Policy Rule on Principles for the Implementation of Pillar 2 of the Basel II Capital Accord

Transcription

1 DE NEDERLANDSCHE BANK N.V. Policy Rule on Principles for the Implementation of Pillar 2 of the Basel II Capital Accord Policy Rule of De Nederlandsche Bank N.V. of [xx], no. [xxx], providing principles for the evaluation as referred to in Section 3:18a of the Financial Supervision Act (Wet op het Financieel Toezicht) of the ICAAP (Internal Capital Adequacy Assessment Process) of banks and investment firms (Policy Rule on Principles for the Implementation of Pillar 2 of the Basel II Capital Accord)

2 Policy Rule on Principles for the Implementation of Pillar 2 of the Basel II Capital Accord 1. INTRODUCTION Under Section 3:17 of the Financial Supervision Act (Wet op het Financieel Toezicht, hereinafter referred to as the FSA ), a bank or investment firm as referred to in Sections 3:17(1) and (3), 3:22 or 3:23 of the FSA1, hereinafter collectively referred to as institutions, will have robust, effective and comprehensive strategies and processes in place which it uses to monitor and ensure on a continuous basis that the size, composition and distribution of its own funds are proportionate to the size and the nature of its current and possible future risks. Under Section 3:18a of the FSA, these strategies and processes, hereinafter referred to as the ICAAP (Internal Capital Adequacy Assessment Process) will be evaluated periodically by De Nederlandsche Bank (DNB). Key to this evaluation, also referred to as the SREP (Supervisory Review and Evaluation Process), is the dialogue between the institution and DNB. The principles that DNB applies in its execution of the SREP are set forth in paragraph 2 of this Policy Rule. Principle 1 applies to DNB s application of the ICAAP guidelines established by the Committee of European Banking Supervisors (CEBS), Principle 2 to the performance of DNB s evaluation of the ICAAP on a consolidated basis, Principle 3 to DNB s recognition of diversification effects in this evaluation, Principle 4 to the confidence interval that DNB applies in its evaluation of the ICAAP, and Principle 5 to the data that DNB needs at a minimum for its evaluation of the ICAAP. 1.1 Definitions o ICAAP capital: the own funds as referred to in Section 24a of the Decree on Prudential Rules under the FSA (Besluit prudentiële regels WFT, hereinafter referred to as the Decree ), which in the institution s opinion are necessary to cover present and possible future risks in a sustainable and controlled manner. o SREP capital: the capital required that DNB, based on its evaluation as referred to in Section 3:18a of the FSA, deems necessary to cover the present and possible future risk of that institution in a sustainable and controlled manner. o Pillar 1 capital: the capital required as referred to in Section 3:57 of the FSA. 1 These are understood to be banks or investment firms with registered offices in the Netherlands, investment firms with registered offices in a non-member State which provide investment services in the Netherlands, and banks with registered offices in a non-member State which conduct their business from a branch situated in the Netherlands. 2

3 1.2 Legal framework Section 3:18a(1) of the FSA stipulates that DNB periodically evaluates the strategies, procedures and measures (ICAAP) which institutions have introduced pursuant to Section 3:17 of the FSA. Further details of the ICAAP are provided in Section 24a of the Decree2 and further details of the SREP are provided in Section 25a of the Decree. Based on the outcome of its evaluation, DNB may take measures under Section 3:111a of the FSA, including the requirement that the institution concerned maintains a higher capital (SREP capital) than that laid down under Section 3:57 of the FSA (Pillar 1 capital), or that the institution, in connection with solvency requirements, pursues a specific policy with regard to provisions. DNB s power in this regard is without prejudice to the powers it has pursuant to the provisions set out in Part 1 of the FSA, including the power to give an instruction to an institution if it does not comply with the provisions laid down under or pursuant to the FSA, as well as an instruction if DNB detects signs of a development that may jeopardise the own funds, solvency or liquidity of that institution. Pursuant to Section 1:29a, opening words and under (d), of the FSA, DNB will make public the general criteria and methods on the basis of which it conducts the SREP as referred to in Section 3:18a of the FSA. This purpose is partly served by this Policy Rule. 1.3 Scope of the ICAAP and the SREP Under Section 24a(1) of the Decree, the ICAAP will be applied by an institution as referred to in Section 23(2), second sentence, of the Decree. This provision refers to the bank or investment firm as referred to in Sections 3:17(1) or (3), 3:22 or 3:23 of the FSA3. The scope of application of the ICAAP corresponds with the scope of application of the Pillar 1 solvency requirements4. In other words, the institutions which are subjected to individual or (sub- )consolidated solvency supervision under Pillar 1, must in principle also have an ICAAP in place. Hence, an institution not subjected to these solvency requirements need not apply the ICAAP provisions. This does not alter the fact that such institution, in the event that it is a party to the (sub-) consolidated supervision of its parent institution, will always be involved in the ICAAP that the parent institution applies on a (sub-)consolidated basis. As regards investment firms, Section 3 of the Decree stipulates that Pillar 1 supervision does not fully apply to investment firms which, solely as an investment service, receive and transmit 2 Decree on Prudential Rules under the FSA (Besluit prudentiële regels Wft) (Staatsblad (Bulletin of Acts and Decrees) 2006, No. 519), as amended by the Decree on the Implementation of the Basel II Capital Accord (Besluit Implementatie Kapitaalakkoord Bazel 2) (Staatsblad (Bulletin of Acts and Decrees) 2006, No. 662). 3 For a further description see footnote 1 to this Policy Rule. 4 For financial institutions which are governed by the transitional arrangement under the regulations implementing the Basel II Capital Accord and which will therefore be subject to the new rules of this Accord only with effect from 1 January 2008, such correspondance between Pillar 1 and Pillar 2 follows from Section II of the Act on the Implementation of the Basel II Capital Accord (Wet Implementatie Kapitaalakkoord Bazel 2) (Staatsblad (Bulletin of Acts and Decrees) 2006, No. 613), in conjunction with Section VIII(2) of the Decree on the Implementation of the Basel II Capital Accord (Besluit Implementatie Kapitaalakkoord Bazel 2) (Staatsblad (Bulletin of Acts and Decrees) 2006, No. 662). 3

