ICAAP_guidelines

Guidelines on the Internal Capital Adequacy Assessment Process (ICAAP) at credit institutions 1 Updated by decision of the Banco de España Executive Commission of 18.03.09. Changes are indicated via footnotes. 25.06.20081 Note: Translation of guidelines originally issued in Spanish. In the event a discrepancy, the Spanish-language version prevails. CONTENTS 1 Introduction 3 2 Own funds target and ICAAP criteria. 4 2.1 Own funds target. 4 2.2 Criteria for consideration in conducting the ICAAP 5 3 Practical implementation of the ICAAP: yearly internal capital adequacy assessment report. 6 3.1 Executive summary and conclusions. 7 3.1.1 Risk profile of the institution. 8 3.1.2 Governance and risk management and control systems. 8 3.1.3 Own funds target: level, composition and distribution among legally independent group institutions. 8 3.1.4 Capital planning. 9 3.1.5 Programme of future measures. 9 3.1.6 Other matters. 9 3.2 Internal governance, risk management and internal audit of risks. 9 3.2.1 Internal governance. 9 3.2.1.1 Description of the institution’s organisation 9 3.2.1.2 Functions and responsibilities of the Board of Directors relating to the management of risks, their internal control and capital adequacy. 10 3.2.1.3 Internal governance assessment 10 3.2.2 Risk management 10 3.2.2.1 Corporate risk culture: general principles of risk management 10 3.2.2.2 Specific aspects of each risk. 11 3.2.2.3 Overall assessment of risk management 12 3.2.3 Internal audit of risks. 12 3.2.3.1 Risk review-related internal audit tasks. 12 3.2.3.2 Internal audit assessment 12 3.3 Measurement of risks and quantification of the capital needed to cover them 13 3.3.1 Assessment of capital needs for credit risk 14 3.3.2 Assessment of capital needs for credit concentration risk 15 3.3.3 Assessment of capital needs for market risk 16 3.3.4 Assessment of capital needs for operational risk 17 3.3.5 Assessment of capital needs for interest rate risk in the banking book 17 3.3.6 Assessment of capital needs for liquidity risk 18 3.3.7 Assessment of capital needs for other risks 18 3.4 Aggregation of capital needs and reconciliation adjustments 19 3.4.1 Aggregation of capital needs for the various risks 19 3.5 Capital planning 21 3.6 Programme of future measures 22 3.7 Other matters 23 4 Review of this information by the Banco de España 23 Annex 1.2. Return IAC01 and instructions for completing it 29 Annex 2. Sectoral and individual concentration 39 Annex 3. Principles of the internal capital adequacy assessment process (ICAAP) 41 Annex 4. Principles of internal governance 44 Annex 5. Guidelines relating to Pillar 2 drafted by the CEBS and the BCBS 47 3 1 Introduction The aim of these guidelines is to simplify the application of the internal capital adequacy assessment process (ICAAP) for institutions, as provided for in article 123 of Directive 48/2006 of the European Council and of the Parliament on the taking up and pursuit of the business of credit institutions (hereinafter the Directive). In this internal capital adequacy assessment process it is necessary to consider the qualitative aspects of risk management and, therefore, these guidelines also provide details for implementing article 22 of the Directive on corporate governance and risk management and control. Articles 22 and 123 of the Directive read as follows: Article 22: “…. every credit institution [shall] have robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and adequate internal control mechanisms, including sound administrative and accounting procedures. The arrangements, processes and mechanisms referred to in paragraph 1 shall be comprehensive and proportionate to the nature, scale and complexity of the credit institution's activities.” Article 123: “ Credit institutions shall have in place sound, effective and complete strategies and processes to assess and maintain on an ongoing basis the amounts, types and distribution of internal capital that they consider adequate to cover the nature and level of the risks to which they are or might be exposed. These strategies and processes shall be subject to regular internal review to ensure that they remain comprehensive and proportionate to the nature, scale and complexity of the activities of the credit institution concerned.” These articles in the Directive have been developed by the Committee of European Banking Supervisors (CEBS) in its document entitled “Guidelines on the Application of the Supervisory Review Process under Pillar 2”, published on 25 January 2006. The present guidelines are based on the principles and criteria laid down in the CEBS guidelines, a summary of which is included in Annexes 3 and 4. Annex 5 indicates other guidelines relating to Pillar 2 drafted by the CEBS and the Basel Committee on Banking Supervision. Articles 22 and 123 of the Directive have been transposed into Spanish legislation in Article 30 bis, paragraph 1 bis of Law 26/1988 on the Discipline and Intervention of Credit Institutions, and in Article 6, paragraph 4 of Law 13/1985 on Investment Ratios, Capital and Reporting Obligations of Financial Intermediaries, which have been implemented in Royal Decree 216/2008 on the own 4 funds of financial institutions in Article 66 (Organisation, risk management and internal control requirements), 67 (Risk management policy) and 68 (Internal capital adequacy assessment process), and also in the rules in the chapter ten on internal governance and capital assessment of Banco de España’s Circular 3/2008 on the determination and control of minimum regulatory capital (henceforth the Circular). 2 Own funds target and ICAAP criteria. The aim of the Basel Pillar 2 is to ensure an appropriate relationship between the risk profile of credit institutions and the capital they actually hold, both in absolute terms and in terms of composition (tier 1, tier 2, tier 3), and, where appropriate, in terms of the distribution between the different legally independent entities of a consolidated group of credit institutions. This alignment between the capital and risks of institutions will make for better risk management. To achieve this aim, and as stipulated in Article 123 of the Directive, institutions should conduct a process (ICAAP) to identify, measure and aggregate their risks, in order to determine the capital needed to cover them. This process should also include medium-term capital planning and establish an own funds target which allows an adequate buffer over the legal requirements of Pillar 1 to be maintained on a permanent basis. 