Circular Finanstilsynet's methodologies for assessing risk ... · Finanstilsynet does consider that using that reporting format will save time both for reporting entities and for

Circular

Finanstilsynet's methodologies for assessing risk and

capital needs

CIRCULAR: 9/2015

DATE: 14.08.2015

THIS CIRCULAR IS APPLICABLE TO: Commercial banks

Savings banks Financial holding companies

Mortgage companies Finance companies

Investment firms Management companies offering

portfolio management Alternative investment fund managers

offering portfolio management

FINANSTILSYNET P.O.Box 1187 Sentrum

NO-0107 Oslo

Finanstilsynet's methodologies for assessing risk and capital needs

2 | Finanstilsynet

Contents

1 Introduction 3

2 Legislative basis 4 2.1 Internal governance and requirements on institutions' assessment of risk

and capital needs (ICAAP) 4 2.2 The supervisory authorities' review of an institution's risk and capital needs

(SREP) 5

3 A closer look at requirements on the institution's assessment of risk and capital needs (ICAAP) 5

3.1 Main principles for the ICAAP process 5 3.2 Projections under stressed economic conditions 7 3.3 Board of directors' accountability 7

4 Main elements of the supervisory authorities' review of institutions' risk and capital needs (SREP) 8

4.1 Dividing institutions into categories 8 4.2 Ongoing monitoring of risk 10 4.3 Elements of the SREP framework 10 4.4 Supervisory instruments, corrective measures and orders 11 4.5 Early intervention 11

5 Finanstilsynet's review of risk level and capital needs 11 5.1 Review of inherent risks and associated capital needs 12

5.1.1 Review of risks 12 5.1.2 Assessment of capital needs 12 5.1.3 Overall capital for inherent Pillar 1 and Pillar 2 risks 14

5.2 Capital needs in a forward-looking perspective, stress tests and the relationship to the Pillar 1 buffer requirements 16

6 Review of liquidity and funding 17 6.1 Institutions' assessment of liquidity risk and funding risk (ILAAP) 17 6.2 Finanstilsynet's review of liquidity risk and funding risk (SREP) 17

7 Supervisory tools and communication with institutions 18

8 Risk assessment and capital assessment for cross-border groups 19

9 Timing of implementation 20


Finanstilsynet | 3

1 Introduction

This circular describes the main elements of Finanstilsynet's methodology for reviewing institutions' overall risk level and need for capital (SREP1). Finanstilsynet's methodology builds inter alia on guidelines from the European Banking Authority published in December 2014.2 The object of describing Finanstilsynet's methodology is to promote transparency. This circular also covers Finanstilsynet's requirements on the process for, and the content of, institutions' risk and capital assessments (ICAAP). It replaces circular 21/2006, 26/2007 and circular 28/2007. The circular applies to:

• commercial banks, savings banks, mortgage companies, finance companies and holding companies in groups of which such companies form part

• investment firms, management companies authorised to provide portfolio management

services, managers of alternative investment funds authorised to provide portfolio management services and institutions covered by the consolidation requirement of the Securities Trading Act section 9-21

The Basel Committee presented new capital and liquidity standards for the banking industry, Basel III, on 16 December 2010. In the EEA these recommendations are implemented in Directive 2013/36/EU (CRD IV) and Regulation 575/2013 (CRR).3 Amendments of 2013 to the Financial Institutions Act and the Securities Trading Act gave CRD IV's capital and buffer requirements effect in Norway from 1 July 2013.4 Associated amendments to regulations to these acts, adopted on 22 August 2014, became effective on 30 September 2014. A new Financial Institutions Act, adopted on 7 April 2015, comes into force on 1 January 2016. Reference is made below to relevant sections of the new Financial Institutions Act. The requirements on institutions' risk and capital assessments and the supervisory authorities' review of institutions' overall risk level and capital needs stand firm. The main principles of Pillar 2 are:

• Institutions shall have in place a process for assessing their overall need for capital in relation to their risk profile and a strategy for maintaining their level of capital.

• The supervisory authority shall monitor and evaluate an institution's assessment of its need for capital and associated strategy. The supervisory authority shall take steps if it does not consider this process to be satisfactory.

1 SREP – Supervisory review and evaluation process 2 http://www.eba.europa.eu/documents/10180/935249/EBA-GL-2014-13+%28Guidelines+on+SREP+methodologies+and+processes%29.pdf/4b842c7e-3294-4947-94cd-ad7f94405d66 3 Replacing earlier capital adequacy directives (2006/48/EU and 2006/49/EU). CRD IV comprises EEA-relevant legislative acts, thus far not incorporated in the EEA Agreement. 4 Investment firms are currently excepted from the buffer requirements provisions; see the Securities Trading Regulations section 9-49(2), see the Securities Trading Act section 9-15a(7).

http://www.eba.europa.eu/documents/10180/935249/EBA-GL-2014-13+%28Guidelines+on+SREP+methodologies+and+processes%29.pdf/4b842c7e-3294-4947-94cd-ad7f94405d66




4 | Finanstilsynet

• The supervisory authority shall expect institutions to hold capital in excess of the minimum capital adequacy requirement.

• The supervisory authority shall intervene at an early stage to prevent capital from falling below the minimal level required to support an institution's risk exposure. The supervisory authority shall take steps where the level of capital is not maintained.

