Ulster Bank Ireland DAC

Background to the Investigation into UBID UBID is a licensed bank pursuant to section 9 of the Central Bank Act, 1971. It has been authorised since 19 September 1973. UBID introduced tracker mortgages to its range of products in October 2001. Tracker mortgages were withdrawn for new customers from 1 October 2008. 4 As part of its supervisory work, the Central Bank became aware of complaints by UBID customers that they were being denied their tracker mortgage entitlements following the withdrawal of trackers. The Central Bank engaged with UBID in relation to those complaints and requested that it undertake a review of its tracker customers to ensure that it was providing them with their correct tracker mortgage entitlements. Despite the Central Bank’s engagement and a number of findings by the then Financial Service Ombudsman (“FSO”) that its documents were unclear, UBID initially refused to undertake that wider review and only did so following further significant supervisory engagement by the Consumer Protection Directorate of the Central Bank, and under the auspices of the TME. The enforcement investigation into UBID for tracker mortgage issues commenced in April 2016, shortly after the start of the TME. Prescribed Contraventions UBID has admitted 49 separate regulatory breaches of the European Communities (Unfair Terms in Consumer Contracts) Regulations 1995, Code of Practice for Credit Institutions 2001, the Consumer Protection Code 2006 and the Consumer Protection Code 2012. The breaches arose because UBID: 1. Failed to disclose to impacted tracker customers all the consequences of fixing their interest rates; 2.

BACKGROUND The Firm is authorised by the Central Bank to carry on banking business under section 9 of the Central Bank Act 1971. Its ultimate parent company is Royal Bank of Scotland Group plc. 3 The European Central Bank supervises the Firm directly, in accordance with the Single Supervisory Mechanism. The European Central Bank referred the matter to the Central Bank in January 2017. The Central Bank’s investigation concerned governance failings in respect of the compilation and submission of returns under the MART Framework. PRESCRIBED CONTRAVENTIONS The Central Bank’s investigation found that the Firm contravened the governance obligations contained in the following regulatory requirements: Contravention 1 Regulation 16(1), 16(3)(b) – (d) and 16(4) of European Communities (Licensing & Supervision of Credit Institutions) Regulations 19921 and Regulation 61(1)(b) and 61(1)(c)(i) of European Union (Capital Requirements) Regulations 20142. Amongst other things, these regulations require institutions to put in place governance arrangements to ensure they are effectively and prudently managed. The particular provisions breached required firms to put in place and maintain sound administrative procedures, as well as adequate internal control mechanisms. Contravention 2 Section 6.4 of the Corporate Governance Code for Credit Institutions and Insurance Undertakings 2010 and the Corporate Governance Requirements for Credit Institutions 2015. These codes establish the corporate governance requirements that apply to the Firm. The provision breached requires firms to put in place a governance structure that is “sufficiently sophisticated to ensure that there is effective oversight of the activities of the institutions taking into consideration the nature, scale and complexity of the business being conducted.

BACKGROUND Ulster Bank Ireland is authorised to carry on banking business in Ireland under Section 9 of the Central Bank Act 1971. It is one of the largest banks in Ireland with over 110 branches and 1.1 million customers. Its principal activities consist of retail and commercial banking. Since 15 July 2010, Ulster Bank Ireland has been required to comply with the CJA 2010. The Central Bank has responsibility for securing the compliance of credit and financial firms with the CJA 2010. During 2012 and 2013, the Central Bank conducted a review of Ulster Bank Ireland’s compliance with the CJA 2010. This review identified of a number of issues in respect of Ulster Bank Ireland’s compliance with the CJA 2010. During this period, Ulster Bank Ireland also self-reported a number of issues of non-compliance with the CJA 2010. In December 2013, the Central Bank initiated engagement with Ulster Bank Ireland in respect of remediation efforts in areas where noncompliance with the CJA 2010 had been identified. On 20 March 2015, the Central Bank notified Ulster Bank Ireland of its decision to commence an investigation into suspected breaches of the CJA 2010. PRESCRIBED CONTRAVENTIONS The Central Bank’s investigation identified 8 breaches of the CJA 2010, namely: Poor controls over AML/CFT outsourcing Ulster Bank Ireland is part of a group of companies headed by Royal Bank of Scotland plc (‘RBS’) as the ultimate holding company. Ulster Bank Ireland outsources 25 AML/CFT activities mainly to other 4 entities in the RBS group.

Background The Firm is reliant on the Royal Bank of Scotland Group (“RBSG”) for the provision of IT services including IT risk oversight and management. The Firm entered into an outsourcing services agreement with RBSG for the provision of IT services in 2005. During June 2012, software that RBSG used to process banking transactions across all of its businesses, including the Firm, failed. The immediate cause of the failure arose from difficulties with a software upgrade supplied by a third party that had been installed by RBSG a few days prior to the IT incident. As a result of the IT incident, the process of updating transactions and customer payments did not run for an extended period of time. This resulted in significant customer and market place disruption. Full account services for the Firm’s customers were not restored until 16 July, which was 28 days after the IT incident first occurred. The impacts of the IT incident on the Firm’s customers included: late processing of payments in and payments out of accounts; inability to access ATMs/cash; late transfers of payments against customers’ credit card balances; incorrect credit and debit interest on accounts/cards; duplicative payments; customers’ inability to honour financial commitments (with impact on credit history); inability to pay for goods and services; inability to use online banking; inability of commercial customers to use the banking system and inability to view account balances.

Background to the liquidity contraventions On 4 October 2011, the Firm advised the Central Bank in writing (following a verbal notification on 21 September 2011) that it had identified an issue whereby haircuts had not been applied correctly to certain retail and corporate deposit products. The Firm also 3 reported that it had excluded certain cash inflows from the calculation of its liquidity position. On discovery of the issue, the Firm took immediate corrective action to rectify the contraventions. The definition of liquidity is set out in the Requirements as follows. “Liquidity is the ability of a credit institution to meet its on and off-balance sheet obligations in a timely manner as they fall due, without incurring excessive cost, while continuing to fund its assets and growth therein”. Liquidity management is, therefore, essential to the proper functioning of credit institutions. The Requirements set out both qualitative and quantitative obligations. The contraventions identified in this case relate to “haircuts” (discounts on cash-flows i.e. the application of a specified discount to the value of the cash-flow, as set out in the Requirements) on certain retail and corporate deposits being applied incorrectly or not being applied at all and the failure of the Firm to adequately manage material cash-flows. Background to the capital requirements contraventions In 2009, the Central Bank imposed an obligation on the Firm to hold €339 million in additional Pillar II capital as a buffer against the risks (over and above credit, market and operational risk) to which the Firm was exposed.