4 client orders in regard of financial instruments, or give advice on financial instruments. All other institutions, including those which trade solely for the account of clients (agents), or those which whether or not under the responsibility and guarantee of a clearing institution - trade for their own account (principals), as well as managers of individual portfolios who are not involved in trading per se but who solely transmit orders for the account of their clients, will in principle be subject to Pillar 1 requirements and, in that respect, to the ICAAP provisions, i.e. Pillar 2 supervision. While the formal scope of Pillar 2 supervision is thus similar to that of Pillar 1 supervision, DNB will focus its assessment in principle on the ICAAP on a consolidated basis. A factor of consideration here is that institutions have usually centralised their capital adequacy process. In addition, the focus on a consolidated ICAAP contributes to the proportionate application of the relevant provisions. 1.4 Application of the ICAAP and the SREP Proportionate application of the provisions of the FSA means that in applying the SREP, account is taken of the nature, scale and complexity of the institution s business. DNB s assessment of an institution s compliance with applicable standards will be based on the guidelines established by the CEBS 5. While DNB expects that a large institution whose business is complex will have, in principle, an economic capital model in place, a smaller institution whose business is relatively simple can make do with a more basic ICAAP 6 implementation. For this category of smaller institutions, DNB relies on the Paper on the Internal Capital Adequacy Assessment Process (ICAAP) for Smaller Institutions, published by the CEBS on 27 March This document has no official status, however, and the principles set out in this document cannot be designated as CEBS guidelines. A list of the CEBS guidelines and the above-mentioned paper on the ICAAP for smaller institutions are included in the Annex to this Policy Rule. The full text of the CEBS documents is available on the CEBS website ( except for the paper on the ICAAP for smaller institutions, the full text of which is available on the DNB website ( Whether an institution can be designated as a smaller institution depends on DNB s assessment of the nature of the institution s business. Factors influencing this assessment are: the nature of the activities, the complexity of such activities and/or the extent to which the activities are confined to a limited number of types of financial instruments or investment services. The institution s market share, its use of internal models and the extent of its cross- 5 In this Policy Rule, the following CEBS guidelines have been taken into account: - Guidelines on the application of the Supervisory Review Process under Pillar 2 of 25 January 2006; - Technical aspects of stress testing under the supervisory review process of 14 December 2006; - Technical aspects of the management of interest rate risk arising from non-trading activities under the supervisory review process of 3 October 2006; and - Technical aspects of the management of concentration risk under the supervisory review process of 14 December For more information on the application of the proportionality principle, reference is made to ICAAP guideline No 9 of the CEBS, included in the Guidelines on the application of the Supervisory Review Process under Pillar 2 of 25 January

