EUROSYSTEM BANK SUPERVISION AND REGULATION DIVISION GUIDELINES TO BANKS ON THE MANAGEMENT OF CREDIT RISK JULY 2008
1. INTRODUCTION The effective management of credit risk is a critical component of a comprehensive approach to the overall risk management and essential for the long-term soundness of a bank. Credit refers to a legal relationship that results or may result in a claim on a counterparty. Credit risk is defined as the potential failure of a bank borrower or counterparty to meet its contractual obligations. The objective of credit risk management is to maximise a bank s risk-adjusted rate of return by maintaining credit risk exposure within acceptable parameters. Banks need to manage the credit risk inherent in their entire portfolio as well as the risk in individual credits or transactions. The relationships between credit risk and other risks should also be considered. Having regard to the above, the Central Bank of Cyprus expects all supervised banks licensed in the Republic of Cyprus: To have adequate and efficient functions commensurate with the nature, scale and complexity of their activities in order to identify, measure, mitigate, monitor and control credit risk as part of an overall approach to business risk management; To hold adequate capital against credit risks; and To ensure that their pricing adequately compensates for the risks incurred. As regards branches of banks incorporated outside the Republic of Cyprus, the Central Bank of Cyprus expects that these operate in the context of relevant policies and procedures prescribed by the board of directors and senior management of their bank and comply with sub-limits assigned to them. In the absence of such sub-limits or policies and procedures, the Central Bank of Cyprus expects the branch concerned to establish, in consultation with the senior management of its bank, appropriate limits, functions, systems and procedures for analysing and assessing credit risk in line with the provisions of these guidelines. 2
Although the guidelines contained in this paper are most clearly applicable to the business of lending, they should be applied to all activities where credit risk is present. Sources of credit risk, other than loans, exist throughout the activities of a bank, including in the banking book and in the trading book, and both on and off the balance sheet, such as bonds, short-term debt securities and derivatives, unused credit lines or limits, guarantees, documentary credits etc. Country risk, transfer risk and settlement risk are also regarded as part of credit risk, in a wider sense. The Central Bank of Cyprus has already issued specific guidelines for the management of country risk and transfer risk. This document is intended to provide supervised banks the core principles of credit risk management as well as provisions on the establishment and maintenance of the credit risk management function. These principles are based on the following recommendations issued by the Basel Committee on Banking Supervision: Core principles for effective banking supervision, issued in October 2006; Sound credit risk assessment and valuation for loans, issued in June 2006; and Principles for the management of credit risk, issued in September 2000. Supervised banks must apply these guidelines in conjunction with the implementation of sound practices in relation to the assessment of asset quality, the adequacy of provisions and loan reserves and the adherence to the prescribed disclosure requirements for credit risk. 2. CREDIT RISK MANAGEMENT ENVIRONMENT 2.1 Credit Strategy, Policies, Processes and Procedures The Central Bank of Cyprus expects all supervised banks to establish a well documented credit risk strategy and define sound policies and procedures for identifying, measuring, monitoring and controlling credit risk. 3
2.1.1 Formulating a Credit Strategy The credit risk strategy, formulated by the board of directors, must be consistent with the supervised bank s general business plan and must define, at a minimum, its: Preferred customer profile in granting credit and its allocation of credit based on exposure type, industry or economic sector, geographical location, currency, maturity and anticipated profitability; Target markets; Risk-taking level based on its risk bearing capacity and principles for diversification of and protection against risks; Expected level of profitability in incurring various types of credit risks; and Credit quality and growth targets by product, market and portfolio segment. The credit risk strategy should be periodically (at least annually) reviewed and revised accordingly. It must, however, be viable in the long run, throughout economic cycles. 2.1.2 Establishing Sound Policies and Procedures The senior management of supervised banks must design and implement policies and procedures for all activities in which credit exposures pose a risk, at both the individual credit and portfolio levels, taking into account internal and external factors such as market position, trade area, staff capabilities and technology. Supervised banks must ensure that their policies and procedures are: Clearly defined and in accordance with the credit risk strategy; Consistent with prudent banking practices and relevant regulatory requirements; and Commensurate with the nature, scale and complexity of the supervised bank s activities. 4
