Governance Aspect

Good governance forms the foundation for the sustainable growth of Krungsri and companies in the Financial Business Group (Krungsri Group). It is also the main factor that drives business in an efficient, transparent, and auditable manner with accountability to all stakeholders. Therefore, Krungsri Group aspires to strengthen good governance continuously to ensure that all our business processes give utmost consideration to the risks and the responsibilities to all stakeholders, all the while boosting sustainable economic, social, and environmental development. We also instill into our employees the sense of duly complying with global good governance principles and anti-corruption, given our measure of zero tolerance toward all forms of corruption, both direct and indirect. All this will help bolster the confidence and trust of shareholders, investors, and all stakeholders in us and also add value and worth to the business in the long term.

Management Approaches
Krungsri emphasizes conducting business based on good corporate governance principles and combating all forms of corruptions. Our management approaches are as follows

• The Board of Directors stipulated ‘Good Corporate Governance Principles’ in writing. The contents cover shareholders’ rights and equitable treatment; disclosure of information and transparency; composition and qualifications of the Board of Directors; roles and responsibilities of the Chairman and the Board of Directors including the subcommittees reporting to it; roles and responsibilities of the President and Chief Executive Officer and other executives; internal control system and internal audit system; Krungsri Group’s business philosophy and roles toward stakeholders; Krungsri’s mission, vision, and core values; and the Code of Conduct and employees’ compliance with it. It is stipulated that these principles must be revised every year or without delay upon any significant change to ensure that Krungsri’s Good Corporate Governance Principles are appropriate to the changed situations and correspond with the relevant criteria, including the organization structure and the compliance environment of Krungsri Group.
• Stipulated ‘The Spirit & The Letter (S&L)’ as practices for all directors, executives, and employees in working with integrity under laws and good governance principles. The S&L specifies the matters for acknowledgement, compliance, caution, and punishment in case of violation in order to create continuous awareness of the practices. Krungsri stipulates that all employees must regularly affix signature as acknowledgement and consent to comply with The Spirit & The Letter every year.

• Regulatory excellence

• Improper payments
• Supplier relationships
• International trade controls
• Anti-money laundering
• Privacy

• Working with governments

• Complying with competition laws

• Fair employment
• Environment, health and safety
• Security and crisis management

• Intellectual property
• Controllership
• Conflicts of interest
• Insider trading & stock tipping

It is Krungsri’s belief that attaching importance to customers, treating them fairly, understanding their expectations and needs, including anticipating how to best respond with our innovative products and services will boost customers’ satisfaction, loyalty, and engagement with the Krungsri brand. As a result, Krungsri will be able to maintain and expand our customer base in the long term, thus becoming the main bank of customers who trust our services.

Krungsri aims to keep creating good customer experiences in accordance with our organization’s culture and our core value of ‘Customer Centricity’ which all employees prioritize and adhere to. Customer demands are analyzed and their expectations and given suggestions are regularly used to improve products and services to meet customer needs accurately and promptly for an excellent customer experience.