5 border activities also play a role. It should be noted that investment firms will, in principle, be regarded as small institutions. ICAAP The ICAAP captures all material risks to which an institution is exposed. The institution uses a risk identification process to demonstrate which risks are incorporated in the ICAAP and which are not. A non-exhaustive list of the risks assessed by an institution is given below7: 1. Pillar 1 risks: credit, market and operational risks; 2. risks not sufficiently covered under Pillar 1: securitisation risk, residual risk arising from the application of credit risk mitigation techniques; 3. risks under Pillar 2: interest rate risk in the banking book, concentration risk, reputation risk, pension risk; 4. the impact of external factors: economic environment factors, stress testing results.8 The ICAAP is embedded in the organisational structure, is risk-based, comprehensive and forward-looking, and it therefore also includes an assessment of future capital adequacy. If this assessment points to future capital inadequacy, the institution must take timely and effective measures to ensure capital adequacy into the future. Stress testing is an essential instrument for the assessment of an institution s future capital adequacy and is therefore incorporated in the ICAAP. 9 The institution will be able to show which capital consequences would arise under exceptional but plausible circumstances, and the institution will have a contingency plan by which to maintain capital adequacy in these circumstances. Stress testing is an integral part of the institution s operational management, and the outcome of stress tests is used in formulating strategic objectives. This does not alter the fact that stress testing can also be usefully applied for other purposes, for instance in the context of parameter estimation. With due regard for the proportionality principle and as part of the SREP, DNB evaluates the quality of stress testing within an institution. Factors used in the assessment are the plausibility and conservatism of the scenarios that are applied, the extent to which these scenarios are appropriate for the nature, scope and complexity of the institution s business, the manner in which these scenarios are set up and translated into capital consequences as well as the adequacy of procedures and measures to safeguard adequate capitalisation if such scenarios were to take place. The guidelines on ICAAP stipulate, among other things, that the ICAAP is the responsibility of every financial institution, that the ICAAP s design must be fully specified, must be an integral part of the management process, and must be risk-based, comprehensive and forwardlooking. As regards the latter, ICAAP 8 specifies that the ICAAP 'should take into account the institution's strategic plans and how they relate to macroeconomic factors. The institution should develop an internal strategy for maintaining capital levels which can incorporate factors such as loan growth expectations, future sources and uses of funds and dividend policy, and 7 See also Section 25a of the Decree. 8 Reference is made to the quantitative analysis template in the Open Book, under Supervision on DNB s website. 9 Section 1 of the Decree on Prudential Rules under the FSA (Besluit prudentiële regels Wft) defines stress testing as: investigating the risks that arise if or when changes in market conditions occur that have an adverse effect on the capital adequacy of a financial institution, and the risks that arise if security rights are exercised in crisis situations. 5

6 any procyclical variation of Pillar 1 minimum own funds requirements. And, furthermore, that 'the institution should have an explicit, approved capital plan which states the institution's objectives and the time horizon for achieving those objectives, and in broad terms the capital planning process and the responsibilities for that process. The plan should also lay out how the institution will comply with capital requirements in the future, any relevant limits related to capital, and a general contingency plan for dealing with divergences and unexpected events'. A financial undertaking is free to review its capital objectives. If a financial undertaking decides to reduce its internal capital objectives, it must inform DNB of this in a timely manner, as the SREP is geared to an institution s internal capital objectives. If the undertaking fails to realise the said objectives, or if failure to do so seems likely, the undertaking should inform DNB. This will provide DNB with an opportunity to assess, in consultation with the undertaking, whether developments give cause to reconsider the outcome of the evaluation process or to conduct a fresh evaluation. Evaluation by DNB: the SREP DNB s evaluation process aims to arrive, through dialogue with the institution, at a shared view on the size, composition and distribution of the available or ICAAP capital that is appropriate for the size and the nature of its current and possible future risks. Additional capital in excess of Pillar 1 capital may be required as a (temporary) adjustment for incorrect risk modelling or as an adjustment for general control deficiencies. Additional capital may also be in order if an institution incurs material risks that have not yet been or cannot yet be translated in terms of capital, or in the case of diversification benefits that cannot (as yet) be taken into account. Expectations are that only in a limited number of cases will DNB s evaluation lead to higher solvency requirements being imposed. This is because many institutions already live up to the expectation as laid down under Pillar 2 that they, of their own accord, will hold capital in excess of the minimum solvency requirements under Pillar 1. This expectation results from the fact that, under ICAAP, risks are covered that are outside the scope of the solvency requirements under Pillar 1. DNB will notify the institution in writing of the outcome of its evaluation. In the event that DNB does not agree with the outcome of the institution s ICAAP, or if DNB is of the opinion that the institution s strategies, procedures and measures or the capital maintained by the institution do not guarantee a controlled and sustainable coverage of the risks involved, will DNB specify additional measures which the institution must take or the extent to which its solvency requirements are to be raised. If appropriate, DNB will provide a reasoned list of deficiencies it has encountered in the institution s measures, strategies and procedures under ICAAP, while stating the measures to be taken by the institution, including the timeframe within which these measures are to be effected so as to comply with the provisions of Section 3:17 of the FSA to ensure a controlled and sound operational management of the institution. Pursuant to Section 3:111a of the FSA, DNB may require the institution to maintain a higher amount of capital (SREP capital), if DNB deems the ICAAP capital to be inadequate in the light of the institution s current and possible future risks, and if other measures cannot 6

