised queuing mechanism, gridlock resolution, pricing incentive and throughput guidelines. - Queuing Mechanism: This mechanism minimizes the risk of liquidity shortages that could cause payments to be blocked in the system. The design of the queuing mechanism allows the sending institution to assign priority within their own queues among transactions awaiting settlement through their workstation. Unsettled payment instructions that are still in the queue at the end-of-day will be flushed from the system, and must be re-entered by the sending member on the next day. However, this situation has rarely occurred in BAHTNET. Furthermore, the cut-off time for customer transfers earlier than the end-of-day close allows participants to manage their liquidity effectively and to achieve their desired overnight balances in their accounts before the close of the system. - Gridlock Resolution: This mechanism is aimed at solving a situation when several transfer instructions among several members cannot be executed due to insufficient funds in one or more of their accounts. When instructions from various institutions stand in their queues and form a loop of funds transfers, the system will search for the group of instructions that, if executed, will result in a positive net position for each of the transferors. When these instructions are found, the system will off-set all related transactions and post them to each account simultaneously. This reduces the liquidity needs in the system. 7 - Intraday Liquidity Facility (ILF): The BOT provides intraday facility, which is fully collateralized. Both direct and associate members who are financial institutions under BOT’s supervision are allowed to use the facility to support liquidity management. However, this facility is not available to members who are non-financial institutions such as securities companies and government agencies. The ILF is provided interest-free during the day. The outstanding amount at the end of the day is treated as an overnight loan and charged at a penalty rate, which is policy rate (repurchase 1 day) plus 0.5% per year. Financial institutions, which have daily average value of funds transfer over BT 500 million, are required to maintain an ILF capacity equivalent to not less than 10 percent of the average value of its funds transfers in BAHTNET in the same fortnight of the previous month. If any BAHTNET members cannot meet the conditions, they will be charged three times the normal rate of transaction fee. In order to receive intraday liquidity, each member must set aside eligible securities to a securities sub-account labeled “ILF” at BOT. Moreover, participants can also request the use of check clearing credit balance for ILF repayment and for BAHTNET transactions. The collateral used for intraday liquidity is government bonds and securities guaranteed by the government denominated in Baht. The collateral is valued on a daily marks-to-market basis with haircuts, which vary on the maturity duration of each class of bonds. - Pricing incentive: BAHTNET fee structure is set in a way that encourages members to submit funds transfer instructions early in the day. There are three time zones with ascending fee rates; 8:30–12:00 with the lowest charge; 12:00–16:00, and 16:00–17:30 with the highest charge. - Throughput guideline: BOT requires members to submit transactions amounting to, at least, 30 percent of the expected total value of that day or average value of the same fortnight of previous month by noon, and at least 70 percent by 15:00. This requirement was introduced in early 2001 aimed at ensuring the smooth operation of the settlement process and avoiding the heavy congestion of instructions and liquidity management problems, particularly in the afternoon. At present, the BOT, as the operator, is in the process of enhancing the liquidity management within BAHTNET by developing a Liquidity watch, which is a real-time monitoring tool, to efficiently follow up members’ behaviors in funds transfer submission pattern, liquidity management as well as daily operation. Furthermore, BOT intends to develop a tool simulating different payment scenarios in order to assess their consequences for the payment system as well as to establish the optimal level of liquidity in the system. Information systems The participants have access to real-time information on payments in the queue, settled transactions and incoming and outgoing payments, their settlement account balances. This information is available to all participants via manual entries on their BAHTNET terminals. It is also provided via SWIFT messages, which allows participants to automate use of these functions in their own systems. Procedures for crisis management The Payment Systems Department, which operates BAHTNET, monitors the participants on a continuous basis during BAHTNET operating time and can identify unusual liquidity shortage or building up position in the “payments queue”. In the event that there is a temporary shortage of funds or technical difficulties within RTGS there are well-established procedures to follow. In the event the Head of Payment Systems Department has reason to believe that a participant in BAHTNET is experiencing liquidity problems that are not temporary. In this case, the Head of Payment Systems Department will inform the Assistant 8 Governor and Financial Institution Supervision Group. Then, they will convene a meeting of the Crisis Management Committee (CMC), which is responsible to handle a crisis situation. The CMC consists of BOT top executives, i.e., Deputy