2.1 Own funds target. The own funds target is that which the institution considers necessary to maintain both at present and in the future period addressed in its capital planning. The target should be in keeping with the risks inherent in the institution's activity, the economic environment in which it operates, the governance and risk management and control systems, the strategic business plan, the quality of the capital available (ratio of tier 1 own funds to total own funds) and the actual possibilities of obtaining more capital if needed. To determine the own funds target, once the capital needed under Pillar 1 has been calculated, the institution should, by means of the ICAAP, review and assess the other risks or factors that have not been considered and which, owing to their significance, should be taken into account. It should further estimate the capital needed to cover all risks and to maintain an adequate buffer in respect of the legal minimum capital requirements under Pillar 1. The own funds target is not automatically deducted from the arithmetic sum of the magnitudes obtained in the ICAAP and included in its summary (see final table of Annex 1), since to determine the own funds target, institutions should consider as a whole all the aspects referred to in the two foregoing paragraphs and which are explained in these guidelines. Insofar as the ICAAP brings to light larger capital needs additional to those of Pillar 1 or larger deficiencies in internal governance or in management or control of their specific risks, the larger the buffer in respect of the minimum capital requirements under Pillar 1 should be. Institutions should consider whether they need a greater capital buffer owing to a limited geographical or business sphere of operations. 5 The own funds target is a reference set by the institution itself, with a reasonable buffer or range of fluctuation, based on its future expectations. Institutions should attempt to ensure the medium term sustainability and consistency of this objective, irrespective of possible temporary imbalances which may arise as a result of adverse impacts or specific circumstances (e.g. one-off corporate transactions). The own funds target set should also enable institutions to meet their minimum capital requirements under Pillar 1 in the event of a severe economic recession or of clearly unfavourable business circumstances. Thus, institutions should use appropriate stress scenarios of the type and in the manner mentioned in Section 3.5 of these guidelines. If the own funds actually held are below the target set, the institution should inform the Banco de España of the causes of the situation and of the measures envisaged to return to this target. 2.2 Criteria for consideration in conducting the ICAAP The ICAAP gives priority to the quantitative aspects of risk management and to the estimation of capital needs. However, the importance accorded to the qualitative aspects of risk management and control should not be sidelined. Accordingly, there is a clear relationship between a credit institution's capital needs, on one hand, and the soundness and effectiveness of its internal governance, risk management and control systems and procedures, on the other. In performing the ICAAP, institutions should take into account the following criteria: - The assessment process is the responsibility of the institutions and should be carried out by them. Consequently, although these guidelines are intended to direct this process, it is the institutions that will decide its exact content and the extent and depth of the analysis, following the principle of proportionality set out in the paragraph below and which is fundamental so that they are not overburdened by this process. - The capital assessment process should be proportionate to the degree of sophistication of each institution's activities, to its risk management systems and to the approaches (standardised or advanced) used in Pillar 1. This proportionality principle (included in CEBS Guidelines) is especially applicable to small and less complex institutions. - Institutions should focus their internal capital adequacy assessment on organisational and control aspects and on the risks that are relevant to them and which may affect their current or future solvency. - The process should take into account the impact of the business cycle and also of adverse external conjunctural factors on the capital the institution needs. This will involve developing sufficiently detailed and rigorous stress scenarios for the various risks. Nonetheless, to this end the aforementioned principle of proportionality should also be taken into account. The result of the internal capital adequacy assessment process, should shortcomings or weaknesses be detected, need not be an increase in capital needs; it may also or alternatively entail the need to improve internal governance, the strengthening of risk management systems or the stepping up of internal controls. 6 The performance of the ICAAP does not mean that the risk management systems used by institutions should be changed, although in view of the result of such process it may be concluded that they should be improved. The internal capital adequacy assessment process should be based on the analysis of risks by the institution for the management of such risks, but at the same time it should have a useful solvency approach. Hence, when necessary, the necessary capital amounts derived from the assessment of risks from a management perspective should be reconciled with those deemed appropriate from a solvency perspective. This reconciliation is explained in greater detail in Section 3.4.2 of these guidelines. The calculations of the capital needed under Pillar 1 implicitly entail a wide diversification, since they have been calibrated for internationally active banks which, given their size and nature, have a significant diversification of their business. Consequently, institutions should, in the ICAAP, consider