7 reasonably ensure that the said provisions with respect to a controlled and sound operational management of the institution are satisfied within a reasonable timeframe. 2 PRINCIPLES FOR THE APPLICATION OF THE ICAAP AND THE SREP Principle 1: DNB bases its evaluation of a financial institution s ICAAP on the guidelines established for that purpose by the CEBS. The CEBS has agreed on standards for the assessment of the ICAAP and on principles in the application of the SREP 10. These agreements have been set down in guidelines which concern supervisory expectations regarding the application of the ICAAP (see, respectively, Section A of the Annex to this Policy Rule and for smaller institutions, Section D), supervisory expectations regarding the application of stress testing (Section B of the Annex), the set-up of the SREP (Section C), supervisory expectations regarding the control of concentration risk (Section F) as well as the control of interest rate risk arising from non-trading activities (Section E of the Annex). DNB will base its application of the SREP on these agreements.11 Principle 2: DNB evaluates the ICAAP representing the institution s position on a consolidated basis unless special circumstances require DNB to carry out its evaluation on an individual or (sub- ) consolidated basis Under the FSA, the scope of the ICAAP follows that of the Pillar 1 requirements. Because institutions usually meet these requirements on a consolidated basis and have centralised their capital adequacy process, DNB will carry out an evaluation of the ICAAP that represents the institution s position on a consolidated basis. Irrespective of the level at which DNB carries out its evaluation, the proportionality principle plays a prominent role in determining the depth of DNB s evaluation. As regards the proportionality principle, the following criteria will be considered: the institution s size, both in absolute terms and in proportion to the Dutch financial system; the institution s risk profile; the ratio between the capital which DNB deems necessary on the basis of its evaluation, and the institution s actual own funds; the closer the ICAAP capital is to the actual own funds, the greater the probability of a deficit and the greater the depth of the evaluation; for entities that form part of a domestic group: the degree of integration with the parent institution and the quality of the group ICAAP ; for entities that form part of a foreign group: the degree of integration with the (foreign) parent institution, the quality of the ICAAP at that level, and the quality of the supervision exercised over the parent institution. The more equivalent the supervision of the parent institution is to that of the subsidiary and the easier the exchange of 10 See paragraph 1.4 of this Policy Rule. 11 Notwithstanding the fact that DNB applies all CEBS guidelines, hence also the guidelines for supervisory authorities, the Annex to this Policy Rule includes with the exception of the SREP guidelines only the guidelines with respect to financial institutions. 7

8 information with the (foreign) supervisory authority concerned, the lower the intensity of DNB s evaluation can be. Further to the last two factors, it may be added that DNB expects at any rate that the management of the subsidiary will be able to demonstrate that its available capital is adequate in relation to its risk profile. Principle 3: DNB may take account of diversification effects in its capital adequacy assessment provided that, irrespective of the amount of own funds that is required on the basis of the ICAAP, the minimum amount of capital is determined by the capital required as referred to in Section 3:57 of the FSA. Diversification takes place at several levels, i.e.: a) within risk categories (intra-risk diversification); b) between risk categories (inter-risk diversification); c) between legal entities; and d) between sectors. These different levels of diversification may be specified as follows: Sub a: intra-risk diversification The solvency requirements for credit risk under Pillar 1 are designed for large, well-diversified institutions and implicitly recognise diversification within the lending portfolio of these institutions. In cases where the lending portfolio is less well-diversified than is assumed in these solvency requirements, DNB expects this to be reflected in the ICAAP of the institution concerned. Consequently, both a concentration of exposures to countries or economic sectors and a relatively small number of counterparties also known as low granularity can create additional capital needs. Sub b: inter-risk diversification In assessing the outcome of an institution s ICAAP, DNB may also take diversification benefits between risk categories into account, i.e. in the context of its evaluation, DNB accepts that the total own funds deemed necessary on the basis of the ICAAP is below the sum of its parts for the individual risks. Whether DNB recognises diversification effects will depend on the arguments presented by the institution, that is, on whether DNB regards the institution s own analyses as sufficiently reliable. Aspects considered in DNB s assessment include the following: The empirical underpinning of diversification effects and the inherent measurement uncertainty. The manner in which possible changes in the correlation between risks under stress conditions are taken into account. The manner in which the models used and their results are applied internally. The more simplified the institution s risk management methods are relative to the size and complexity of its business, the more conservative DNB will be in recognising diversification benefits. DNB expects that institutions which opt for the recognition of diversification effects, have the explicit ambition to improve, in time, the quantification of these effects. The extent to which analyses are based on conservative assumptions, and the quality and results of the sensitivity analyses performed. 8

9 Sub c: diversification between legal entities Furthermore, in its evaluation, DNB takes account of diversification between entities within a consolidated base, provided the institution concerned is able to demonstrate convincingly that the group s capital is available in time for entities that need it, i.e. it should be demonstrated that no material obstacles impede the transferability of capital between the group entities. At least the following factors play a role here: i. Possible speed and ease of payment; ii. Third-party involvement/interests in the subsidiary concerned; iii. Distribution of capital within the group; iv. Possible tax problems; v. Possible currency restrictions; vi. Availability of readily convertible assets at the subsidiary concerned; vii. Influence of supervisory and regulatory requirements; viii. Whether the subsidiary s objectives provide for the transferability of capital; ix. Whether the legal structure of the parent institution or the subsidiary provides for transferability; x. Whether contractual agreements with the parent institution or with third parties provide for transferability; xi. Track record and expectations regarding the possibility of transferability; and xii. The extent to which the parent institution applies solo consolidation. Sub d: diversification between sectors In assessing the outcome of the ICAAP of a financial conglomerate, DNB will not take into account possible diversification benefits between banking and insurance activities that arise because a bank (which is subject to Pillar 2) is a subsidiary of an insurer or of a non-regulated holding company that also owns an insurance subsidiary. Principle 4: DNB s evaluation of the capital adequacy of an institution is based on a confidence level of at least 99.9 per cent, over a one-year horizon. The amount of capital which an institution needs as a buffer against risks depends in part on its risk appetite as reflected, for instance, in a rating target. An important consideration underlying DNB s decision to base its capital adequacy assessment on scaling the ICAAP capital to a confidence level of at least 99.9 per cent, is that a 99.9 per cent confidence level also underlies the minimum solvency requirements under Pillar 1. Furthermore, scaling promotes evaluation consistency, both between institutions and between the outcome of the Pillar 1 solvency requirements and the ICAAP capital. DNB explicitly does not interfere with the institution s strategic choices as regards risk profile or rating ambition. Scaling requests are to be made as part of the dialogue between DNB and the institution in the context of DNB s evaluation. Scaling in the aforementioned sense does not apply to institutions which do not use internal models. This does not alter the fact, however, that these institutions, too, must be able to demonstrate that their capital calculations are adequate. Principle 5: To evaluate an institution s ICAAP, DNB must receive adequate information concerning at least: 9