Governors and Assistant Governors. The immediate task of the CMC is to diagnose the source, scope and dimension of any liquidity problem and to prepare solutions such as relaxing the ILF regulations. Assessment Observed Comments The design and the functionalities provided by BAHTNET protect the participants against credit risk and enable them to manage their liquidity risk appropriately. CP IV - The system should provide prompt final settlement on the day of value, preferably during the day and at a minimum at the end of the day. Description Irrevocability As an RTGS system, BAHTNET provides real time immediate settlement finality. Once a payment is settled—simultaneous debit and credit of the paying and receiving participants’ settlement or current account at the BOT—it is irrevocable, unconditional and cannot be reversed by the sender or a third party. Clearly defined and legally effective moment of final settlement The finality of payments in BAHTNET is clearly defined and effectively enforced. However, as mentioned in CPI, there is a risk that the settlement might be challenged in the event that the sending bank might be declared bankrupt or placed under public administration. Interval between acceptance and final settlement As an RTGS system, payments are settled during the course of the day in real time. Payments which are unsettled at the end of the day are removed from the queue. To be settled, they must be resubmitted the following day. Rejection of payments According to BAHTNET regulations, the sending bank is allowed to cancel an outgoing payment in the queue. However, the receiving bank has to give consent before the transfer instruction can be cancelled if this bank has been advised of this expected payment. Enforcement of settlement processes and openings times The operating timetable of BAHTNET is defined in BAHTNET regulations. The standard settlement hours are 08:30–17:30. For a further 30 minutes after the close of settlement, members can download relevant reports for reconciliation. The BOT has the discretion to vary the operating hours when it is needed. If a participant needs to make payment transactions after the operating hours, the BOT reserves the right to charge fees. The decision to extend the operating hours is taken by the manager of BAHTNET. Assessment Broadly Observed Comments While the opinion provided by the official of the Council of State helps to eliminate the risk that payment transactions settled in BAHTNET can be revoked in the event of insolvency, it would be better to amend the Bankruptcy Law in order to provide greater certainty in this regard. CP V – A system in which multilateral netting takes place should, at a minimum, be capable of ensuring the timely completion of daily settlements in the event of an inability to settle by the participant with the largest single settlement obligation. Description BAHTNET is an RTGS system that settles on a continuous basis during the day with intraday finality. Assessment Not applicable 9 Comments CP VI – Assets used for settlement should preferably be a claim on the central bank; where other assets are used, they should carry little or no credit risk and little or no liquidity risk . Description BAHTNET settles in central bank money, i.e., the settlement assets in BAHTNET are claims on the BOT. Settlement is executed by debiting the sending participant’s current or settlement account with the BOT and crediting the beneficiary participant’s current or settlement account. Moreover, the system provides settlement only in Baht. Assessment Observed Comments Settlement takes place in central bank money, and no settlement bank or deposit risk occurs in BAHTNET. CP VII – The system should ensure a high degree of security and operational reliability and should have contingency arrangements for timely completion of daily processing. Description Security policy and objectives The BOT has defined the security policies, operational reliability and business continuity of the system. The overall objective is to ensure an efficient, stable and secure settlement of interbank payments transfers. BAHTNET is a separate stand-alone module with a specified exchange of information between the subsystems. The BOT benchmarks its operation and quality of services against the international and national industry-level standards such as ISO 17799:2005 for information security requirement, ISO 9364 for banking communications messages. Security risk analysis and monitoring The IT-Department is responsible for the security of BAHTNET. The system is subject to regular analyses of security risks. The system’s activity and payment process are monitored throughout the processing day, using a variety of automated tools, graphs and manual checks. Incidents and disruptions are logged adequately and rules and routines are in place for operational follow-up. Documentation The system provides an audit trail for all instructions. All incidents in the system are reported and logged. The severity of the incident plays a major role in the depth of the investigation, but all technical irregularities, even the minor ones, are also logged. The PSD keeps statistics of the members’ incidents in the system and may make bilateral contacts with members that cause frequent disruptions. The information recorded includes: source, description and solution to problem, and impact on BAHTNET sessions. BAHTNET has not so far experienced any major incident and the number of total incidents is relatively low. Operational Reliability and contingency The BOT has developed a contingency