NAB.032.001.2600

Contains confidential information

Memorandum for Group Risk Return Management Committee

Melissa Reynolds Executive Gen ' ‘" ~

Tel:

INTRODUCER CHANNEL: RISK REVIEWPurpose

This memorandum provides a summary of the risk findings from key reviews undertaken on the Introducer Channel.

Background

The Introducer Channel has grown rapidly, however the risk controls have not kept pace with growth. This has created a number of operational risk issues which are now being addressed. Some of these issues were made visible through the NSW Greater Western Sydney Local Area Market (GWS LAM) fraud event in October 2015 alerted via the Whistleblower Confidential Alert Line. The GWS review was presented to the Committee (Jan 2016) and highlighted issues specific to the controls of the channel. There have also been a number of other reviews undertaken on the channel as follows:• PB Business Improvement: end-to-end channel diagnostic (Dec 2015).• Internal Audit: 2-Star audit that highlights no single enterprise channel owner or strategy and

inconsistent processes across the enterprise (Mar 2016).• Introducer Channel Strategic Review (June 2016): Review of the channel performance and the

strategic role of Introducers in growing mortgage customers. Initial findings show that the Introducer channel is a viable and commercially solid source of business for NAB and one that will be strengthened by the actions resulting from the risk reviews undertaken.

Overview of Key Issues & RisksA high level summary of the findings from the three reviews include:• No designated enterprise channel owner resulting in governance gaps and increased risk due

to inconsistency in processes (eg. onboarding) across PB and BB.• No agreed enterprise wide targeting strategy. This has resulted in non-preferred or

undesirable Introducers, as well as ineffective monitoring of Brokers who ‘act as Introducers’. This has driven customer churn, high Introducer dormancy, Introducer self-referring and some Banker/Introducer collusion. Brokers have impacted credit quality due to Broker adverse selection of mortgages into the Introducer channel (predominately BB).

• Unclear role of the National Referral Partners (NRP’s) vs Direct Introducers.• Weaknesses in relationship management of Introducers and the opportunity to increase B2B

relationship management capability of bankers.• Inconsistent and potentially ineffective application across the enterprise of:

o on-boarding process; ando regulatory requirements, due to varying levels of understanding (ie. operating under

NCCP Exemption to provide brief customer details - ‘Spot & Refer’).• Limited due diligence oversight performed by NRPs on new sub-introducers (affiliates).• Banker incentive and Introducer commission structures potentially not driving the right

behaviours.• System limitations driving inefficiencies and risk due to many manual processes.

Actions Completed to dateTo address the review findings and strengthen the Introducer Channel, a number of actions have been completed. These include:

NAB.032.001.2601

• Enterprise channel ownership has been agreed and will reside in PB. BB will be part of Enterprise Introducer Governance Forum and adhere to enterprise strategy, policies, processes and frameworks (May 2016).

• Targeting Strategy (Phase 1) - Mandated acceptable industries were implemented across PB and the NRPs (Dec 2015) with BB to be implemented. Acceptable industries include Accountants, Financial Planners, Real Estate Agents and Solicitors.

• Education and up-skilling of Retail sales leaders on Introducer policies, regulations and engagement protocols (Feb 2016).

• Strengthened PB Introducer Assurance Testing framework moving from time specific (eg. 6-months on book) to being risk based. This includes a series of risk triggers to identify, monitor and investigate high risk Introducers (March 2016).

• Enterprise Introducer Governance Forum strengthened to include Products & Markets, Business Bank and PB 2nd line Risk. The forum’s role is channel governance including Introducer performance, reviews and outcomes, on-boarding, strategy and policy changes (April 2016).

Actions underway and still to be completedFollowing actions are being progressed:• Implement the agreed channel management structure in PB and BB to establish the BB

Assurance testing framework in line with PB.• Further strengthening the front-book (onboarding) Targeting Strategy eg. Mandate appropriate

industry accreditation (ie. Accountants to be a CPA) and apply to back-book (portfolio) clean­up.

• Improve the on-boarding process for all Introducers and define the strategy for when to on­board a potential Introducer through a NRP versus Direct arrangement.

• Further define and agree Introducer relationship management model and capability required.• Embed Introducer portfolio management approach and strengthen risk control framework that

includes claw-back, addresses self-referring and sets Introducer volume thresholds.• Address banker incentives as part of the broader Enterprise Performance and Rewards

review.• Improve technology and Customer Relationship Management platform to address system

limitations, data gaps and manual workarounds.• Embed compliance with policy changes that prohibit Brokers ‘acting as Introducers’ across the

enterprise.

PB CRO comments are included in Appendix 1 while further detail is provided on issues, risks andremediation actions in Appendix 2

It is anticipated that finalising the strategic review will close the 2-Star Audit stage gate by June 302016.

Recommendation

It is recommended the Committee REVIEW and DISCUSS this paper ahead of submission to the Board Risk Committee.

Proposed by:

Melissa Reynolds EGM Retail

7 June 2016

Supported by:

Gavin SlaterGroup Executive Personal Banking

Appendix 1: PB Chief Risk Officer Comments Appendix 2: Issues/Risks and Remediation Actions

NAB.032.001.2602

APPENDIX 1: PB CHIEF RISK OFFICER COMMENTS

PB CRO is supportive of the work that has been done to date to stabilise the risk profile of this channel and actions detailed to uplift risk management. To ensure success it will be critical that a robust controls assurance plan is in place to continue to test the effectiveness of the new controls and this plan will need to be agreed between both BB and PB to enable consistency in reporting of control effectiveness.

It is recommended that there is stronger engagement with the CRO team to establish an aligned view on the detailed actions and the work required to mitigate the risks associated with this channel to a more acceptable level.