10 a. The manner in which the ICAAP has been integrated into the institution s management process; b The manner in which the capital adequacy policy has been set up; c. The manner in which senior management is involved in the ICAAP; d. Which present and future risks have been identified by the institution; e. How has the institution s risk profile been translated into the required own funds; f. How has stress testing been taken into account; g. How is the ICAAP assessed internally, and with what frequency; h. Which amount of own funds is deemed necessary by the institution to cover present and possible future risks; i. Which amount of own funds has been allocated to each of the identified material risks and which amount of own funds is eliminated because of diversification effects; j. What are the main arguments put forward to explain any significant differences between the minimum capital required as referred to in Section 3:57 of the FSA and the own funds which the institution, based on the outcome of the ICAAP, allocates to the risks covered by the provisions of Section 3:57 of the FSA; k. Where a group is concerned, how have the actual own funds been distributed over the main entities of the group and what is their proportion to the capital required as referred to in Section 3:57 of the FSA and the own funds deemed necessary for these entities on the basis of the ICAAP. Every institution which is obliged to carry out the ICAAP, will provide the above-mentioned information to DNB to serve as a starting point for DNB s evaluation. The form and timing of the provision of such information will be determined in consultation with DNB. Institutions will report regularly on the (more easily measurable) Pillar 2 risks concentration risk and interest rate risk in the banking book by using the appropriate forms annexed to the Regeling staten financiële ondernemingen (regulation on statements of financial institutions). The ICAAP assessment will be updated at least once a year. 10

11 3 FINAL PROVISIONS This Policy Rule will be cited as the Policy Rule on Principles for the Implementation of Pillar 2 of the Basel II Capital Accord. This Policy Rule will be published on the website of De Nederlandsche Bank N.V. ( Notice of this publication will be given in the Staatscourant (Government Gazette). Amsterdam, [date] 2007 De Nederlandsche Bank N.V. Prof. A. Schilder, Executive Director 11

12 Annex to the Policy Rule on Principles for the Implementation of Pillar 2 of the Basel II Capital Accord CEBS GUIDELINES ON ICAAP AND SREP Introduction and Table of Contents This Annex contains a summary of the Guidelines of the Committee of European Banking Supervisors (CEBS) for the Internal Capital Adequacy Assessment Process (ICAAP) to be drawn up by banks and investment firms, and for the evaluation of the ICAAP to be carried out by the supervisory authority concerned (DNB), which evaluation is referred to as the Supervisory Review and Evaluation Process (SREP). This Annex is made up of the following Sections: Section A. Section B: Section C: Section D: Section E: Section F: CEBS Guidelines on ICAAP CEBS Guidelines on Stress Testing (ST) CEBS Guidelines on SREP CEBS Guidelines on Smaller Financial Institutions CEBS Guidelines on the Management of Interest Rate Risk on Non-Trading Activities CEBS Guidelines on the Management of Concentration Risk 12

13 Section A. CEBS Guidelines on ICAAP Explanatory note: DNB will apply the Guidelines listed below when assessing an institution for compliance with ICAAP standards. The basis for DNB s assessment is provided by Sections 20 and 21a of the Decree on Prudential Rules under the FSA (Besluit prudentiële regels WFT), in conjunction with the principle that the standards set out in that Decree will be applied proportionally. ICAAP 1: ICAAP 2: ICAAP 3: Every institution must have a process for assessing its capital adequacy relative to its risk profile (an ICAAP). The ICAAP is the responsibility of the institution. The ICAAP s design should be fully specified, the institution s capital policy should be fully documented, and the management body (both supervisory and management functions) should take responsibility for the ICAAP. ICAAP 4: The ICAAP should form an integral part of the management process and decision making culture of the institution. ICAAP 5: ICAAP 6: ICAAP 7: ICAAP 8: ICAAP 9: The ICAAP should be reviewed regularly. The ICAAP should be risk-based. The ICAAP should be comprehensive. The ICAAP should be forward looking. The ICAAP should be based on adequate measurement and assessment processes. ICAAP 10: The ICAAP should produce a reasonable outcome. 13

