GUIDELINES ON

INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS (ICAAP)

UNDER
PILLAR -II OF NEW CAPITAL ACCORD BASEL II

UTTARA BANK LIMITED

1

Preface
In 1988 the Basel Committee on Banking Supervision (BCBS) released a capital adequacy measurement system commonly known as the Basel Accord or Basel-I which was the then current International Standard framework for assessing Capital Adequacy of banks. Basel I was initially introduced to assess capital in relation to Credit Risk and was revised in 1999 taking into account Market Risk. But in June2001 the Basel Committee published a more comprehensive new package on capital adequacy framework known as Basel-II. The new accord is based on the following three mutually reinforcing pillars: 1. Pillar 2. Pillar I : Minimum Capital Requirement II: Supervisory Review Process

3. Pillar III : Market Discipline Basel II is more risk sensitive and comprehensive and its implementation requires improved risk management. As a measure of improving risk management in banks in Bangladesh, Bangladesh Bank has already introduced guidelines on managing core risk in banks. Meanwhile, Bangladesh Bank has decided to implement Risk Based Capital Adequacy in Bangladesh from August2011 as per Basel-II and accordingly Bangladesh Bank planned a roadmap vide BRDP circular No. 14 dated 30.12.2009 for implementation of the same . In the line of roadmap for starting Basel-II in Bangladesh in the year 2010 Bangladesh Bank has issued guidelines on Risk Based Capital Adequacy for banks vide BRPD circular No. 09 dated 31.12.2008. As per said circular all schedule banks are reporting quarterly risk based capital adequacy to Bangladesh Bank on quarterly basis under Pillar-I of Basel II which covers only Credit Risk, Market Risk and Operational Risk. This reporting will be continued upto 31.12.2009. In Banking business the banks bear not only Credit Risk, Market Risk and Operational Risk but also residual risk, country risk, concentration risk, reputation risk, liquidity risk, earning risk etc. To cover all of risks inherent in banks Bangladesh Bank has ordered all the schedule banks to develop Internal Capital Adequacy Assessment Process-ICAAP (Pillar II). Through this process banks will assess adequate capital which compensate all risks in their business.

Executive Summary
Risk based capital adequacy for banks in line of Basel-II is going to start in Bangladesh from 2010. Meanwhile Bangladesh Bank has formed a guidelines on Risk Based adequacy for Banks so that all schedule banks can be able to comply with international best practice and to make the banks capital more risk sensitive as well as to build up the banking industry more shock absorvent and stable. The salient objectives of formulation of new capital measurement are to achieve greater transparency and increase financial stability in institutions. The institutions themselves will take the responsibility of designing a process for Internal Capital Adequacy Assessment. For this purpose the banks themselves identify their risks in their business, assess their risk management and their capital adequacy in commensurate with their business size and complexity of their business. The supervisory authority also has some requirements regarding adequate capital on the financial institutions that will be complied by the financial institutions within the scope of their internal capital adequacy assessment process. For this purpose all schedule banks and financial institutions themselves are to select and design the manner in which these requirements are to be met.

PILLAR -I Vs PILLAR- II a comparative study:

Pillar I of Basel-II presents the calculation of the minimum capital requirement (MCR) for credit risk, market risk and operational risk i.e. the banks consider only three risks in their business. Present minimum capital requirement is 10% of the total risk weighted assets (RWA) of a bank with core capital (tier-I) not less than 5% of RWA. Pillar I does not consider overall risks in the banking business. It covers only a part of the overall risk. As a result minimum capital will not fit for compensating the overall probable loss due to risk profile of the bank. On the other hand second pillar of Basel-II Supervisory Review Process (SRP) suggests that the banks have a process for assessing overall capital adequacy in relation to their risk profile and strategy for maintaining their capital at an adequate level. Here adequate capital means enough capital to compensate all the risks in their business and to develop and practice better risk management techniques in monitoring and managing their risks. This process (SRP) considers three main areas of risks- a) Risks covered under minimum capital requirement (MCR), (b) other risk which are not captured by MCR, (c) Risks factors external to the banks arises from the regulatory, economic or business environment. The more risks involved in business the more capital will be required. So banks should maintain adequate capital to cover all losses due to overall risks inherent in banking business. Four key principles of Supervisory Review Process (SRP): 1. Banks should have a process for assessing their overall capital adequacy in relation to their risk profile and a strategy for maintaining their capital levels. 2. Supervisors should review and evaluate banks internal capital adequacy assessments and strategies, as well as their ability to monitor and ensure their compliance with regulatory capital ratios. Supervisors should take appropriate supervisory action if they are not satisfied with the result of this process. 3. Supervisor should expect banks to operate above the minimum regulatory capital ratios and should have the ability to require banks to hold capital in excess of the minimum. 4. Supervisors should seek to intervene at an early stage to prevent capital from falling below the minimum levels required to support the risk characteristics of a particular bank and should require rapid remedial action if capital is not maintained or restored.