Basel III and CRD IV assign the same importance to Pillar 2 as previously. This circular illuminates areas that are new or that will acquire increased importance in the assessment of institutions' risks and capital needs. In addition to meeting minimum requirements and various types of buffer requirements under Pillar 1, institutions must, in their capital adjustment, make allowance for risks not covered by Pillar 1. The EBA has started work on developing benchmarks for use by supervisory authorities when assessing entities' risk and associated need for capital under Pillar 2. The EBA's development of benchmarking methodology will inform Finanstilsynet's further development of its own methods for assessing risks and capital add-ons under Pillar 2.

2 Legislative basis

2.1 Internal governance and requirements on institutions' assessment of risk and capital needs (ICAAP)

Articles 73 to 96 of the CRD IV Directive establish new, more detailed requirements for institutions' internal organisation and governance. Article 73 of the Directive establishes that in addition to fulfilling the capital adequacy requirement under Pillar 1, institutions shall have in place a process for assessing their overall need for internal capital relative to their risk profile (ICAAP) and a strategy to maintain their level of capital. Article 87 of the Directive introduces a new requirement that institutions shall under Pillar 2 identify, manage and monitor the risk of excessive debt accumulation. The leverage ratio is referred to as an indicator for such risk. Article 76 describes the board of directors' responsibility for monitoring and managing the institution's overall risk and includes a requirement for the board to establish a risk committee. Requirements for the assessment of risk and overall capital needs are implemented in Norwegian legislation in the new Financial Institutions Act section 13-6. Directive requirements on internal governance, including requirements on risk control functions, are set out in the new Financial Institutions Act section 13-5. See also the capital requirements regulations chapter 47 and regulations on risk management and internal control. Requirements on internal organisation and governance at investment firms are described in the Securities Trading Act section 9-14 subsection (2) and in the Securities Trading Regulations, Part 3, Chapter 9 III. Requirements on investment firms' assessment of overall need for capital are set out in the Securities Trading Act section 9-16 subsections (1) to (4).


Finanstilsynet | 5

2.2 The supervisory authorities' review of an institution's risk and capital needs (SREP)

The provisions governing the supervisory authorities' review of institutions' risk and capital assessment process (SREP) are retained in CRD IV with the addition of the following new provisions:

• The supervisory authorities shall, in addition to assessing evaluating risks for the institution in isolation, also evaluate risks that an institution poses to the financial system; see Article 97.

• The supervisory authorities may impose higher capital requirements on groups of institutions that are exposed to, or pose, similar risks; see Article 103.

These provisions are implemented in the new Financial Institutions Act section 14-6 on supervisory follow-up, corrective measures and orders. As regards investment firms, the provisions on the supervisory authorities' review of an institution's risk and capital assessment process (SREP) are covered in the Securities Trading Act section 9-16 subsection (5), while section 9-18 deals with corrective measures and orders.

3 A closer look at requirements on the institution's assessment of risk and capital needs (ICAAP)

3.1 Main principles for the ICAAP process The principles underlying the ICAAP process as set out in circular 21/2006 and circular 28/2007 are essentially retained; see appendix 1A. All institutions are required regularly to evaluate the composition and the level of the risks to which they are or might be exposed, the quality of their management and control of the various risks, and equally to assess whether the level, composition and distribution of their aggregate capital is proportionate to the level of risk. The evaluation must cover all material risks that may affect the institution's ability to honour its commitments upon falling due. Evaluations shall include stress tests. As regards groups of institutions, the evaluation shall cover the entire group and show the distribution of risk and capital needs for each of the main entities in the group. For foreign groups with sub-groups in Norway, the evaluations must cover all Norwegian sub-groups. The evaluation of risk level and capital needs must be carried out and documented at least once a year or more often if called for by material changes in the institution's operating environment, activity level or risk picture. Appendix 1B provides an updated overview of the required content of an institution's ICAAP documentation. The capital assessment must show the minimum requirement under Pillar 1 for credit risk, market risk and operational risk, and capital needs for risks not covered by Pillar 1 (i.e. Pillar 2 risks). Capital used to meet the minimum requirement and the overall buffer requirement under Pillar 1 cannot be used to


6 | Finanstilsynet

cover Pillar 2 risks. Reply form (i) in appendix 1C is mandatory and must be completed by the institution as part of its ICAAP documentation. Independent investment firms that are not part of a banking group must complete reply form 1D. While investment firms are not obliged to utilise the format in enclosure 1D, Finanstilsynet does consider that using that reporting format will save time both for reporting entities and for Finanstilsynet. Any themes in the reply form that are not covered in the institution's reporting will most likely need to be covered by additional reporting or through other supervisory activities. In addition to the evaluation of risk level and capital needs, the ICAAP documentation must contain a summary of the institution's financial situation, including its strategic and market position and likely future profitability. Further, the institution's capital plan must be documented by a strategy to maintain the institution's financial position, a strategy for dividend distribution, along with targets for capital level in the short and long term. Compared with circular 21/2006 and circular 28/2007, the following risk factors are assigned increased significance:

• Liquidity risk and funding risk shall be an important part of the overall risk assessment, and shall take into account possible unexpected losses resulting from asset sales and increased funding costs in stressed periods. The evaluations shall also cover risk exposure resulting from the transfer of the institution's assets to, or the posting of such assets in favour of, other financial institutions. The institution's internal evaluation of liquidity and funding risk (ILAAP5) may be conducted as part of the ICAAP and described in the same document6.

