Corporate Codes Of Conduct Guidance on Implementing an Effective Ethics Program

Financial Institution Letter

FIL-105-2005

October 21, 2005

Federal Deposit Insurance Corporation

550 17th Street, NW, Washington, D.C. 20429-9990

CORPORATE CODES OF CONDUCT

Guidance on Implementing an Effective Ethics Program

Summary: The FDIC is providing the attached guidance to financial institutions to remind them of the

importance of an effective internal corporate code of conduct or written ethics policy.

Distribution:

FDIC-Supervised Banks (Commercial and Savings)

Suggested Routing:

Chief Executive Officer

Compliance Officer

Internal Auditor

Fraud Prevention

Personnel/Human Resources

Legal Counsel

Related Topics:

FDIC Statement of Policy – “Guidelines for

Compliance with The Federal Bank Bribery Law

18 U.S.C. 215”

FDIC Statement of Policy – “Statement Concerning

the Responsibilities of Bank Directors and Officers”

FIL-46-2005, dated June 1, 2005: “Guidance on

Developing an Effective Pre-employment

Background Screening Process”

FIL-80-2005, dated August 16, 2005: “Guidance on

Implementing a Fraud Hotline”

Attachment:

“Corporate Codes of Conduct: Guidance on

Implementing an Effective Ethics Program”

Contact:

Examination Specialist Kathryn Weatherby at

Kweatherby@FDIC.gov or (202) 898-3673

Note:

FDIC financial institution letters (FILs) may be

accessed from the FDIC's Web site at

www.fdic.gov/news/news/financial/2005/index.html.

To receive FILs electronically, please visit

http://www.fdic.gov/about/subscriptions/fil.html.

Paper copies of FDIC financial institution letters

may be obtained through the FDIC’s Public

Information Center, 801 17th Street, NW, Room

100, Washington, DC 20434 (1-877-275-3342 or

(202-416-6940).

Highlights:

• A corporate code of conduct or ethics policy should be

implemented to provide employees, officers, directors and agents

with specific guidelines on acceptable and unacceptable

business practices

financial institution letters

may be obtained through the FDIC’s Public

Information Center, 801 17th Street, NW, Room

100, Washington, DC 20434 (1-877-275-3342 or

(202-416-6940).

Highlights:

• A corporate code of conduct or ethics policy should be

implemented to provide employees, officers, directors and agents

with specific guidelines on acceptable and unacceptable

business practices.

• The policies should cover the entire organization, including

subsidiaries and specific business activities unique to an

institution.

• The corporate code of conduct or ethics policy should adopt

provisions that explain the general prohibitions of the Federal

Bank Bribery law.

• Management should require bank employees, officers,

directors and agents to sign a written acknowledgement of the

institution’s corporate code of conduct or ethics policy, including

written acknowledgement of any subsequent material changes to

the code or policy.

• Management should provide periodic training about its

corporate code of conduct or ethics policy.

• Compliance with the policies should be monitored. Violators

should be subject to specific and appropriate actions to deter

wrongdoing, compel accountability and promote adherence to

the policy.

1

CORPORATE CODES OF CONDUCT

Guidance on Implementing an Effective Ethics Program

The Federal Deposit Insurance Corporation (FDIC) is reminding financial institutions of the

importance of written standards to promote honest and ethical conduct, compliance with

applicable rules and regulations, and accountability in adhering to a corporate code of

conduct or ethics policy.

Components of a Code of Conduct or Ethics Policy

An institution’s board of directors should convey the message that integrity and ethical

values of the highest standard should be maintained. The board should establish clear

expectations on acceptable business practices and prohibited conflicts of interest by

establishing policies on expected behavior

te code of

conduct or ethics policy.

Components of a Code of Conduct or Ethics Policy

An institution’s board of directors should convey the message that integrity and ethical

values of the highest standard should be maintained. The board should establish clear

expectations on acceptable business practices and prohibited conflicts of interest by

establishing policies on expected behavior. Management should ensure that these policies

are communicated and understood throughout the organization. Issues that should be

addressed in these policies include:

¾ Safeguarding Confidential Information

In accordance with the Gramm-Leach-Bliley Act (GLBA) of 1999, financial institutions are

required to have administrative, technical and physical safeguards for sensitive customer

information. Sensitive information collected by the institution must not be used or disclosed

for any reason other than the intended purpose and must be protected from misuse that could

result in identity theft.

¾ Ensuring the Integrity of Records

Records and accounting information must be accurate and maintained with reliability and

integrity. Transactions must be reflected in an accurate and timely manner. Policies should

prohibit false entries and activities that result in false entries.

¾ Providing Strong Internal Controls Over Assets

Employees, officers and directors must comply with all internal control procedures

established by the institution for the safeguarding of assets and proper reporting and

disclosure of financial information.

¾ Providing Candor in Dealing with Auditors, Examiners and Legal Counsel

All employees, officers and directors should be required to respond honestly and candidly

when dealing with the bank’s independent and internal auditors, regulators and attorneys

trol procedures

established by the institution for the safeguarding of assets and proper reporting and

disclosure of financial information.

¾ Providing Candor in Dealing with Auditors, Examiners and Legal Counsel

All employees, officers and directors should be required to respond honestly and candidly

when dealing with the bank’s independent and internal auditors, regulators and attorneys.

¾ Avoiding Self-dealings and Acceptance of Gifts or Favors

Policies prohibiting self-dealing should properly address director, officer, employee,

customer and supplier relationship issues and should provide guidelines that include the

provisions of the Federal Bank Bribery law.