Key components of SRP. Review of the banks risk profile: The Central Bank will form a view of the banks overall risk profile as part of the ongoing riskbased supervision with the purpose of assessing those risk and control factors that may result in additional capital for the bank. Review of the banks ICAAP: The central bank will assess their ICAAP as part of the SRP. This review will include a consideration of the assumptions, methodology, coverage and outcome of a banks CAAP, with a view to ascertaining the adequacy and effectiveness of a banks CAAP. Determination of the banks minimum CAR and/ or other supervisory measures: The Central Bank will consider whether the banks minimum CAR remains appropriate or needs to be changed by applying the assessment framework set out to the results and findings gathered from the above reviews. The Central Bank may also require the bank to take other actions to rectify any system or control deficiencies identified during the SRP. Communication of SRP results to the bank : After completion of the SRP, the Central Bank will discuss with the bank the results of his assessment, including any areas of concerned which may lead to an increase in its minimum CAR. The Central Bank explain in sufficient detail the factors which have led to his assessment and recommend what actions the bank should take to address the concerns. If there is proposed increase in the minimum CAR, the bank will be consulted before a decision is finalized. Ongoing monitoring of the banks capital adequacy: This is to monitor that the bank complies with the various regulatory capital standards and requirements applicable to it on a continuing basis. The Central Bank will update the banks risk profile regularly, taking into account its progress in addressing any supervisory concerns raised or other events which may significantly affect the banks ability to monitor and ensure compliance with the Banking Capital Rules.

ICAAP and SREP (SRP):

ICAAP & SREP are two major components of SRP- Second Pillar of Basel-II. The SREP is reserved for the regulator, defines said institutions regulatory review activities and may take rather different forms depending on the jurisdiction- and, and as such, has limited influence on banks risk management activities. The ICAAP, on the other hand, carries great importance for banks since it assesses their capital adequacy levels based on their indigenous complexity and risk exposures. The ICAAP is usually described as a process owned by the bank and reviewed by the regulator as part of SREP. implementation of Pillar II Definition of ICCAP: Means Internal Capital Adequacy Assessment Process by which a bank identifies and measures the risks it faces and assesses how much capital is needed to support those risks in order to run the sound banking business. Why adequate capital need? There are several reasons to hold a capital buffer above the regulatory minimum capital requirement: Future capital needs for growth trend, availing investment opportunities, contingency in dividend payout ratio. Being prepared for occasional losses. External rating goals market reputation strategic goals. Regulatory requirement in the time horizon in consideration of economy. Key principles of ICAAP: 1. A bank must have a process for assessing its capital adequacy relative to its risk profile 2. The ICAAP is the responsibility of banks. Banks are responsible for setting internal capital targets that are consistent with their risk profile, operating environment, and strategic and business plans. 3. Banks ICAAP and other policies supporting it should be formally documented, and they should be reviewed at least annually, as often as is deemed necessary and approved by the board and senior management. 4. The ICAAP should form an integral part of banks risk management processes so as to As a result banks usually focus on the ICAAP side in their

enable the board and senior management to assess on and on going basis, the risks that are

