FINANCE, COMPETITIVENESS & INNOVATION INSIGHT | FINANCIAL STABILITY & INTEGRITY BASEL II Pillar II Practice Study © 2018 The World Bank Group 1818 H Street NW Washington, DC 20433 Telephone: 202-473-1000 Internet: www.worldbank.org All rights reserved. This volume is a product of the staff and external authors of the World Bank Group. The World Bank Group refers to the member institutions of the World Bank Group: The World Bank (International Bank for Reconstruction and Development); International Finance Corporation (IFC); and Multilateral Investment Guarantee Agency (MIGA), which are separate and distinct legal entities each organized under its respective Articles of Agreement. We encourage use for educational and non-commercial purposes. The findings, interpretations, and conclusions expressed in this volume do not necessarily reflect the views of the Directors or Executive Directors of the respective institutions of the World Bank Group or the governments they represent. The World Bank Group does not guarantee the accuracy of the data included in this work. Rights and Permissions The material in this publication is copyrighted. Copying and/or transmitting portions or all of this work without permission may be a violation of applicable law. The World Bank encourages dissemination of its work and will normally grant permission to reproduce portions of the work promptly. All queries on rights and licenses, including subsidiary rights, should be addressed to the Office of the Publisher, The World Bank Group, 1818 H Street NW, Washington, DC 20433, USA; fax: 202-522-2422; e-mail: pubrights@worldbank.org. Photo Credits: Shutterstock FINANCE, COMPETITIVENESS & INNOVATION INSIGHT | FINANCIAL STABILITY & INTEGRITY TABLE OF CONTENTS ABBREVIATIONS AND ACRONYMS III ACKNOWLEDGMENTS V EXECUTIVE SUMMARY VII I. INTRODUCTION 1 II. LEGAL FRAMEWORK: INTERNATIONAL STANDARDS AND PRACTICE 5 Basel Capital Standards 5 Common Challenges for Effective Implementation of Pillar II 7 III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 11 The Capital Regime 11 The Internal Capital Adequacy Assess Process (ICAAP) 12 The Supervisory Review and Evaluation Process (SREP) 22 Risk Assessment 22 Supervisory Response 29 Corrective Actions 31 IV. CONCLUSIONS AND LESSONS 33 REFERENCES 37 LIST OF BOXES Box 1. Cross Border Implementation: The United States and Canada 15 Box 2. The Use of Quantitative and Qualitative Approaches in the United States 17 Box 3. European Union: Capital Planning and the ICAAP 18 Box 4. Comprehensive Assessment of Risk for ICAAP Purposes in the United States 18 Box 5. OSFI: Recognition of Diversification Effects in the ICAAP 20 Box 6. European Union: Scoring in the SREP 25 Box 7. European Union: Supervisory Engagement and Proportionality in the SREP 28 LIST OF TABLES Table 1. Jurisdictions That Responded to the Survey 2 Table 2. Basel III—Key Elements 8 Table 3. Basel II, Pillar I—Selected Approaches in Survey Respondents 12 Table 4. Common Topics of ICAAP Templates in Surveyed Jurisdictions 13 Table 5. ICAAP—Minimum Risks Required to Be Addressed by Supervisors 19 Table 6. Independent Review Required by Supervisors 21 Table 7. SREP—Characteristics 26 BASEL II PILLAR II PRACTICE STUDY I LIST OF FIGURES Figure 1. Basel II—The Three Pillars 6 Figure 2. ICAAP Requirements—Number of Jurisdictions 13 Figure 3. The SREP—Number of Jurisdictions 23 Figure 4. Corrective Actions 32 TABLE OF CONTENTS II FINANCE, FINANCE, COMPETITIVENESS COMPETITIVENESS & INNOVATION & INNOVATION INSIGHT INSIGHT | LONG-TERM | FINANCIAL FINANCE STABILITY & INTEGRITY ABBREVIATIONS AND ACRONYMS AMA advanced measurement approach A-IRB advanced internal ratings-based approach BCBS Basel Committee on Banking Supervision BIA basic indicator approach CCPs central counterparties CEO chief executive officer D-SIB domestic systemically important bank EU European Union F-IRB foundation internal ratings-based approach G-SIB global systemically important bank ICAAP internal capital adequacy assessment process ILAAP internal liquidity adequacy assessment process IMA internal models approach IMF International Monetary Fund IRB internal ratings-based IRRBB interest rate risk in the banking book LCR liquidity coverage ratio NSFR net stable funding ratio OSFI Office of the Superintendent of Financial Institutions PD probability of default RBS risk-based supervision RCAP Regulatory Consistency Assessment Programme RWA risk-weighted assets SREP supervisory review and evaluation process TSA standardized approach for operational risk U.S. United States WB World Bank BASEL II PILLAR II PRACTICE STUDY III ACRONYMS AND ABBREVIATIONS IV FINANCE, COMPETITIVENESS & INNOVATION INSIGHT | FINANCIAL STABILITY & INTEGRITY ACKNOWLEDGMENTS T his paper was produced by Ana Maria Aviles (Task Team Leader, January–June 2018), Laura Ard (Task Team Leader, July–December 2017), and Cristina Pailhé (main author), with the support of a team consisting of Pierre-Laurent Chatain, Matei Dohotaru, and Jiemin Ren (all World Bank). The following list of peer reviewers provided • Thailand—Premjit Somrattanachai (Assistant valuable feedback to the document: Steen Byskov, Director, International Supervisory Standards Ines Gonzalez Del Mazo, and Syed Mehdi Hassan Team, Regulatory Policy Department, Bank of (all World Bank); Cameron Evans (International Thailand) Financial Corporation); and Antonio Pancorbo • Turkey—Aydan Aydın İnan (Senior Specialist, (International Monetary Fund). Banking Regulation and Supervision Agency) The team is thankful to their counterparts in the The team appreciates the support and guidance countries listed here for their cooperation and received by Irina Astrakhan, Aurora Ferrari, responses to the survey. The team wishes to extend Alfonso Garcia Mora, and Yira Mascaro (all its gratitude to the following: World Bank). This project benefited from the contributions of the following in the design of the • Argentina—International Affairs Department, survey and in initial implementation of the Basel Central Bank of Argentina II Pillar 2 Implementation Toolkit under which this • Colombia—Camila Quevedo Vega (Deputy study has been completed: Koo Han, Sang Man Director Economic Studies, Superintendencia Park (secondments to World Bank from Korea Financiera) Financial Supervisory Service) and Yejin Carol • Croatia—Sanja Stojević (Deputy Director, Lee, Sameer Goyal, Damodaran Krishnamurti, and Supervision Department 1, Croatia National Bank) Brian Kwok Chung Yee (all World Bank). The team • Republic of Korea—Sang Don Lee (Lead would also like to thank the following World Bank Manager, Financial Supervisory Service) colleagues for their extended help as liaisons with • Morocco—Badr Nabil (Deputy Director of the the authorities: Ratchada Anantavrasilpa (Thailand) Banking Supervision Department, Bank Al- and Youjin Choi (Republic of Korea). Lastly, we Maghrib) thank Barbara Hart for editing this publication and • Nigeria—James Yashiyi (Deputy Director/ Aichin Lim Jones for overall design and production Project Manager, Basel II/III Implementation, services and Liudmila Uvarova for general Central Bank of Nigeria) publishing support • Peru—Javier Poggi Campodónico (Deputy Superintendent Research, Superintendencia de This project was possible thanks to the generous Bancos, Seguros y AFP) financial support of the government of the • Poland—Jakub Zakrzewski (Chief Specialist, Republic of Korea through the Seoul Center for Polish Financial Supervision Authority) Financial Sector Development partnership with the Ministry of Strategy and Finance. Note: This paper summarizes the main outcomes of a survey that received responses from 10 countries. Because of confidentiality restrictions, the country specific results have been made anonymous in the present report BASEL II PILLAR II PRACTICE STUDY V ACRONYMS AND ABBREVIATIONS VI FINANCE, COMPETITIVENESS & INNOVATION INSIGHT | FINANCIAL STABILITY & INTEGRITY EXECUTIVE SUMMARY P illar II is a key element of the Basel Capital Framework. It requires banks to formalize a comprehensive process to assess and measure their internal overall capital needs, a process called the internal capital adequacy assessment process (ICAAP). It also requires that supervisors ensure they have the right tools to evaluate banks’ risk systems, risk profiles, strategic planning, and corresponding links to capital calculations, which is the supervisory review and evaluation process (SREP). Supervisors should be empowered to require capital above the minimum regulatory level and adequate tools for rapid remedial action and early intervention when needed. Pillar II is principles based and bank specific—two adopt different approaches to the risks required to be features that challenge both financial institutions assessed in the ICAAP. Whereas some supervisors and supervisors. This Pillar is not based on fixed suggest only some risks that should be assessed rules, and there is no “one size fits all” approach. by institutions, others mandate the minimum risks Therefore, a range of different practices is observed for which banks must have Pillar II capital. Most across jurisdictions. Approaches vary from those in respondents to the survey developed a template to which supervisors assume a strong leadership role be used by financial institutions. The contents and to others that rely more on banks’ internal processes degree of prescription vary from country to country, and methodologies. but the survey allows the identification of elements that are typically required by a supervisor as part of This paper summarizes the range of approaches the ICAAP template. adopted in a sample of surveyed World Bank (WB) client jurisdictions when implementing Surveyed jurisdictions follow different approaches Pillar II. The WB conducted a survey in a sample to the level at which ICAAPs are required when of jurisdictions to learn client countries’ experiences the institution is part of a financial group. For most in implementing this Pillar. The survey collected respondents, ICAAPs are required on both a consolidat- information regarding (a) how supervisors have ed and a stand-alone basis. For others, however, the approached the ICAAP and the expectations they ICAAP is required only at the consolidated level; have therein, (b) how supervisors consider and in one jurisdiction, it is required only on a stand- respond to banks’ ICAAP (the SREP), and (c) which alone basis. Moreover, most respondents are corrective actions and tools are available in each host supervisors of branches and subsidiaries of jurisdiction. The surveyed countries are emerging international banking groups, and those respondents markets that are committed to implement Basel II and have adopted requirements to ensure that the ICAAP III, even though the degree of implementation differs is properly targeted to the institution operating locally. among respondents. The majority of the surveyed countries are non-Basel Committee members. All respondents consider that, in practice, proportionality is embedded in ICAAPs and that Regarding the ICAAP, the survey allows the reports and methodologies vary with the size and identification of some commonalities and complexity of banks. Further, most respondents differences among respondents. Most of the require quantitative and qualitative information respondents have issued guidelines requiring banks as part of the ICAAP, and the complexity of the to implement an ICAAP, but the level of prescription quantitative approaches very much depends on the differs among jurisdictions. Furthermore, supervisors characteristics of the institutions. BASEL II PILLAR II PRACTICE STUDY VII Transparency and disclosure of the ICAAP whereas in others, supervisors adopt a more are not required in most of the respondents’ prominent role. Moreover, in most respondent jurisdictions. Only one respondent requires banks jurisdictions, failure of a bank to satisfy the Pillar to disclose a summary of the institution’s approach II capital requirement constitutes noncompliance. In to assessing the adequacy of its internal capital most countries, banks are not allowed to use capital to support business, but that respondent does not that has been allocated to Pillar II. require that quantitative capital needs be disclosed. All surveyed supervisors have tools available Regarding the SREP, although most surveyed to deal with less-than-satisfactory ICAAP jurisdictions have developed specific processes results. Those tools include (a) requiring banks to and guidelines, others may conduct an SREP improve risk management systems and controls, as part of regular examinations. Moreover, most (b) intensifying monitoring of the bank, (c) respondents do not assign a specific rating that is requiring additional capital, (d) requiring a capital for each supervised institution and is based on the adequacy restoration plan, (e) restricting payment SREP. Supervisors consider that proportionality is of dividends, (f) restricting banks’ current activities, key to the SREP, and they follow various approaches and (g) prohibiting new activities or acquisitions. to implement the assessment. Establishing a formal categorization for financial institutions is a common Finally, drawing on identified practices, the paper practice adopted by respondents to support the SREP. sheds light on some lessons and on desirable characteristics and elements for the ICAAP and Respondent supervisors conduct the SREP by the SREP. Regarding the ICAAP, the elements combining inputs from different sources. All addressed include the role of supervisory guidelines respondents use on-site and off-site reviews and and templates, the importance of proportionality, discussions with the bank and other stakeholders the capital plans with clear time horizons, and the to underpin the assessment. The ICAAP typically role of transparency and disclosure. Regarding is discussed with banks’ management, and in only the SREP, lessons are discussed on topics such as some countries do supervisors also discuss it with the importance of a strong culture of risk-based banks’ boards and risk committees. supervision to underpin the SREP, the importance of implementing a proportional approach, and the In most of the surveyed jurisdictions, the Pillar II need for a structured dialogue between supervisors capital amount is primarily determined by banks, and institutions. EXECUTIVE SUMMARY VIII FINANCE, COMPETITIVENESS & INNOVATION INSIGHT | FINANCIAL STABILITY & INTEGRITY I. INTRODUCTION T he implementation of Basel II has been a significant challenge for banks and supervisors for more than 10 years. The Basel II Framework emerged within the context of the international regulatory landscape in 2004,1 with a challenging new approach to calculate and assess capital needs (BCBS 2004). Since the days of its predecessor, Basel I,2 supervisors have been familiar with having minimum capital charges agreed on at the international level. Nevertheless, the Basel II Framework proposed an innovative approach for the time. Basel II is built on the “Three Pillar Approach,” in which total capital requirements are the result of not only a regulatory requirement (Pillar I) but also an internal assessment by banks as well as a supervisory review (Pillar II), and it is supported by strong bank disclosure requirements (Pillar III). The 2008 financial crisis underscored the vary from those in which supervisors assume a need to strengthen global capital and liquidity strong leadership role (for instance, by offering rules to promote a more resilient banking detailed guidance to calculate Pillar II risks) to sector. To address the market failures revealed those that rely on banks’ internal processes and by the crisis, the Basel Committee on Banking methodologies. Some elements are key determinants Supervision (BCBS) introduced a number of of the approaches chosen by jurisdictions, such as fundamental reforms to the international regulatory the supervisory culture, the ability to exercise expert framework. The reforms strengthened bank-level, judgment, and the existence of legal foundations microprudential regulations, but they also had a allowing the use of supervisory judgment and the macroprudential focus. The package known as the enforcement of decisions made therein. Moreover, Basel III Framework not only strengthened Basel II the experience shows that a sound legal protection but also introduced additional measures. framework for supervisors and experience with risk-based supervision (RBS) are key determinants Similar to other BCBS standards, the Basel II for effective implementation of Pillar II. Framework was aimed at being applied—on a consolidated basis—to internationally active Supervisors have typically assessed capital banks. Nevertheless, a considerable number of adequacy as part of their regular supervisory supervisors around the globe adopted the standard procedures. Under RBS, supervisors should assess not only for such institutions but also for local banks. whether banks have enough capital not only to satisfy regulatory requirements but also to address all of the Basel II implementation typically starts with significant risks they may face. The second Pillar of the adoption of Pillar I, the minimum capital Basel II formalizes that process. It explicitly requires requirement. Once the foundations for the banks to implement an internal capital adequacy calculation of minimum (regulatory) capital are assessment process (ICAAP) and supervisors to in place, supervisors typically start addressing the have a well-established, formal process in place to design and implementation of the second Pillar. review banks’ capital assessment (the supervisory review and evaluation process [SREP]). Pillar II is flexible, and different jurisdictions display a range of different practices. Approaches 1 The original version was released in June 2004; a comprehensive version was issued in June 2006 (BCBS 2006). 