plan to cope with a wide range of incidents and failures. It deals with different levels of software and hardware defects and disruptions in the various communication networks. Various scenarios and staff roles are analysed, including disruptions in telecommunication and electrical power, and disruptions in contact with important external parties. In the contingency plan, rules and procedures for decision-making processes are worked out and there is a clear division of staff responsibility in the various emergency situations and follow-up responsibilities. In addition to its primary site, BOT has the backup site at Surawongse Office located about 10 kilometers from the primary site and the 2 nd backup site at Puttamontol, 35 kilometers from the main site, is being set up to replace Surawongse site. As a backup site, it has the identical hardware and software for the Current Account System, Book Entry System, SWIFT Gateway and network as the primary site. It is a ‘hot backup’, which means all transactions in the production environment are mirrored to the backup site in real time and 10 loss of transaction data cannot occur. The backup site has the ability to continue operations for a longer term. Apart from that there are communication lines duplication and dial-up line back up, which are serviced by different providers. The benchmark is that the downtime of BAHTNET should not be more than four hours. There are agreements between the BOT and IT vendors to provide services in case of emergency within a few hours. In order to ensure that the computer hardware and software at the backup site are ready to operate, operational rehearsals with IT vendors and BAHTNET members are held periodically. The BOT conducts an extensive range of contingency exercises to test the operational reliability of BAHTNET under different circumstances. Different types of tests are carried out by the BOT: - Partial test: The operating staffs are assigned to carry out the business continuity plan (BCP) testing. The partial tests are conducted, at least, every six months. - Scenario test: The scenario is programmed to cover all possibilities, for example, front-end processor failure, communication failure, host computer failure, and disaster at the main site. - Full scale test: The full-scale test is also in place and held at least once a year. - External testing: The external testing with securities settlement system, vendors and network providers are also undertaken regularly. - Industry wide test: In order to ensure that the BCP is able to support all members, an industry wide test is performed at least once a year. IWT tests the operations by using the back up environment as defined in the BCP. The contingency exercises test of BAHTNET is an integral part of the overall test of BO T’s BCP. Protection of data communication Two communication networks are in place to transmit payment orders to the RTGS system: SWIFT network and BAHTNET network. The bulk of the transactions (above 75%) is transmitted to the RTGS system using the SWIFT V-copy services. The second communication network is the BOT web, which is an ‘end -to-end’ encryption network with the Public Key Infrastructure (PKI) to provide security, confidentiality, and integrity of the payment instructions. Firewalls are in place to protect the systems from intrusion attempts by outsiders. Audit trails All transactions in BAHTNET can be traced back from the recipient to the sender (end-to- end). BAHTNET logs the progress of transactions at each status change in the transaction life cycle. All transactions have a unique transaction ID number which provides an audit trail for future enquiry. Development and procurement The PSD and IT Department have implemented rigorous measures and procedures in order to ensure the safety and quality of the development of new software and testing of new updates and releases. The BOT employs a comprehensive change management program to protect the integrity and quality of the application software, hardware and communication network configuration that is made available to members. All changes to the system require user testing and signoff. Availability and scalability The average annual availability of BAHTNET (all components) was 99.80% for 2005 and 99.98% for 2006. At no time during recent years was the entire BAHTNET facility unavailable for its participants. 11 BAHTNET has sufficient capacity to handle significant increases in volumes/activity. Required capacity is set out in a Capacity Plan. The system has sufficient capacity to handle high volumes during peak times. Currently, the system uses on average 45 percent of its capacity. Audits The system is regularly audited by the Internal Audit Department. The BOT’s internal audit procedures review conformity to commercially reasonable standards for confidentiality, integrity, authentication, non-repudiability, availability and auditability through a comprehensive program, comprising, but not limited to, technical reviews and regular operational inspections. In addition, the IT security risk as well as BCP are assessed by external auditor regularly, covering both internal systems and networks. Assessment Observed Comments The BOT has rigorous and comprehensive security policy measures and procedures in place in order to ensure a high degree of operation reliability. Recommendation: Extend the scope of external audit of BAHTNET IT-infrastructure to include internal procedures and routines for business continuity. Carry out a separate contingency test specifically for BAHTNET. Request BAHTNET