inherent in their activities and material to their bank. 1. The ICAAP should capture all material risks that banks are exposed to. 2. Banks should have a documented process for assessing risks i.e. the ICAAP should be the mixture of detailed calculation and estimates. The banks rely on quantitative methods as well as qualitative assessment and management judgment of inputs and outputs. 3. The ICAAP should take into account banks strategic plans and how they relate to macro-economic factors. Banks should develop an internal strategy for maintaining capital levels which can incorporate factors such as loan growth expectations, future sources and uses of funds and dividend policy and any procyclical variation of minimum regulatory capital requirement. Banks should also have board approved policies specially capital plan which states their objectives and time horizon for achieving those objectives and in broad terms the capital planning process and the responsibilities for that process. The plan should also lay out how banks will comply with capital requirements in the future, any relevant limits related to capital and a general contingency plan for dealing with divergences and unexpected events e.g. raising additional capital, restricting business, or using risk mitigation techniques. Combined objectives of Pillar II and ICAAP:

The ICAAP is process to ensure that the management body (both supervisory and management functions): adequately identify, measure, aggregate and monitor the institutions risks. hold adequate ( more that MCR) internal capital to cover all material risks the institution inherent in its business. use sound risk management systems and develop them further It is the responsibility of the institution to define and develop its ICAAP.

The capital adequacy is monitored in boarder terms than only covering the minimum capital requirements as defined pillar I ( credit, market and operational risks). The aim of the Pillar II is to enhance the link between and institutions risk profile, its risk management and risk mitigation systems and its capital. Institution should themselves develop sound risk management processes that adequately identify, measure, aggregate and monitor the institutions risks. Institutions are expected to have an adequate assessment process that encompasses all the key elements of capital planning and management and generates an adequate amount of capital to set against those risks. Institutions should develop and manage their risk management processes ; the ICAAP belongs to the institution and supervisor should not dictate how it is applied. Ten requirements that sought by the Supervisory Authority in respect of ICAAP
Every institution must have an ICAAP relative to its risk profile.

The ICAAP is the responsibility of the institution. The ICAAPs design should be fully specific, the institutions capital policy should be fully documented and the management body should take responsibility for the ICAAP. The ICAAP should form an integral part of the management process and decision making culture of the institution. The ICAAP should be reviewed regularly. The ICAAP should be risk-based. The ICAAP should be comprehensive/complete/full/widespread The ICAAP should be forward looking and take into consideration the firms own plans and conceivable external changes. The ICAAP should be based on adequate measurement and assessment process. The ICAAP should produce a reasonable outcome.

Key features of ICAAP: ICCAP lies at the core of the four key principles of the Supervisory Review identified the Basel Committee. Basel II has delineated five main features of ICAAP discussed as below: Senior Management Oversight Basel II has entrusted banks Board of Directors and Senior Management with the responsibility of putting in place an ICAAP appropriate to its risk profile and the business plan and analysis of banks current and future capital needs. Sound Capital Assessment Sound Capital Assessment requires ICAAP design to be comprehensive and provide for identification, quantification, and reporting of all the material risks faced by the bank. The bank should establish internal capityal adequacy goals and have a process for internal control, review and audits. Comprehensive Capital Assessment ICAAP must address all material risks faced by the bank. ICAAP extends beyond the Pillar I as it covers all of the following risk:

A) Inherent risks captured under MCR 1. Credit Risk- arises from direct exposures to counterparties. 2. Market risk- arising from adverse movements in bond prices, securities or commodity prices or foreign exchange risk in the trading book. 3. Operational Risk- lack of systems, problems in controlling, absence of quality in employees.