Management Approaches

• Determined the Krungsri Core Value of ‘Customer Centricity’ as part of the organization’s culture as well as the heart of our business operations in order to become customers’ number one preferred financial institution.
• Formulated the ‘Policy on Market Conduct’ for controlling market conduct management according to regulatory requirements. The policy serves as a guideline on providing fair services to customers for both the Bank and companies in the Financial Business Group, which are all obliged to comply with the policy and must refer to it as a guideline for formulating their own comparable policies unless there are more stringent legal or regulatory requirements imposed on each company. Moreover, the policy must be revised at least every two years or upon significant changes.
• Stipulated processes relating to selling and offering in an appropriate manner so as to not invade customers’ privacy. Customers shall receive complete, sufficient, and accurate key facts about products or services for their decision-making. This includes providing after sales information and services.
• Safeguarded customers’ data by being mindful of privacy and confidentiality. In this regard, disclosure of customer data to other parties must not violate the customer’s privacy, be it for marketing purposes or not (more details under the topic: Personal Data Protection).
• Training and communicating to all levels of customer service employees the importance of providing services fairly (more details under the topic Human Resources Development Re: Developing and Arranging Market Conduct Courses).
• Promote, communicate, and set standards so that all parts of the Bank realize and understand the Bank’s ‘Customer Complaint Resolution Process (CCRP)’ which covers not only the main contact channel ‘Krungsri Call Center 1572’ but also other channels such as the Bank’s branches, website, email, and fax. This is so that employees have a guideline to follow for handling customers’ complaints, compliments, and suggestions. All relevant business units must resolve any complaint within the time limit counting from the date that the complaint was received.
• Established the ‘Digi-care Contact Center’ team to collect customers’ complaints, compliments, and suggestions through the Bank’s social media channels, e.g., Facebook, Twitter, websites, email, or other online media such as the Pantip Webboard. At present, there is an upward trend in how customers contact us via online media. This team ensures that everyone’s voice is fully acknowledged, addressed, and taken care of by the responsible business unit in Krungsri. Replies and updates are sent to customers in the most appropriate, prompt, timely, and efficient manner.
• Stipulated the process of measuring customer satisfaction with a tool called ‘Net Promoter Score (NPS)’. Krungsri regularly measures customer satisfaction annually to keep track of interests, preferences, and opinions on the Krungsri brand. The NPS is another channel for listening to the feedback of customers, who are among the organization’s most important stakeholders, in order to satisfy their expectations and demands accurately.

Digital technologies and innovation play a greater role in human daily life. Therefore, consumer expectations and behaviors have changed where they tend to more rely on technology to access products and services to enhance efficiency and swiftness. Moreover, a number of leading corporates in various industries and financial service providers are putting an effort to adopt innovations and technologies to enhance operational efficiency and create good customer experiences such as artificial intelligence (AI), machine learning (ML), and distributed ledger technology (DLT) or blockchain, and Robotic Process Automation (RPA). At the same time, the potential of innovation and technology has been developed to cope with advanced cyberthreats which cause substantial damages at national and international levels.

As a responsible financial service provider, the Bank places importance on preventing theft of financial data and risks arising from cyberattacks to ensure we can mitigate threats related to data leakage, misuse and unauthorized use of personal data, and other cyber risks. Krungsri takes a serious approaches on cybersecurity to protect data of employees, customers, and relevant parties as well as to ensure business continuity including service provision.

Management Approaches

• Established ‘Enterprise Information Security Policy’ as a guideline to manage and protect IT data of the Bank and communicate with the Bank’s employees and other stakeholders such as counterparties, temporary employees, suppliers and vendors, and other external parties who need to use the Bank’s data to ensure that they acknowledge such policy and abide by the legal requirements and regulations related to this policy. Relevant actions were taken under three important frameworks such as maintenance of data confidentiality, integrity, and availability whereby the IT contingency plan was formulated. It is stipulated that the policy be applicable to the Bank and companies in the Financial Business Group (‘subsidiaries’) in which at least 50 percent of shares are held by the Bank where the subsidiaries are required to adopt this policy as a common guideline to formulate their own IT security policy. Moreover, the content is to be revised and updated at least once a year in line with the risk landscape and future trends that could impact the Bank’s IT security.
• Applied efficient security control measures starting from employment, transfer of position, or resignation procedures and informed the IT security system administrator in case of transfer of employees or computers
• Prepared a complete IT asset register and maintained IT assets on a regular basis to ensure availability to support the Bank’s business
• Performed information classification, maintained and destroyed the data according to its class, managed the cryptography and key management throughout the encrypted key usage period which are reliable and meet international standards
• Stipulated access management and verified user identity according to their access right, level of necessity, and the risk level to prevent access and system modification performed by unauthorized persons
• Provided the cybersecurity center and allocated the office area for key IT operations to prevent damage caused by cyberattack and natural disaster
• Managed irregular events and issues arising from the use of technology in an appropriate and timely manner where there was a record, analysis, and reporting of irregularity, problems, and rectification results to the Board of Directors for acknowledgement
• Formulated the IT contingency plan to enable the Bank to handle irregular incidents that caused system interruption and damage to ensure business continuity and timely system recovery
• Established ‘Information Technology Security Measures’ in order to be adopted as a measure to handle various situations in line with the ‘Enterprise Information Security Policy’ of the Bank. The measures covered 14 sub-topics as follows:
  1. IT security management measures
  2. Communication network security measures
  3. Organization-wide IT security structure measures
  4. IT operation security measures
  5. Personnel security measures
  6. System procurement and development measures
  7. IT asset management measures
  8. IT issue and irregularity management measures
  9. Data security measures
  10. IT contingency plan management measures
  11. Access control measures
  12. Third-party management measures
  13. Environmental and physical security measures
  14. Regulatory compliance security measures
• Established ‘Guidelines for Cybersecurity Incident Response’ to increase the Bank’ s capability to comprehensively maintain cybersecurity to prevent cyberthreats and support IT advancement including the phishing simulation exercise and the cyber tabletop exercise. An incident where the Bank was under cyberattack was simulated where officers from relevant functions were required to participate in the exercise to ensure that they knowledge and understand as well as were being familiar with the threat response process to ensure that they can handle cyberthreats in an efficient manner.
• Adopted domestic and international industry standards and applied best practices for the management of cyber and IT security in the organization such as the advanced persistent threat tool and cyberthreats intelligence tool from reliable sources to enhance capability for detecting irregular events which was a part of cyberthreat monitoring process performed by the Security Operations Center (SOC), Society for Worldwide Interbank Financial Telecommunications (SWIFT), compliance with ISO 27001 Certification, Information Security Management System (ISMS) in two different systems including the Bank of Thailand Automated High-value Transfer Network (BAHTNET) for major funds transfer transactions and Imaged Cheque Clearing and Archive System (ICAS) according to the BOT’s requirements, and other relevant actions to strengthen cybersecurity standards.
• Provided a channel to report the receipt of phishing mail, malware, computer virus, and other regularities caused by cyberattack to the Cyber Security Department