participants, including TSD, to submit the summary of the contingency plan test and the results of regular external audits of the security of their internal payment infrastructure. CP VIII - The system should provide a means of making payments, which is practical for its users and efficient for the economy. Description Crucial functions of BAHTNET BAHTNET was developed in order to reduce counterparty risk and enhance electronic payments in Thailand. The main objective of BOT is to offer efficient and secure infrastructure to the financial sector. Furthermore, by using SWIFT as a message carrier, considerable efficiency and safety are achieved. Available functionalities in the system All RTGS major functionalities are offered by BAHTNET such as sending/receiving payments, queuing, inquiry and data collecting. In addition, an optimizing mechanism that solves gridlocks is in place. Liquidity management and availability of intraday credit Several functionalities are used in order to manage liquidity. (See CP III for further information) Intraday liquidity is based on repo transactions, and there is no restriction or limitation with regards the liquidity as long as the participant has access to eligible securities. Opening time and practicality of the settlement cycle BAHTNET standard settlement hours are 08:30–17:30. The BOT may also extend operating times if the Financial Markets Office or a participant requires it. (See CP IV for further information). The settlement value is available to the participants instantaneously after the settlement is executed. Processing speed From a technical viewpoint, there is no restraint on the speed of processing in BAHTNET. The main contributor to the time to settle is a participant’s management of liquidity. In addition, BAHTNET has not encountered any capacity constraints. The system is designed to 12 settle payment orders with the daily capacity of 20,000 transactions and the current number averages 7,200 transactions a day. Cost recovery and pricing The BOT objective is operational cost recovery. The monthly fee is BT 3,500 for direct participants and BT 500 for associated participants. In addition, the BOT charges ascending fee rate aimed at encouraging the submission of transfer orders early in the day. The BOT charges BT 5 per transaction between 8:30 and 12:00; BT 10 for 12:00–16:00, and BT 200 for 16:00–17:30. From a strict accounting viewpoint, only 50 percent of all costs (operating, development and investment costs) are covered by revenues. Assessment Observed Comments BAHTNET provides a means of making payments, which is practical for its users and efficient for the economy. Recommendations: Revise the methodology used to determine the pricing structure taking into account the total cost as well as the benefit for the entire economy such as systemic risk reduction. CP IX - The system should have objective and publicly disclosed criteria for participation, which permit fair and open access. Description Access criteria BAHTNET system is open to a relatively broad range of institutions, including banks, non- bank financial institutions and government agencies. To participate in the system, participants must be qualified to open an account at the BOT, demonstrate that they have the necessary operational capacity, and adequate liquidity. A non-financial institution is also allowed to be participant, provided that it has total assets of not less than 200 million baht and makes or receives high-value funds transfers through clearing system or BAHTNET system as 3 rd party. An applicant can decide to be a direct participant or an associate participant. A direct participant is able to send and receive funds transfer, and perform other functions using its own workstation subsystem, which is directly connected to a BAHTNET Host Computer (BHC). An associate member has an account at BOT, but does not have its own workstation subsystem. Both direct and associate members have equal access to all facilities of the system. BAHTNET access rule is clearly defined and publicly disclosed both in BOT website and in documents circulated to all participants. Technical requirements for participants To access the system, participants must have BAHTNET terminal access. This allows participants to monitor their settled payments and account balance, monitor and manage their collaterals for Intraday Liquidity and queued payments. Cost of access for low volume participants The networks used for BAHTNET terminal access are SWIFT and Web interface for sending and receiving. The use of SWIFT as a main interface would enable straight-through processing and be consistent with international practice. Meanwhile, web-based technology would be an effective channel in handling interactive inquiries and message transmission for smaller-scale members. The price charged for the web-based users is a bit higher, provided that participant using SWIFT will carry additional cost incurred by SWIFT. Exit rules BAHTNET exist rules are clearly defined in it regulations. In brief, a member may resign by giving the BOT 30 days notice in writing. The BOT may decide to terminate its services to a user who does not observe its regulations or poses risks to the system. 