2 BCBS 1988. BASEL II PILLAR II PRACTICE STUDY 1 Pillar II implementation is challenging both and respond to banks’ ICAAP (the SREP). The for institutions and for supervisors. Financial survey was organized in five sections: (a) an institutions are required to demonstrate that they overall discussion of the capital adequacy regime have a well-designed internal process in place to in each country, (b) a set of questions related to the assess their total capital needs, not just to meet a institution’s ICAAP, (c) a description of how the regulatory requirement. Quantitative techniques SREP is designed and implemented by supervisors, to measure risks and capital are not enough; those (d) a list of supervisors’ responses, and (e) a series techniques must be accompanied by sound corporate of corrective actions available to supervisors for governance and risk management frameworks. Pillar II purposes. The survey collected information Total capital must be consistent with the bank’s risk about respondents’ practices as of the submission profile, business model, and operating environment. date in September 2017. Capital should be forward looking, and it should be sufficient to cover potential losses not only under The countries selected to participate in the normal conditions but also under extreme but survey were emerging markets that are WB plausible events (stressed scenarios). client jurisdictions from different geographical regions. Ten countries responded to the survey The World Bank (WB) has undertaken a study (table 1). Some of those countries have committed of Pillar II practices in selected countries to to Basel II implementation, whereas others have assist jurisdictions in their goal of further already implemented Basel III. The formality of implementation of international capital those commitments differs among countries, and standards. As a basis for the work, the WB implementation of both Basel II and Basel III is at designed a survey (a) to collect information different stages. Some countries are BCBS members regarding how supervisors have approached the and have formal commitments to implement the ICAAP and the expectations they have therein standards, whereas others are adopting Basel II and and (b) to understand how supervisors consider III to keep pace with international standards. Table 1. Jurisdictions That Responded to the Survey Countries World Bank Classification Basel Committee Members 1 Argentina X 2 Colombia Latin America and the Caribbean 3 Peru 4 Croatia 5 Turkey Europe and Central Asia X 6 Poland 7 Korea X East Asia and Pacific 8 Thailand 9 Morocco Middle East and North Africa 10 Nigeria Sub-Saharan Africa Note: World Bank regional classifications can be found here: https://datahelpdesk.worldbank.org/knowledgebase/ articles/906519. I. INTRODUCTION 2 This document presents an analysis of countries’ examination was performed to assess how a specific responses aimed at helping supervisors identify requirement is effectively applied in practice; that common practices, challenges, and lessons additional review is beyond the scope of this work. from Pillar II implementation. This paper is targeted to help supervisory authorities, especially The structure of the paper is as follows: Section II those in emerging markets, with the design and offers a brief discussion about international capital implementation of the second pillar of Basel II. standards and their recent evolution, and it focuses Thus, supervisors may learn from the experience on Pillar II. That section also describes how laws of similar jurisdictions surveyed for this project. and regulations operate in practice to support Pillar As a by-product, this document contributes II implementation. Section III presents the main to constructive supervisory discussions with findings in surveyed jurisdictions. That section banks regarding their direction and progress in reviews the capital regime in the countries that implementing standards. It also indicates, at a high responded to the survey. It also outlines the main level, the range of practices and nuances therein. findings on ICAAP implementation and describes The paper builds on responses provided by the the main findings and practices on the SREP. In surveyed jurisdictions, and information was cross- Section IV, the paper sets out a range of measures checked with the legislation and with documents that supervisors can consider when dealing with provided by respondents. Nevertheless, no further Pillar II implementation. BASEL II PILLAR II PRACTICE STUDY 3 SECTION TITLE 4 FINANCE, COMPETITIVENESS & INNOVATION INSIGHT | FINANCIAL STABILITY & INTEGRITY II. LEGAL FRAMEWORK: INTERNATIONAL STANDARDS AND PRACTICE Basel Capital Standards A fter a period of intensive preparation, the BCBS released the Basel II Framework in June 2004. The BCBS conducted five rounds of quantitative impact studies from 1999 to 2003 and consulted extensively with banking sector representatives, supervisory agencies, central banks, and other stakeholders to develop a framework with more risk-sensitive capital requirements than did the previous 1988 Accord.3 The 1988 Accord (Basel I) was the first for all exposures and a “one size fits all” approach. standard agreed on to establish common capital There was limited scope for proportionality. Some requirements for internationally active banks significant financial products at that time, such as and to promote a level playing field. It called securitizations, were not addressed by the framework, for a minimum ratio of capital to risk-weighted which introduced incentives for banks to move some assets (RWA) of 8 percent (BCBS 1988). Initially, assets off their balance sheets and thus promoted it focused on credit risk, but in 1996, the BCBS regulatory arbitrage. issued an amendment to include capital charges for market risk (BCBS 1996). Banks were, for the first Basel II represented a paradigm shift in the time, allowed to use internal models as a basis for approach to capital regulation that existed measuring their market risk capital requirements, at that time. First, minimum capital is required subject to quantitative and qualitative standards. to address not only credit and market risk but Ultimately, Basel I was introduced not only in also operational risk. Several options were made BCBS member countries but also in virtually all available to calculate capital for each one of those countries with active international banks and in risks, from standardized to more risk-sensitive, jurisdictions with no international banks. internally based (model-based) approaches (Pillar I, Minimum Capital Requirements). Second, capital Eventually, Basel I became outdated because needs are determined not only by the minimum it did not keep pace with financial innovation, requirement established by regulators but also by banks’ capital, risk management advances, and an internal, well-informed process in the bank. supervisory practices. Business models were Supervisors should have the ability to review that propelled by rapid innovation in financial instruments process, to require more capital, and to intervene that were not properly captured by Basel I. The when necessary (Pillar II, the Supervisory Review interaction of the credit derivative markets with the Process). Third, banks should disclose information growth of securitization technology and the rapid to the public to explain how they calculate and growth of the institutional investor base entailed manage the public’s capital needs. Transparency is additional challenges. There was rapid growth in particularly important when banks calculate Pillar investor appetite for new forms of credit risk. Basel I I capital using approaches that are based on their was not risk sensitive enough. For instance, for credit own internal (not-so-transparent) methodologies risk measurement, there were only five risk weights (Pillar III, Market Discipline) (figure 1). For further discussions, see BCBS 2018a 3 BASEL II PILLAR II PRACTICE STUDY 5 Figure 1. Basel II—The Three Pillars Minumum Capital Pillar I Requirements Basel II Supervisory Pillar II Review Process Pillar III Capital Disclosure Pillar II is based on four key principles that • Principle 3. Supervisors should expect banks to emphasize the responsibility of banks for operate above the minimum regulatory capital assessing and holding appropriate levels of capital ratios and should have the ability to require banks to cover all their material risks beyond Pillar I. to hold capital in excess of the minimum (capital Moreover, Pillar II is intended to encourage banks to above the minima). develop and use better risk management techniques in monitoring and managing their risks. The role of • Principle 4. Supervisors should intervene at an supervisors under Pillar II is (a) to critically evaluate early stage to prevent capital from falling below and review banks’ assessments and risk management the minimum levels required to support the risk standards, (b) to require (or encourage) banks to hold characteristics of a specific bank and should capital in excess of Pillar I minimum requirements, require rapid remedial action if capital is not and (c) to intervene at an early stage if necessary to maintained or restored (early intervention and prevent capital from falling below the levels required remedial action). to support the risk characteristics of a specific bank. Formally, Pillar II is based on the following four When the first shocks of the global financial principles (BCBS 2006): crisis were felt in August 2007, Basel II was in the very early stages of implementation—even • Principle 1. Banks should have a process for though many of the jurisdictions seriously hit by assessing their overall capital adequacy in relation the financial crisis were already considered Basel to their risk profile and a strategy for maintaining II compliant. In most countries—especially for their capital levels (the ICAAP). internationally active banks, the Basel framework had not even been implemented. Nevertheless, the • Principle 2. Supervisors should review and international financial crisis underscored a number evaluate banks’ internal capital adequacy of shortcomings with the global banking system and assessments and strategies, as well as their ability the regulatory framework, including the following: to monitor and ensure their compliance with regulatory capital ratios. Supervisors should take • Excessive leverage, with insufficient high-quality, appropriate action if they are not satisfied with true loss–absorbing capital supporting banks’ assets the result of this process (the SREP). II. LEGAL FRAMEWORK: INTERNATIONAL STANDARDS AND PRACTICE 6 • Excessive credit growth, driven by a low-interest- complements bank-level regulation to create greater rate monetary policy and fueled in part by weak resilience at the individual bank level by reducing underwriting standards and an underpricing of the risk of systemwide shocks. The second Pillar credit and liquidity risk of the Basel capital framework was strengthened to addresses weaknesses revealed in banks’ risk • A high degree of systemic risk, interconnectedness management processes during the financial turmoil, among financial institutions, and common turning Pillar II into a major tool to assist banks exposures to similar shocks and supervisors in better identifying and managing • Inadequate capture of the risks posed by risks and appropriately determining an overall derivatives and hybrid instruments, and assessment of capital adequacy. insufficient capital dedicated to those risks The post-crisis regulatory framework is still • Inadequate capital buffers to mitigate being implemented, although the most significant procyclicality of financial markets and to maintain reforms have already been completed by the lending to the real economy in times of stress BCBS. Moreover, BCBS member countries have committed to adopting the Basel III framework, • Insufficient liquidity buffers and excessive which will go into effect by 2022 (BCBS 2017a). exposure to liquidity risk • Inadequate measures of market risk, such as Common Challenges for Effective assumptions of market liquidity and value at risk Implementation of Pillar II limitations. (Ingves 2015) Pillar II implementation requires a legal and The Basel III framework seeks to address those regulatory framework that allows supervisors weaknesses revealed by the financial crisis. Basel to require capital beyond the Pillar I regulatory III builds on the Basel II Framework. Although minimum. The assessment of capital under Pillar Basel III updates some components of Basel II, II by supervisors (SREP) relies on banks’ rigorous it coexists with all of the elements of the Basel II internal capital assessment processes (ICAAP), Framework that have not been replaced or updated which should be well informed and well developed yet.4 In particular, the three-pillar structure of the and which not only are compliance based but also Basel II Framework has not been modified. require assessment by experts and the exercise of expert judgment. Basel III itself is a comprehensive set of reform measures designed to further strengthen the First, to implement the ICAAP, the legal and regulation, supervision, and risk management regulatory frameworks should not be an obstacle of the global banking sector (table 2). Those and should provide the right incentives for measures aim to (a) improve the banking sector’s banks to assess capital needs beyond minimum ability to absorb shocks arising from financial and regulatory requirements. Banks’ ICAAP that is economic stress, (b) improve risk management binding in practice should assess and determine and governance, and (c) strengthen banks’ capital requirements that reflect their own risk transparency and disclosures. The reforms target characteristics and institutional capacities over and bank-level, or microprudential, regulation, which above sole compliance with regulatory minima. will help raise the resilience of individual banking Moreover, Pillar II is intended not only to ensure institutions in periods of stress. They also address that banks have adequate capital to support all the systemwide, or macroprudential, risks that can risks in their business but also to encourage banks to build up across the banking sector, as well as the develop and use better risk management techniques procyclical amplification of those risks over time. in monitoring and managing their risks. The macroprudential approach to supervision BASEL II PILLAR II PRACTICE STUDY 7 Table 2. Basel III—Key Elements Name Background Pillar I Definition of Revised definition. Greater focus on common equity. Minimum raised to 4.5% of RWA, after deductions. Capital Total loss absorbing capital definitions Risk Coverage Securitizations. Strengthened capital treatment. Banks required to analyze externally rated securitization exposures. Trading book. Significantly higher market risk capital for trading and derivatives activities and complex securitizations. New framework released in January 2016 (Fundamental Review of the Trading Book). Counterparty credit risk. Stringent requirements for measuring exposure; capital incentives to use central counterparties for derivatives; higher capital for interfinancial exposures. Bank exposures to central counterparties (CCPs). This standard describes the capital requirements for bank exposures to CCPs. These came into effect on January 1, 2017. Equity investment in funds. Enhanced treatment of banks’ investments in the equity of funds that are held in the banking book. Leverage Ratio Non-risk-based ratio that includes off-balance sheet exposures and serves as a backstop to the risk- based capital requirement. It helps contain system wide buildup of leverage and provides a simple metric for comparability, which is difficult with use of IRB methods Pillar II Supplemental Firmwide governance and risk management; off-balance-sheet exposures and securitization; risk Requirements concentrations; sound compensation practices; valuation practices; stress testing; accounting standards for financial instruments; supervisory colleges. Interest rate risk in the banking book (IRRBB): updated principles and a new quantitative framework. Pillar III Public Enhanced disclosures requirements: securitization exposures and sponsorship of off-balance-sheet Disclosure vehicles; components of regulatory capital; detailed explanation on regulatory capital ratios. Capital Buffers Capital Comprising common equity of 2.5% of RWA, bringing the total common equity standard to 7%. Conservation Constraint on a bank’s discretionary distributions are imposed when banks fall into the buffer range. Buffer Countercyclical Imposed within a range of 0-2.5% comprising common equity, when authorities judge credit growth is Buffer resulting in an unacceptable buildup of systematic risk. G-SIBs and D-SIBs G- Sibs Framework for an assessment methodology and higher loss absorbency requirements (Common Equity Tier 1) to discourage banks from becoming even more systemically important. D-Sib Principles on the assessment methodology and the higher loss absorbency requirement. Focus on the impact that the distress or failure of banks will have on the domestic economy. Liquidity LCR Banks should have sufficient