Expanded_Risk_Management_Training_Presentation (1).pptx

Risk management for entry level officials

1. Review of Fraud Management Policy and Guidelines of IBBPLC A C Memo: 192 , Dated: 15 .0 9 .2025

2. Overview on Fraud Management Policy and Guidelines Regulatory Mandate Modification & Changes Recommendation & Resolution Agenda

3. Audit Committee in its 560th Meeting held on 11.02.2025 while discussing memo on defalcation of Bank’s fund advised to formulate Fraud prevention strategy including Cyber, Personnel and Financial fraud and response plan thereagainst. Accordingly, a Committee was constituted by HRW through Ref : IBBPLC/HO/HRW/HRAD/ G-0205/2025 , dated May 13, 2025 consisting of the following : Background of the Memo

4. Background of the Memo SL Name, Designation Status Qua;lification & Contribution in Brief 01 Md. Altaf Hossain, AMD Convener Overall strategic direction 02 Md. Maksudur Rahman, DMD Member Secretary Overall Coordination and Formulation of the Policy. 03 Khaled Mahmud Raihan , FCCA, EVP Member Critical guidelines. 04 Mohammad Kamal Uddin Patwary , VP Member Monitor and follow up the activities of Sub-Committee 05 Md. Nizamuddin Sheikh, VP Member Audit related inputs 06 Mohammad Rezaur Rahman Sarker , SAVP Member Coordinated HR-related inputs 07 Md. Masudur Rahman Mamun , FAVP Member Legal inputs 08 Md. Matiur Rahman, SPO Member Risk Related inputs 09 Md. Rabiul Alam , CCNA Security, CCNP, PO Member IT and Cyber related Inputs Members of the Committee are:

5. Co- Opted Members are: Background of the Memo SL Name, Designation Status 01 Shuaib Ahmed, SVP Member (Co opt) First batch CAMS of IBBPLC, recognized for strategic leadership and expertise in compliance. 02 Muhammad Faizul Hoque , FAVP Member (Co opt) Contributed operational risk expertise and compliance alignment.

6. The Committee formed a Sub-Committee to work on revising the Policy & Guidelines (April 2023, Version-2). The Sub-Committee met three focused meetings on 21 st , 22 nd , and 25 th May 2025, resulting in the preparation of a comprehensive draft policy. The final and 3 rd meeting of the Committee was held on 15.07.2025 , where the proposed draft policy was presented via PowerPoint. Committee Placed this memo to RMCC. RMCC recommend the same place before the Audit Committee Background of the Memo

7. Existing policy does not sufficiently cover: New and technology based fraud typologies Structured risk response mechanisms Dedicated training, particularly on cyber threats Alignment with international best practices Necessity for Reviewing the Policy

8. This updated policy is therefore essential not just to meet regulations but to : Protect the Bank in a better way Improve awareness among staffs Strengthen the Bank’s readiness to detect, prevent, and respond to both internal and external fraud in today’s fast-changing environment Necessity for Reviewing the Policy

9. Bangladesh Bank’s SREP requires Fraud Policy. In failure Bank leads to capital charge. Aligned with ICAAP and governance. Covered Internal and External risks. Regulatory Mandate SREP: Supervisory Review and Evaluation Process ICAAP: Internal Capital Adequacy Assessment Process

10. New Additions : Inclusion of a complete chapter on Cyber Fraud (Chapter-3); Introduction of a Fraud Risk Matrix and Fraud Typology Table; Risk Response Timeline mechanism; Practical Case Studies on cyber, personnel, and financial frauds (Chapter-9); Structured Annexures ( A-F ) for easy reference and guidance; Provision for independent and targeted training programs, especially focusing on cyber fraud awareness and response. Changes at a Glance

11. Major Modifications: Updated and reorganized background and objectives; Complete revision of theoretical framework and action planning; Integration of fraud detection, assessment, and management into unified chapters; Alignment of internal controls and response mechanisms with Shariah principles and risk-based practices; Policy hierarchy, reporting structure, and roles redefined to promote accountability and monitoring. Changes at a Glance

12. Changes ( Addition) SL Ref. in 2025 Ref. Page in 2025 Additions at a glance 1 1.1 01 Introduction 2 1.3 02 Regulatory Requirement 3 1.4 02 Scope of the policy 4 1.5 02 Related Policy 5 2.3 12 Definition of Cyber Fraud 6 Chapter-3 16-18 Cyber Fraud (Complete Chapter) 7 Chapter-8 32-73 Annexures (A-F) 8 Chapter-9   Case Study

13. Changes ( Addition) SL Ref. in 2025 Ref. Page in 2025 Additions at a Glance 01 1.1 01 Introduction: Fraud seen as moral threat; Zero tolerance policy emphasized; Ethics guide bank’s fraud framework; All staff accountable to mission; Policy targets every fraud type.