14 Section B: CEBS Guidelines on Stress Testing (ST) ST1. ST2. ST3. ST4. ST5. ST6. ST7. ST8. ST9. The Guidelines on Stress Testing will be applied to all institutions taking into account their size, sophistication and diversification. In line with one of the principles listed in the CEBS Guidelines on the Supervisory Review Process (ICAAP 7) institutions should identify their material risks. In general, institutions should conduct stress tests on all the risks they have identified as material. Based upon the identification of material risks, institutions should derive material risk factors that should be subject to stress testing. Depending on their situation, institutions should consider historical and/or hypothetical scenarios. Stress testing should be based on exceptional but plausible events. Stress testing should in principle be applied at the same level as the ICAAP. The frequency of stress testing should be determined in accordance with the nature of the risks to which the institution is exposed and the types of tests performed. Institutions should determine the time horizon of stress testing in accordance with the maturity and liquidity of the positions stressed. Under specific circumstances, supervisors may require institutions to perform ad hoc stress tests at a specific point in time. ST10. Institutions should use accurate, complete, appropriate and representative data when performing stress tests and the IT resources should be commensurate with the complexity of the techniques and the coverage of stress tests performed by institutions. ST11. ST12. ST13. The management body has the ultimate responsibility for the overall stress testing framework. Where appropriate the management body can delegate certain aspects of this framework to specific risk committees or senior management, keeping the effective oversight. The stress testing process should be an integral part of an institution s risk management framework, with clear reporting lines and communication in an understandable format. Where deemed appropriate by the institution, it should take remedial measures or actions considering the level of risk exposure as revealed by stress tests and the objectives and risk tolerances defined by the management body. ST14. Appropriate documentation should be in place to facilitate the adequate implementation of the whole stress testing framework. 14

15 ST15. Institutions should consider periodically whether stress tests are still adequate. In particular, institutions should ensure that assumptions regarding the risk profile and the external environment are still valid over time. ST16. In line with one of the CEBS s High Level Principles listed in the CEBS Guidelines on the Supervisory Review Process (ICAAP 8) institutions should use stress testing as one (among others) tool to assess the risks in a forward looking manner. ST17. As part of these policies and processes, institutions should conduct stress tests for their positions in financial instruments in the trading book. ST18. For those institutions using internal models for the calculation of capital requirements for market risks, supervisory requirements for stress testing remain unchanged. Their ongoing fulfilment will be considered under the SREP. ST19. Institutions under the large exposures provisions using the comprehensive method for calculating the effects of financial collateral, or permitted to use their own estimates of LGDs and conversion factors, should identify conditions which would adversely affect the realisable value of their financial collateral. ST20. According to Article 114 (3) of the CRD, where the results of the stress testing indicate a lower realisable value of collateral, the value of collateral taken into account for the purpose of determining an institution s LE limits should be adjusted accordingly. ST21. Institutions should regularly project cash flows under alternative scenarios of various degrees taking into account both market liquidity (external factors) and funding liquidity (internal factors) ST22. When assessing the impact of these scenarios on their cash flows, institutions should rely on a set of reasonable assumptions that should be reviewed regularly. ST23. Institutions should have in place adequate contingency plans in the event of the realisation of a liquidity crisis. ST24. To come up with a complete view of various risk positions, stress testing of other risk types may be usefully considered to design alternative liquidity scenarios. ST25. Supervisors may perform their own stress tests based on available data in their assessment of liquidity risk under SREP. 15

16 Section C: CEBS Guidelines on SREP SREP 1: SREP 2: SREP 3: SREP 4: SREP 5: SREP 6: SREP 7: SREP 8: SREP 9: The SREP should be an integrated part of the authority s overall risk based approach to supervision. The SREP should apply to all authorised institutions. The SREP should cover all the activities of an institution. The SREP should cover all material risks and internal governance. The SREP will assess and review the institution s ICAAP. The SREP will assess and review the institution s compliance with the requirements laid down in the CRD. The SREP should identify existing or potential problems and key risks faced by the institution and deficiencies in its control and risk management frameworks; and it should assess the degree of reliance that can be placed on the outputs of the institution s ICAAP. The SREP will inform supervisors about the need to apply prudential measures. The results of the SREP will be communicated to the institution at the appropriate level (usually the management body) together with any action that is required of the institution and any significant action planned by the supervisory authority. SREP 10: The supervisory evaluation should be formally reviewed at least on an annual basis, to ensure that it is up-to-date and remains accurate. 16