13 Assessment Observed Comments The access rules for BAHTNET are clear, publicly disclosed, fair and objective. The access criteria do not have a restrictive impact on competition. CP X – The system’s governance arrangements should be effective, accountable and transpa rent. Description Ownership structure and accountability of the management BAHTNET is owned and operated by the BOT. The Payment Operations Office, which is a division of the Payment Systems Department (PSD) manages the day-to-day operations. System’s enhancement is carried out by the PSD under the policy guidance of the Payment Systems Committee (PSC). The PSD reports directly to the Assistant Governor, Information Technology Group. Financial targets and other objectives BAHTNET was introduced in order to reduce the systemic risk and enhance the efficiency of electronic payments in Thailand. It is regarded by the Thai Authorities as a crucial financial infrastructure and financial target such as full cost recover is not an objective. Availability of information on the system The BOT’s website provides detailed information on the design and function of BAHTNET. The BAHTNET terminals provide real time information on the system to participants, including operational changes and due dates for related services such as invoice payments. Consultation with all relevant users on major decisions An operational and/or technical working group is formed to facilitate feedback from users when new projects or facilities are developed. However, this working group does not meet on a regular basis to discuss ongoing issues. However, the PSD has on-purpose bilateral meetings with the members’ managers, CEOs or equivalent. Fulfilment of the Basel Core Principles As has been demonstrated in this assessment, BAHTNET fulfils the other nine Core Principles. Assessment Observed Comments BAHTNET’ governance arrangements are effective, accountable, and transparent. Recommendations: Set up a permanent advisory user group that meets on a regular basis to discuss issues related to technical and business features of BAHTNET. Central Bank Responsibilities in Applying the CPSIPS Responsibility A – The central bank should define clearly its payment system objectives and should disclose publicly its role and major policies with respect to systemically important payment systems. Description There is no specific legislation that empowers the BOT to oversee payment systems. The Royal Decree of B.E. 2485 (1942), which is based on the Bank of Thailand Act B.E. 2485 (1942), authorizes the BOT to “administrate interbank clearing system. Moreover, the Commercial Banking Act B.E. 2505 (1962) empowers the BOT to supervise payment systems operated by commercial banks. In addition, the Electronic Transactions Act B.E. 2544 (2001) authorizes the BOT to regulate electronic payments. The legislation empowering the BOT to regulate electronic payments is not stated in the Electronic Transactions Act B.E. 2544 (2001). It is in the drafted Royal Decree, which is derived from the Electronic Transactions Act. Based on these legal acts, the BOT has defined its objectives in the field of payment systems. Its main objective is to maintain the safety and efficiency of payment systems in the country. The Payment Systems Committee (PSC) was set up in order to advise 14 the BOT in formulating a national payment system policy and defining its oversight role. The PSC is chaired by the Governor and served by the PSD. According to a draft amending the Bank of Thailand Act, the PSC will be legally empowered to formulate and implement the BOT oversight policy. Within the PSD, an appropriate separation exists between the payment oversight function and payment operations. The Payment Systems Policy and Oversight Office is responsible for preparing and implementing the policy and the Payment Operations Office is responsible for operating BAHTNET. Public Disclosure of role and objectives The BOT uses various channels to inform the public on its role and policy in the field of payment systems. For instance, the BOT has publicly disclosed its roles and policies, objectives and activities in its annual reports and on website. On its website, the BOT provides a comprehensive description of the payment infrastructure in Thailand. Assessment Observed Comments Recommendation: Avoid potential conflicts of interest between the BOT oversight function and its role as an operator of BAHTNET when formalizing the PSC function and responsibility. Enact the revised Bank of Thailand Act that would provide more transparency of the BOT objectives in the field of payment systems. Responsibility B – The central bank should ensure that the systems it operates comply with the core principles. Description The Payment Systems Policy and Oversight Office implements the BOT oversight responsibility of payment systems operating in Thailand, including BAHTNET. As a part of its tasks, this Office monitors the activities of BAHTNET and analyses the associated risks. It is also informed of any operational problem and jointly defines with the Payment Operations Office the measures that are necessary to avoid spill-over. The Payment Systems Policy and Oversight Office has carried out an extensive assessment of BAHTNET against the Core Principles. The result of the assessment was made public in the payment Systems Report of 2004. Furthermore, the current assessment is based on an update self assessment, which was prepared by this Office in 2006. Assessment Observed Comments Responsibility C – The central bank should oversee observance with the core principles by systems it does not operate and it should have the ability to carry out this oversight. Description The oversight responsibility of the BOT is implemented by the Payment Systems Policy and Oversight Office, which has about 50 staff members with a diversified and well qualified professional background. The Office is in the process of developing oversight methods and procedures, including regular monitoring, collecting information and data, reporting, etc. Together with the banking supervision group, the Office is developing procedures for on-site oversight of important systems with the support from the Supervision Group. The staff is sent on a regular basis to training courses organized in Thailand and aboard. To a larger degree, the BOT fulfills its oversight role by monitoring payment services providers and collecting information on a regular basis. At present, there is no privately operated system in Thailand considered systemically important by the BOT, and for this reason there is no need for the BOT to carry out an assessment against the Core Principles. 