• Institutions/groups with subordinate entities that provide insurance services must

evaluate insurance risk.

• Institutions must evaluate risk associated with their future pension obligations. An institution is expected to document its use of sensitivity tests to estimate the effect of, for example, rate-of-return expectations, discount rate, annual wage growth and longevity assumptions. The results of the sensitivity tests in the form of increased obligations can be viewed against possible deductions from equity capital for overfunding of pension commitments in the calculation of capital adequacy under Pillar 1.

• Institutions shall evaluate systemic risk, i.e. the risk of an unstable financial situation becoming so widespread as to trigger a systemic impairment in which economic growth and welfare are seriously impacted.

• The ICAAP must contain an evaluation of the risk of excessive debt accumulation in the institution.

5 ILAAP - Internal liquidity adequacy assessment process 6 In the following, the term ICAAP may refer both to capital and liquidity.


Finanstilsynet | 7

3.2 Projections under stressed economic conditions Institutions shall develop a framework for stress testing and associated capital management that incorporates all material risks to which the institution is, or might be, exposed. The stress test methodology shall cover serious economic setbacks. Mild, brief downturns such as Norway has experienced after the banking crisis in the early 1990s are not sufficient. At least one scenario shall represent a reverse stress test in which at least one year produces negative profit. An institution must show the result of its stress tests in the ICAAP in the form of the outturn for its liquidity and funding situation as well as for its CET1 capital adequacy in the stress test period. The ICAAP shall document how stress testing is employed in the institution's capital planning. It shall against the background of stress tests carried out assess and show whether the capital conservation buffer is sufficient to cope with a serious setback.

3.3 Board of directors' accountability Finanstilsynet will continue to emphasise the need for the board of directors to carry through a sound process to ensure that the institution holds sufficient capital relative to its overall risk profile. The board of directors is responsible for ensuring that the ICAAP document is updated regularly and that it is an integral part of the institution's management process and decision-making system. The board of directors must see to it that procedures are in place to ensure that the level of risk and need for capital are updated as and when required and at least once per year. The board of directors shall ensure that the annual ICAAP documentation is evaluated by a body independent from the institution's administration. The independent evaluation should be part of the basis for the board of directors' decisions with regard to the ICAAP. The ICAAP and associated internal methodology and processes should be proportionate to the institution's size, scope and complexity. For further details of the classification of institutions, see chapter 4 on proportionality and supervisory follow-up. Institutions that use internal models as support for their capital assessments shall ensure that the models are sufficiently conservative and promote prudent measurement and management of risks. It is important in this context for an institution's management team and board of directors to have an overview and knowledge of the models' characteristics as well as their limitations in terms of underlying assumptions and result prediction.


8 | Finanstilsynet

4 Main elements of the supervisory authorities' review of institutions' risk and capital needs (SREP)

The following figure gives an overview of the content of the supervisory review of risk level and capital needs (SREP).

Division of institutions into categories Ongoing risk monitoring

Elements of SREP Analysis of business model

Review of group-wide governance and control systems

Review of risk and capital needs:

Review of liquidity and funding

• Review of inherent risks • Review of liquidity risk and funding risk

• Review of risk management and control

• Review of management and control of liquidity risk

• Stress tests and decision on capital needs

• Stress tests and decision on liquidity instruments

Supervisory instruments, corrective measures and orders Capital Liquidity Other instruments

Early intervention

The elements of the above figure are described below.

4.1 Dividing institutions into categories Finanstilsynet will divide entities into five categories based on size, complexity and area of business, as well as degree of risk the institution poses to the financial system. The classification will determine the frequency and the scope of Finanstilsynet's assessments and dialogue with the institutions. See the table below. Category 1 comprises institutions which the Ministry of Finance deems to be systemically important in Norway; see Regulations of 12 May 2014 no. 627 on the identification of systemically important financial institutions. These are currently DNB ASA, Nordea Bank Norway and Kommunalbanken AS. Category 2 comprises large or medium-sized institutions mainly operating in the domestic market but with high market shares nationally or regionally. They operate across several lines of business – including offering loan facilities and other financial products to the retail and corporate markets. This category currently numbers 15 banks. Category 3 comprises small and medium-sized institutions operating in a limited number of lines of business mainly in a local geographical area of Norway. They have a limited product


Finanstilsynet | 9

range and mainly offer loans to the retail market and small and medium-sized local businesses. This category comprises other Norwegian institutions (beyond those in categories 1 and 2) with assets totalling in excess of NOK 3 billion. Category 4 comprises small institutions operating in a local geographical area of Norway. They have a limited product range and offer mainly loans to the retail market and small and medium-sized local firms. This category comprises Norwegian institutions with assets totalling NOK 3 billion or less. Category 5 comprises independent investment firms, management companies authorised to provide portfolio management services and managers of alternative investment funds authorised to provide portfolio management services. The above classification may be revised. The category to which the individual institution is assigned will depend on changes in the institution's size, activity level, risk level and significance for the financial system. Frequency of SREPs for the various categories of institutions:

Category Risk monitoring

Detailed SREP review with written feedback

Simplified and overarching SREP review

Scope of contact with the institution

1 Quarterly Annually Annually Regular contact with board of directors and management team

2 Quarterly Every second year Annually Regular contact with board of directors and management team

3 Quarterly Every third year Annually Contact with board of directors and management team when called for based on risk, at least every third year

4 Quarterly Every third year Annually Contact with board of directors and management team when called for based on risk, at least every third year

5 Quarterly Depending on risk assessment

Annually Contact with board of directors and management team when called for based on risk assessment

Proportionality considerations entail that not all risk factors will be equally relevant to all institutions. Hence different aspects of the SREP process will receive differing emphasis and be conducted with varying granularity based on the institution's size, business model and complexity.