17 Section D: Guidelines on Smaller Financial Institutions 1. Introduction 1. Section D provides recommendations for smaller institutions (credit institutions and investment firms) on how they might approach the ICAAP. This Section is a summary of the guidelines formulated by CEBS in its Paper on the Internal Capital Adequacy Assessment Process (ICAAP) for Smaller Institutions, which full text is available at the website of DNB ( and provides more detail about how smaller institutions could comply with the guidelines formulated by CEBS in its Guidelines on the Application of the Supervisory Review Process under Pillar 2 (hereafter: Guidelines ), published on 25 January The recommendations in this Section are without prejudice to the approaches that may be considered or adopted by larger institutions. 3. The recommendations focuses mainly on elaborating Guidelines on ICAAP 6 to 10 in the Guidelines, which are subject to the principle of proportionality. For the avoidance of doubt, smaller institution should also adopt Guidelines on ICAAP 1 to 5 in the Guidelines (also subject to the principle of proportionality). 4. The approaches to ICAAP described in these recommendations are not exhaustive. The recommendations are instead to be seen as a toolkit from which institutions can collect ideas on how to approach the ICAAP in Pillar Proportionality and scope of application 5. The Guidelines state that the ICAAP should be proportionate to the nature, scale and complexity of the activities of the institution. This implies that the concept of proportionality will have a particular influence on the structure and complexity of the ICAAP of smaller institutions. 6. For the purpose of these recommendations, an institution would usually be considered as a smaller institution if it meets most or all of the following criteria: 1 its activities are non-complex and focus on a limited product range; 2 it has a relatively small market share; 3 it does not adopt or use any of the IRB, AMA and internal models related to market risk which are approved by DNB; 4 it mainly operates inside the national territory and has none or only limited international activities. However, the supervisory authorities recognise that some small investment firms conduct more extensive cross-border activities or service foreign clients; and 5 it describes itself as a smaller institution in its own assessment. However, the ultimate decision whether an institution should be considered as a smaller institution in the sense of this paper rests with the supervisory authorities. 17

18 2. Smaller institutions and ICAAP 2.1 ICAAP requirements General requirements 7. The Capital Requirements Directive includes basic requirements for all institutions to have robust governance arrangements and effective processes for managing all risks. It also requires all institutions to have in place sound, effective and complete strategies and processes to assess and maintain adequate capital, having considered the nature and level of their risks in a forward-looking manner. 8. The management body of the institution is responsible for structuring the ICAAP and assessing the institution s internal capital need. The smaller institutions bear the responsibility for setting targets of adequate internal capital need in a way which is consistent with their risk profile and operating environment. This remains the case even if the ICAAP is outsourced to any extent in accordance with CEBS Standards on Outsourcing. The institution must further be able to explain and demonstrate how the ICAAP meets supervisory requirements. Regardless of the choice of ICAAP structure and assessment methodology, the ICAAP should be based on the Guidelines on ICAAP 1 to 10 laid down in the Guidelines. 9. The ICAAP should capture all the material risk to which the institution is exposed including all Pillar 1 risks, risk not fully captured under Pillar 1, Pillar 2 risks, and risk factors external to the institution Requirements for smaller institutions 10. Smaller institutions are also expected to conduct capital planning and capital adequacy assessment relative to their entire risk profile considering institution specific characteristics and uncertainties. A suitable ICAAP can be seen as one of the key internal management processes for the management body. The development of an ICAAP aims to enhance risk awareness, maintain good risk assessments in smaller institutions and a sufficient level of internal capital to meet unexpected losses. 11. The supervisory authorities expect that the smaller institutions will already conduct many of the thought processes required by the ICAAP as part of their usual budgeting and strategic planning processes. 12. Smaller institutions could comply with the criteria in the Guidelines by setting up an ICAAP which takes into consideration the appropriate risk areas including risk drivers from Annex 1 of the Guidelines. These risk areas and risk drivers should be considered as a reference source institutions can use to identify which risks they are exposed to. If the institution is exposed to risks not mentioned in Annex 1 of the Guidelines, it should ensure that internal capital if appropriate is allocated to capture such risks. 13. Smaller institutions should be mindful that capital is not the only mitigant available and that in many circumstances, risk can be addressed through adequate systems and controls, especially for risks which are difficult or impossible to quantify. 18

19 2.2 Methodology 14. There is no single correct process when setting up the ICAAP. Smaller institutions could, for example, adopt an ICAAP based on the Pillar 1 minimum capital requirement and assess extra capital proportionate to the non Pillar 1 risk. Alternatively, smaller institutions could choose to adopt a building block approach, using different methodologies for the risk types under the different Pillars and then calculating a sum of the resulting capital needs. As a further alternative, an institution might start with its actual capital (risk taking capacity) and break it down to all its material risks. The choice of methodology should clearly be commensurate with the institution s ability to collect the necessary information and to calculate the necessary inputs in a reliable manner. 15. Regardless which methodology a smaller institution decides to adopt, it needs to compare its actual and future capital with the actual and future internal capital need arising from the assessment. The actual calculation and allocation of internal capital always needs to be supplemented by sufficiently robust qualitative procedures, measures and provisions to identify, manage, control and monitor all risks. 16. The process an institution has chosen for its ICAAP will always consist of two parts. One part covers all steps necessary for calculating the risks. The other part covers all steps necessary to calculate the actual capital. In order to compile this overall measure, the institution has to define which components of its balance sheet and/or P/L can be included into the calculation (i.e. which balance sheet and/or P/L components genuinely represent loss absorption capacity for the institution). Therefore the institution has to define a clear process for the calculation. As these two parts will always meet at the end of the ICAAP and have to be in balance, there is no procedure which says which part has to be calculated first Pillar 1 minimum capital requirement approach 17. An institution which chooses to use the Pillar 1 minimum capital requirement as the starting point has to consider what additional capital may be required to take account of those risks which are not included or fully captured by the Pillar 1 minimum capital requirement. This requires an assessment first of whether the Pillar 1 minimum capital requirement fully captures the Pillar 1 risks (credit risk, market risk and operational risk), and second, how much capital to allocate against the Pillar 2 risks and external factors Structured approach 18. An institution which chooses to use a structured approach will need to set the internal capital requirement at a starting point of zero capital and then build on capital due to all Pillar 1 and Pillar 2 risks and external factors. This methodology could be seen as a simple model for calculating economic capital and is not based on the Pillar 1 minimum capital requirement. All material risk areas, including credit risk, market risk and operational risk, should be assessed and taken into consideration when assessing the internal capital need. A sensitivity analysis could form the starting point. The sensitivity analysis should be based on an exceptional but plausible scenario. Risks which are not included in the sensitivity analysis should also be considered in terms of the structured approach. 19