These policies and procedures must enable the supervised bank to: Maintain sound credit-granting standards; Monitor and control credit risk; Properly evaluate new business opportunities; and Identify and administer problem credits. Supervised banks must also ensure that they have adequate risk management procedures and controls in place for new products and activities before these are being introduced or undertaken. Special attention must be paid to products that involve unfamiliar markets, pricing, contract law and accounting or risk management principles. The credit policies must be communicated to all relevant functions throughout the organisation, monitored and periodically revised to take into account changing internal and external circumstances. They should be applied, where appropriate, on a consolidated bank basis, including foreign branches and subsidiaries, and at the level of individual affiliated entities. Staff should be held accountable in cases of non compliance with established policies and procedures. 2.2 Organisation Structure and Delineation of Responsibilities The Central Bank of Cyprus expects supervised banks to establish an appropriate organisation framework for the sound management of credit risk and ensure that tasks and responsibilities are clearly delimited among the board of directors, management and relevant functions and personnel involved in the credit risk management. 2.2.1 Board of Directors The board of directors has the responsibility for approving and periodically reviewing the credit risk strategy, significant credit risk policies and procedures of the supervised bank as well as setting of appropriate limits and assigning approving authorities. In this connection, the board of directors should regularly, either within the credit risk strategy or within a credit policy statement, approve the bank s overall credit 5
granting criteria, including general terms and conditions. In addition, it should approve the manner in which the bank will organise its credit-granting functions, including independent review of the credit granting and management function and the overall portfolio. Finally, the board of directors, either directly or through a delegated committee, should approve any major new credit activity. The board of directors must also ensure that: All relevant personnel clearly understand the credit risk strategy and significant credit risk policies approved by the board of directors. The senior management is fully capable of managing the credit granting activities conducted by the supervised bank and that those activities are done within the credit strategy, policies and limits approved by the board of directors. The supervised bank s remuneration policies do not contradict its credit strategy. 2.2.2 Senior Management The senior management has the responsibility for implementing the credit risk strategy approved by the board of directors and for developing policies and procedures for identifying, measuring, monitoring and controlling credit risk. The senior management must, at a minimum, ensure that: The credit granting activities conform to the adopted strategy and credit policies. The personnel have the sufficient expertise to implement the credit policies under the adopted strategy. Loan approval and review responsibilities are clearly and properly assigned. An independent internal review and assessment of the credit granting and risk management functions is carried out. The credit granting policies are communicated throughout the organisation and implemented through appropriate procedures. Policies and procedures are promptly revised to take into account changing internal and external circumstances. 6
The credit portfolio is adequately diversified pursuant to the credit strategy approved by the board of directors. The supervised bank has established targets for portfolio mix and set exposure limits on single customers and groups of connected customers, particular industries or economic sectors, geographic regions and specific products. Sound credit granting and management standards are maintained. 2.2.3 Independent Credit Review Function To ensure that the adopted principles for credit risk management are appropriate and complied with, the supervised bank must establish a separate, independent function for the review and assessment of its credit risk management processes. This function should be conducted by individuals that are independent from the business and credit approving functions. The independent credit review function must, inter alia, ensure that: The credit granting function is being properly managed and that credit exposures are consistent with prudential standards and within the internal limits of the supervised bank. The management information systems provide correct and adequate data on the supervised bank s aggregate credit exposures and changes thereof over time. Exceptions to policies, procedures and limits are reported in a timely manner to the appropriate levels of management. The supervised bank has adopted procedures for more frequent customer monitoring in case of impaired payment capacity as well as procedures for managing problem credits. Internal credit risk ratings assigned to individual borrowers or counterparties are consistent and accurately reflect their credit quality. Provisions and loan loss reserves are adequate. The independent credit review function must report directly to the board of directors and/or senior management without lending authority. 7
In the case of branches of banks incorporated outside the Republic of Cyprus, the responsibilities of the independent credit review function maybe carried out by the corresponding internal credit review function of the bank. 3. CREDIT GRANTING CRITERIA AND CREDIT GRANTING PROCESS 3.1 Credit Granting Criteria The Central Bank of Cyprus expects supervised banks to establish and operate within well-defined credit granting criteria to ensure that all credit approvals are done in a safe and sound manner. These criteria must include: A clear indication of the target market, based on the supervised banks credit risk strategy; A clear indication of the credit decision and credit granting procedures; A thorough understanding of the borrower or counterparty, as well as the purpose and structure of the credit, the source of repayment and the management of collaterals or guarantees. 3.1.1 Credit Analysis and Evaluation Each credit decision must be based on an analysis of the financial status and creditworthiness of the credit applicant. A careful evaluation of each applicant s ability to meet his obligations entails obtaining sufficient information about the prospective borrower and the project to be financed. Supervised banks must clearly define what kind of information and documentation they need for evaluating applications for new credits as well as for renewal and revising of existing credits. In this respect, supervised banks are expected to set up an appropriate credit analysis and evaluation function, commensurate with their size, nature and complexity of their credit operations. 8
