THE COMPLIANCE PROGRAM 

a) Guide the CARD Bank’s directors, officers and personnel, especially the Compliance Unit headed by the Chief Compliance Officer (CCO) to continuously identify relevant Philippine laws, rules and regulations and pertinent BSP Circulars governing the operations of rural banks; 

b) The program set out the planned activities of the compliance function, such as the review and implementation of specific policies and procedures; compliance risk assessment; compliance testing; educating staff on compliance matters; monitoring compliance risk exposures; and reporting to the board of directors or board-level committee. The program espouses a risk-based approach and shall have appropriate coverage across businesses and units.

c) To identify and mitigate business risks2 enumerated below which are detrimental to the bank’s ability to generate returns for its continuous operation.

▪ Risk to reputation that arise from internal decisions that may damage a bank’ market standing; 

▪ Risks to reputation that arise from internal decisions and practices that ultimately impinge on the public’s trust of a bank; 

▪ Risks from the actions of a bank that are contrary to existing regulations and identified best practices and reflect weakness in the implementation of codes of conduct and standards of good practice; 

▪ Legal risks to the extent that changes in the interpretation or provisions of regulations directly affect a bank’s business model 

d) To devise a systematic and effective communication systems to keep management always conscious of their obligations and legal responsibility as trustee of public funds; and 

e) Judiciously remind management of the long-lasting benefits to the Bank in particular, and the rural banking industry in general, by strictly adhering to the rules and regulations and the provisions of the Manual of Regulations prescribed by BSP in the management of the affairs of the Bank. 

f) Provide for periodic compliance testing with applicable legal and regulatory requirements. Testing frequency should be commensurate with identified risk levels (e.g., annual testing for low-risk, quarterly testing for medium-risk, monthly testing for high-risk). It should also provide for the reporting of compliance findings noted to appropriate levels of management 

g) Establish the responsibilities and duties of the Chief Compliance Officer and other personnel (if any) involved in the compliance function