20 2.2.3 Allocation of risk-taking approach 19. An institution which chooses to use this method will start from its actual capital and compare this figure to its total risks. Thereby it breaks the capital down to all its material risks. This step in the process requires quantification or at least an estimation method for various risks. The amount of capital provided for each risk category is determined by the current and envisaged amount of risk in each category, a risk buffer and the risk appetite of the institution. The institution will decide which type of risk quantification/estimation method is suitable and sufficient for its particular use. If the allocated capital seems insufficient, either the risk has to be reduced or the capital has to be raised. The allocated amounts of the capital will therefore work as a limit system, which assists and facilitates the institution in balancing its risk-taking capacity and its risks. The actual calculation and allocation of capital always needs to be supplemented by sufficiently robust qualitative procedures, measures and provisions to identify, manage, control and monitor all risks. 20. After choosing its ICAAP methodology, the institution could take its thinking through the following steps in developing the ICAAP: 1 Risk identification A smaller institution could prepare a list of all material risks to which it is exposed; for that purpose it may find it useful to identify and consider its largest past losses and whether those losses are likely to recur. The identification of all material risk to which the institution is exposed should be conducted in a forward looking manner. 2 Capital assessment For all the risks identified through the process above, a smaller institution could then consider how it would act, and the amount of capital that would be absorbed, in the event that one or more of the risks identified was to materialise. 3 Forward capital planning A smaller institution could then consider how its capital need as calculated above might alter in line with its business plans over its strategic time horizon, and how it might respond to these changes. In doing so, a smaller institution may want to perform a sensitivity analysis to understand how sensitive its capital is to changes in internal and external factors such as business risks, and changes in business cycles. 4 ICAAP outcome Finally, a smaller institution should document the ranges of capital required identified above and form an overall view on the amount of internal capital which it should hold. 2.3 Risk areas of focus according to the nature of activities of smaller credit institutions 21. The next section sets out risks which may be considered by smaller credit institutions. It provides examples of the types of risks which such institutions might typically face and should therefore consider in their ICAAP, as detailed in the section above. The definitions of risks are valid as laid down in Annex 1 of the Guidelines. 20

21 2.3.1 Concentration risk 22. Concentration risk resulting from concentrated loan portfolios could be a significant factor, especially for smaller institutions. If a credit institution chooses to use the minimum capital requirement as a starting point for its capital assessment, it should remember that, when assessing its exposure to concentration risk, the minimum capital requirement is calibrated on the assumption that an institution is a well diversified internationally active institution, which usually does not apply to smaller institutions. 23. In assessing the degree of credit concentration, a credit institution should consider its degree of credit concentration to both individual counterparties and economic or geographic areas. Where the business of a credit institution is, by its nature, concentrated (for example, a specialised firm lending to one sector only, or where there is collateral concentration), it should consider the impact of adverse economic factors on the concentrated area and its impact on asset quality Control/management risk 24. Control/management risk could be divided into risk due to control/management deficiencies and risk due control/management limitations. Control/management deficiencies relate to circumstances where institutions do not comply with minimum legal requirements. Control/management limitations relate to circumstances where the institutions comply with minimum legal requirements, but, due to structural reasons inherent in their size, have a limited capacity to set up sophisticated governance arrangements and systems and controls. 25. Control/management deficiencies should normally be addressed by using other risk mitigants than capital. In fact, the correct response must be to take action to resolve the problems. 26. Control/management risk due to control/management limitations could be a significant factor for smaller institutions. The concept of proportionality means that supervisors would not expect the same degree of sophistication of governance arrangements and controls that could be found in a larger institution. However, other things being equal, the overall risk profile may be higher in smaller institutions after taking into account the proportionate management and control environment (whether in relation to specific risks, or in general). Smaller institutions will also be expected to consider the risk resulting from control/management limitations in their internal capital assessment, if the application of other measures is deemed to be inadequate to address such limitations within an appropriate timeframe Credit risk 27. The Pillar 1 minimum requirement seeks to cover credit risk. However, the Standardised Approach might not reflect the full credit risk of the institution. Therefore it is important that the institution considers whether its credit risk is fully captured in the capital assessed by Pillar 1. For example, the institution should make sure that the capital assessment allocates internal capital for the weaker exposure classes where accounting standards do not require (or allow) that provisions are made and where the Pillar 1 approach used does not sufficiently reflect the risk of a particular portfolio. 21