high-quality liquid assets to withstand a 30-day stressed funding scenario. NSFR Longer-term structural ratio to address liquidity mismatches. Provides incentives for banks to use stable sources of funding. Principles Principles for Sound Liquidity Risk Management and Supervision. Enhanced with lessons learned during the crisis. Fundamental review of sound practices for managing liquidity risk. Monitoring Common set of monitoring metrics to assist supervisors in identifying and analyzing liquidity risk trends Tools at both the bank and system-wide level. Note: D-SIB = domestic systemically important bank; G-SIB = global systemically important bank; IRB=internal ratings- based; LCR = liquidity coverage ratio; NSFR = net stable funding ratio; RWA = risk-weighted assets. Source: Adapted from BCBS 2017b and BCBS 2018b. II. LEGAL FRAMEWORK: INTERNATIONAL STANDARDS AND PRACTICE 8 Second, the supervisory culture should not be challenging for supervisors to require capital above so prescriptive or so compliance based that it minima. In many jurisdictions, supervisors have jeopardizes the exercise of risk-based supervision, legal powers to require additional capital. As part which is key to implementing the SREP. The of the exercise of RBS, they require such additional SREP requires supervisors to be able to assess capital—even though a formal SREP as understood capital beyond compliance with minimum regulatory by the second Pillar of the Basel II Framework may requirements. Supervisors should be able to challenge not be in place yet. banks on their determination of total capital needs. Supervisors should carry out a comprehensive review Finally, supervisors should have a range of of the banks’ internal capital process. This process tools at their disposal to intervene at an early includes assessing the quality and effectiveness of risk stage, and they should be able to require rapid management frameworks, governance arrangements remedial action if capital is not maintained supporting the ICAAP, and consistency with the or restored. A common restriction arises when business model of the institution. supervisors are allowed to intervene only when there is noncompliance with written rules. In that The supervisory review goes beyond the case, the legal framework tends to be backward- determination of compliance with formal looking and does not allow supervisors to intervene requirements; expert judgment is needed to analyze before the materialization of risks. Supervisors the different topics and to recognize the limitations should have a range of options at their disposal if of each one. Some supervisors have used Pillar II to they become concerned that a bank is not meeting supplement their risk-based supervisory approach. the requirements for sound Pillar II implementation. Moreover, a sound regulatory framework that Such options may include (a) intensifying the provides clear guidance about risk management, bank’s monitoring, (b) restricting the payment internal controls, and corporate governance of dividends, (c) requiring the bank to prepare underpins the implementation of both the ICAAP and implement a satisfactory capital adequacy and the SREP. To that end, supervisors typically restoration plan, or (d) requiring the bank to raise reinforce their regulatory framework by adopting additional capital immediately. guidelines or regulations that convey their expectations for the management of different risks Supervisors should have the discretion to use the (credit, operational, market, and so on) and that tools best suited to the situation. The permanent are based on what is required by the respective solution to banks’ difficulties is not always international standards.5 increased capital alone; it sometimes requires noncapital actions, such as restriction on business Third, the legal framework should allow operations or mandated improvements in risk supervisors to require capital above the management and controls. Moreover, although out minimum regulatory requirement. This power is of the scope of the survey and of this document, a precondition for Pillar II implementation in full. jurisdictions should have adequate frameworks Supervisors should have this ability, which is based to resolve institutions in an orderly manner, with on their supervisory evaluations and which should be legislation and tools appropriated to accomplish informed by banks’ internal assessment. Experience effective resolution. Jurisdictions should adopt shows that this limitation is one of the most serious legislation along the lines of international standards impediments for the implementation of Pillar II. In (such as the Financial Stability Board standards on countries where the legal framework is too rigid—in resolution [Financial Stability Board 2014] with the sense that it is linked only to regulatory capital— tools typically aimed at public interest objectives, or where the law sets the required capital, it may be such as the maintenance of financial stability or the protection of retail depositors. Such standards include, for example, the Basel Core Principles and the Basel Committee guidelines for the management of 5 each risk. BASEL II PILLAR II PRACTICE STUDY 9 ACRONYMS AND ABBREVIATIONS 10 FINANCE, COMPETITIVENESS & INNOVATION INSIGHT | FINANCIAL STABILITY & INTEGRITY III. MAIN FINDINGS IN SURVEYED JURISDICTIONS The Capital Regime T hree surveyed countries are BCBS members and, therefore, have committed to implementing Basel III according to the agreed-on timetable. Two countries have been assessed by the BCBS6 as fully compliant with the Basel III framework on capital and liquidity, and one has been assessed largely compliant with the Basel III capital framework and compliant with Basel III standards on liquidity. Two jurisdictions adopted the Basel III framework given that they follow the European Directives and rules, and one has also implemented Basel III. Other respondents have adopted selected Basel III components: for instance, two countries adopted the Basel III definition of capital. Moreover, one of them has committed to complete the implementation of Basel IIII capital requirements within an agreed-on timetable, whereas other jurisdictions adopted the revised definition of capital as well as definitions of the capital buffers (capital conservation and countercyclical). On Pillar I, 9 of the 10 respondents to the survey have banks use the F-IRB, one uses the A-IRB, and two implemented one or more of the Basel II approaches. use the IMA for market risk. One country presents a The remaining country implements Basel I for credit noteworthy case because the majority of banks (10 risk and a standardized approach for market risk of 17) use the F-IRB for credit risk, and two banks following the Basel I and II standardized approach use the A-IRB, whereas for market risk, six banks but has no capital requirement for operational risk. have adopted the IMA and five use the AMA for operational risk. In one country, only the IMA is The simpler approaches to Pillar I are preferred by allowed, but no bank has implemented that approach those surveyed countries using Basel II. Advanced yet (table 3). approaches are not allowed in two countries. They are allowed in three other countries, but no bank Regarding Pillar II, none of the surveyed jurisdictions uses those approaches yet in two of those three identifies the legal framework as a significant countries. In one jurisdiction that allows internal restriction to implement this Pillar. This finding approaches, only one bank (of 31) partially uses seems to be a logical output of how the sample the foundation IRB (F-IRB) and the advanced IRB was selected, because the participants are countries (A-IRB) for some of its credit exposures, and only already embarking on Pillar II implementation. two banks use the advanced measurement approach They may have fewer legal constraints than have (AMA) for operational risk.7 A similar situation those countries that are not yet implementing Pillar exists in another jurisdiction, where the advanced II and are not included in this survey. Nine countries approaches are allowed, but only one bank uses the that responded to the survey mentioned that the legal internal models approach (IMA) for market risk. framework is neither an impediment to require an ICAAP of banks or to implement Pillar II in general. In another surveyed jurisdiction, four banks partially The remaining jurisdiction is not requiring formal use the A-IRB approach, and seven use the AMA ICAAPs yet, but not because of legal restrictions. for operational risk. In yet another jurisdiction, two 6 In 2012, the BCBS launched the Regulatory Consistency Assessment Programme (RCAP) to monitor progress in introduc- ing domestic regulations, in assessing their consistency, and in analyzing regulatory outcomes in member jurisdictions. See http://www.bis.org/bcbs/implementation/rcap_jurisdictional.htm. 7 Going forward, the AMA will no longer be considered an available approach. BASEL II PILLAR II PRACTICE STUDY 11 Table 3: Basel II, Pillar I—Selected Approaches in Survey Respondents Allowed Used in Practice Standardized 9 9 F-IRB 7 3 (Country 1: partial use by 1 bank; country 2: 10 out of 17 banks; country 3: 2 banks) Credit Risk A-IRB 7 4 (Country 1: partial use, 1 bank; country 2: 2 out of 17 banks; country 3:partial use, 4 banks; country 4: 1 bank) Standardized 10 10 Market Risk IMA 6 3 (Country 1: 6 out of 17 banks; country 2: 1 bank; country 3: 2 banks) BIA 9 9 Operational Risk TSA 6 5* AMA 6 3 Note: A-IRB = advanced internal ratings-based approach; AMA = advanced measurement approach; BIA = basic indicator approach; IMA = internal models approach; F-IRB = foundation internal ratings-based approach; TSA = standardized approach for operational risk. *In one jurisdiction, the alternative TSA is used. The Internal Capital Adequacy two jurisdictions, there is a guideline addressing Assess Process (ICAAP) the requirement of both an ICAAP in banks and the SREP for supervisors. One surveyed country follows Of the 10 countries that responded to the survey, a particular approach to Pillar II in general and to the 9 have already issued guidelines or regulations ICAAP in particular in which the supervisor requires, requiring banks to implement an ICAAP (figure by regulation, a standardized capital requirement to 2). The remaining country has issued a general cover some of the Pillar II risks. Banks must have requirement, but ICAAPs are not required yet in capital enough to cover those risks, and they must practice.8 One respondent jurisdiction has issued assess as part of their ICAAP any other material a regulation requiring banks to develop ICAAPs, risk not addressed by those supplemental Pillar II but it has been partially implemented, and banks charges. Thus, the ICAAP in that country has two are not required to submit ICAAP reports to the main components: a standardized part, which is authorities. In some countries, the regulation is required by regulation, and an internal part, which is specific to ICAAP, whereas in others, the ICAAP determined by the bank to address additional risks. is required in the regulation on sound practices for In three jurisdictions, the first ICAAP reports were risk management and in the regulation on internal submitted as of December 2010. In one country, they systems together with best practices guidelines. In have been submitted since December 2011, whereas It is worth mentioning that in this country, the authorities require credit institutions to comply with a stress-testing frame- 8 work. From now on in this section, “respondents” refers to countries that require ICAAPs for their institutions. III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 12 Figure 2. ICAAP Requirements—Number of Jurisdictions 10 9 8 8 Responded to Require Require ICAAP Common/Suggested the Survey ICAAPs Reports to be Sent Template for to the Supervisor the Report three countries have required ICAAP reporting since be used by the institutions. The contents of the December 2013. One jurisdiction received the first templates vary from country to country. Some of ICAAP reports from banks in 2016. In those eight them are very high level (as in one case, in which only countries requiring ICAAP reports, the reports must the titles for each section are suggested), whereas be submitted to the supervisor annually. most templates offer more detailed guidance on the expected contents. Nevertheless, a comparison Most of the supervisory authorities requiring among them helps identify some commonalities and ICAAP reports developed a template that should the sections typically included (table 4). Table 4. Common Topics of ICAAP Templates in Surveyed Jurisdictions Summary General information, scope of application, key components of the ICAAP, summary of stress testing, capital planning. Risk Governance Board and senior management responsibilities. Role of committees. Role of internal Framework audit. Risk Assessment Identification and measurement (or assessment) of significant risks and related and Internal Capital capital needs. Relationship with risk profile, risk appetite, and capacity. Requirements Capital Planning and Needs and sources of capital. Capital plan for current and next years. Description of Stress Testing stress testing. Aggregation or Aggregation of internal capital needs for all risks. Guidance on the treatment of Consolidation of Risks diversification effects. Conclusions Tables or explanations summarizing total internal capital needs and capital sources. Source: Based on requested templates from respondent jurisdictions. BASEL II PILLAR II PRACTICE STUDY 13 The reasons for having common templates are financial business group, and (b) solo consolidation, twofold. On one hand, templates help institutions to which consists of a financial institution and its better organize the information they should provide subsidiaries that grant credit or are involved in credit- to supervisors and to know what the supervisor’s like transactions, all of which are subject to certain expectations are. On the other hand, a common thresholds. In another surveyed country, the ICAAP template helps supervisors to make a comparison submission is made at the individual level, and banks among institutions and to better organize the are expected to include risks stemming from their information they receive. Nevertheless, there should subsidiaries as part of their risk management process. be a balance between standardization and flexibility; institutions should be able to target the template to An important topic for supervisors is reflect their specific conditions. The template should determining how to deal with ICAAPs of not be so rigid as to become just a checklist. In sum, branches and subsidiaries of international the template should be standardized but flexible banking groups. The ICAAP guidelines should enough to reflect that the ICAAP is a bank-driven establish clear responsibilities regarding the role of and a bank-specific process. local institutions that are subsidiaries or branches of international banking groups. In some jurisdictions, Jurisdictions follow different approaches on the requirement comes from the general legal the level at which ICAAP reports are required or regulatory framework: therefore, no further when the institution is part of a financial group. instructions are necessary for ICAAP purposes. The BCBS requires that Basel II be applied on a consolidated basis for internationally active banks Supervisors should expect local banks and their (BCBS 2006, Part 1, Scope of Application). The boards (whether a subsidiary or a branch office) scope of application also includes—on a fully to be involved and empowered to discharge their consolidated basis—any holding company that is duties in relation to their ICAAP. The assessment the parent entity within a banking group to ensure of capital adequacy for subsidiaries should not be that it captures the risk of the whole banking group. different from that for local banks, even though The scope also applies to all internationally active subsidiary banks may place greater reliance on parent banks at every tier within a banking group on a fully company global measurement and management consolidated basis, and supervisors should ensure tools in a manner appropriate to and consistent with that individual banks are adequately capitalized on a local market characteristics. The local institution stand-alone basis. should be responsible for the application of global tools and processes at the local level. In the case of In three of the surveyed jurisdictions that require branches, experience shows that when this home- ICAAP reports, both consolidated and stand-alone host issue is not addressed correctly, the ICAAP is reports are required. Four other jurisdictions require too far removed (at the head office level) from the only the consolidated ICAAP. In the latter case, host reality. This finding is particularly the case of a there are some differences: although one of those branch office that is not material from a groupwide jurisdictions requires the ICAAP at the highest level perspective but may be material for the host market. of consolidation, the other requires consolidation at To illustrate this topic, box 1 describes the example the bank level (which is not necessarily the highest of two countries not surveyed under this project. level). Jurisdictions that require consolidation at the bank level do so because those banks account for a In the case of branches, some of the surveyed significant size of the balance sheet of the group. In countries