10 | Finanstilsynet

4.2 Ongoing monitoring of risk Along with its monitoring of macroeconomic trends and financial market developments, Finanstilsynet monitors individual institutions on an ongoing basis. Selected risk indicators and financial key figures are tracked with a basis in periodically reported data and other information from the financial markets. The monitoring is based on quarterly data, but may increase in intensity when called for by market developments. The object is to identify institutions on a negative trend as early as possible. In addition to the quarterly monitoring of all institutions, Finanstilsynet conducts each year a risk analysis of the largest banking groups. In the case of small entities a simplified and general annual risk analysis is performed. The quarterly risk monitoring and the annual risk analyses are the basis for prioritising among supervisory activities and are used as input for Finanstilsynet's detailed SREPs (see further details in chapter 5).

4.3 Elements of the SREP framework

Analysis of business model The institution's business model and overall strategy will form a basis for Finanstilsynet's assessment of risks and capital needs. The business model assessment could involve analyses at sub-group level in the case of larger groups, analyses of individual entities, as well as thematically based analyses for groups of local savings banks. The analyses may cover assessments of an institution's risk appetite, risk strategies, market-related framework conditions and various customer segments' and products' contributions to the institution's balance sheet structure, risk profile and profitability. The assessments will seek to judge the institution's viability in the short and long term. The analysis of the business model will start out from documentation received and evaluations made in connection with on-site inspections, ICAAP documentation and ordinary periodic reporting of risk data and financial data to Finanstilsynet. Review of overall management and control The SREP will include an assessment of the institution's overall management and control systems, and assessments of the management and control of individual risks. The assessments will be based on information about the institution's internal governance, corporate and risk culture, organisation and leadership, remuneration arrangements, risk management systems and internal control, internal audit and other independent control functions, reporting and management control tools and recovery plans. An important matter in this respect will be to assess to what extent the institution's strategy, policies, procedures and compliance are implemented across the entire group, and that the institution's risk measuring systems include uniform data from all units. The review of overall management and control will start out from the documentation received, and assessments made in connection with on-site inspections, ICAAP documentation and ordinary periodic reporting of data to Finanstilsynet. Review of risk and capital needs Finanstilsynet will review inherent risks to which the institution is exposed, and the institution's management and control of those risks. Further, systemic risk will be assessed, as well as results of the institution's stress tests compared with the results of Finanstilsynet's own stress tests. The risk assessments will end in a supervisory review of the institution's need for capital. Chapter 5 gives further details.


Finanstilsynet | 11

Review of liquidity and funding As part of the SREP, Finanstilsynet will attach importance to assessing the institution's liquidity reserves and funding risk, and the institution's management and control of those risks. Chapter 6 gives further details.

4.4 Supervisory instruments, corrective measures and orders The Financial Supervision Act, the new Financial Institutions Act section 14-6 and the Securities Trading Act section 9-18 provide the legal basis for Finanstilsynet's authority and use of policy instruments. Finanstilsynet's SREP assessments may impose institution-specific requirements as to capital level, level of liquidity key figures or funding structure. In some cases it could be relevant for Finanstilsynet to ask the institution to reduce its risk exposure or take other risk-mitigating steps, including changing policies, limits, making improvements to the management and control of the risk concerned. Chapter 7 gives further details.

4.5 Early intervention Sudden, unforeseen events may arise in markets or in individual institutions that cause an institution's capital adequacy to deteriorate rapidly and with great effect. This could cause triggers in the institution's recovery plan to be released or, at worst, jeopardise the institution's ability to fulfil the minimum requirement under Pillar 1. In such cases the authorities will review the institution's viability and may initiate early intervention. Attention is drawn to the new Financial Institutions Act, and to the ongoing process of implementing Directive 2014/39/EU (Crisis Management Directive) in Norwegian legislation.

5 Finanstilsynet's review of risk level and capital needs

Finanstilsynet will in its risk and capital review draw a distinction between the two following main elements when Pillar 2 add-ons are to be determined:

• Capital needs for inherent risks based on a risk level over a twelve-month term. This need will be assessed independently of the buffer requirements of Pillar 1. Finanstilsynet will expect the institution to maintain this capital add-on at all times.

• Capital needs in a forward-looking perspective arising from a stressed situation

featuring a serious economic setback in which the capital conservation buffer under Pillar 1 is not sufficient.

Both components of the Pillar 2 capital add-on must be covered by common equity tier 1 capital. Capital used to cover the minimum requirement and the overall buffer requirement under Pillar 1 (including the effect of the current Basel 1 floor) cannot be used to cover Pillar 2 add-ons.