Depending on the type of credit exposure and the nature of the existing credit relationship, the factors to be considered and documented in approving credits must, at a minimum, include: The amount, term and purpose of the credit as well as the expected source of repayment; The current risk profile (including the nature and aggregate amounts of risks) of the borrower or counterparty and collateral and their sensitivity to economic and market developments; The borrower s current, historical and future repayment capacity; The proportion of the borrower s own funding for the project concerned; For commercial credits, the status of the borrower s industry or economic sector, the borrower s position within this sector as well as the borrower s business expertise; Commitments towards persons connected with the borrower; The proposed terms and conditions of the credit, including covenants designed to limit changes in the future risk profile of the borrower; and Where applicable, the adequacy and enforceability of collateral or guarantees, including under various scenarios. In evaluating whether, and on what terms, to grant credit, supervised banks need to assess the risks against expected return both in pricing individual credits as well as the overall profitability of their customer relationship. In evaluating risk, supervised banks should also take into consideration potential future macroeconomic changes and their possible impact on borrowers or counterparties. Supervised banks need to understand to whom they are granting credit. Consideration should be given to the integrity and reputation of the borrower or counterparty as well as their legal capacity to assume the liability. Strict policies must be in place to avoid association with individuals involved in fraudulent activities and other crimes. Reputation or familiarity with the bank, however, should not be solely used for granting credit. Particular attention needs to be paid to the identification procedures used for new customers. The customer identification must be documented and filed to make it possible to establish later on how the customer relationship was formed and what information it was based on. In general, supervised banks are required to fully comply with the Central 9
Bank of Cyprus Directive on the Prevention of Money Laundering and Terrorist Financing. The supervised banks must have information systems in place for the collection and updating of customer data as well as established procedures for the identification of connections between individual customers, counterparties and entities related to them, and the calculation of risk concentrations. Where actual or potential conflicts of interest exist within the supervised bank, internal confidentiality arrangements must be established to ensure that the supervised bank is not prevented from obtaining all relevant information from the borrower. These arrangements must not, however, prevent units or persons dealing with internal control and risk management from obtaining necessary data. 3.1.2 Credit Risk Mitigants The credit decision must primarily be based on the creditworthiness and repayment ability of the borrower, but collateral and guarantees offered as credit risk mitigants may also be of significance. It should be emphasised, however, that collateral cannot be a substitute for a comprehensive assessment of the borrower or counterparty, nor can it compensate for insufficient information. Supervised banks must recognise that credit enforcement actions can eliminate the profit margin as well as that the value of the collateral may well be impaired by the same factors that have led to the diminished recoverability of the credit. Supervised banks must have policies and procedures for: Accepting different types of collateral; Classifying collateral; Regularly monitoring and assessing collateral values; Ensuring that collateral is legally enforceable, adequate and realisable; and Identifying and managing any concentrations arising from collateral. 10
Supervised banks must evaluate the level of coverage being provided by guarantees in relation to the credit-quality and legal capacity of the guarantor and be careful when making assumptions about implied support from third parties. With regard to netting agreements used for reducing credit risks, especially in interbank transactions, supervised banks should ensure that these agreements are sound and legally enforceable. 3.2 Limits Supervised banks must have a limit system in place to ensure that credits are granted within exposure limits established in accordance with their credit strategy, at the level of: Individual borrowers and counterparties; Groups of connected counterparties; and Groups of products and/or counterparties that aggregate in comparable and meaningful manner different types of exposures. Limits should be established for all activities that credit risk is present, both in the banking and trading book and on and off the balance sheet, and generally be binding and not driven by customer demand. Limits for single counterparties and groups of connected counterparties must be based primarily on the internal risk rating assigned to the borrower or counterparty and the potential exposure to that counterparty. The potential exposure should recognise and reflect the risks associated with near-term liquidation of positions in the event of counterparty default, and factor in any unsecured exposure. When appropriate, potential future exposures should be calculated over multiple time horizons. The results of stress testing should also be considered. Supervised banks must monitor the actual utilisation of established limits on an ongoing basis and all credit granting in excess of predetermined levels must be documented, analysed and reported in accordance with defined procedures. Procedures must be established for monitoring positions approaching risk limits 11