14. Changes ( Addition) SL Ref. in 2025 Ref. Page in 2025 Additions at a Glance 02 1.1 02 Scope of the Policy: Applies to staff, vendors, shareholders, contractors Covers all fraud or suspected fraud cases Guides management in anti-fraud implementation Promotes whistleblower protection and reporting Ensures confidentiality and zero retaliation Rewards credible fraud disclosures, if applicable

15. Changes ( Addition) SL Ref. in 2025 Ref. Page in 2025 Additions at a Glance 03 3.1 16-17 Overview of Cyber Fraud – Key Points New chapter fully defines cyber fraud Focus on internal, external threats Cyber fraud exploits digital banking systems Targets ICT: core systems, networks, access Insiders may abuse privileged system access Cards face phishing, skimming, data breaches Mobile banking vulnerable to malware, phishing

16. Changes ( Addition) SL Ref. in 2025 Ref. Page in 2025 Additions at a Glance 04 3.2 17 Cyber Factors– Key Points: App-based fraud includes session hijacking risks Unethical tech use and poor oversight enable insider fraud and system abuse Weak security in fast digital rollout creates exploitable system vulnerabilities Low cyber awareness, rural users targeted via phishing, OTP scams, social engineering Regulatory gaps and weak KYC exploited in fintech and mobile services Job insecurity, low digital literacy risk increases insider threats and victim vulnerability

17. Changes ( Addition) SL Ref. in 2025 Ref. Page in 2025 Additions at a Glance 05 3.3 17 Cyber Fraud Preventive Measures : AI-powered fraud detection and monitoring systems Multi-factor authentication secures user access Real-time transaction surveillance for anomalies Geo-blocking and encryption protect digital platforms Access control and duty segregation enforced Structured risk assessment and KYC enhancements

18. Changes ( Addition) SL Ref. in 2025 Ref. Page in 2025 Additions at a Glance 07 3.5 19 Monitoring & Compliance : KPIs track fraud detection and awareness; Ensures compliance with BB regulations; Aligned with global fraud management standards; Policy reviewed regularly for improvements.

19. Changes ( Addition) SL Ref. in 2025 Ref. Page in 2025 Additions at a Glance 08 5.11 29-30 Fraud Risk Event Matrix (Bangladesh Context): Captures real-world fraud events across the banking sector; Organized by functional areas: ( General Banking, Investment Operations, Foreign Exchange (FX) ); Each event is evaluated based on: (Likelihood of occurrence, Impact on the institution, Overall risk rating, Practical mitigation remarks); Supports risk-prioritized action planning and control design.

20. SL Ref. in 2025 Ref. Page in 2025 Additions at a Glance 09 5.12 30-31 Top 10 Damaging Fraud Types – Quick View: Internal fraud with fake investment schemes Accounts hacked using cyber login tricks Fake deposits created with staff help Money transferred without proper checks Fake identity used to open accounts Property documents and value manipulated False numbers shown in financial reports Bad checks reused or bounced repeatedly Prices altered in trade invoices Same person opened many fake accounts Changes ( Addition)

21. Changes ( Addition) SL Ref. in 2025 Ref. Page in 2025 Additions at a Glance 10 09 78-81 Case Study: Real incidents studied and ranked 11 incidents incorporated ( General Banking=5, Investment=3, Foreign Exchange=3); Focus on staff-level misconduct Recommendations included for each case Lessons applicable bank-wide today

22. Changes (Modification) SL Ref. in 2025 Ref. Page in 2025 Modifications at a Glance 01 - Background (Modified) Objective of the Policy (Modified) Theory & Concept (Complete modification) Fraud Management Precautionary Measures – Annexure-D