additional benefits of diversification in a prudent and sufficiently substantiated manner. The Banco de España will review and evaluate the ICAAP and the internal governance environment in which it is performed applying the risk-based approach to banking supervision (SABER, by its Spanish acronym). The dialogue on the ICAAP between the institution and the Banco de España will be an essential part of the review process. However, the Banco de España will also bear in mind other relevant information available to it, and specifically that arising from its status as supervisory authority. One important aspect of the ICAAP at those institutions which use advanced methods under Pillar 1 (IRB approach for credit risk, AMA for operational risk, or VaR models for market risk) is the self- assessment of compliance with the minimum requirements established in the Circular for their use (internal validation). However, this aspect of the ICAAP is beyond the scope of these guidelines, as it has been addressed in the Guidelines on the implementation and validation of advanced approaches previously published by the Banco de España, in line with the related CEBS guidelines on this matter dated 4 April 2006 and entitled Guidelines on validation. 3 Practical implementation of the ICAAP: yearly internal capital adequacy assessment report. To formalise the ICAAP and facilitate its review by the Banco de España, the capital assessment process should be included in a report known as the yearly internal capital adequacy assessment report (hereafter "the capital report"). This will be sent to the Banco de España along with the year- end own funds reporting and is therefore a confidential document. The report should contain the following sections: 1. Executive summary. 2. Internal governance, risk management and internal audit of risks. 3. Measurement of risks and quantification of the capital needed to cover them. 4. Aggregation of the capital needs and reconciliation adjustments. 7 5. Capital planning. 6. Programme of future measures. 7. Other matters. Given the importance this report will have for the institution itself and for the Banco de España review, the institution's management (Board of Directors or equivalent body) should be apprised of the report's content and approve it. Detailed below are the contents of the different sections of the report. The institutions should, however, adapt the content of the capital report to their own needs and circumstances, as this report should contain the relevant information substantiating the summary, conclusions and programme of future measures. The principle of proportionality to be applied in the internal capital adequacy assessment process should also be reflected in the content of the report, so that it is focused on the relevant risks and aspects for the institution. The capital report should be self-explanatory. However, to prevent institutions from duplicating information published previously on their own initiative or in compliance with legislation, the various sections of the report, except Section 1 (executive summary and conclusions) and Section 6 (programme of future measures), may be completed through the inclusion of parts of other previously published reports, indicating the source. Such sections should be updated and attached as annexes. In any event, the information included should conform to the aim and requirements of the capital report. Given the foreseeable stability over time of the systems and procedures relating to internal governance, risk management and internal audit of risks, the sub-sections of Part 3,2 of the report may be completed by reference to the sub-sections of the report submitted in the previous two years, as long as significant changes have not taken place. Nevertheless all the sections relating to internal capital adequacy assessment should be updated every year and a general update of Section 3.2 of the report carried out every three years. Annex 1 includes a report format which concludes with the summary ICAAP return. In case of groups of credit institutions the summary return should be broken down by significant institution. To this end significant institutions will be identified in Section 1 of the capital report. This identification will, when appropriate, be carried out in co-operation with other supervisors. The different sections or sub- sections of the report should also be broken down by significant institution when there are major differences with respect to the group. 3.1 Executive summary and conclusions. The aim of this section of the report is to offer an overview of the internal capital adequacy assessment process and of the main conclusions, which are set out in greater depth in the other sections of the capital report. First, the scope of application of the ICAAP should be indicated (individual institution, consolidated or sub-consolidated group) and, if a consolidated group of credit institutions is involved, the institutions included in the ICAAP should be listed in an annex, showing those considered 8 significant for the purpose of the last paragraph of section 3. According to that paragraph, if in a group of credit institutions there are significant differences in any relevant subsidiary credit institution with respect to the group as a whole, such differences should be specified in the related section of the capital report, indicating the institution where such differences are present and, where appropriate, the envisaged period within which the subsidiary institution in question will come under the general managerial scope of the group. Since the capital report contains sections relating to different departments of the institutions, the department or person responsible for the integration of the different parts and for their review should be indicated. The capital report will indicate the contact person with the Banco de España on matters relating to the capital report2. The capital report should be signed by the individual designated as the contact person for the Banco de España. The date of its approval by the Board of Directors or equivalent body should be indicated. Next, this section should reflect the following: 3.1.1 Risk profile of the institution The material risks to which the institution is expo