and exceptions to credit risk limits. Exceeding or modifying established risk limits should require explicit approval of senior management or the board of directors. 3.3 Credit Granting Process Supervised banks must have a clearly-defined process in place for approving new credits as well as for the amendment, renewal and re-financing of existing credits. The credit granting process must coordinate the efforts of all the individuals involved from the business origination function, the credit analysis and evaluation function as well as the credit approval function, to ensure that sound credit decisions are made. Credit decisions must be made in accordance with written instructions approved by the senior management. There must be a clear audit trail documenting the whole process, from credit application to credit decision, and it should be approved by the appropriate level of authority. The credit decision or the documents appended thereto must give a detailed account of the contents of the decision, the grounds for granting or turning down the application and an indication of the decision makers. The entire credit granting process must be verifiable after the event. The written instructions on credit granting must clearly designate the duties and responsibilities of those who have the authority to approve credit. The instructions must also specify who has the authority to grant credit and the limit of the authority. Only authorized persons and units may make credit decisions. Approval authorities must be commensurate with the size and complexity of the transaction as well as the experience, knowledge and background of the individuals involved. The processing of credit applications and the credit decisions must be segregated in a way that the person preparing the credit application cannot make the credit decision on his or her own. Credit must not be disbursed to the customer until the supervised bank has received all the necessary documents. Credit documents and collateral must be retained at least until the credit has been repaid. 12
The granting of all new credit and changes of terms and conditions of credit previously granted must be provided on an arm s-length basis. Supervised banks must ensure that credit is not extended to related parties at terms and conditions that could jeopardise the supervised banks financial status or otherwise the confidence in their operations. Supervised banks must establish a system of controls that ensures: Terms and conditions of credits granted to related companies and individuals are not more favourable than credit granted to non-related borrowers; and Amount of credit granted to such parties is suitably monitored and within strict absolute limits. All credit to related parties must require the approval of the board of directors and extended in accordance with the relevant provisions of the Banking Law of 1997, as subsequently amended. 4. MEASUREMENT OF CREDIT RISK AND THE MANAGEMENT INFORMATION SYSTEMS Supervised banks must be able to measure the credit risk inherent in all their balance sheet items and off balance sheet commitments using sound information systems and appropriate risk measurement techniques. 4.1 Management Information Systems Supervised banks must establish sound management information systems that generate sufficient, accurate and appropriate information on the composition of the credit portfolio, including identification of any concentrations of risk, to enable the board of directors and management to: Assess, quickly and reliably, the credit risk exposure of the supervised bank in its various activities; Determine whether the supervised entity s operations comply with its credit risk strategy; and Fulfil their respective oversight roles, including determining the required level of capital to be held for credit risk. 13
The adequacy of scope of information must be reviewed on a periodic basis by business line managers and senior management to ensure that it is sufficient for the complexity of the business. 4.2 Risk Measurement Techniques Supervised banks must use risk measurement techniques that are appropriate to the nature, complexity and level of the risks involved in their activities and have procedures in place for establishing and monitoring appropriate limits. The measurement of credit risk should, at least, take account of: The specific nature of the credit; Its contractual and financial conditions; The existence of collateral and/or guarantees; The probability of default; and Possible market movements affecting the exposure value. Supervised banks must establish effective validation procedures when credit risk assessment involves risk measurement models and assumption-based estimates. Supervised banks must establish tolerance limits for differences between expected and actual outcomes and remedial procedures when policy tolerances are exceeded. The validation process and results must be documented and subject to periodic review by qualified, independent persons. 5. CREDIT ADMINISTRATION Supervised banks must have procedures in place for the ongoing administration of their various credit risk bearing portfolios. The guidance and support of the board of directors and senior management is a key factor in ensuring that the credit administration is recognised as an important element of the credit risk management process. A supervised bank must have an independent function, segregated from the credit granting process, to ensure that relevant documents are duly prepared and credits are granted in accordance with terms of approval. The credit documents 14