12 | Finanstilsynet

5.1 Review of inherent risks and associated capital needs

5.1.1 Review of risks Finanstilsynet's review of inherent risks at the individual institution will start out from the institution's own risk analyses in its ICAAP. The institution's risk analyses will be compared with those conducted by Finanstilsynet. Finanstilsynet has procedures that involve the preparation of an annual, overall risk review for the largest banking groups. This is an internal document used as a basis for the SREP. In the case of smaller banks, simplified risk analyses are prepared. The overall risk assessment is done with a basis in an analysis of the institution's business model and covers credit risk, concentration risk, market risk, operational risk, liquidity and funding risk and other risks of significance to the individual institution; see the new Financial Institutions Act Section 13-6, the Securities Trading Act section 9-16 and the Capital Requirements Regulations chapter 47. For a more detailed description of factors included in Finanstilsynet's assessments of an institution's risk exposure in the areas of credit risk, concentration risk, market risk and operational risk, see Finanstilsynet's modules for risk-based supervision published on Finanstilsynet's website7. Each module contains a component for assessment of risk level and component for assessment of management and control. As a conclusion to the annual overall risk analysis, Finanstilsynet will consider what measures will be relevant to apply at the institution. 5.1.2 Assessment of capital needs Finanstilsynet's assessment of capital add-ons for risks not covered by Pillar 1 will take a basis in individual risks and the institution's own calculations of capital needs in their ICAAP. Finanstilsynet will in addition make its own schematic estimates, make comparisons with other entities and apply discretionary judgement. Account will be taken of the risk of unexpected loss or profit fluctuations in a 12-month perspective, risk associated with possible flaws in the institution's management and control systems and the risk that the institution's models used to calculate capital needs understate risk and the need for capital. In the case of credit risk, market risk and operational risk, Finanstilsynet will review the institution's reporting and capital adequacy relative to the minimum requirements of Pillar 1 and compare this calculation with the capital needs emerging in the institution's ICAAP. The minimum requirement under Pillar 1 including any effects of the Basel 1 floor will form a minimum for Finanstilsynet's assessment of the capital needed for each of these risks. Hence capital used to meet the Basel 1-floor requirement under Pillar 1 cannot be used to meet non-Pillar 1 risks. Finanstilsynet's SREPs will as previously address elements of credit risk, market risk or operational risk that are not covered by the minimum requirement. Any diversification effects between various risk types, including credit risk, market risk and operational risk, will not be taken into account in Finanstilsynet's assessment of the institution's overall need for capital.

7 http://www.finanstilsynet.no/no/Bank-og-finans/Banker/Tema/Kapitaldekning/Vurdering-av-risiko-og-kapitalkrav-/Risikobasert-tilsyn-banker/

http://www.finanstilsynet.no/no/Bank-og-finans/Banker/Tema/Kapitaldekning/Vurdering-av-risiko-og-kapitalkrav-/Risikobasert-tilsyn-banker/



Finanstilsynet | 13

Risk associated with credit portfolios Close analysis of the composition and quality of institutions' credit portfolios, including counterparty exposures, and associated capital needs will constitute an important part of Finanstilsynet's SREPs. The design of capital requirements for credit risk under Pillar 1 starts out from the assumption of a broadly diversified credit portfolio. Credit-related concentration risk may arise where individual exposures or groups of exposures with the same risk of loss are so large that risk weights calculated under Pillar 1 fail to reflect the risk posed by the overall exposure. This may for example apply to a concentration on individual clients, sector or geography. When considering a possible Pillar 2 add-on for concentration risk, Finanstilsynet will give weight to three factors in particular:

- concentration on individual clients - concentration on a sector - exposure to corporates outside the institution's geographical core area

As regards the calculations' methodology and basis, see appendix 2 to this circular as published on Finanstilsynet's website. In addition to the above add-ons for concentration risk, further add-ons may be made for:

- institutions with particularly high lending growth - institutions that calculate minimum capital requirements using the standardised

approach, and whose corporate client portfolio is of materially poorer quality than that of other institutions (benchmark)

Pillar 2 add-ons may also be relevant in cases where the sufficiency of an institution's write-downs on single exposures or sub-portfolios is uncertain. Market risk In connection with the SREP an assessment is made of market risk in both the banking book and the trading book. Sensitivity tests are used to specifically assess interest rate risk, credit spread risk, equity risk and exchange rate risk. As a general rule the risk assessment is based on the market risk limits established by the institution. The results of the sensitivity tests provide a basis for assessing capital need for market risk and are viewed relative to capital required under Pillar 1 and the institution's own calculations in its ICAAP. In the SREP process Finanstilsynet will not take into account possible diversification effects between various types of market risk when calculating the need for capital against market risk. Based on experience from the previous financial crisis, Finanstilsynet points out that unexpected losses on equity portfolios and fixed income portfolios can arise simultaneously in a mutually reinforcing manner, thereby creating a risk of concentration effects. For a description of Finanstilsynet's sensitivity test, see appendix 3 to this circular as published on Finanstilsynet's website.8 8 http://www.finanstilsynet.no/no/Bank-og-finans/Banker/Tema/Kapitaldekning/Vurdering-av-risiko-og-kapitalkrav-/

http://www.finanstilsynet.no/no/Bank-og-finans/Banker/Tema/Kapitaldekning/Vurdering-av-risiko-og-kapitalkrav-/

http://www.finanstilsynet.no/no/Bank-og-finans/Banker/Tema/Kapitaldekning/Vurdering-av-risiko-og-kapitalkrav-/