provide specific instructions. In one one respondent jurisdiction, consolidation is applied respondent jurisdiction, the ICAAP guidance at two levels: (a) full consolidation, which consists applies also to branches of credit institutions of a financial institution, its parent company, the from a third country that is authorized by the host subsidiaries, and all affiliated companies within the supervisory authority to provide services. In another III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 14 Box 1. Cross Border Implementation: The United States and Canada In the United States, the Pillar II guideline requires that each bank should have an internal capital adequacy assessment process (ICAAP) that is appropriate for its unique risk characteristics and should not rely solely on the assessment of capital adequacy at the parent company level. This approach does not preclude the use of a consolidated ICAAP as an important input to a subsidiary bank’s own ICAAP, provided that each entity’s board and senior management ensure that the ICAAP is appropriately modified to address the unique structural and operating characteristics and risks of the subsidiary bank. In Canada, the Office of the Superintendent of Financial Institutions determines that Canadian subsidiaries of foreign banks may borrow from consolidated group methodologies for assessing risk. However, a foreign bank subsidiary’s ICAAP should reflect its own circumstances, and groupwide data and methodologies should be appropriately modified to yield internal capital targets and a capital plan that are relevant to the foreign bank subsidiary. Sources: Office of the Comptroller of the Currency et al. 2008; Office of the Superintendent of Financial Institutions 2010. jurisdiction, the legal framework requires foreign complex banks.9 One of those countries follows a banks’ subsidiaries and branches to develop their specific approach, allowing small banks to increase own ICAAP for the host market. In yet another the minimum regulatory requirement (Pillar I) by surveyed country, affiliates and branches of banks a fixed amount (an add-on) to cover Pillar II risks. located abroad may use methodologies developed Banks following that approach must justify the abroad for calculations in their ICAAP, but they relevance of such an approach and to what extent should be made subject to local validation, and the it covers all the relevant risks. In one jurisdiction, documents required regarding those methodologies the supervisor provides specific guidance on the should be submitted to the host supervisory agency. elements that a bank should consider if it is to Under certain conditions, validation abroad may measure some Pillar II risks, such as concentration, be accepted, and there should be a memorandum liquidity, and reputational and strategic risk. In of understanding for cooperation between the another jurisdiction, there is a regulation specifying local and foreign supervisory authorities. The the methodologies that all institutions (independent models, processes, and instruments concerning the of their characteristics) must use to measure some methodology shall be wholly established in the Pillar II risks (concentration, IRRBB, liquidity, institution in the host country. business cycle risk), whereas any other material risk should be measured by the institution itself. All of the respondents consider that, in practice, proportionality is embedded in ICAAPs and that Thus, the ICAAP is a mix of a standardized reports and methodologies vary with the size (regulatory) requirement and an internally and complexity of banks. As indicated by most determined amount. In the case of the other four respondents, the smaller and less complex banks are countries requiring ICAAPs, proportionality is allowed to use simple measurement methodologies. decided and applied by the bank itself and is assessed They typically have less complex risk management by supervisors during the SREP. Nevertheless, one frameworks and ICAAPs. Seven of nine respondent of the respondent jurisdictions will implement a supervisors do not offer standardized methodologies simplified Pillar II approach for small institutions to measure Pillar II risks individually; their in the near term. Another country that responded measurement tools are aimed at being used by less to the survey is considering whether to include That is an approach followed, for instance, by the Bank of Spain, which is not an institution surveyed for this exercise. 9 BASEL II PILLAR II PRACTICE STUDY 15 supervisory benchmarks in the context of capital qualitative and quantitative elements are required in adequacy assessment to ease comparability. In yet the United States in the context of the ICAAP. another of the surveyed countries, supervisors are analyzing whether to simplify the questionnaires In all respondent jurisdictions, supervisory and documents to be submitted by some cooperative directives on ICAAP require board and senior banks to support the ICAAP. management oversight. This oversight entails the requirement that the board approves the ICAAP Supervisors should weigh the benefits and drawbacks and that the board and senior management together of providing standardized methodologies for banks are responsible for formulating strategic plans to measure risks in the ICAAP. The expected and setting risk appetite and risk tolerance. The benefits typically are for the smallest or less complex Basel standards highlight that the board should be institutions, which may have neither the methodologies responsible for defining the corporate objectives, nor the tools or resources to measure some Pillar II risks. the risk strategies, and the bank’s risk profile, as Supervisors may feel comfortable because they may well as for approving the approach and overseeing compare institutions more easily by using those sorts the implementation of key policies pertaining to the of standardized methodologies for Pillar II. The main bank’s ICAAP. Consistent with the direction given drawbacks are that, by doing so, supervisors may inhibit by the board, senior management should implement banks’ incentives to develop their own methodologies. business strategies, risk management systems, and Moreover, those standardized methodologies may not risk culture processes and controls for managing the capture appropriately the risk characteristics of each risks to which the bank is exposed and consistent institution. with the board’s risk appetite. One of the key objectives of Pillar II is to encourage All nine jurisdictions requiring ICAAPs indicated banks to develop and use better risk management that supervisory guidelines underscore the link techniques in monitoring and managing their risks between capital planning and strategic business (BCBS 2006, par. 720). The question should, plans, risk management processes, and risk therefore, be to what extent—by providing profiles. For instance, in one respondent jurisdiction, standardized options to measure risks—may banks must provide evidence that their internal supervisors inhibit banks’ incentives to develop their capital targets are well founded and consistent with own risk measurement tools? Since the beginning of their overall risk profile and operating environment. Pillar II implementation, the supervisory community In another of the surveyed countries, an institution agreed on the importance of ensuring that ICAAP may also consider other factors, such as the target implementation should remain a bank-driven external rating, market position, entrance to new process, which is leveraged on banks’ internal risk markets, capital accessibility, acquisitions of other management processes as much as possible. undertakings, and other strategic goals. Banks should develop a capital plan that is integrated to their All eight countries requiring ICAAP reports strategic plans, risk appetite, and risk tolerance. Banks require both quantitative and qualitative should have an internal, integrated, and global process information. The ICAAP is a process and, as such, to assess the adequacy of internal capital on the basis is not just a quantitative measure of capital. The of their risk profile and a strategy for maintaining their ICAAP includes—besides the quantitative measure capital levels over time. Box 3 illustrates the capital of risks—board and senior management oversight planning in the European Union (EU). (for which sound corporate governance is key) and identification, monitoring, and control of risks. All Most supervisors who responded to the survey of those topics are required to be described as part typically require that certain specific risks of the reports. In addition, box 2 describes how should be assessed as part of banks’ ICAAPs. III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 16 Box 2. The Use of Quantitative and Qualitative Approaches in the United States In the United States, the Pillar II guideline requires that—in the internal capital adequacy assessment process (ICAAP)—all measurements of risk should incorporate both quantitative and qualitative elements. Generally, a quantitative approach should form the foundation of a bank’s measurement framework. Quantitative approaches that focus on most likely outcomes for the purpose of budgeting, forecasting, or measuring performance may not be fully applicable for assessing capital adequacy, which also should take less likely outcomes into account. In some cases, quantitative tools can include the use of large historical databases. Such databases are most applicable when they (a) are fully reflective of all relevant risk characteristics, (b) incorporate appropriate variability, and (c) have adequate granularity and history, including stressful economic periods or operating environments. When internal data are not available or do not reflect a bank’s risk profile, a bank may rely on external data for risk measurements, but it should ensure that external data have applicability to the bank’s own activities and risk profile. In many cases, risk assessments may rely on models that use both qualitative and quantitative inputs. The use of models can enhance the ICAAP, but it can also introduce challenges. Models may fail to work as intended or expected, or they may be used inappropriately for purposes not considered in their initial design. Those concerns apply to models purchased from third-party vendors, as well as to models that are internally developed. A bank should apply appropriate conservatism to compensate for any risks associated with models. Source: Office of the Comptroller of the Currency et al. 2008. Besides banks’ own assessment of Pillar I risks, of risk. In addition, box 4 describes the requirements in the ICAAP should include the following: (a) risks the Pillar II guideline in the United States (jurisdiction considered under Pillar I that are not fully captured not surveyed in this project). by that Pillar (for example, concentration risk, some securitizations); (b) risks not taken into account by Some supervisors require banks to assess certain Pillar I (for example, IRRBB, business, strategic, specific risks that are relevant to their financial reputational, liquidity risk); (c) factors external to systems. Thus, in one surveyed country, banks the bank (for example, business cycle effects); and are required to assess currency-induced credit risk (d) the assessment of compliance with the minimum (table 5). That may be a material risk for some standards and disclosure requirements of the advanced banks when they lend money to clients in a foreign methods in Pillar I.10 Table 5 shows that most of the currency but when their repayment capacity is in eight respondents require banks to assess all of those local currency (which induces currency mismatches risks. In one jurisdiction, some risks are not required in clients’ balance sheets). In this country, banks to be measured by the institutions themselves in should also assess the risk of excessive leverage their ICAAPs (concentration, IRRBB, liquidity, as part of their ICAAP. In another respondent and business cycle risk). Rather, the methodology jurisdiction, supervisors identified that some risks to measure those Pillar II risks is determined by a have become significant, such as technological risks regulation that applies to all institutions, irrespective and cybercrime, and banks are required to assess of their own characteristics. Only one surveyed those risks in their ICAAPs. In yet another of the supervisor does not specify the risks that should be surveyed countries, all institutions must build a assessed as part of the ICAAP, expecting those to countercyclical capital buffer, which is considered a be decided by the banks. The supervisory guideline component of the Pillar II capital requirement. In this requires that the assessment cover all types of risks country, the Pillar II capital is partially determined identified as significant, including the expected level by a regulation covering some of those risks. As required by the Basel II Framework (BCBS 2006, par. 724). 10 BASEL II PILLAR II PRACTICE STUDY 17 Box 3. European Union: Capital Planning and the ICAAP The European guidelines document requires that institutions should have an explicit, approved capital plan that states the bank’s objectives and the time horizon for achieving those objectives, plus—in broad terms—the capital planning process and the responsibilities for that process. The plan should lay out how the institution will comply with capital requirements in the future, what are any relevant limits related to capital, and what a general contingency plan is for dealing with divergences and unexpected events (for example, raising additional capital, restricting business, or using risk mitigation techniques). The institution’s management body is responsible for integrating capital planning and capital management into the institution’s overall risk management culture and approach. That body should ensure that capital planning and management policies and procedures are communicated and implemented institutionwide and are supported by sufficient authority and resources. Institutions should provide information about capital planning to their authorities. Information should refer to the methodology and policy documentation on capital planning, along with (a) a description of the general setup of capital planning, including dimensions considered (for example, internal, regulatory, time horizon, capital instruments, and capital measures) and (b) a description of the main assumptions underlying the capital planning. Institutions are also required to provide information about the following: (a) a forward-looking view about the development of risks and capital in terms of both internal capital and regulatory own funds and (b) a description of the current conclusions from capital planning such as planned issuances of various capital instruments, other capital measures (e.g. dividend policy), and planned changes to the balance sheet (for example, sales of portfolios). Source: EBA 2014. Box 4. Comprehensive Assessment of Risk for ICAAP Purposes in the United States In the United States, the Pillar II guidelines describe some risks that should be considered by institutions in their internal capital adequacy assessment processes (ICAAPs), including credit risk, market risk, operational risk, interest rate risk in the banking book, and liquidity risk. The guideline highlight that other risks, such as reputational risk, business or strategic risk, and country risk may also be material for a bank and, in such cases, should be given equal consideration to the more formally defined risk types. Additionally, if a bank uses risk mitigation techniques, it should understand the risk to be mitigated and the potential effects of that mitigation (including enforceability and effectiveness). Moreover, a well-developed ICAAP should include an assessment of all relevant factors that present a material source of risk to capital, and it should account for concentrations within each risk type. A bank should assess whether its capital is sufficient to absorb any losses that may arise from activities that expose the bank to multiple risks within and across business lines or that create concentrations across risk types. Additionally, the ICAAP should focus on any complex activities that give rise to multiple risks and to their interaction. The ICAAP should include an assessment of the potential effects of convergence of risks within and across business lines and their combined effect on capital adequacy. The ICAAP should consider the link between capital adequacy and damage or potential damage to a bank’s reputation. The bank’s ICAAP should also assess risks associated with new products, markets and activities, and challenges presented by new business lines or strategic acquisitions according to their effect on capital adequacy. Source: Office of the Comptroller of the Currency et al. 2008. III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 18 Directives in some countries explicitly require Table 5. ICAAP—Minimum Risks banks to describe whether they follow a Required to Be Addressed by quantitative or qualitative treatment of risks in the ICAAP. This is the case in two surveyed Supervisors jurisdictions. In addition, in one of the jurisdictions, Jurisdictions banks must rate the significance of each risk; they Requiring/ must also explain what risks are not significant Risk Type Total* and the rationale for making that determination. Credit 9/9 Moreover, banks should explain for each one of the Pillar I risks whether in their ICAAPs they Market 9/9 use the same approach as described in Pillar I, or Operational 9/9 if they measure credit, operational, and market risk using other methodologies. Banks should explain Concentration 8/9 the effects of stress-testing exercises on the amount IRRBB 8/9 of capital required internally for each one of those risks. The process is considered adequate (a) if it Securitization 6/9 captures appropriately significant risks, (b) if it Business 6/9 ensures an internal capital level adequate for the risk profile of the institution, and (c) if it is adequately Strategic 7/9 incorporated into the governance arrangements of Reputational 7/9 the institution. Liquidity 7/9 After banks estimate their internal capital needs External Factors 7/9 for each risk, one of the most challenging aspects relates to risk aggregation. Because of the challenges Other Risks presented by risk aggregation, banks should be Currency induced credit risk 1/9 expected to apply conservative assumptions in their modeling to reflect data and to model uncertainties. Excessive leverage 1/9 Banks should have clear policies and procedures Compliance with minimum supporting the aggregation across risk types and standards and disclosure 1/9 should apply conservative assumptions on risk requirements aggregation and diversification. Practices and techniques in risk aggregation are generally less Compliance with accounting sophisticated than are the methodologies used in standards and regulatory 1/9 measuring individual risk components. They rely on framework ad hoc solutions and judgment without always being IT and cyber security risk 1/9 theoretically consistent with the measurement of the components. Diversification benefits embedded in Business cycle risk 1/9 inter-risk aggregation processes often are based on Profile of historical average credit expert judgment or average industry benchmarks. 