(Reuters) - Australia and New Zealand Banking Group <ANZ.AX> needs to improve internal risk controls at its New Zealand unit, the Reserve Bank of New Zealand (RBNZ) said on Thursday, citing an external report conducted by Deloitte that was ordered after the departure of the bank's country manager.
New Zealand's largest bank came under fire this year after its license to calculate its own operational risk capital was revoked and when its then Chief Executive Officer David Hisco abruptly left the bank after an expense scandal.
The central bank said ANZ needs to improve its director attestation process at the New Zealand unit and asked for another external report by June 2021 to review whether the bank had implemented all recommendations of the report filed by Deloitte.
"We're committed to implementing all the recommendations by the time of the next section 95 review in 2021," said John Key, the chairman of ANZ's New Zealand unit.
Australian lenders are under pressure both at home and in New Zealand following the fallout of a series of damaging revelations, leading to increased scrutiny by regulators.
In a statement, Reserve Bank Deputy Governor Geoff Bascand said it was worrying that Deloitte found a level of complacency in ANZ's historical approach to the attestation process.
"While we acknowledge ANZ's work over the recent months to improve its framework and the attention these matters are now receiving, more is required," Bascand added.
One of the concerns that RBNZ raised when it ordered the report was the sale of a property by an ANZ unit to Hisco's wife. The Deloitte report came to the conclusion that the sale did not breach ANZ policies.
A second RBNZ-requested report is set to be completed in February next year, the central bank said.
The Deloitte report also found "a number of in-use but unapproved credit models" in November during its review. RBNZ had been informed of those by both itself and ANZ, Deloitte said.
The findings show a "historically complacent approach", a lack of a compliance plan, diffused accountability and inadequate assurance processes as factors behind the persistent breaches, the report said.
(Reporting by Nikhil Kurian Nainan in Bengaluru; Editing by Muralikumar Anantharaman; Editing by Sam Holmes & Simon Cameron-Moore)