15 Assessment Observed Comments Recommendations: Strengthening oversight responsibility of the Payment Systems Policy and Oversight Office by further developing its oversight methodology and procedures, including prioritization among payment systems, selection of the oversight instruments to be used and the periodicity of on-site inspection of systemically important systems. Responsibility D – The central bank, in promoting payment system safety and efficiency through the core principles, should cooperate with other central banks and with any other relevant domestic or foreign authorities. Description Domestic cooperation The BOT cooperates with other relevant authorities which have interests in various aspects of the payment systems. In particular, the BOT cooperates with the SEC, which is responsible for regulating the securities markets. A Memorandum of Understanding (MOU) is signed with SEC that sets out a framework for cooperation between BOT and SEC in respect of regulatory responsibilities for clearing and settlement facilities. However, there is no regular meeting to discuss common technical and policy issues, which are of interest of both the BOT and SEC such as the operation of TSD and interaction between BAHTNET and TSD. International cooperation The BOT cooperates with other central banks, in particular, in neighboring countries, to exchange experience and knowledge on RTGS system and also other related payment systems issues. The BOT hosts regional conferences on payment systems, attended by representatives from central banks in the region as well as worldwide. Furthermore, the BOT foresees the possibility of cross-border linkages among regional payment and securities settlement systems. Therefore, a cooperative oversight framework is being developed with other central banks. Assessment Observed Comments Recommendations: Strengthen the cooperation with SEC by having regular meetings to discuss common issues, including the operations of TSD and its interaction with BAHTNET. Table 1. Summary of BAHTNET Observance of CPSIPS and the BOT Responsibilities in Applying the CPSIPS Core Principle/Responsibility Comments Legal foundation CP I – The system should have a In general, the current regulatory framework well-founded legal basis under all relevant ensures that the design and operations of jurisdictions BAHTNET have a sound and solid legal basis. Understand and management of risks CP II – The system’s rules and procedures A variety of channels are used aimed at ensuring should enable participants to have a clear that participants understand BAHTNET business understanding of the system’s impact on each features, operational specifications and the risks of the financial risks they incur through they incur by using the system. participation in it. 16 CP III – The system should have clearly Adequate risk measures are in place in order to defined procedures for the management of cope with credit and liquidity risks. Furthermore, credit risks and liquidity risks, which specify the BOT has well-established and adequate the respective responsibilities of the system procedures to handle crisis situation. operator and the participants and which provide appropriate incentives to manage and contain those risks. Settlement CP IV – The system should provide prompt The system provides prompt final settlement final settlement on the day of value, during the day. However, as mentioned above, preferably during the day and at a minimum there is a potential risk that a transaction can be at the end of the day. revoked in the event of insolvency. CP V – A system in which multilateral Not applicable, as BAHTNET is a gross netting takes place should, at a minimum, be settlement system. capable of ensuring the timely completion of daily settlements in the event of an inability to settle by the participant with the largest single settlement obligation CP VI – Assets used for settlement should BAHTNET settles in central bank money on a preferably be a claim on the central bank; continuous basis during the day with intraday where other assets are used, they should carry finality. little or no credit risk and little or no liquidity risk. Operational reliability and efficiency CP VII – The system should ensure a high Several measures are in place in order to ensure degree of security and operational reliability a high degree of security and operational and should have contingency arrangements reliability, including redundancy at the primary for timely completion of daily processing site and duplication of services at the remote backup site. CP VIII – The system should provide a BAHTNET meets the key requirements of speed, means of making payments, which is cost, practicality, and users’ relevance. practical for its users and efficient for the economy. Access and governance CP IX – The system should have objective BAHTNET access criteria are clear, publicly and publicly disclosed criteria for disclosed, fair and objective. These criteria do participation, which permit fair and open not have a restrictive impact on competition. access. Rules relating to suspension, termination and resignation from BAHTNET are also defined in BAHTNET regulations. CP X – The system’s governance BAHTNET governance arrangements are arrangements should be effective, effective, accountable and transparent. accountable and transparent. 