23. Changes (Modification) SL Ref. in 2025 Ref. Page in 2025 Modifications at a Glance 02 - Bank Self-Assessment of Anti-Fraud Internal Control Mechanism– Annexure-E Fraud Risk Management (FRM) Hierarchy Response Mapping– Annexure-F Administration

24. Changes (Deletion) S L Ref. in 2023 Page No. Deleted Items 1 1.2.1 08 Figure of Types of Fraud 2 1.2.3 14 2014 Global Economic Crime Survey 3 3 15 Pie Chart 4 1.2.5 16 Image of Common Fraud 5 1.3 21 Repetition – Why Fraud is Committed 6 1.3 22 Fraud Triangle 7 1.4 22 Who Commits Fraud?

25. Changes (Deletion) S L Ref. in 2023 Page No. Deleted Items 8 1.6.1 23–24 Example of Fraud 9 Chapter-03 27–29 Entire section on Fraud Detection 10 4.1 31 Graph on Planning 11 4.2 31 Graph on Identification & Evaluation 12 4.3 32 Graph on Possible Fraud 13 4.4 32 Fraud Risk Prioritization Content 14 7.3 59 Diagram of Fraud Risk Program 15 7.3 60 Risk Cycle Diagram

26. Recommendation & Resolution PLACED FOR KIND PERUSAL AND GUIDELINE OF THE RISK MANAGEMENT COMMITTEE OF THE BOARD

27. Introduction to Risk Management Risk management refers to the process of identifying, assessing, and mitigating potential losses in banking operations. Banks face various types of risks such as credit, market, liquidity, operational, and reputational risks. Effective risk management ensures financial stability, customer confidence, and regulatory compliance.

28. Global Financial Crisis 2008 - Overview The 2008 crisis originated in the U.S. housing market due to subprime mortgage lending. It led to widespread defaults, bank failures, and a global recession. Poor risk assessment and excessive leverage were the main causes. This event highlighted the importance of strong risk governance and early warning systems.

29. Lessons from the 2008 Crisis for Bangladeshi Banks The crisis emphasized the need for diversified portfolios, robust capital buffers, and liquidity management. Bangladeshi banks must strengthen credit appraisal systems, maintain adequate provisioning, and ensure compliance with Basel III and Bangladesh Bank’s risk guidelines.

30. Types of Risks in Banking 1. Credit Risk – possibility of borrower default. 2. Market Risk – loss from changes in market variables (interest rate, FX rate, etc.). 3. Liquidity Risk – inability to meet obligations on time. 4. Operational Risk – failure due to system or human error. 5. Reputational & Compliance Risk – damage to image or violation of laws.

31. Basel Framework and Risk Management Basel Accords (I, II, III) are international regulatory frameworks that define minimum capital requirements for banks. They aim to strengthen financial stability through risk-weighted assets (RWA), capital adequacy ratio (CAR), and liquidity standards. Basel III focuses on Tier 1 capital, LCR, NSFR, and stress testing.

32. Risk Governance and Three Lines of Defence 1st Line: Business units own and manage risks. 2nd Line: Risk management and compliance functions provide oversight. 3rd Line: Internal audit provides independent assurance. Strong governance ensures accountability and transparency.

33. Regulatory Framework in Bangladesh Bangladesh Bank issues risk management guidelines and monitors compliance through SREP and ICAAP. Banks are required to maintain capital buffers, perform stress testing, and ensure proper risk disclosures. Failure to comply can lead to capital charge or supervisory intervention.

34. Cyber and Fraud Risk With digital banking expansion, cyber risk has become a major concern. Fraud risk includes cyberattacks, internal collusion, and social engineering scams. Banks must adopt fraud prevention strategies, employee training, and real-time monitoring systems.

35. Developing a Risk Culture Risk culture refers to the shared values, beliefs, and behaviors regarding risk awareness and accountability. Leadership plays a key role in promoting transparency, ethical behavior, and proactive risk identification.

36. Conclusion and Way Forward Risk management is not a one-time task but a continuous process. Banks should integrate risk management into strategic planning, technology, and decision-making. Building a resilient risk culture ensures long-term stability and stakeholder trust.