Associate, CFCC, Governance at Standard Chartered Bank

• Managing local regulatory engagement / relationships including liaison, reporting and regulatory audit in collaboration with other CFCC teams.

• Regulatory Breach Investigations
• Regulatory Notifications / Reporting
• Regulatory Review
• Regulatory Correspondence
• Regulatory Meetings
• Horizon Scanning

Obligations Register for Financial Services Regulation – Overall framework delivery, with responsibility for only completing functions obligations management

• Ensuring the Functions are compliant with local regulatory obligations.

• Functions Compliance Advisory
• Management of standards
• Obligations Register for Financial Services Regulation

• Ensuring all relevant 2nd line risk management policies and procedures, including any governance framework, are embedded by the Functions & CFCC Teams.

• Standards implementation for Functions
• Risk Framework Activity embedding: Risk Assessment, Training, Standards, MI, Projects.

• Escalating country regulatory issues specific to Functions to regions where relevant

• Risks & issues escalation
• Investigations / Complaints Management

• Managing the relationship with Functions stakeholders

• Committee Attendance

• Executing role of 2nd line as outlined in the ERMF to Functions

• Provide oversight and challenge of relevant 2nd line processes
• Deliver required F2F training to the Functions for CFCC owned policies and procedures

• Supporting review engagement & management activities as required

• In-Function Review Management
• Business & Functions Review Management

• Providing advice required to fulfil local entity corporate governance requirements where relevant in collaboration with other country CFCC teams.
• Accountable for managing the relationship with other 2nd line stakeholders, 3rd line stakeholders and external stakeholders

Performing the roles below as the Country Data Protection Supervisor (DPS)

1) Informing and advising the Group on its local Privacy obligations:

• determine if the Group Privacy Standard needs to be adapted to comply with any more onerous local Privacy obligations and develop a Country Addendum if required, in line with the Country Risk Governance Standards;
• ensure the local Obligations Register includes any applicable local Privacy obligations, in accordance with the Standard for Managing Legal and Regulatory Obligations by Compliance;

2) Monitoring compliance by local Businesses and Functions with the Group Privacy Standard and local requirements:

• ensure local compliance monitoring and periodic reviews include monitoring and reviews of Privacy controls, such as reviewing the Control Sample Testing (CST) results conducted by the 1st Line;

escalate Privacy-related metrics and key performance indicators, identified through monitoring, to the Group Data Protection Officer (GDPO) and, where considered appropriate by the country DPO, to local senior management.

3)  Acting as the contact point for any local data protection supervisory authority:

• determining whether a Personal Data Breach impacting Individuals in their country is notifiable to the local data protection supervisory authority; to avoid doubt, any communications with the local data protection supervisory authority must comply with the requirements of the Group Communications with Regulators Standard.

1. Providing advice and guidance on Privacy Impact Assessments (PIAs) where the Personal Data Processing is only carried out in or for their country, in line with the PIA Guidance;
2. Escalating any significant Privacy issues or risks relating to their country:

• where any local / country compliance risk assessments are conducted, ensure it contains an

assessment of Privacy risk. Consult with the GDPO for latest methodologies and recommended approaches to risk assessment and for the Group context;

• inform the GDPO of any material issues via email (for any urgent, time-sensitive or high-risk matters) or via the regular Privacy Network / Country DPO forums/discussion sessions/calls;
• keep the GDPO team informed of any significant changes to the Privacy risk landscape for the country (e.g. the development of a new laws or regulations, significant changes to any existing laws or regulations or significant changes to the enforcement regime)
• ensure issues relating to the Privacy risk sub-type are appropriately escalated to the Board / senior management, in line with the Compliance Risk Type Framework.

Regulatory & Business Conduct

• Display exemplary conduct and live by the Group’s Values and Code of Conduct.
• Take personal responsibility for embedding the highest standards of ethics, including regulatory and business conduct, across Standard Chartered Bank. This includes understanding and ensuring compliance with, in letter and spirit, all applicable laws, regulations, guidelines and the Group Code of Conduct.
• Support the Compliance team to achieve the outcomes set out in the Bank’s Conduct Principles: [Fair Outcomes for Clients; Effective Financial Markets; Financial Crime Compliance; The Right Environment.] *
• Effectively and collaboratively identify, escalate, mitigate and resolve risk, conduct and compliance matters.

Key Stakeholders

• Head, CFCC, Ghana
• Head, CFCC, West Africa
• Business and Functional Heads (Ghana)
• Data Protection Commission and all other relevant Regulators in Ghana
• Group Data Protection team
• Other Risk and Control Functional Heads (Risk, Audit, etc)

Other Responsibilities

• Includes Risk Assessment, Policy Governance, Training, Reporting & Escalation, and Remediation.