14 | Finanstilsynet

Operational risk A Pillar 2 add-on may also be relevant for factors related an institution's operational risk. Examples of such risks are consistent flaws in an institution's IT systems, or non-compliance with legislation, for example the Anti-Money Laundering Act and associated regulations. Risk associated with pension obligations An institution's future pension obligations to its employees may be considerable. The risk associated with such obligations is not included under Pillar 1. This risk should therefore be assessed in Pillar 2. Finanstilsynet will in the first instance assess and compare institutions' methodology and associated results. Finanstilsynet will at a later stage consider the merits of developing a method specific to this area. Risk of excessive debt accumulation The leverage ratio will be used as an indicator for a high share of external funding and excessive debt accumulation. Among factors that may be assessed under this point is the trend in leverage ratio over time, including a forward-looking assessment that takes account of the institution's growth ambitions and business strategy. The effect on the leverage ratio will be included in Finanstilsynet's stress tests. Systemic risk In the new Financial Institutions Act section 13-6 and the Securities Trading Act section 9-16, systemic risk is listed as a risk to be taken into account by entities in their overall assessment of risk level and associated capital needs. In the SREP, Finanstilsynet will consider whether an institution or a group of entities stands to be particularly exposed to systemic risk, or whether such institution or group of entities contributes to systemic risk. Stress tests will be a tool in such an assessment. Use of supervisory instruments under Pillar 2 will be viewed in conjunction with buffer requirements established under Pillar 1. Other risks An institution's business model and risk exposures may create vulnerabilities to Pillar 2 risks other than those mentioned above. Relevant examples are strategic risk, business risk and owner risk. This will be reviewed by Finanstilsynet as part of the SREP. Over time it may also be relevant for Finanstilsynet to develop indicators specifically with a view to capital add-ons for risks other than those explicitly mentioned above. Consequences of future changes in the minimum requirement under Pillar 1 Future changes in Pillar 1 requirements could move Finanstilsynet to revise the content of Pillar 2 assessments. The Basel Committee is working on proposals for a number of revisions to the standardised approach for credit risk and on a new standardised approach for operational risk. Work is also in progress on changes to the design of the standardised approach for risk in the trading book and on assessing whether interest rate risk in the banking book should be included in Pillar 1. Capital calculations based on a new standardised approach could also be employed as a floor for capital calculations using IRB models. Capital needs under Pillar 2 will be affected if the above changes to Pillar 1 are carried through. 5.1.3 Overall capital for inherent Pillar 1 and Pillar 2 risks Finanstilsynet's assessment of an institution's minimum capital need (Pillar 1 + Pillar 2) in per cent of risk weighted assets (including current Basel 1 rules) will be determined as a sum of:


Finanstilsynet | 15

- The minimum capital requirement of 8 per cent under Pillar 1 (including at least 4.5 per cent CET1 capital and 6 per cent tier 1 capital) with the addition of buffer requirements under current capital adequacy rules, and

- A CET1 requirement of X per cent to cover risks to which the institution is exposed which are not covered, or are only partially covered by the Pillar 1 minimum requirement (Pillar 2 add-on).

Finanstilsynet requires the Pillar 2 add-on for inherent risks to be covered by CET1 capital, i.e. capital with the best loss-absorbing capacity. Finanstilsynet expects the Pillar 2 add-on to be maintained at all times. An institution cannot meet the Pillar 2 add-on with capital that is used to meet the minimum Pillar 1 requirement (including the Basel 1 floor) or capital that is used to meet the overall buffer requirement under Pillar 1 (countercyclical capital buffer, systemic risk buffer and, if appropriate, the buffer for systemically important financial institutions and the capital conservation buffer). The figure below illustrates the connection between the minimum requirement under Pillar 1, Pillar 2 add-ons and the overall buffer requirement under Pillar 1. The figure should be read from the bottom up. See also the description in chapter 7 of supervisory instruments and communication with institutions. Overall capital need in the SREP

CET1 = common equity tier 1 capital, AT1 = other eligible additional tier 1 capital, T2 = tier 2 capital

Pillar 1 (CET1, AT1 and T2)

Pillar 2 (CET1)

Countercyclical capital buffer (CET1)

Systemic risk buffer and buffer for systemically

important financial institutions (CET1)

Capital conservation buffer (CET1)

Assessed minimum capital need = P1+P2


16 | Finanstilsynet

5.2 Capital needs in a forward-looking perspective, stress tests and the relationship to the Pillar 1 buffer requirements

Finanstilsynet will employ its own stress tests to assess the consequences of a serious economic setback for individual institutions. A serious economic setback shall have a duration of at least three years. Assumptions, scenarios and results of Finanstilsynet's stress tests will be compared with assumptions, scenarios and results of the institution's own stress tests in its ICAAP. The economic downturn scenario that Finanstilsynet will utilise in its stress tests will be stringent, but realistic. Finanstilsynet's stress tests will contain inter alia assumptions that affect the banks' credit portfolios, portfolios of financial instruments and funding conditions. The stress test results will be compared with a baseline scenario. The stress tests will show results for the development of the institution's balance sheet and risk weighted assets, funding costs and net interest income, earnings on financial instruments, other substantial income and expense components, write-downs and losses as well as of capital adequacy, leverage ratio and ability to pay shareholder dividends. Based on the proportionality principle, the granularity and scope of Finanstilsynet's stress tests will vary depending on the institution's size and complexity. Annual stress testing will in principle be conducted for all Norwegian banks and mortgage companies. Should the result of the stress test show that an institution will, in a serious economic setback lasting at least three years, see its CET1 capital ratio reduced by more than 2.5 percentage points, i.e. exhausting its entire capital conservation buffer, Finanstilsynet will indicate to the institution that it should increase its overall common equity tier 1 capital ratio, i.e. establish a planning buffer. See the illustration in the figure below. Institution A (SIFI) Institution B (SIFI)