10

B) Inherent risk not captured under MCR. 1. Residual Risk: Risk arises from error in the documents and error in valuation in a loan proposal 2. Interest Rate Risk- resulting from adverse movement in interest rates. 3. Liquidity Risk-crisis (shortfall) and problem (excess) of liquidity both are risk of liquidity. 4. Strategic Risk- arising from changes in the business environment, and from adverse business decisions improper implementation of decisions or lack of responsiveness to industry, economy or technological changes. 5. Reputation Risk-negative publicity regarding an institutions business practices, whether true or not, reduces the level of confidence of public. 6. Country Riskthat country. 7. Earning Risk- current income may develop less favorably than expected. 8.Concentration Risk- exposures concentrated on a limited number of customers, a certain sector or geographic area. Monitoring and Reporting refers to potential losses that may be generated by an event that occurs in a specific country where the event can be controlled by

This involves stabilizing a formal monitoring and reporting mechanism which provides the senior management with the necessary information on the risk profile, trends and capital requirement. Internal Control Review This involves putting in place an appropriate mechanism of internal control and external audits for ensuring the reasonableness of ICAAP and the accuracy of the data. Mechanisms for materialization of ICAAP In order to make the Internal Capital Adequacy Assessment Process (ICAAP) realistic the following approaches/ mechanisms may be exercised: Controlling by internal audit

11

Monitoring and Reporting Banks face several challenges in implementing the reporting and monitoring processes, procedures and systems. These challenges include identifying the granularity level for each risk type, deciding on the appropriate monitoring procedures and systems for each risk, reporting templates, frequency of reporting. A fully automated reporting framework with specific generation schedule and predefined reports covering risk identification, assessment, quantification, aggregation and allocation holds the answer to the stringent reporting requirements of ICAAP. Risk Identification It is the banks responsibility to identify all the material risks faced by the bank. Risk identification requires a thorough analysis of the banks activities, its business units, regulatory and market environment, historical scenarios etc. Bank should put in place an automated process for identification of risks at the predetermined frequency. Risks are identified for entity, line of business, geography, product, process and resources. Risk Quantification One of the key challenges banks face is in the quantification of risks models need to be appropriate for the bank based on the materiality of identified risks. Since credit, market and operational risk comprise the most material risks; banks should focus on sophisticated modeling solution for assessment of these risks. Currently there are no established standard models for liquidity risk, reputation risk, and strategic risk. However many banks practice keeping a arbitrary capital cushion for these risks. Though there are no specific models or procedures for quantification of risks, the banks are keeping practice some assumptions, scenarios, historical data, etc for hypothetical quantification of risks.

12

Risk quantification procedures, approaches and models in some cases (yet to be practiced) are discussed as under: Risks Credit Risk Sub-category of Risks Credit Risk Country Risk Concentration Risk Residual Risk Interest Rate Risk in the banking book Medium Low Risk Standard Very High Medium High Procedures, approaches and models Standardized counterparty classes, credit rating, risk weights Internal rating based models, counterparty credit rating and credit scoring, expected losses (PD,LGD,EAD) CreditVar, simulations

Market Risk

Equity Risk in Trading Book Interest Rate Risk in Trading Book Foreign Exchange Risk

High Medium Low

Stress Testing, scenarios analysis Value at Risk (VaR)

Operational Risk Liquidity Risk

Low

Self assessment Statistical methods ( external and internal database) GAP analysis Stress Testing Deposits etc. modeling, different simulations, scenarios statistical model ALM ( Asset-Liability

Low

13

Strategic Risk Reputation Risk

Medium Low

Management) analysis Self Assessment Scenario analysis Self Assessment

Economic Capital Allocation Calculation of economic capital is an element that is meant to link risk management and capital management. Economic capital is defined as the minimum level of capital necessary to cover potential losses that can arise in a banks activities. The economic capital calculation process should enable identification of material risk, quantification of risks and transposition of risk measures to economic capital allocated to specific risks/ portfolios. As part of this process banks should also identify potential risks that may materialize in the future and take into consideration. Reconciliation of ICAAP and Pillar I Banks not only need to compute the economic capital for various risks under ICAAP but are also required to reconcile it with the regulatory capital requirement. This process requires computing, comparing and explaining the differences between the two. This is a challenging task for banks and involves thorough comparison of the banks internal models and assumptions in relation to regulatory model and its assumptions to enable the bank to attribute differences between the two to specific factors.

14

Background
This section covers the relevant organizational structure-small or medium or large, business lines-size of assets, nature of business, volume of transaction, historical data for the bank

15