We are currently in the era of rapid technology advancement, incurring risks on infringement of privacy rights in the process of data collection, data utilization, disclosure of personal data of stakeholders— customers in particular. Therefore, the Bank emphasizes the appropriate management of personal data such as general personal data, financial transaction data, and customer behavior data in terms of the use of products and services. We always realize that winning trust and earning confidence from customers and stakeholders who use our products and services are truly priceless. Also, the storage of customer and stakeholder information in a secure and appropriate manner help boost the Bank’s credibility, reputation, and good image.

In this connection, the management of privacy and security of customer and stakeholder data is considered as compliance with legal requirements and relevant regulations including the Personal Data Protection Act B.E. 2562 (2019) which will go into effect in 2020. Therefore, Krungsri has regularly reviewed the policies and personal data protection measures to protect the rights of data owners as required by laws.

Management Approaches
Data quality management

• Established the ‘Data Governance Committee’ responsible for supporting the strategic plan of Bank of Ayudhya regarding information management to ensure correctness and accuracy. This is to strengthen the capability to access customer needs, offer tailor-made products and services to each customer, and issue a report in a correct manner in line with the requirements of external regulatory authorities, financial management, and enterprise-wide risk management.
• Established the ‘Data Governance Department’ responsible for stipulating the operating practices and data management standards through the ‘Data Management Governance Policy’. The Department is tasked with overseeing the Bank’s transactions throughout the entire processes starting from data input, management, analysis, and report insurance to ensure correctness and completeness. The said policy shall be applicable to the Bank, directors, executives, employees, and individuals and juristic persons performing tasks on behalf of the Bank such as outsourced staff whereby all these groups of stakeholders shall strictly comply with the said policy. In this connection, the policy shall be updated every two years or upon any significant change.
• Encouraged the establishment of ‘Key Data Elements (KDEs)’–a key data for customer services, risk and financial reports, and reports submitted to the relevant regulatory authorities
• Established ‘the process to review and improve data quality in a sustainable manner’ by focusing on five principles consisting of accuracy, correctness and completeness, compliance with relevant standards, alignment, and non-redundancy. Also, the roles and responsibilities of relevant persons regarding data management were stipulated under the concept of ‘Three Lines of Defense’ to ensure that all functional units of the Bank have in place data management and supervision guidelines.

Three Lines of Defense

• First Line of Defense; refers to business and supporting functions.
• Second Line of Defense; refers to the Data Governance Committee and the Data Governance Department.
• Third Line of Defense; refers to the Internal Audit Group.