must include information to track the history of the credit as well as information on the credit decision process, the staff involved in the credit process and credit decision and information on the current financial status of the borrower or counterparty. In developing their credit administration functions, supervised banks must ensure: The efficiency and effectiveness of credit administration operations; The accuracy and timeliness of information provided to the management information systems; Adequate segregation of duties; and Compliance with prescribed management policies and procedures as well as applicable laws and regulations. 6. CREDIT MONITORING 6.1 Monitoring the Status of Individual Credits Supervised banks must have in place a system for monitoring the status of individual credits and borrowers in different credit portfolios including determining the adequacy of provisions and reserves against thereof. There must also be procedures that ensure: The adequate monitoring of customers, covenants, collaterals and guarantees; The prompt reporting to the senior management, and where appropriate, the board of directors, of exposures exceeding risk limits; and The identification and reporting of potential problem credits or other deteriorating business activities at an early stage so that that they are subject to more frequent monitoring as well as possible corrective action, classification and/or provisioning. Supervised banks must ensure that the monitoring function provides the persons responsible for credit risk assessment with updated information. When delegating monitoring responsibilities, management must recognise the potential for conflicts 15
of interest, especially for persons who are judged and rewarded on such indicators as loan volume, portfolio quality or short-term profitability. 6.2 Monitoring the Overall Composition and Quality of the Credit Portfolio Supervised banks must have in place a system, commensurate with the nature, size and complexity of their credit portfolios, for monitoring the overall composition and quality of the various credit portfolios. As a high level of concentration can expose supervised banks to adverse developments in the area in which the credits are concentrated, supervised banks must have a system in place for monitoring the overall credits to: Single borrowers or counterparties; Groups of single counterparties and related entities; Particular industries or economic sectors; Geographic regions or groups of countries whose economies are strongly interrelated; Certain types of collateral; Exposures with the same maturity; and Exposures in specific products or instruments. Supervised banks must also identify risk concentrations based on situation specific and subtle linkages among credits in the portfolio. Supervised banks must establish concentration limits in accordance with their credit risk strategy. If the avoidance of certain risk concentrations is difficult or the concentrations are justifiable from a business point view, the increased credit risk arising must be taken into account in the pricing of the credits and the calculation of internal own funds. The regulatory limits on large exposures or other limits set by the Central Bank of Cyprus on concentration risk, should, on no occasion, be exceeded. In managing risk concentrations or mitigating their effects, supervised banks can use such mechanisms as loan sales, credit derivatives and other secondary loan market arrangements. When supervised banks decide to utilise such mechanisms, they need to first have separate policies and procedures, as well as 16
adequate controls, in place for identifying and managing also the risks that these mechanisms involve. 7. INTERNAL RISK RATING SYSTEM In managing credit risk, supervised banks are expected to develop and utilise an internal risk rating system, approved and supported by senior management, commensurate with the nature, size and complexity of their activities. The internal rating systems should categorise credits into various classes designed to take into account gradations in risk. Risk ratings should reflect the borrower s current financial condition and paying capacity, the current value and realisability of collateral and other counterparty and facility characteristics. A well-structured credit risk grading system enables a detailed analysis of the characteristics, concentrations, problem credits and adequacy of loan loss provisions pertaining to the credit portfolio. The risk rating can also be used for capital allocation, credit pricing and profitability of transactions and relationships. In establishing a credit risk grading system, supervised banks should define the characteristics of each credit risk grade and delineate the responsibilities for the design, implementation, operation and monitoring of the performance of the system. The credit review function must have the responsibility for verifying or, where circumstances warrant, setting internal ratings to ensure their consistency and accuracy. The ratings assigned to individual borrowers or counterparties at the time the credit is granted must be reviewed on a periodic basis, at least annually, by the credit review function and individual credits must be assigned a new rating when conditions either improve or deteriorate. The Central Bank of Cyprus may permit supervised banks to calculate their riskweighted exposure amounts for regulatory capital requirements purposes, using an internal risk rating system. Explicit Central Bank of Cyprus permission must be obtained subject to the fulfilment of the minimum requirements as set out in Unit A, Annex VII, Part 4 of the Directive to Banks for the calculation of the capital requirements and large exposures issued in 2006, as subsequently amended. 17