Planning buffer (CET1)

Systemic risk buffer and buffer for systemically important

financial institutions (CET1)



Pillar 2 (CET1)



Systemic risk buffer and buffer for systemically important

financial institutions (CET1)


Pillar 2 (CET1)



Finanstilsynet | 17

CET1 = common equity tier 1 capital, AT1 = other eligible additional tier 1 capital, T2 = supplementary capital In the column for institution A to the left, the institution sees its CET1 capital ratio reduced by more than 2.5 percentage points, i.e. exhausting its entire capital conservation buffer. In light of such result, Finanstilsynet could consider the institution to be in a vulnerable capital situation and in need of a planning buffer extending beyond the capital need ensuing from the minimum requirements under Pillar 1, capital add-ons to cover Pillar 2 risks and the overall buffer requirement under Pillar 1. A planning buffer on top of the overall buffer requirement of pillar 1 must be met by common equity tier 1 capital.

6 Review of liquidity and funding

6.1 Institutions' assessment of liquidity risk and funding risk (ILAAP)

Institutions' own assessment of liquidity risk and funding risk should open with a description of strategies, policies and limits in that area. An institution should describe its need for liquidity in the short and medium term, including liquidity needed for day-to-day liquidity balancing, and results of conducted stress tests. The size, composition and quality of the institution's liquidity buffer should be shown, along with the development of quantitative measurement parameters such as the liquidity coverage ratio (LCR) and the net stable funding ratio (NSFR). The description of funding risk will highlight information on maturity profile, concentration on funding sources, market access, future funding needs and funding plans. Institutions should also describe management and control systems in the above area, including the design of forecasts, stress tests and contingency plans.

6.2 Finanstilsynet's review of liquidity risk and funding risk (SREP)

Finanstilsynet's review of entities' liquidity risk and funding risk will be an important part of the SREP: see the new Financial Institutions Act section 13-7 and the Securities Trading Act section 9-15b. Finanstilsynet's review will build on a number of sources, including the institution's own assessment as presented in its ICAAP/ILAAP. Documentation and assessments connected to on-site inspections, periodic reporting of liquidity indicators and financial data along with associated analyses will also be material informing the risk assessments. The scope and design of liquidity management, systems and funding plans will be assessed in relation to the institution's size and complexity. For a further description of factors included in the review of institutions' risk exposure in the areas of liquidity risk and funding risk, see Finanstilsynet's webpages. The website also


18 | Finanstilsynet

describes modules for risk-based supervision.9 Like other risk modules, the module for liquidity risk and funding risk contains a component for assessing risk level and a component for assessing the quality of management and control. Finanstilsynet will consider the adequacy of an institution's liquidity reserves and whether the quality of management and control is satisfactory. The review may lead to the institution being asked to improve management and control, reduce risk exposure, take steps to improve its liquidity and funding structure or increase its capital. If called for by the risk situation, Finanstilsynet may order the institution to report its liquidity situation more frequently, or demand that it adjusts to a raised level of liquidity key figures, for example LCR and NSFR.

7 Supervisory tools and communication with institutions

The ICAAP/SREP dialogue with an institution will result in final feedback from Finanstilsynet to the institution's board of directors. The frequency of the detailed SREP response is shown in the table in chapter 4.1. Feedback to institutions will be based on Finanstilsynet's review of overall risk level and will contain a conclusion regarding the institution's overall need for capital. In addition to assessing the need for capital over and above the minimum required by Pillar 1 and the overall buffer requirement, Finanstilsynet may ask the institution to reduce its risk exposure or to take other risk-mitigating measures, including revising policies, limits or making improvements to its management and control. Finanstilsynet will require the institution to have an overall capital that covers:

1. The minimum capital requirement of 8 per cent under Pillar 1 (including at least 4.5 per cent CET1 capital and 6 per cent tier 1 capital) under current capital adequacy rules, and

2. A Pillar 2 add-on of X per cent to cover further capital needs resulting from risks to which the institution is exposed which are not, or are only partially, covered by the minimum requirement under Pillar 1. The add-on shall be met by common equity tier 1 capital.

3. An overall buffer over and above point 1 point 2 consisting of common equity tier 1 capital to cover the sum of the buffer requirements of Pillar 1 that are in effect at any time.10

Finanstilsynet shall be notified immediately if an institution has reason to believe that its capital adequacy ratio will fall below, or has already fallen below, its overall need for capital, i.e. the minimum Pillar 1 requirement, Pillar 2 add-on and overall buffer requirement; see points 1 to 3 above. In such cases the institution's board of directors is expected to explain the reason for the situation in writing, and to present an action plan to increase capital adequacy

9 http://www.finanstilsynet.no/no/Bank-og-finans/Banker/Tema/Kapitaldekning/Vurdering-av-risiko-og-kapitalkrav-/Risikobasert-tilsyn-banker/ 10 Currently this will, as of 1 July 2016, be 9 per cent for systemically important institutions and 7 per cent for other institutions.