1/9 default losses Surveyed countries follow several approaches Any other risk material to the bank 9/9 on diversification effects. Given all the challenges Note: IRRBB = interest rate risk in the banking book; IT = information technology presented by risk aggregation, supervisors usually * Total respondents that require ICAAP. adopt a conservative approach. In one respondent jurisdiction, the regulation requires that total internal capital be determined by simply adding the capital BASEL II PILLAR II PRACTICE STUDY 19 determined to cover each risk. Therefore, no inter- the countries that responded to the survey, there are risk diversification effects are recognized. In other no specific instructions on how to aggregate risks; country, there are two options: (a) banks may add the therefore, diversification effects are, in principle, Pillar I requirement plus any other significant risk allowed, and assumptions are reviewed during the (Pillar II), with no diversification effects recognized; SREP. In one jurisdiction, if a bank intends to use or (b) institutions may use complex approaches risk diversification benefits, it must obtain approval to measure total internal capital requirements. In from the supervisor. In yet another of the surveyed the latter case, they should document and explain countries, banks are allowed to recognize inter-risk the assumptions and should establish whether the diversification effects when measuring total internal assumptions are valid under stressed scenarios. capital needs in the ICAAP. Box 5 summarizes the treatment of diversification effects in Canada. In two of the respondent jurisdictions, banks are required to explain how internal capital is Most jurisdictions require some level of internal determined. In both cases, banks should include the review for the ICAAP, the outcomes, and the quantification of internal capital for each risk and reports. Seven of nine respondents require the total internal capital, as well as methods for allocating ICAAP to be reviewed by the internal audit, and internal capital. In another of the respondent only two of those countries specify that the review jurisdictions, risk types should be consolidated should be done at least annually. In one jurisdiction, considering correlation and diversification effects the internal audit is required to review compliance on the condition that they are calculated by the with regulatory capital requirements, but it does not bank to be conservative. The methodology used review the whole ICAAP. The international standards in correlation and diversification effects should be highlight that an effective and efficient internal audit presented to supervisors. function constitutes the third line of defense in the system of internal control. It should provide an In one of the jurisdictions that responded to the independent assurance to the board of directors and survey, two approaches are allowed: (a) banks that senior management on the quality and effectiveness estimate Pillar II capital on a risk-by-risk basis must of a bank’s internal control, risk management, and use the simple summation of the capital charges that governance systems and processes (BCBS 2015). are estimated to cover each one of those risks; and (b) banks using comprehensive models (economic In practice, one of the most important challenges capital or similar) are allowed to estimate inter-risk is whether the internal audit has appropriate skills, correlations, with reasonable caution. In another of knowledge, and resources to conduct an effective Box 5. OSFI: Recognition of Diversification Effects in the ICAAP In Canada, the Office of the Superintendent of Financial Institutions (OSFI) Guidelines document determines that minimum (Pillar I) capital requirements are regulatory minimums that assume an institution has a portfolio of risk exposures that is highly granular and widely diversified. Because minimum regulatory capital requirements contain restrictive or simplifying assumptions, an institution should not rely only on compliance with regulatory minimums when conducting its own assessment of the adequacy of its capital. The guidelines underscore that institutions should exercise caution when including risk diversification benefits in their ICAAP. Assumptions on diversification are often based on expert judgment and are difficult to validate. Institutions should be conservative in their assessment of diversification benefits, in particular between different classes of risk, and those institutions should consider whether such benefits exist under stressed conditions. Source: Office of the Superintendent of Financial Institutions 2010. III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 20 review of banks’ ICAAPs. Moreover, in two planning as part of the ICAAP. For instance, jurisdictions, the ICAAP may be subject to review in one of those countries, the capital plan must by external audits if considered necessary by the consider stress test outcomes and must be aligned bank, whereas in another country, the review by to future business plans and strategic objectives, external auditors is mandatory. In one jurisdiction, and it should explain the sources of available the review may be done by the internal audit or capital. In another jurisdiction, in addition to those by an internal unit that is independent from those requirements, the capital plan should explain responsible for capital adequacy assessment how the bank will comply with capital adequacy (table 6). In three countries, models and ratios—with any relevant limits related to its own methodologies used within the scope of the ICAAP fund—and a general contingency plan for dealing may be validated not only by an independent with divergences and unexpected events. internal team but also by third parties or even the parent bank, subject to some conditions. In one country, the directives require banks to develop a capital plan, but it is not submitted to the Institutions engage in capital planning as part authorities (nor is the ICAAP). The required time of their ICAAP. Capital adequacy may vary over horizon for the capital plan ranges from only the time with economic, financial, or credit cycles, current year (in one of the surveyed jurisdictions) and banks must plan for this variance. As a result to a minimum of two years (in two jurisdictions) to of capital planning, a bank may choose to hold three years (in four jurisdictions). In one country, more capital to cover potential variations, or it may the regulation does not specify any time horizon. In have contingency plans to adjust capital or risk in another country, banks are required to have a capital response to changes in the cycle. Banks typically management process in place to ensure that the level set capital targets. In doing so, institutions typically of its own funds is adequate to cover long-term consider their risk appetite, the regulatory capital capital goals, emergency plans, and internal capital requirements, and their internal assessments of needs as assessed by the bank. capital needs, including those arising from the institution’s business plans, strategy, and stress tests. Supervisors use several tools to determine that the capital process is integrated with day-to-day Notwithstanding that most respondents require operations. Eight of nine respondents implement banks to develop a capital plan, the degree of some sort of use test when reviewing their supervised detail varies among jurisdictions. In some cases, institutions, both during the on-site visits and with off- submission to the authority is not required yet. site information. Consistent with the use test, some Four jurisdictions provide more specific guidance supervisors assess whether a single ICAAP is used for on what is expected by the supervisor on capital internal and regulatory purposes. In one jurisdiction, supervisors also assess whether model inputs (such Table 6. Independent Review as the probability of default [PD], scorings, and Required by Supervisors ratings) are used in the bank’s business management and not just for Pillar II capital purposes. They also Jurisdictions assess whether the information sources used for the Unit Responsible Requiring/Total ICAAP are integrated into the bank’s systems. In for the Review Respondents* another country, this issue is evaluated during on-site Internal Audit 7/9 examinations, and findings are factored into rating and risk assessment methodology. In two countries, External Audit 3/9 the regulation requires that the ICAAP be an integral part of the banks’ management process and decision- Bank’s Internal Unit 1/9 making culture. In one country, full supervisory *Total respondents that require ICAAPs (9 jurisdictions). review of this topic is not in practice yet. BASEL II PILLAR II PRACTICE STUDY 21 Eight of nine jurisdictions that require ICAAPs runs its own supervisory (top-down) exercise, also require banks to perform stress tests and the outputs are used when assessing banks’ for ICAAP purposes. Those exercises must be capital adequacy. In one country, banks must use integrated into risk governance and capital planning. their own scenarios for ICAAP purposes. Those In two of the respondent jurisdictions, stress-testing exercises are supplemented by annual supervisory outputs must be considered by banks when assessing stress test, in which the supervisory authority ICAAP capital needs and when setting capital plans. prescribes a common scenario that should be run Two countries require that banks take stress-testing by banks (bottom-up approach). This supervisory results obtained into account when assessing and exercise is done for financial stability purposes. maintaining an adequate level of internal capital. In yet another of the surveyed countries, the In one jurisdiction, banks are required to use the supervisor requires that some elements (such as results of stress tests for capital planning purposes— a significant decline in economic activity, high primarily the results of the stress test providing volatility in key financial prices, and so forth) the worst results. In another country, banks have must be considered by banks when they run the to integrate stress-testing outcomes to determine stress tests for ICAAP purposes, but the scenarios their internal target capital ratio, which should be considering those elements must be developed by sufficient to cover a deep economic recession. In the institutions themselves. only one country, regulations recommend that banks should incorporate stress-testing results into capital The Supervisory Review and planning, but there is no formal obligation to do so. Evaluation Process (SREP) A few supervisors provide common scenarios Risk Assessment that must be used for stress testing in the context of the ICAAP. This is the case of one of As part of Pillar II, supervisors are expected to the respondent jurisdictions, where, each year, the regularly review the process whereby a bank supervisory authorities provide up to three scenarios assesses its capital adequacy, risk position, for ICAAP purposes. Some of the benefits deriving resulting capital levels, and quality of capital from that are to enhance comparability among held (BCBS 2006, The Second Pillar, par. 746). institutions and to prevent banks from being too Supervisors should also evaluate to what extent optimistic about the scenarios. The drawback is that a bank has a sound internal process in place to by definition, supervisory scenarios are not bank assess capital adequacy. Moreover, the supervisory specific; therefore, they may not capture accurately evaluation of capital adequacy is a key component the specificities that may be relevant to some banks of a risk-based supervision system. Basel II but not to others.11 highlights the need to implement a formal and well- developed system to assess banks’ capital adequacy, In one jurisdiction, the supervisor provides using banks’ own internal assessment process (the scenarios for bottom-up exercises (supervisory ICAAP) as input to that evaluation. stress testing), and the banks use those exercises during the SREP as a benchmark for banks’ internal Of the 10 jurisdictions that responded to the survey, exercises. In another of the respondent countries, 2 have no process in place for ICAAP review. That banks must use their own scenarios for stress lack is because one of the jurisdictions does not testing in the ICAAP. The supervisory authority require ICAAPs to be submitted by the supervised For instance, for a bank with operations concentrated in a certain geographic region, the GDP growth for that region may 11 be a significant variable for the macro scenario, whereas it may not be relevant at all to institutions operating in that region. III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 22 institutions, whereas in the other jurisdiction, the In another country, the authority has issued very short, requirement exists but is only partially implemented. high-level guidelines with a general description of Banks are not required to submit ICAAP reports to the SREP. Three jurisdictions in the sample have the authorities. Nevertheless, supervisors in those not developed a separate, specific SREP for Pillar two countries review capital adequacy as part of II purposes. In one of those three countries, the on- their regular supervisory process. For instance, in site review of the ICAAP is conducted within the one country, supervisory guidance to assess capital regular, full-scope examinations. ICAAP findings goes beyond assessing compliance with minimum are factored into the general risk assessment and the regulatory capital, and supervisors assess whether capital adequacy assessment of the bank. In another banks have set internal capital goals according to of the countries in this group, the jurisdiction follows their risk profile. the European guidelines, and the ICAAP evaluation is integrated into the overall supervisory review and Five of the eight countries that require ICAAPs evaluation process. The supervisor does not have and ICAAP reports have developed specific separate procedure or methodology concerning processes and guidelines for the SREP. In the other ICAAP evaluation, but the ICAAP evaluation is three jurisdictions, the SREP is conducted as part of part of the overall capital assessment in the regular the regular examinations (figure 3). In two countries, supervisory process. Finally, in the third country in the supervisory authority has developed an internal this group, supervisors review and evaluate ICAAPs document for the SREP, with the procedures and as part of their ongoing supervision, which includes methodologies that must be followed by supervisors on-site examination, off-site monitoring, and when reviewing the ICAAPs. That methodology is ongoing communication with the bank. not disclosed to the industry. In another jurisdiction, the supervisor has also developed an internal The SREP has also adopted some specific methodology for the SREP, which is not disclosed characteristics depending on the country. In one to the public. Nevertheless, it is aligned with the jurisdiction, a process for gathering information has European guidelines, which are disclosed to the public been developed to analyze outlier institutions, and by the European Banking Authority (EBA 2014). a specialized working group that provides support Figure 3. The SREP—Number of Jurisdictions 10 9 8 5 3 Responded to Require Have Have a Separate, Have SREP as the Survey ICAAPs a SREP Specific Process Part of Full Examination BASEL II PILLAR II PRACTICE STUDY 23 to supervisors on Pillar II issues was created within one of the countries in this group, there is one rating the supervision