8. STRESS TESTING As part of their credit risk management process, supervised banks must identify potential events or future changes in economic conditions that can have unfavourable effects on their credit exposures and assess their ability to withstand such changes. Such stress tests should take into consideration economic or industry downturns, interest rate and other market movements, liquidity conditions and higher than expected levels of delinquencies and defaults. Moreover, supervised banks should fully understand the linkages between different categories of risk that are likely to emerge in times of crisis. Senior management must review the output of stress testing on a periodic basis and take appropriate action in cases where the results exceed agreed tolerances which can include such techniques as hedging against the outcome or reducing the size of the exposure. The output of stress testing must also be incorporated into the process for assigning and updating policies and limits. 9. CONTROL OF CREDIT RISK Supervised banks must establish an adequate system of internal controls to ensure that their credit risk exposure is maintained within parameters set by the board of directors and the senior management. Such system should encompass an efficient internal review and reporting system process to enable the bank management to monitor adherence to the established credit risk objectives. In this context: An appropriate limit system must be in place to ensure that: - Credits to individual borrowers/counterparties are granted within exposure limits established in accordance with their credit strategy; - Activities involving credit risk are adequately diversified; and - Management is effectively monitoring actual risk taking against predetermined credit risk tolerances and controlling credit risk exposures. 18
There should be in place precise policies and procedures for early remedial action on deteriorating credits and managing problem credits. Responsibility for managing problem credits may be assigned to the originating business function, a specialised workout section, or a combination of the two, depending upon the size and nature of the credit and reason for its problems. Appropriate mitigation techniques should be applied for reducing the credit risk within acceptable levels. Such techniques may include collateral, guarantees, netting agreements, hedging through credit derivatives, loan sales, etc. In this respect, supervised banks must define, in writing, their policies and procedures for mitigating credit risk as well as to ensure that adequate controls are in place for identifying and managing the risks that these mechanisms may involve. Mitigation mechanisms should be regarded to form part and not a substitute for a proper credit risk management process. Internal audits must be used to identify areas of weakness in the credit risk management process, policies and procedures as well as any exceptions to policies, procedures and limits. Internal audits of the credit risk processes must be conducted on a periodic basis to determine that: - Credit activities are in compliance with the supervised bank s credit policies and procedures; - Credits are authorised within the guidelines established by the supervised bank s board of directors; and - Existence, quality and value of individual credits are accurately being reported to senior management. 10. SUPERVISION BY THE CENTRAL BANK OF CYPRUS The Central Bank of Cyprus requires supervised banks to adopt the above guidelines in the context of implementing their credit risk management system. It also expects the credit risk management system to be commensurate with the supervised bank s size, complexity and risk profile and form an integrated part of the overall risk management process of the supervised bank. 19
The Central Bank of Cyprus shall review and evaluate the credit risk environment of supervised banks as well as the appropriateness and adequacy of their credit risk measurement tools in the context of the supervisory review and evaluation process (Pillar 2 of the capital requirements directive). The Central Bank of Cyprus review and evaluation, shall, inter alia, include: The soundness of the bank s risk management process and overall control environment with respect to credit risk; The internal analysis for evaluating the quality of individual credits; The internal reviews for assessing the overall quality of the credit portfolio; The adequacy of loan provisions and reserves; The effectiveness of the credit review process in identifying deteriorating credits at an early stage; The quality of internal validation process where internal risk ratings and/or credit risk models are used; and The adequacy of capital for the level of credit risk identified and inherent in their various on- and off-balance sheet activities. When the supervised bank forms part of a banking or a financial group, the credit risk should be managed in an appropriate and integrated manner across the group. In performing its evaluation, the Central Bank of Cyprus, in such cases, shall co-operate and exchange information with other supervisors involved in the supervision of the group. The Central Bank of Cyprus shall require supervised banks to take the necessary actions and steps at an early stage for addressing any weaknesses and/or deficiencies identified in the course of its credit risk management evaluation. Where appropriate, the Central Bank of Cyprus may take further supervisory measures in accordance with the provisions of Unit A, Chapter 4, Section 2 of the Directive to banks for the calculation of the capital requirements and large exposures issued in 2006 as subsequently amended. AK/PV 20