17 Central bank responsibilities Responsibility A – The central bank should The BOT’s objective, which is published in the define clearly its payment system objectives Payment Systems Annual Report and other and should disclose publicly its role and relevant materials, is to promote sound and major policies with respect to systemically efficient payment systems in Thailand. The important payment systems. Payment Systems Committee (PSC) was set up in order to advise the BOT in implementing its oversight responsibility and payment systems policy. Responsibility B – The central bank should A formal assessment of BAHTNET against the ensure that the systems it operates comply Core Principles was carried out by the Payment with the core principles. Systems Policy and Oversight Office and the report was discussed by BOT executive management. Responsibility C – The central bank should At present, there is no privately operated system oversee observance with the core principles in Thailand considered systemically important by systems it does not operate and it should by the BOT to be assessed. have the ability to carry out this oversight. Responsibility D – The central bank, in The BOT cooperates with the Securities and promoting payment system safety and Exchange Commission (SEC) and other relevant efficiency through the core principles, should authorities. A Memorandum of Understanding cooperate with other central banks and with for sharing information is set up with the SEC any other relevant domestic or foreign and the Department of Insurance. The BOT also authorities. cooperates with other central banks, in particular, in neighboring countries, to exchange experience and knowledge on payment systems issues. 18 III. RECOMMENDED ACTIONS AND AUTHORITIES’ RESPONSE TO THE ASSESSMENT A. Recommended actions Reference principle Recommended action Legal foundation (CP1) While the opinion provided by the official of the Council of State helps to eliminate the risk that payment transactions settled in BAHTNET and securities transactions settled in TSD can be revoked in the event of insolvency, it would be better to amend the Bankruptcy Law in order to provide greater certainty in this regard. Settlement finality (CPIV) While the opinion provided by the official of the Council of State helps to eliminate the risk that payment transactions settled in BAHTNET can be revoked in the event of insolvency, it would be better to amend the Bankruptcy Law in order to provide greater certainty in this regard. Security and operational reliability, and Extend the scope of external audit of BAHTNET contingency arrangements (CPVII) IT-infrastructure to include internal procedures and routines for business continuity. Carry out a separate contingency test specifically for BAHTNET. Request BAHTNET participants including TSD and to submit the summary of the contingency plan test and the results of regular external audits of the security of their internal payment infrastructure. Efficiency and practicality of the system Revise the methodology used to determine the pricing structure (CPVIII) taking into account the total cost as well as the benefit for the entire economy such as systemic risk reduction. Governance of the payment system (CPX) Set up a permanent advisory user group that meets on a regular basis to discuss issues related to technical and business features of BAHTNET. Central Bank Responsibilities in Applying Enact the revised Bank of Thailand Act that would provide the CPSIPS more transparency of the BOT objectives in the field of payment systems. Avoid potential conflicts of interest between the BOT oversight function and its role as an operator of BAHTNET when formalizing the PSC’s function and responsibility. Strengthen the BOT oversight responsibility by further developing its oversight methodology and procedures, including prioritization among payment systems, selection of the oversight instruments to be used and the periodicity of on- site inspection of systemically important systems. Strengthen the cooperation with SEC by having regular meetings to discuss common issues, including the operations of TSD and its interaction with BAHTNET. 19 B. Authorities’ response 12. Bank of Thailand (BOT) agreed with the assessment and appreciated to have had Thailand’s systemically important payment system, the Bank of Thailand Automated High- value Transfer Network (BAHTNET), reviewed by the IMF and the FSAP. The review was conducted professionally and cooperatively. 13. With regard to the recommendation to have explicit legal protection for settlement finality in both BAHTNET and securities settlement system, the Bankruptcy Law has already been in the process of amendment. It is to ensure that transactions in BAHTNET cannot be revoked by the court order in the event of insolvency of the participant. 14. As BOT is at the initial stage of implementing payment systems oversight, some necessary steps are needed to broaden the area of oversight. Currently, BOT is formalizing the oversight methodology and procedures.