department. There is an ongoing (CAMELS type)12 that is the outcome of the regular training program for supervisors on various risk- supervisory process, and the SREP feeds the overall related topics. The risk-based supervisory approach rating assigned to the bank. In another jurisdiction, remains the same as that before the introduction there is a similar treatment: supervisors do not of Pillar II. In another jurisdiction, the analysis of assign a separate rating to the ICAAP, but ICAAP ICAAP reports encompasses the appropriateness review findings are factored into the general risk of that process, including risk management assessment and into the capital adequacy evaluation practices, and the internal capital. In another of the of the bank. In one country in the sample, there is countries, during the SREP, supervisors review the a rating for the SREP, and it follows the European adequacy of risk governance, the risk management guidelines (EBA 2014). control function, the compliance with minimum requirements under Basel II, and the banks’ risk A similar situation exists in another of the appetite statement. In one jurisdiction, in the first jurisdictions, where the SREP follows the European stages of ICAAP implementation, there was a unit guidelines, with some adjustments to consider within the supervisory authority responsible for characteristics of the local market. Moreover, in this overseeing ICAAPs, for providing consultation, and country, there is a separate, seven-grade scale used for developing guidelines for supervisors. Currently, for ICAAP assessment, which is part of a capital the task of evaluating a bank’s ICAAP submission adequacy score. This score is not included in the has been assigned to the team responsible for overall SREP score algorithm and is assigned based conducting ongoing supervision of that bank. on expert judgment. In yet another of the respondent The rationale behind this assignment is that the countries, there is not a separate rating for bank’s supervisor of a particular bank has more specific ICAAP, but the evaluation of ICAAPs is used in information about a bank and therefore is better determining a composite rating of a bank. In another positioned to evaluate its ICAAP. country, there is a similar treatment: there is not a specific rating for the ICAAP, but the results of the Some specific topics are typically included in ICAAP review feed qualitatively into the overall the supervisory manual or guidelines for the assessment and rating of the bank. The inclusion of SREP. The specific methodology for the SREP ICAAP results into the overall supervisory rating developed by four countries describes the roles is foreseen in the near future. Box 6 presents the and responsibilities of supervisory staff members example of the use of a scoring system for the SREP who are involved in reviewing ICAAPs, and it in the EU. details the specific steps in evaluating the ICAAPs. The methodologies also describe the procedures Proportionality is a key characteristic of the SREP, for documenting and recording the findings and and eight surveyed jurisdictions implementing an recommendations from the ICAAP review, as well SREP (whether specific or as part of the general as the procedures for communicating the outcomes supervisory process) follow a proportional of the review to banks. approach. Jurisdictions follow several approaches to implement proportionality during the SREP. In Most of those jurisdictions implementing an four jurisdictions, the supervisory authority has SREP do not assign a specific rating to supervised established a formal categorization for financial institutions on the basis of that process. Five of institutions. In one of those countries, there are four eight supervisors that have an SREP in place do not categories based on the systemic importance, size, assign ratings on the basis of that assessment. In and business model of an institution. Institutions The CAMELS rating system produces a composite rating of an institution’s overall condition and performance by assess- 12 ing six components: capital adequacy, asset quality, management administration, earnings, liquidity, and sensitivity to market risk. III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 24 are assigned to one of four buckets based on those based on size, complexity, interconnectedness, parameters, and the category to which they belong and substitutability). In another of the surveyed applies for the entire SREP process. In two others countries, a similar approach, based on the within this subgroup, there are four categories based BCBS methodology, was designed to provide a on size and business type. In the fourth country that categorization of financial institutions, as well as to belongs to this subgroup, institutions are classified determine the intensity of supervision. based on size, systemic importance, and origin of capital (whether local or foreign). Supervisors conduct the ICAAP review combining the use of several tools and inputs from In another two countries, proportionality is applied different sources. The eight countries implementing on a case-by-case basis, even though in one of an SREP use the on-site and off-site reviews, and those jurisdictions, a simplified ICAAP for small their assessment is fed by discussions with the bank institutions will be implemented to enhance a and with other stakeholders. It is worth mentioning proportional approach during the SREP. In two that although in the eight surveyed jurisdictions the countries, the supervisor has already identified ICAAP is discussed with banks’ management, in domestic systemically important banks (D-SIB), only four countries do supervisors discuss with the following the BCBS methodology for G-SIB banks’ boards as well. In one country, supervisors (the indicator-based approach [BCBS 2012] discuss their findings with banks’ risk committees, Box 6. European Union: Scoring in the SREP The European guidelines for the supervisory review and evaluation process (SREP) determine that authorities should score the institution’s business model and strategy, internal governance and institutionwide controls, individual risks to capital, capital adequacy, individual risks to liquidity and funding, liquidity adequacy, and overall SREP assessment. In the assessment of the individual SREP elements, authorities should use a range of 1 (no discernible risk) to 4 (high risk), thus reflecting the “supervisory view” of the risk based on the relevant scoring tables in each element-specific title. Authorities should use the accompanying considerations provided in those tables for guidance to support supervisory judgment (that is, it is not necessary for the institution to fulfill all the considerations linked to a score of 1 to actually achieve a score of 1) or to further develop them or add additional considerations. Authorities should assign a score of 4 to reflect the worst possible assessment (that is, even if the institution’s position is worse than that envisaged by the considerations for a score of 4, a score of 4 should still be assigned). Authorities should ensure that through the scoring of individual risks they provide an indication of the potential prudential effect of the risk to the institution after considering the quality of risk controls to mitigate this impact. Authorities should ensure that the scoring of the overall SREP assessment achieves the following objectives: (a) it provides an indication of the institution’s overall viability; (b) it indicates the likelihood that early intervention measures should be taken, and it can act as a trigger for them; and (c) it determines, through the assessment of the overall viability of the institution, whether that institution is failing or is likely to fail. The overall SREP score is on a scale of 1 to 4 and reflects the overall viability of the institution. When the outcome of the overall SREP assessment suggests that an institution can be considered to be “failing or likely to fail,” authorities should apply a score of F and should follow the process of engaging with resolution authorities. Source: EBA 2014. BASEL II PILLAR II PRACTICE STUDY 25 which include members of the board of directors. only five jurisdictions is that frequency the same In most of the jurisdictions, the supervisory work as the average length of the supervisory cycle. is fed by the work of banks’ internal audit, whereas In one jurisdiction, the average frequency of the in only one is the work of the external audit used in supervisory cycle is semiannual, whereas in another addition to the supervisory review, as a commentary it is every two years, but if material findings are tool when revising the banks’ ICAAPs. identified during the SREP, the bank’s rating could be reviewed by carrying out the regular supervisory Peer group comparisons and thematic reviews are process in advance. In another country, the ICAAP used in most countries. It is worth mentioning that review for cooperative banks with the highest regular supervisory interaction with the different supervisory ratings is done every three years. levels of the institutions is key to an effective risk However, all cooperative banks annually submit governance framework. The BCBS standards on reports describing the state of their ICAAP. corporate governance emphasize the importance of regular supervisors’ interaction not only with senior In addition to requiring ICAAP reports, management but also with the board of directors, supervisors request banks to submit additional individual board members, and those responsible documentation to support their ICAAPs. All for risk management, compliance, and internal audit respondent jurisdictions request that banks submit functions (BCBS 2015). Such interactions encourage their business model and business strategy, the risk each level of the institution to be accountable for governance and management framework, their its respective roles. They support timely and open risk appetite, the bank’s stress-testing framework, dialogue on a range of issues, including bank’s the risk data, any aggregation methodologies, the strategies, business models and risks, effectiveness information technology systems, and the internal of corporate governance at the bank, bank’s culture, audit reports covering ICAAP. and findings or expectations that supervisors believe should be particularly important to board members. Most of the surveyed supervisors do not use strict All those elements are of utmost importance to the quantitative indicators or benchmarks to evaluate SREP (see table 7). capital for each risk category. In one country, the adequacy of the bank’s assessment is judged by (a) The SREP is conducted annually in the eight the qualitative methods that are based on peer group jurisdictions implementing that procedure, and sectoral comparisons, (b) the trend of capital but that frequency does not necessarily match allocation for each type of risk, and (c) the realized the average length of the supervisory cycle. losses for risk, if available. In another jurisdiction, In the eight jurisdictions implementing SREP, the assessment of a bank´s capital adequacy is banks’ ICAAPs are reviewed annually, but in part of a more comprehensive assessment of risks (holistic approach) that includes—among other tools—supervisors’ methodologies to challenge Table 7. SREP—Characteristics banks’ calculations and the review of banks’ models Jurisdictions and parameters. In one country, the supervisor uses Requiring/Total supervisory benchmarks for challenging internal Respondents* capital requirements for IRRBB, credit concentration risk, and currency-induced lending risk. In another A supervisory rating is an 3/8 country, the risk stemming from foreign exchange outcome of the SREP mortgages to unhedged borrowers has been addressed Supervisory categorization of by a capital add-on determined by the supervisor. 4/8 financial institutions In yet another of the respondent jurisdictions, Annual SREP 8/8 the supervisor has a list of indicators that must be *Total refers to the eight jurisdictions that have a SREP. considered by supervisors when assessing Pillar III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 26 II risks, particularly for concentration, liquidity, are required to assess their resilience with respect strategic, business, and reputational risk. Finally, one to hypothetical adverse macroeconomic conditions. surveyed jurisdiction requires all banks to measure With that aim, the supervisory authority provides some Pillar II risks (concentration, IRRBB, liquidity, two main scenarios (baseline and adverse). and business cycle risk) while using methodologies determined by a regulation. Banks are required to assess constraints in raising capital during periods of stress as part of The supervisor usually considers how external their capital plans. Six of the seven jurisdictions factors may affect banks’ internal capital that require capital plans have such a requirement in assessments. Seven of the supervisors implementing place. In one of those jurisdictions, such constraints a formal SREP consider external factors such must be part of the stress-testing assumptions used as business cycle effects and macroprudential by banks, and the results of their stress tests must be parameters as part of the ICAAP evaluation. In one considered when developing the contingency plans. of those countries, banks’ ICAAPs must consider In another jurisdiction, if the capital plan is assessed external factors such as economic cycle effects and as unreliable by supervisors, the jurisdiction the current economic situation. Moreover, models requires banks to resubmit the capital plan. Banks used by banks for credit risk under the ICAAP are required to assess constraints in raising capital should use through-the-cycle PDs. Supervisory during periods of stress within the recovery-planning stress test outcomes are considered during the SREP process. In another of those countries, supervisors and are based on top-down exercises done by the evaluate whether the outcomes of capital planning supervisory authority. under the baseline and stressed scenarios are consistent with macroeconomic and external events. In another jurisdiction, the macroeconomic In one of the jurisdictions in this group, the capital environment is taken into account in the supervisory plan must consider a range of situations, such as stress test that is used as a benchmark for banks’ own how the bank will be affected in an economic crisis, exercises. In one of the jurisdictions responding to what a regression in the bank’s activities might the survey, supervisors assess some macroeconomic be, what stress testing is used, and how the bank variables (commodity prices, foreign exchange will maintain its activities and its capital without rate, inflation rate, and interest rates) to determine breaching the minimum capital adequacy ratio. the plausibility of stress test assumptions used by Finally, in the remaining jurisdiction in the group, banks. In another jurisdiction, the supervisory banks are required to provide a capital plan under authority determines the scenarios that banks both normal and stress conditions, in accordance must use for ICAAP purposes. For determining with their future business plan and with the risk those scenarios, the authority considers the recent tolerance approved by the board of directors. macroeconomic development and expectations. In another jurisdiction, supervisors consider the All respondent supervisors that have an SREP macroeconomic environment when assessing will communicate the results to the banks, but not banks’ assumptions used in their stress tests. In yet all of them will communicate such information another country, supervisors assess banks’ business directly to the banks’ board, notwithstanding plans and banks’ performance while considering recommendations by the international the macroeconomic environment and the external standards.13 In two of seven countries implementing environment, which might negatively affect banks’ an SREP, supervisors communicate the outcomes revenues, capital, and viability. Finally, in one of of the SREP only to the banks’ chief executive the respondents to the survey, as part of the regular officer (CEO). In another country, the outcomes risk-based supervisory process, credit institutions are also communicated to the board of directors; in See BCBS 2015, Principle 13: The Role of Supervisors. 