Report to Society 2019 - Esg market conduct and treating our customers fairly

How we do business continued

PERSONAL CONDUCT AND MANAGING CONFLICTS OF INTEREST

Standard Bank Group has a robust and stringent conflicts of interest control framework in place to ensure that conflict of interest risk is adequately managed.

The framework provides for processes, procedures and mechanisms to identify, prevent and manage conflicts of interest to:

Ensure the fair treatment of clients

Maintain a sound financial environment

Ensure that conflicts of interest are managed fairly

Prevent the misuse of Need to Know information

Protect the good reputation of the Standard Bank Group and the industry.

The group has implemented a number of policies and procedures under the framework, including the group’s conflicts of interest policy which aims to ensure that the group and all our employees comply with the applicable statutory and regulatory obligations by ensuring that all reasonable steps have been taken to prevent or fairly manage potential conflicts of interest, and thereby mitigate the effect that such conflicts could have on our clients and the group. The policy reflects the minimum requirements that need to be adhered to, to ensure that all reasonable steps are taken to prevent conflicts of interest from constituting or giving rise to a material risk of damage to the interests of our clients. Employees are furthermore required to adhere to the group’s gifts and entertainment policy; outside business interests policy; and personal account trading policy.

SEE less

Data privacy and security

We are committed to protecting the personal information of clients, third-parties and employees, and adhere to the relevant codes and regulations, including South Africa’s Code of Banking Practice.

We dedicate extensive focus to management of cyber risk. We continue to invest in enhancing cyber resilience across the group, including investing in improved capabilities to predict, prevent, detect and respond to cyber incidents.

The group’s data privacy policy provides for measures to ensure that the group processes personal information in a lawful and responsible manner, in line with in-country privacy laws.

These measures, together with other relevant policies, inform the security safeguards necessary to protect personal information from unlawful and unauthorised access, use, destruction or loss. These measures cover all processing activities within the group.

We ensure accurate and relevant data security policies and procedures are in place and applicable to employees’ day-to-day work

We protect our core system by controlling access rights

We assess new and existing clients in relation to their associated risk level and their proposed activities with focus on sanctions, terrorist financing, bribery and corruption, money laundering and fraud

We engage with clients and provide them with information on how to protect their accounts.

The data privacy consent and notification framework enables the free flow of information within the group. This allows each group entity to align itself with one consistent commitment to the customer in terms of protecting their information. Where we become aware of privacy incidents, we investigate the incidents, and immediately take steps to mitigate any risks to clients. Our privacy statement can be found here. Standard Bank South Africa’s privacy statement is published here.

Our PAIA (Promotion of Access to Information Act) manual and the Standard Bank website set out the procedures for information requests. Our group data privacy policy applies to all information requests.

Cybersecurity

Cyber incidents are a major threat to companies globally, and to financial services companies in particular, which are commonly targeted.

Standard Bank is committed to safeguarding clients’ data, money and time from cyber threats. Cyber risk receives extensive focus at various governance and management committees across every level of the organisation.

Standard Bank Group board has delegated the management of cyber risk to the group chief information security officer (CISO), who is responsible for creating and executing the cybersecurity strategy and programme. The strategy and programme are aligned to security frameworks such as ISO27001, the US National Institute of Standards and Technology, and Information Security Forum’s Standard of Good Practice for Information Security and has been ratified by the group board. In 2019, the group certified the Africa shared core banking platform against ISO27001. The CISO provides regular updates to the board on the group’s cyber risk posture. The board also gets assurance through an annual independent assessment of the strategy by a cybersecurity expert.

As part of the cybersecurity programme, the group employs a continuous testing, continuous monitoring strategy. Testing includes technology testing (vulnerability scanning, penetration testing), people testing (training and awareness) and response testing (cyber incident simulations, disaster recovery testing) to stress test security capabilities. Monitoring includes using machine learning, big data and robotics to detect suspicious behaviour, as well as continuously measuring the effectiveness of security controls.

The group maintains dedicated cyber insurance cover for additional protection against common cyber threats. During 2019 the group detected and successfully mitigated several attempted cyber threats, leading to zero material or client impacting incidents for the year.

Cyber security skills shortages are a growing risk to cybersecurity strategies across the globe, with almost two million security vacancies worldwide. In response, the group has created a Cybersecurity Academy to develop cybersecurity skills. In 2019, the academy trained 75 group technology employees on various aspects of cybersecurity.

SEE less

Serving our customers

System availability

Work to improve the availability and reliability of our transaction channels is ongoing.

In 2019, we experienced five priority one incidents in South Africa and 14 such incidents in Africa Regions. A priority one incident refers to extensive impact and critical urgency incidents.

Responding to customer complaints

Standard Bank endeavours to respond timeously to all customer complaints.

In South Africa, the Ombudsman for Banking Services named Standard Bank overall winner for ‘large’ banks in terms of: Quality of the written response of the bank to the office in response to a specific complainant, response time, and overall fairness of the response. We also received an award for innovation in dispute resolution resulting in a noticeable decrease in consumer disputes and an engagement award for our dealing with the Ombudsman.

Also see reports: SBG governance and remuneration report and SBG risk and capital management report