Finanstilsynet | 19

or reduce the risk level. Finanstilsynet will review the situation, including the action plan and the measures that the institution intends to put in place. If Finanstilsynet considers the measures proposed by the institution itself to be inadequate, it will, under the new Financial Institutions Act section 10-6 (4), consider adopting a decision to restrict dividend payouts. Finanstilsynet will also, depending on what measures are put in place by the institution, consider the advisability of establishing a raised minimum requirement pursuant to the new Financial Institutions Act section 14-6(3)(b) or the Securities Trading Act section 9-18(1) no. 2 and in that connection, also pursuant to the new Financial Institutions Act section 14-6(3)(f) and (g), a possible order imposing restrictions on the ability to pay shareholder dividend and interest on tier 1 capital and on performance-based remuneration. If, in its SREP, Finanstilsynet required the institution to have in place a planning buffer over and above the minimum Pillar 1 requirement, Pillar 2 add-on and overall buffer requirement under Pillar 1, the institution will be entitled to use this buffer to meet an increased need for capital resulting from unexpected loss events. The institution must nonetheless inform Finanstilsynet as rapidly as possible that the planning buffer will be utilised, and provide the following information:

• The reason why the planning buffer must be resorted to and what connection there is to the institution's capital plan

• A plan for how the institution intends over time to rebuild the planning buffer Following a dialogue with the institution, Finanstilsynet may in such cases require the institution to submit additional reports to enable Finanstilsynet to monitor the situation. Finanstilsynet may also define critical capital ratio thresholds which could trigger further supervisory follow-up and measures if capital adequacy falls short of them. Situations may arise where sudden unforeseen market events or institution-specific conditions cause an institution's capital adequacy to deteriorate rapidly and with large effect, in the worst case to the point where the institution is in danger of falling short of the minimum requirement under Pillar 1. Such a situation will bring the institution's recovery plan into play. In such cases the authorities will assess the institution's viability and may intervene at an early stage. Reference is made to the Banks' Guarantee Fund Act, and to the ongoing process of implementing Directive 2014/59/EU (Crisis Management Directive) in Norwegian legislation.

8 Risk assessment and capital assessment for cross-border groups

With regard to cross-border groups for which colleges have been established drawing participants from a number of European countries' supervisory authorities, Finanstilsynet will adhere to the EBA's guidelines11 for the work of such colleges, including guidelines for the ICAAP/SREP process. The ICAAP/SREP process for cross-border groups follows the same main guidelines as those described in this circular, but will include a further specification of

11 Based on Articles 113 and 116 of EU Directive 2013/36/EU


20 | Finanstilsynet

the distribution of tasks between the supervisory authorities of the home country and the host country. The home country's supervisory authority will conduct a preliminary risk assessment of the parent company and the group. The host country authorities will for their part conduct a similar risk assessment of those institutions that are subject to their supervisory authority (subsidiaries at the solo or partly consolidated level). The preliminary analyses and assessments will thereafter inform a joint assessment and decision by the college regarding overall risk level. This covers liquidity and funding risk and capital needs, at group level and for underlying subsidiaries. In order to facilitate an overarching SREP review for a cross-border group and its underlying entities, the decision material will be documented in special templates prepared by the EBA.

9 Timing of implementation

Supervisory practices in the ICAAP/SREP area are being aligned on a gradual basis, and the EBA's guidelines will underlie Norwegian supervisory practices insofar as appropriate to Norwegian conditions from and including 1 January 2016. Erik Lind Iversen Acting Deputy Director General

Per Jostein Brekke Head of Section

Contact persons as regards banks, mortgage companies and finance companies: Senior Supervisory Adviser Aimée Staude on +47 22 93 97 08, E-mail: [email protected] Head of Section Per Jostein Brekke on +47 22 93 98 90, E-mail: [email protected] Special Adviser Ann Viljugrein on +47 22 93 99 09, E-mail: [email protected] Contact persons as regards investment firms: Senior Adviser Jaan-Herluf Steenberg on +47 22 93 98 77, E-mail: [email protected] Adviser Anders Overgård Hauglund on +47 22 93 99 87, E-mail: [email protected]

mailto:[email protected]






Finanstilsynet | 21

Appendices: The following appendices are attached to circular 9/2015 published on Finanstilsynet's website. Appendix 1A ICAAP process – general framework Appendix 1B Documentation of risk profile and capital needs Appendix 1C Commercial banks, savings banks, financial holding companies, mortgage companies and finance companies: ICAAP overall capital need Appendix 1D Investment firms, management companies and AIF managers: ICAAP overall capital need Appendix 2 Finanstilsynet's assessment of Pillar 2 capital add-ons for credit portfolios Appendix 3 Finanstilsynet's assessment of Pillar 2 capital add-ons for market risk

FINANSTILSYNET P.O.Box 1187 Sentrum

NO-0107 Oslo [email protected]

WWW.FINANSTILSYNET.NO

Documents

Circular Finanstilsynet's methodologies for assessing risk ... · Finanstilsynet does consider that using that reporting format will save time both for reporting entities and for