13 BASEL II PILLAR II PRACTICE STUDY 27 another, results are also communicated to the risk Drawing on the SREP, supervisors provide committee. In one respondent country, besides the feedback to banks focused on the areas with CEO and the board of the institution, the outcomes the most significant weaknesses. For instance, of the ICAAP review are communicated to the in one jurisdiction, on the basis of the SREP, board risk committee. In two of the jurisdictions, the supervisor determines recommendations or supervisors communicate such information to bank comments appropriate to the bank´s risk profile. They boards and to the home supervisors of foreign banks, can be associated with qualitative and quantitative and in another country, besides communication topics, such as the risk management process, the to bank boards, the assessment is communicated determination of risk appetite, the quality of risk data, to external auditors and to the Bank Guarantee the model assumptions that are not well supported, the Fund. As mentioned, supervisory interaction methodology to capture risks relevant to the bank´s with several levels of the institutions (the board; risk profile, and the validation procedures. In another senior management; and those responsible for risk country, main deficiencies are related to the internal management, compliance, and internal audit) is models used for Pillar II purposes and stress-testing key to support a sound risk governance framework assumptions. In one of the respondent jurisdictions, (BCBS 2015). because the SREP is embedded in the regular Box 7. European Union: Supervisory Engagement and Proportionality in the SREP Authorities should apply the principle of proportionality in the scope, frequency, and intensity of supervisory engagement and dialogue with an institution, and supervisory expectations of the standards the institution should meet in accordance with the category of the institution. For the frequency and intensity of the supervisory engagement aspect of proportionality and when planning supervisory review and evaluation process (SREP) activities, competent authorities should adhere to a minimum level of engagement model. Institutions are classified into four categories. The categorization reflects the assessment of systemic risk posed by institutions to the financial system. Authorities should use it as a basis for applying the principle of proportionality and not as a means to reflect the quality of an institution. Institutions in Category 1 are G-SIBs (global systemically important banks) and other systemically important institutions. Those in Category 2 are medium to large institutions that operate domestically or with sizable cross-border activities. Category 3 refers to small to medium institutions that do not qualify for Category 1 or 2, that operate domestically or with nonsignificant cross-border operations, and that operate in a limited number of business lines. Category 4 includes all other small noncomplex domestic institutions that do not fall into the previous categories. For all groups of institutions, the authorities should monitor some key indicators on a quarterly basis. The frequency of the assessment of all SREP elements varies depending on the group to which the institutions belong: from annual (Category 1), to every two years (Category 2), and to every three years (Categories 3 and 4). The frequency of the minimum level of engagement and dialogue with the institution is also based on the categorization. For instance, for institutions in Category 1, authorities are expected to implement an ongoing engagement with institution’s management body and senior management. For institutions in Category 4, the engagement with institution’s management body and senior management should be at least every 3 years. Source: EBA 2014. III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 28 supervisory process, supervisors do not provide Some jurisdictions plan to update supervisory individual feedback regarding ICAAP evaluations; guidelines to the assessment of liquidity by however, the supervision authority is working on a banks. In one surveyed jurisdiction, the SREP thorough framework for ICAAP reviews. In another methodology has been adjusted to the European jurisdiction, most of the feedbacks identified from guidelines on the internal liquidity adequacy ICAAP reviews are related to the assumptions used assessment process (ILAAP) (EBA 2016), for capital planning purposes, methodologies to with some adjustments resulting from size and evaluate risks, and stress-testing methodologies complexity of the activity carried out by banks in and assumptions. Box 7 summarizes the model of the local banking sector, especially, cooperative supervisory engagement and dialogue used in the EU. banks. The review of adequacy of liquidity is part of the SREP. In another country, the supervisor None of the eight respondent supervisors is working to amend the directives on ICAAP require banks to disclose their Pillar II capital. requirements to introduce more elaborated Disclosure requirements under Pillar III typically information on liquidity. In one country, there is refer to transparency of Pillar I capital calculations a plan to complement the ICAAP with ILAAP in but not to Pillar II internal figures. One country in the future. Regarding the assessment of liquidity, the sample requires banks to disclose a summary of three jurisdictions are not considering further the institution’s approach to assessing the adequacy adjustments to either the ICAAP or the SREP. of its internal capital to support current and future activities but doesn’t require them to disclose Supervisory Response quantitative capital needs. This requirement is in line with the European Pillar III regulatory framework. Having carried out the SREP, supervisors should In two countries, banks are required to disclose their take appropriate action if they are not satisfied with Basel III capital buffers. the results of the bank’s own risk assessment and capital allocation (BCBS 2006, Pillar II, par. 756). Regarding the near future, many of the surveyed Bank-specific uncertainties will be treated under Pillar jurisdictions are expected to be involved with II. Supervisors will typically require or encourage Basel III implementation. The analysis of the banks to operate with a buffer over and above Pillar responses to the survey shows that five jurisdictions I. There are several means available to supervisors have already implemented Basel III, and most of to ensure that individual banks are operating with them are not planning significant changes with adequate levels of capital. Among other methods, the respect to Pillar II in the short- or mid-term. Two supervisor may set trigger-and-target capital ratios jurisdictions mentioned that they plan to adopt the or may define categories above minimum ratios to new Basel Committee methodology to measure identify the capitalization level of the bank (BCBS IRRBB, as a requirement under Pillar II. One 2006, Pillar II, Principle 3, par. 757). country is also proposing to issue guidelines on concentration and reputational risk, business model In the 10 jurisdictions that responded to the analysis, and stress testing. The other jurisdictions survey,14 banking laws and regulations provide that responded to the survey did not provide detailed the supervisors with explicit power to set answers regarding changes to Pillar II arising from individual capital expectations that are based the adoption of Basel III. on Pillar II review and outcomes. For instance, in 14 This includes one jurisdiction where ICAAPs are not required yet. The legal framework also empowers this supervisory authority to require capital above the minimum regulatory requirements when deficiencies are identified during the ICAAP review. BASEL II PILLAR II PRACTICE STUDY 29 one country, supervisors assess each bank and may The range of Pillar II add-ons resulting from require capital above Pillar I when the bank faces the supervisory review is wide in the surveyed certain risks, either specific to the bank or affecting jurisdictions. In two countries, the supervisor may the economy as a whole. Moreover, regulations set require an amount that is based on a bank-by-bank a range of possible actions to address shortcomings overall analysis of risk (holistic approach) within in banks’ ICAAPs, including the requirement the SREP. In one jurisdiction, capital add-ons of additional capital. In another of the surveyed ranged from 1.21 to 9.62 percentage points in 2015 countries, the legislation allows the supervisory and from 0.57 to 6.30 percentage points in 2016. In authority to increase the minimum capital adequacy another of the surveyed countries, all commercial ratios; to apply different ratios to each bank; and banks were subject to an add-on in 2016, and the to differentiate calculation and even the reporting range was 0.48–3.81 percentage points. In one periods, considering the banks’ internal systems, jurisdiction, the supervisor does not prescribe any assets, and financial structure. In one of the capital add-on to banks; rather, banks are required respondent jurisdictions, the legal framework allows to assess material risks to which they are exposed the supervisor to instruct a credit institution to hold and to calculate Pillar II capital requirements using capital in excess of the minimum requirements their own methodologies. Supervisors review relating to elements and risks not covered by Pillar I. those methodologies and the resulting capital estimates as part of the supervisory process. Two In most jurisdictions, banks primarily determine of the surveyed countries do not have this process the Pillar II capital amount, whereas in others, in place yet. supervisors adopt a more prominent role. Most of the jurisdictions have a two-stage process. First, Some supervisors do not have an ex ante, banks determine their Pillar II capital needs as part prespecified time frame for banks to comply with of their ICAAPs. Second, supervisors review banks’ Pillar II capital expectations, whereas others assessment and decide whether the Pillar II capital, have such a time frame. Four countries have no as determined by the bank, is enough. If supervisors prespecified time frame; it is decided on a case-by- decide that a bank´s capital level is insufficient to case basis. For instance, in one of those countries, cover its risks, then they may require additional supervisors set the time frame considering the time capital. This is the process followed in four of needed for the capital increase. Two countries report the surveyed jurisdictions. In one country, the a prespecified time frame of three to six months and of supervisor determines Pillar II add-ons. In another of six months, respectively. In another of the surveyed the surveyed countries, the supervisor requires that countries, there is a specific process, because if the all institutions should have capital to address some supervisor has established a standardized Pillar II Pillar II risks (concentration, IRRBB, liquidity, and requirement, it must be satisfied on a monthly basis. business cycle risk) on the basis of a standardized For other Pillar II risks measured internally by the methodology provided by the supervisor. bank, if the bank does not have capital enough, it should present a capital plan within 15 days after the Banks must assess whether they face any other ICAAP report is sent to the supervisor (once a year). material risk not covered by the regulatory In two countries, the process is not in place yet. requirements (for both Pillar I and the standardized Pillar II risk), in which case they should use their In most surveyed jurisdictions, the failure of a own internal methodologies to determine the bank to satisfy the supervisor’s Pillar II capital necessary internal capital. In one jurisdiction, beside expectations constitutes noncompliance. This banks’ internal capital assessment, the supervisor is an indicator that the Pillar II requirement is may require additional capital for banks with the binding in practice and is not just the minimum highest risks. In two of the surveyed countries, this (Pillar I) capital requirement. To illustrate, in one process is not in place yet. jurisdiction, if the current capital adequacy ratio III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 30 falls below the internal capital ratio, the bank shall and implement a satisfactory capital adequacy promptly submit an action plan to the supervisor restoration plan, and requiring the bank to raise ensuring that it will restore its capital to the level additional capital immediately. Supervisors should of the internal capital ratio. In another jurisdiction, have the discretion to use the tools best suited to capital for some Pillar II risks is required by the circumstances of the bank and its operating regulation. Therefore, when a bank does not satisfy environment (BCBS 2006, Pillar II, par. 759). this requirement, it is considered in noncompliance with a regulatory requirement. All surveyed supervisors requiring ICAAPs have tools available to deal with less-than-satisfactory In six of the countries, banks are not allowed to ICAAP results. Requiring banks to improve risk use capital that has been allocated to Pillar II. management systems and controls, intensifying the Only under extreme circumstances such as severe bank’s monitoring, and requiring additional capital stress, some jurisdictions may allow the use of such are tools available to the nine surveyed supervisors capital. For instance, in one jurisdiction, under who require ICAAPs. Requiring a capital adequacy such a scenario, the bank must prepare a capital restoration plan and restricting payment of dividends conservation plan and submit it to the supervisor no are tools available to eight of the nine respondents. later than five working days after the bank identifies Six of the nine respondents can require banks to that it is failing to meet the Pillar II requirement. In reduce their risk exposure, restrict banks’ current another respondent jurisdiction, the countercyclical activities, or prohibit new activities or acquisitions. capital buffer (which is considered part of the The most frequent action required by supervisors Pillar II capital) is allowed to be used under certain in the past two years has been to improve risk circumstances. In one country, supervisory approval management systems and control (figure 4). is needed if a bank intends to use Pillar II capital. Some of the weaknesses mentioned in this area by respondents are that the risk appetite and risk Under normal circumstances, most surveyed tolerance are not consistent and are not well linked to supervisors adjust their Pillar II capital ICAAP results, that there is a lack of an independent expectations annually on the basis of their annual review of the ICAAP by an independent area of the SREP. Nevertheless, they are prepared to adjust their bank or the internal audit, and that there is a the lack expectations more frequently if there are significant of a forward-looking solvency assessment. changes in the bank or in market conditions. One jurisdiction reports an ongoing monitoring of In most surveyed jurisdictions, banks have access banks and may require monthly adjustments to to the supervisor or to a third party through an the banks’ capital adequacy on the basis of off-site appeals process to review the supervisory decision supervisory analysis. In another jurisdiction, the to raise Pillar II capital. In one jurisdiction, banks supervisor adjusts an expectation monthly, at least should submit their objections to the supervisor in for the standardized Pillar II requirement, which writing. Once the supervisor issues the final report, is measured for that frequency. In one country, the the institution may file a complaint against that frequency ranges from one to two years. decision in a court of law. In another jurisdiction, banks may file defense briefs with the supervisor; however, those allegations are not necessarily Corrective Actions admitted. In one country, since 2016, the additional Supervisors should consider a range of options capital requirements (Pillar II add-ons) have been if they become concerned about whether a imposed through an administrative decision. bank is meeting the requirements embodied in The decision is final and subject to immediate the Pillar II process. Those actions may include implementation; however, the bank may file a intensifying the bank’s monitoring, restricting the motion to reconsider the decision. If the decision is payment of dividends, requiring the bank to prepare sustained, the bank may appeal the decision at the BASEL II PILLAR II PRACTICE STUDY 31 administrative court. In another jurisdiction, once an appeals process. Four surveyed jurisdictions do the direction to raise capital is final and the bank is not have such a process yet. notified, the decision cannot be overridden through Figure 4. Corrective Actions Tools—Available Tools—Used in the Past 2 Years Improve Risk Raise Additional Capital 10 7 Management Start Capital Intensity Monitoring 10 2 Restoration Plan Improve Risk Management Raise Additional 10 1 Capital Restrict Dividends 9 Restrict Dividends 1 Start Capital Restrict 9 Current Activities 1 Restoration Plan Prohibit New Activities Intensify Monitoring 7 1 or Acquisitions Prohibit New Activities Restrict Current Activities 7 or Acquisitions 1 Reduce Risk Exposure 7 Reduce Risk Exposure 0 III. MAIN FINDINGS IN SURVEYED JURISDICTIONS 32 FINANCE, COMPETITIVENESS & INNOVATION INSIGHT | FINANCIAL STABILITY & INTEGRITY IV. CONCLUSIONS AND LESSONS B y design, Pillar II is principle based and flexible; therefore, the specifics of implementation differ across jurisdictions and institutions. By analyzing how Pillar II has been implemented across a sample of jurisdictions, this note helps to highlight areas in which challenges still exist and from which some lessons may be learned. Regarding the ICAAP, the main lessons and quantitative assessment of risks and the internal challenges are as follows: capital required to cover those risks. Institutions should describe how they identify and measure • Having clear supervisory guidelines for the their material risks and related capital needs. They ICAAP is important to clarify expectations should describe clearly the consistency of this for both supervisors and banks. The degree assessment with their risk profile, risk appetite, of detail of those guidelines may vary and is and capacity. The template should include a typically influenced by the supervisory culture section where institutions describe their capital of the country. Nevertheless, the main expected planning and