In addition to oversight on closing out the actions outlined in this paper, CRO team will also provide more comprehensive oversight by:

• Completion of quarterly reviews of selected Introducers to validate quality of loans• Completion of quarterly reviews of selected Bankers with high concentration to Introducers• Continuation of oversight of Sales Incentives outliers with significant exposure to this

channel• Establish a Third Party oversight governance forum to cover all 3rd Party channels. This will

focus on reviewing decisions taken in 1st line in relation to termination of Introducers, Brokers, and consequence management applied for misconduct or breaches.

Finally, further investment will be required in this channel to improve MIS and reporting (particularly exception reporting) and resourcing levels to ensure appropriate monitoring.

Improvement in the levels of reporting and monitoring will provide greater visibility for PU leaders and with this will be increased accountability to act quickly and apply appropriate consequence management for breaches or misconduct.

Jacqui Colwell Chief Risk Officer Personal Banking

NAB.032.001.2603

APPENDIX 2: ISSUES/RISKS AND REMEDIATION ACTIONS

Key Issues/Risks - Summary of Review Findings Solution Dates

1.0 STRATEGY & ORGANISATIONAL MODEL

1.1 Channel Management & GovernanceNo enterprise owner of Introducer channel.

Enterprise ownership agreed to be with PB and will cover Strategic Direction, Governance and Operations. BB MA to be accountable for BB Assurance testing.

Decision Complete. Detailed design commences July

1.2 TargetingNo overall targeting strategy increases risk of acquiring poor quality business or Introducers

• Phase 1 - Targeted industries implemented• Phase 2 - Additional enhancements to strengthen controls. This includes

requesting relevant industry accreditation and framework for appropriate sole traders.

• Phase 3 - Back book clean up

Phase 1 - (Dec 2015) Phase 2 - 30/6Phase 3-31/8

1.3 Operating Model (Sales)Current 1:1 banker/introducer relationship model increases risk of banker and introducer collusion

A centrally managed BDM model for PB Retail to ensure a segregation of duties. Detailed design 31/7

1.4 Portfolio ManagementBack book monitoring and management is ineffective

Back book clean-up to remove dormant, underperforming and Introducers outside of the target set. On-going monitoring through Governance Forum

Implementation 31/8

1.5 Minimum ExpectationsRequired referral volumes is not communicated or monitored

Define and communicate minimum expectations, policy, capture through on- boarding and utilise a trigger to monitor as part of Portfolio Management approach.

Implementation 31/7

1.6 Claw back StrategyNo overall targeting strategy with the risk of acquiring poor quality business that exhibits elevated levels of churn

Introducer does not pay trail so options to claw back are being considered. Change will be reflected in Introducer agreements.

Implementation 31/7

1.7 Self-ReferringBankers setting customers up as Introducers to use commission payment as incentive to win business.

Targeting will address the problem as the miscellaneous industries are no longer accepted.

Implementation 31/7

2.0 PROCESSES, MEASURES & REPORTING

2.1 On-boarding - NRPsLimited oversight of the NRP’s due diligence and gaps between Direct and Affiliate on-boarding process

1) Centralise, oversee and enhance the on-boarding of affiliates2) Close gaps between Direct and Affiliate due diligence, including annual

NRP performance reviews.

Implementation 30/6 Implementation 30/9

2.2 Manual Reporting & Validation ControlsManual reporting and lack of validation is creating risk and information gaps

Enhanced, automated reporting to improve portfolio management, management decision making and data gaps.

Implementation 31/8

2.3 Checks: Broker / Ex-employee Implement control check to confirm if prospective Introducer is a non-NAB 31/8 (ES&T

NAB.032.001.2604

Limited control checks on prospective Introducers including non-NAB Broker and ex-employee checks.

Broker and leverage current broker ex-employee check deliverable)

2.4 Termination ProcessMonitoring of Introducer terminations is ineffective

Develop monthly control check with ES&T, enhance process and document by event type.

Implementation 30/6

3.0 PEOPLE & CAPABILITY

3.1 Lack of banker understanding of on-boarding, relationship protocols and when to use NRPs

Education and up-skilling of Retail Sales Leaders and bankers including policies implemented Feb 2016.

Implemented (Feb 2016)

3.2 Lack of banker B2B relationship management capability results in inconsistent, business outcome or risk issues.

To be addressed as part of the Revised Operating Model (Sales) Implementation date requires completion of detailed design 31/7

4.0 REWARDS & INCENTIVES

4.1 High individual rewards and 1:1 relationships with To be considered as part of broader Enterprise Performance and Rewards Short-term actionsIntroducers increases possibility of undesirable behaviour review. Short-term actions include: a) addressing incentive outliers in

conjunction with other initiatives, b) claw back, c) M A Assurance Testing triggers for high flow concentration, d) targeting strategy and e) operating model.

Implementation 30/9

4.2 BB treatment of commission on banker P&L has resulted in Amortise Introducer commission over average loan life (~5 years) in business 31/08 for H1 17bankers not paying commission on fulfilled deals bank bankers P&Ls Scheme

5.0 SYSTEMS & TECHNOLOGY

5.1 System limitations are driving inefficiencies, impacting Introducer experience and increasing risks

Short-Term: Agree interim CRM system to record interactions by leveraging existing enterprise capability and infrastructure.Medium term: Assess technology options to address system limitations, manual workarounds

Agree CRM system & design approach 31/7 Agree option 31/8

5.2 Data gaps are impacting effectiveness of on-going due diligence (eg. System only captures one company director)

Implement tactical solution to address key data gaps, including:• ABN & industry type, employee ID at parent level only• Only single director per Introducer in database"

Delivery TBC pendingTechnologyassessment