Management of private information

• Established ‘Privacy Policy’ with the following objectives
  • To protect privacy of individuals with particular attention on ‘personal information’ of customers, business partners, employees and directors of the Bank.
  • To enhance employees’ understanding of the Privacy Policy with respect to acquisition, use, disclosure and storage of personal information in a responsible manner; to prevent violation of laws; to protect the Bank’s reputation, credibility and image.
  • To prevent conflict of interest as a result of the acquisition, use and disclosure of personal information; in this connection, the said policy shall be applicable to the Bank, companies in the financial business group, and overseas branches. Also, companies in the financial business group and overseas branches shall adopt this policy as a guideline to formulate their comparable policies, criteria, and operating process except for having other stricter and more comprehensive policies and regulations. The said policy shall be reviewed every two years or once any significant change is made.
  • Established the scope of applications and disclosure of personal data under the requirements of the Bank under the scope of legal application; usage and disclosure of information must be in line with the objectives and intention of the data owner. Moreover, the said ‘Privacy Policy’ must be updated once the Personal Data Protection Act B.E. 2562 has come into force in 2020.

Krungsri Group places importance on managing the relationships between the Bank and/or companies in the Financial Business Group, and vendors of goods and/or services, or ‘suppliers’, including sustainable supply chain management through establishment of the common standards of fair treatment of suppliers, including service providers, intermediaries, and agents for equality, fairness, and non-discrimination. All suppliers are managed and encouraged to adopt their corporate governance guidelines, while strictly complying with regulatory requirements related to self-governance and responsibly undertaking business by taking social and environmental issues into account.

Sustainable supply chain management promotes business continuity of Krungsri Group toward our set goals. It does not only reduce the risk of business interruption due to economic, social, and environmental impacts but also enhances cost management efficiency. In addition, the cooperation between Krungsri Group and vendors or suppliers in the development and creation of innovative financial products and services helps promote the flexibility of the domestic economy and finance system as well as transparency, thoroughness, and equality—eventually lead to sustainable supply chain management.

Management Approaches

• Establish the ‘Supplier Code of Conduct’ as a guideline to encourage all suppliers to adopt corporate governance guidelines and code of conduct standards in the same fashion as Krungsri Group did, particularly regulatory requirements related to their respective corporate governance guidelines, such as laws regarding countering all forms of direct and indirect bribery and corruption, and laws regarding human rights and labor, workplace well-being and safety. They are also encouraged to undertake their business responsibly taking into account impacts on social and environmental aspects. Therefore, Krungsri and companies in the Financial Business Group, as well as suppliers, can sustainably thrive together.
  
  In this regard, the Bank communicated with all suppliers about the 'Supplier Code of Conduct' through our website (www.krungsri.com), including notifying them about the statements and The Spirit and The Letter, Environmental Disclosure Statement, and Human Rights Disclosure Statement, as well as social and environment responsibility with active suppliers through e-mail for their compliance. This is to encourage all suppliers to adhere to the same practices, in a similar manner to Krungsri Group.
    The Supplier Code of Conduct covers four main aspects, namely:
  Business code of conduct

  Workplace well-being
  and safety

  Human rights and labor

  Environment


• Establish the ‘Supplier Relationship Policy’ as a guideline to promote governance and ensure that they are treated and managed in a prudent manner and not against laws, other internal policies, and procedures. The Policy helps foster relationships between Krungsri Group and vendors or suppliers so that the business activities can be carried out in an efficient and fair manner. Krungsri Group expects that the vendors or suppliers acknowledge and comply with the Policy as well.


• Formulate supply chain management strategies, with sub-strategies including increasing productivity and efficiency strategies to align with the Bank's Medium-Term Business Plan. The supply chain management strategies consist of:
  1. Supplier management: To ensure fairness and transparency and reduce risks arising from procurement activities.
  2. Cost management: Manage limited or multiple suppliers in the market, outsourcing services, and centralized procurement.
  3. Use of technology for procurement activities: Develop tools or software to support procurement activities such as e-bidding software, developing AI systems for supplier identity verification etc.
  