2

An institution’s corporate code of conduct or ethics policy should prohibit any employee,

officer, director, agent or attorney of any bank from:

(1) soliciting for themselves or for a third party (other than the bank itself) anything

of value from anyone in return for any business, service or confidential information of the

bank, and

(2) accepting anything of value (other than bona fide salary, wages and fees referred

to in 18 U.S.C. 215(c)) from anyone in connection with the business of the bank, either

before or after a transaction is discussed or consummated.

Refer to the Statement of Policy, “Guidelines for Compliance with the Federal Bank Bribery

Law,” dated December 31, 1987, p. 5289.

¾ Observing Applicable Laws

The board of directors should ensure that bank management is cognizant of all applicable

laws and regulations. Further, the board should make certain that compliance with all laws

and regulations receives a high priority and that violations are not knowingly committed by

bank employees

ance with the Federal Bank Bribery

Law,” dated December 31, 1987, p. 5289.

¾ Observing Applicable Laws

The board of directors should ensure that bank management is cognizant of all applicable

laws and regulations. Further, the board should make certain that compliance with all laws

and regulations receives a high priority and that violations are not knowingly committed by

bank employees. Management should consider including the following regulations in

policies, when applicable:

• Section 18(k) of the Federal Deposit Insurance Act (FDI Act) – “Authority to

Regulate or Prohibit Certain Forms of Benefits to Institution-Affiliated Parties”

• Part 359 of the FDIC Rules and Regulations – “Golden Parachutes and

Indemnification Payments”

• Section 39(c) of the FDI Act – “Compensation Standards”

• Section 32 of the FDI Act – “Agency Disapproval of Directors and Senior

Executive Officers of Insured Depository Institutions or Depository Institution

Holding Companies”

• Section 19 of the FDI Act – “Penalty for Unauthorized Participation by Convicted

Individual”

• Part 349 of the FDIC Rules and Regulations – “Reports and Public Disclosure of

Indebtedness of Executive Officers and Principal Shareholders to a State Nonmember

Bank and its Correspondent Banks”

• Sections 22(g) and 22(h) of the Federal Reserve Act – “Loans to Executive

Officers of Banks and Extensions of Credit to Executive Officers, Directors, and

Principal Shareholders of Member Banks”

• The Federal Reserve Board’s Regulation O – “Loans to Executive Officers,

Directors, and Principal Shareholders of Member Banks”

• Section 337.3 of the FDIC Rules and Regulations – “Limits on Extensions of

Credit to Executive Officers, Directors, and Principal Shareholders of Insured

Nonmember Banks”

• Part 348 of the FDIC Rules and Regulations – “Management Official Interlocks”

• Section 7(j) of the FDI Act and the Change in Bank Control Act of 1978

ve Officers,

Directors, and Principal Shareholders of Member Banks”

• Section 337.3 of the FDIC Rules and Regulations – “Limits on Extensions of

Credit to Executive Officers, Directors, and Principal Shareholders of Insured

Nonmember Banks”

• Part 348 of the FDIC Rules and Regulations – “Management Official Interlocks”

• Section 7(j) of the FDI Act and the Change in Bank Control Act of 1978

3

• Section 737 of the Gramm-Leach-Bliley Act – “Bank Officers and Directors as

Officers and Director of Public Utilities”

• Section 8(e) of the FDI Act – “Removal and Prohibition Authority”

• Section 8(g) of the FDI Act – “Felony Charge Involving Dishonesty or Breach of

Trust as Cause for Suspension, Removal, or Prohibition”

¾ Implementing Appropriate Background Checks

Financial institutions should develop a risk-focused approach in determining when pre-

employment background screening is considered appropriate or when the level of screening

should be increased based upon the position and responsibilities. In addition, institutions

should verify that contractors are subject to screening procedures similar to those used by the

financial institution. Refer to FIL-46-2005, dated June 1, 2005: “Guidance on Developing an

Effective Pre-Employment Background Screening Process.”

¾ Involving Internal Auditor in Monitoring Corporate Code of Conduct or Ethics Policy

Internal controls against self-serving practices and conflicts of interest should be monitored

with an effective audit program to identify operational weaknesses and to ensure corrective

action and compliance with laws, regulations and internal policies.

¾ Providing a Mechanism to Report Questionable Activity

Establishing a hotline is one mechanism available to report questionable activity. For

maximum effectiveness of the hotline, institutions should advertise and market the hotline's

existence to employees, suppliers, third-party service providers and customers

rective

action and compliance with laws, regulations and internal policies.

¾ Providing a Mechanism to Report Questionable Activity

Establishing a hotline is one mechanism available to report questionable activity. For

maximum effectiveness of the hotline, institutions should advertise and market the hotline's

existence to employees, suppliers, third-party service providers and customers. Refer to FIL-

80-2005, dated August 16, 2005: “Guidance on Implementing a Fraud Hotline.”

¾ Outlining Penalties for a Breach of the Corporate Code of Conduct or Ethics Policy

Compliance with the policies should be monitored. Any violators should be subject to

specific and appropriate actions to deter wrongdoing and promote accountability for

adherence to the corporate code of conduct or ethics policy.

¾ Providing Periodic Training and Acknowledgement of Policy

Management should ensure information in the corporate code of conduct or ethics policy is

relayed to staff in periodic training. Training will provide staff with resources when

questions arise.

¾ Periodically Updating Policies to Reflect New Business Activities

Institutions should update policies frequently to encompass new business activities.