stress-testing framework, including components of a sound ICAAP should be a description of their needs and sources of capital, explicitly mentioned in the guidelines. their capital plan for current and next years, and a clear description of the stress-testing framework. • It is useful that supervisors require the use of The template should allow banks to describe common templates for institutions to report what their approach to aggregate their internal the ICAAP. Nevertheless, there should be a capital needs for all risks might be and whether balance between standardization and flexibility. diversification effects (inter- as well as intra-risk Templates should be standardized but flexible diversification) are considered. In the conclusions, enough to reflect that the ICAAP is a bank- banks should summarize their total internal capital driven and a bank-specific process. The template needs and capital sources. should not be so rigid that it becomes simply a checklist. The template should include not only • The scope of ICAAPs should be sufficient to quantitative but also qualitative information. accurately reflect the risks in a financial group The ICAAP is a process; as such, it should and to allow supervisors to determine if risks be supported by strong corporate governance are properly captured and addressed. In some and a sound risk management framework cases, supervisors may require both consolidated that should be described in the template. and stand-alone ICAAPs. Supervisors should expect subsidiaries and branches of international The templates should typically include a summary banking groups to be involved and empowered to section covering the general information, the scope discharge their duties in relation to their ICAAP. of application, the key components of the ICAAP, The local institution should be responsible for the summary of a stress-testing framework, and the application of global tools and processes the bank’s approach to capital planning. In another relative to the host financial market; otherwise section, the institution should describe its risk the ICAAP for the whole group may not be governance framework, including the board and a good representation of the reality of the senior management responsibilities, the role of institution in the host market. In this regard, committees, and the role of the internal audit in the the ICAAP guidelines should clearly establish ICAAP. Another section should be devoted to the the responsibilities of local institutions that are BASEL II PILLAR II PRACTICE STUDY 33 subsidiaries or branches of international banking what the time horizon is for achieving those groups. In jurisdictions where the requirement objectives, how they set capital targets, and comes from the general legal or regulatory which people or internal areas are in charge of framework, no further instructions are necessary that process. The time horizon should exceed the for ICAAP purposes. The assessment of capital current year, and it should cover from three to five adequacy for subsidiaries should not be different years to allow for a forward-looking perspective. from that for local banks, and the local institution should be responsible for the application of global As part of their ICAAP, institutions should explain tools and processes at the local level. In the case clearly the link between capital planning and of branches, experience shows that when this their strategic business plans, risk management home-host issue is not addressed correctly, the processes, and risk profiles. Banks should provide ICAAP is too far removed from the host reality. evidence that their internal capital targets are well founded and consistent with their overall risk • Proportionality must be embedded in ICAAPs. profile and operating environment. Moreover, ICAAP reporting and methodologies should vary institutions should explain if—to determine their according to the size and complexity of banks in the capital targets—they consider factors such as a given jurisdiction. The smaller and less complex target external rating, market position, entrance to institutions should be allowed to use simple new markets, capital accessibility, acquisitions of measurement methodologies that are consistent other undertakings, and other strategic goals. The with their less complex risk management capital plan needs to be integrated to institutions’ frameworks and ICAAPs. Nevertheless, even in strategic plans, risk appetite, and risk tolerance. the simpler banks, Pillar II capital should not be Banks should have a well-defined process to an automatic add-on, but it should be risk-based assess the adequacy of internal capital on the basis and consistent with the institution’s business and of their risk profile and a strategy for maintaining risk profile. To determine whether proportionality their capital levels over time. is being applied consistently, supervisors needs a clear and deep understanding of each institution. • Supervisors should be aware of the challenges and limitations faced by those parties involved Supervisors should weigh the benefits and in the ICAAP review, such as the board and drawbacks of providing standardized ICAAP the internal audit. The staff members in the methodologies. In particular, supervisors should internal audit departments should be trained not redirect banks’ incentives to develop their own and resourced so that they have the proper methodologies. ICAAP implementation should skills, knowledge, tools, and techniques to remain a bank-driven process that is established provide an independent assurance on the on banks’ internal risk management processes as quality and effectiveness of a bank’s internal much as possible. Most jurisdictions surveyed control, risk management, and governance for this projects do not offer standardized systems and processes supporting the ICAAP. methodologies that may be used by banks to measure their Pillar II—with only one exception. Board and senior management oversights are In all other cases, proportionality is decided key to an effective ICAAP. The board should and applied by the bank itself and assessed by be responsible for approving the ICAAP and— supervisors during the SREP. together with the senior management—should be responsible for formulating strategic plans • A capital plan is a key component of a sound and setting risk appetite and risk tolerance. The ICAAP; it should be forward looking, with board should define the corporate objectives, clear time horizons that go beyond the current the risk strategies, and the bank’s risk profile, year. Supervisors should require that the capital as well as approve the approach and oversee the plan states what the institution’s objectives are, implementation of key policies pertaining to the IV. CONCLUSIONS AND LESSONS 34 bank’s ICAAP. Consistent with the direction • The outcomes of the SREP should be integrated given by the board, senior management should into the overall supervisory assessment. implement business strategies, risk management The SREP and the regular supervisory cycle systems, and risk culture processes and controls should not be disconnected, and silo approaches for managing the risks to which the bank is should be avoided. The supervisory capital exposed, all of which should be consistent with assessment for Pillar II purposes and that under the board’s risk appetite. the regular supervisory cycle should be closely linked, even if the frequency of the SREP is • Supervisors should encourage institutions to not the same as that of the regular supervisory disclose their Pillar II capital figures and the cycle. The results of the SREP must be risk governance aspects around Pillar II and integrated into the regular supervisory cycle. to allow third parties to better assess banks’ total capital adequacy. Even though Pillar III The SREP needs to be a well-structured process requirements focus on Pillar I capital figures, that is based on a sound written document. a total capital ratio should be disclosed jointly The supervisory authority should develop a with the disaggregation of capital assigned to document for the SREP, with the procedures each of the risks that the bank considers part and methodologies that must be followed by of Pillar II. That disclosure will allow for a supervisors when reviewing the ICAAPs. There comprehensive picture of the bank’s soundness. should be a clear procedure describing how the outcomes of the SREP are considered during the The aggregation methodology and inter-risk regular supervisory process. diversification effects, when they exist, should also be disclosed. Given all the challenges • Proportionality should be a key characteristic presented by risk aggregation, supervisors should of the SREP. Jurisdictions should follow adopt a conservative approach on the recognition the approach that is best suited to their of diversification effects for Pillar II purposes. characteristics—for instance, by identifying When institutions are allowed to recognize those formal categories of institutions or by using a effects, they should document the assumptions case-by-case analysis. A formal categorization for and methodologies used and should show whether financial institutions—reflecting the assessment they are valid under stressed scenarios. The of systemic risk posed by institutions to the methodology used to determine correlation and financial system—may be used by supervisors as a diversification effects should be disclosed. basis for applying the principle of proportionality. Regarding the SREP, the main lessons and The categorization should be reviewed at identified challenges are the following: least annually or in the event of a significant corporate event such as a large divestment, an • The SREP needs to be underpinned by a acquisition, or an important strategic action. strong culture of risk-based supervision. The The categorization should be consistent with SREP requires supervisors to assess capital any other categorization used for supervisory beyond compliance with minimum regulatory purposes, such as those used to identify G-SIBs requirements. Supervisors should be suitably or D-SIBs based on the BCBS methodology. equipped with sufficient skilled resources to be able to challenge banks on their determination of The supervisor must possess the skills and total capital needs and carry out a comprehensive resources to evaluate a range of ICAAPs review of the banks’ ICAAPs. The supervisory relative to banks’ sizes and complexities and culture should not be too compliance based so the resulting capital configurations. Supervisors that it jeopardizes the exercise of risk-based should conduct the ICAAP review combining supervision, which is key to implement the SREP. the use of several tools and inputs from different BASEL II PILLAR II PRACTICE STUDY 35 sources, including on-site and off-site reviews. must be empowered to set capital requirements The supervisory assessment should also be fed on the same basis. Lacking such tools, the by discussions with the bank and with other supervisor is handicapped in discharging its duty: stakeholders. Supervisors may request banks that of safeguarding the overall soundness of to submit additional documentation to support the banking sector and the economy as a whole. their ICAAPs. Supervisors should analyze key financial and nonfinancial indicators to monitor Thus, the total capital requirement that an the financial conditions and risk profiles of institution should hold should be the Pillar I institutions. Supervisors should monitor these capital, plus the Pillar II capital as determined indicators periodically to identify the need for by the institution in its ICAAP and reviewed updates to the assessment of the SREP in light by supervisors during the SREP, and any other of new material information outside of planned additional capital requirement determined by the supervisory activities. supervisor as a result of the SREP. In addition, there should be clear supervisory guidelines • As part of the SREP, supervisors should have determining that the failure of a bank to satisfy discussions with, and provide feedback to, the supervisor’s Pillar II capital expectations not only the senior management but also the constitutes noncompliance. This is an indicator board of directors and those responsible for that the Pillar II requirement is binding in practice. risk management, finance, compliance, and Moreover, supervisory guidelines should be clear internal audit functions, as appropriate. This about under which circumstances (if any), banks helps to double-check information as well as to are allowed to use capital that has been allocated convey to parties their roles and responsibilities to Pillar II. That should be allowed only under in the ICAAP and risk management processes in extreme circumstances, for example, in periods of general. Moreover, it emphasizes and reinforces severe stress and subject to supervisory approval. the board’s responsibility in the process and holds them accountable for the integrity • Supervisors should have a range of tools to and independence of the process. Regular deal with less-than-satisfactory ICAAP results. supervisory interaction with the different levels Supervisors should exercise their supervisory of the institutions is key to an effective risk powers on the basis of deficiencies identified governance framework. Those interactions during the SREP. Supervisors should determine encourage each level of the institution to be the institution’s viability, on the basis of the accountable for its respective roles. Peer group adequacy of its capital resources, governance, comparisons and thematic reviews should also controls, business model or strategy to cover the be used during the SREP. risks to which it is or may be exposed. On the basis of this determination, supervisors should • Supervisors should have the explicit power take supervisory measures necessary to address to set individual bank capital expectations those concerns, including requiring a capital based on Pillar II review and outcomes. Given adequacy restoration plan, restricting payment the genesis of the Pillar II capital standards, to of dividends, requiring banks to reduce their risk more proactively provide capital support for risks exposure, restricting banks’ current activities, or and their configurations based on each bank’s prohibiting new activities or acquisitions. characteristics and business strategy, supervisors IV. CONCLUSIONS AND LESSONS 36 FINANCE, COMPETITIVENESS & INNOVATION INSIGHT | FINANCIAL STABILITY & INTEGRITY REFERENCES BCBS (Basel Committee on Banking Supervision). 1988. International Convergence of Capital Measurement and Capital Standards. Basel, Switzerland: Bank for International Settlements (BIS). ———. 1996. Amendment to the Capital Accord to Incorporate Market Risks. Basel, Switzerland: Bank for International Settlements (BIS). ———. 2004. International Convergence of Capital Measurement and Capital Standards: A Revised Framework. Basel, Switzerland: Bank for International Settlements (BIS). ———. 2006 International Convergence of Capital Measurement and Capital Standards. A Revised Framework. Comprehensive Version. Basel, Switzerland: Bank for International Settlements (BIS). ———. 2011. Basel III: A Global Regulatory Framework for More Resilient Banks and Banking Systems. Revised version (original published December 2010). Basel, Switzerland: Bank for International Settlements (BIS). ———. 2012. A Framework for dealing with Domestic Systemically Important Banks. Basel, Switzerland: Bank for International Settlements (BIS). ———. 2015. Corporate Governance Principles for Banks. Guidelines. Basel, Switzerland: Bank for International Settlements (BIS). ———. 2017a. Basel III: Finalising Post-Crisis Reforms. Basel, Switzerland: Bank for International Settlements (BIS). ———. 2017b. Twelfth Progress Report on Adoption of the Basel Regulatory Framework. Basel, Switzerland: Bank for International Settlements (BIS). ———. 2018a. History of the Basel Committee. Basel, Switzerland: Bank for International Settlements (BIS). ———. 2018b. Basel III Summary Table. Basel, Switzerland: Bank for International Settlements (BIS). EBA (European Banking Authority). 2014. “Guidelines on Common Procedures and Methodologies for the Supervisory Review and Evaluation Process (SREP).” EBA/GL/2014/13. London: EBA. ———. 2016. “Guidelines on ICAAP and ILAAP Information Collected for SREP Purposes. Final Report.” London: EBA. Financial Stability Board (FSB). 2014. Key Attributes of Effective Resolution Regimes for Financial Institutions. Basel, Switzerland: FSB. BASEL II PILLAR II PRACTICE STUDY 37 Ingves, Stefan. 2015. “From the Vasa to the Basel Framework: The Dangers of Instability.” Unique lecture presented at the 2015 Annual Convention of the Asociación de Mercados Financieros, November 2, 2015, Madrid, Spain. Office of the Comptroller of the Currency, Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation and Office of Thrift Supervision. 2008. “Supervisory Guidance: Supervisory Review Process of Capital Adequacy (Pillar 2) Related to the Implementation of the Basel II Advanced Capital Framework.” Office of the Federal Registrar, Washington, DC. https://www .federalreserve.gov/newsevents/pressreleases/files/bcreg20080715a1.pdf. Office of the Superintendent of Financial Institutions. 2010. “Internal Capital Adequacy Assessment Process (ICAAP) for Deposit-Taking Institutions.” Guideline E-19. Government of Canada. http://www.osfi-bsif .gc.ca/Eng/fi-if/rg-ro/gdn-ort/gl-ld/Pages/icaap_dti.aspx?pedisable=true. REFERENCES 38