  You can read more information from https://www.krungsri.com/th/esg/sustainable-banking/esg/governance > Supply Chain Management > PDF: Supply Chain Management Strategies


• Stipulate ‘a fair supplier selection process’ with a focus on conducting procurement activities with honesty, transparency, fairness, and accountability, in accordance with good corporate governance principles and best practices, by promoting and providing equal opportunities to all partners in conducting businesses with Krungsri Group. This also included small enterprises, those of the underprivileged, minority groups, females, disable veterans, etc., who are business owners to compete in offering products and/or services in order to gain a share of the Bank's purchase volume and take into account environmentally responsible procurement to enhance business operations in parity with related standards and reduce adverse social and environmental impacts.
   
  Supplier Selection Process

  Step 1

  Consider the appropriate bidding method to ensure transparency such as bidding through electronic systems (e-Auction)

  

  

  Step 2

  Establish a taskforce comprising representatives from related business units, and experts or specialists to select suppliers

  

  

  Step 3

  Consider the verification results of suppliers’ information before engaging in transactions with them, such as Know Your Customer (KYC), transactions that may have conflicts of interest, and other relevant factors of all suppliers

  

  

  Step 4

  Evaluate suppliers by the functions using such service after the service is completely delivered by filing out the Supplier Performance Evaluation Form

  

  

  Step 5

  Provide whistleblowing channels for suppliers


• Established Green Procurement, Krungsri Group has implemented green procurement practices by establishing social and/or environmental criteria as selection criteria for suppliers. These criteria are specified in the Request for Quotation Form (RFQ) and the Request for Proposal Form (RFP). The same criteria are used to evaluate both active and new suppliers.


• Establish appropriate ‘credit terms’ for suppliers, with an average of 45 days, depending on the agreements between the Bank and the suppliers. This also includes establishing practices to stipulate payment terms to suppliers, categorized by the characteristics of products and/or services provided, as follows:
  • Utility and government agency suppliers: Payment within 15 days
  • Tourism and commission-based suppliers: Payment within 15 days
  • Other suppliers: Payment within 45 days
  
  The payment period is counted from the date the supplier submits a complete and accurate invoice that meets Krungsri Group's conditions.


• Established the procedure on ‘Know Your Customer and Customer Due Diligence of the Third Party’, requiring that all suppliers be verified to prevent making transactions involving conflicts of interest. Criteria have been clearly defined such as Related Party Transactions (RPT), Supplier Risk Assessment, or criteria for certain outsourced suppliers that could impact business continuity, as well as compliance with the Bank's Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) policy and Anti-Bribery and Anti-Corruption policy and measures.


• Require that risk assessments be conducted on suppliers, both new and existing, in terms of their economic situation as well as environmental, social and governance (ESG) risks, according to specified evaluation or review criteria and through various channels such as questionnaires, business status verification, and supplier evaluations.


• Formulate agreements to uphold and safeguard the confidentiality and proprietary information of Krungsri Group while Krungsri Group is also obliged to protect suppliers' information as stipulated in confidentiality agreements. Furthermore, notifications regarding personal data protection have been disseminated through email and the website (krungsri.com) to active suppliers, seeking their acknowledgment and compliance with the Personal Data Protection Act B.E. 2562 (PDPA).


• Conduct ‘Supplier Classification’ to ensure that Krungsri Group can continually deliver customer services by grouping suppliers as follows:
  • Critical vendors refer to vendors or suppliers that are highly crucial to Krungsri Group's operations. There may be one or a limited number of critical vendors or suppliers. Their inability to provide services to the Bank could result in significant harm to the Bank's business.
  • Significant vendors refer to vendors or suppliers involved with specialized products and/or services. The nature of work is complex, and while it is possible to find replacement partners, it may take time to procure them. Therefore, this could impact business operations.
  • General vendors refer to common vendors or suppliers. If they are unable to offer services to the Bank, it will not result in any harm to the Bank's business.


• Communicate to suppliers about the Anti-Bribery and Corruption Program, covering all forms of bribery and corruption, both directly or indirectly, and become members of the Thai Private Sector Collective Action Against Corruption (CAC Recertification), as well as invite vendors or suppliers to join such anti-corruption organization. The Bank also specified and communicated about the Procedure for Gift and Entertainment.

Performance
 
Supply Chain Management Strategy