Banks Act Circular 2/2005: New Capital Accord (Basel II) Impact Study and Related Requirements

2005-01-04 TO ALL BANKS, BRANCHES OF FOREIGN BANKS AND MUTUAL BANKS BANKS ACT CIRCULAR 2/2005 NEW CAPITAL ACCORD (“BASEL II”) – IMPACT STUDY AND RELATED REQUIREMENTS

1. Executive Summary As part of the iterative process of planning for and implementing Basel II, all banks, branches of foreign banks and mutual banks (“banks”) are required to take part in an impact study and to comply with the related requirements. In terms of this impact study, this Office wishes to address aspects of the following areas of Basel II: • Pillar I – Capital requirements. • Pillar II – Capital management. • Pillar III – Disclosure requirements. The purpose of the impact study and related requirements is manifold and includes the following: • Promoting sound project-management principles and practices in the planning for and implementation of Basel II. • Obtaining relevant information pertaining to the impact of Basel II. • Assessing the state of preparedness for Basel II implementation. • Developing guidance.

2 Banks and/or banking groups are required to submit the following to this Office by specified deadlines: • Duly completed Quantitative Impact Study 4 (“QIS 4”) worksheets. • Duly completed questionnaire relating to the completion of the QIS 4 worksheets. • Description of the current status and intended position of the capital management of the bank or the banking group, as the case may be. • A set of financial statements compliant with generally accepted accounting practice and Basel II. 2. Introduction On 26 June 2004, the Basel Committee on Banking Supervision (“Basel Committee”) issued a publication, titled “International Convergence of Capital Measurement and Capital Standards: a Revised Framework” and commonly referred to as Basel II. As was stated in Banks Act Circular 20/2004 dated 14 December 2004, the common implementation date in South Africa for all approaches under Basel II is 1 January 2008. Given the enormity and complexity of Basel II, the application of sound project￾management principles and processes is a prerequisite to the successful implementation of Basel II. To this end, this Office, in terms of Banks Act Circular 15/2004, required banks to perform a gap analysis and readiness assessment. In terms of the abovementioned circular, banks are required to participate in an impact study regarding Pillar I (capital requirements) and to fulfil requirements pertaining to Pillar II (capital management) and Pillar III (disclosure requirements). This Office is mindful of the fact that the Basel II implementation date is 1 January 2008 and that banks have not yet achieved their intended state of readiness. In the foreseeable future, this Office will require banks to: • complete draft versions of the new proposed Banks Act returns as part of the development process of such returns; and • discuss and submit their up-to-date Basel II implementation plans.

3 3. Purpose of the exercise The purpose of the impact study and related requirements include the following: • Promoting sound project-management principles and practices in the planning for and implementation of Basel II. • Obtaining relevant information pertaining to the impact of Basel II. • Obtaining information relevant to the planning for Basel II implementation. • Assessing the state of preparedness for Basel II implementation. • Developing guidance on relevant issues pertaining to Basel II. This Office wishes to address aspects of the following areas of Basel II: • Pillar I – Capital requirements. • Pillar II – Capital management. • Pillar III – Disclosure requirements.

Independently from this impact study, the National Treasury has commissioned an economic impact study. These impact studies augment one another. 4. Programme for completion of the various required components The relevant deadlines are set out in the table below. Description of requirement Entities to which requirements are applicable Applicable paragraphs of circular Submission date to this Office Bank Banking group Bank and Banking group QIS 4: Credit risk – retail and corporate (Pillar 1) Yes No No 5 2005-03-31 QIS 4: All other areas (Pillar 1) Yes No No 5 2005-04-30 Questionnaire relating to completion of QIS 4 (Pillar I) Yes No No 5 2005-04-30 Aggregated and consolidated capital requirements No No Yes (*) 6 2005-05-31 Capital management (Pillar II) No No Yes 7 2005-05-31 Disclosure (Pillar III) No No Yes 8 2005-06-30 • = A bank that has a subsidiary is required to fulfil these requirements. Please submit completed documentation to Ms Nicolette van Zyl, who may be contacted at telephone number (012) 313-4283, or telefacsimile number (012) 313-4864, or via e-mail, at Nicolette.vanZyl@resbank.co.za.

4 5. QIS 4 worksheets and instructions The QIS 4 worksheets in the format of an Excel file are available from http://www.reservebank.co.za/internet/Publication.nsf/Preview/c4e80fce654218c d42256f73003762d4?OpenDocument&AutoFramed The document titled “Instructions for Workbooks for Further Impact Studies/Field Testing” dated 3 December 2004 and issued by the Basel Committee is available from http://www.bis.org/bcbs/qis/qis4_instructions.pdf

Banks are required to measure their exposures and related capital requirements in respect of all of the following bases: • In respect of credit risk o In terms of the Basel I approach, being the current regulatory requirements. o In terms of the Basel II simplified standardised approach. o In terms of the Basel II standardised approach. o In terms of the Basel II internal ratings based approach (“IRB”) only when the said approach is the intended approach. • In respect of operational risk o In terms of the basic indicator approach. o In terms of the standardised approach. o In terms of the Basel II advanced measurement approach (“AMA”) only when the said approach is the intended approach. The above various measurements of exposures and related capital requirements, inter alia, would have the following value. • In respect of credit risk o A comparison of Basel I, the Basel II simplified standardised approach and the Basel II standardised approach would assist in reaching a decision on the basis for capital floors in terms of the transition arrangements for implementation of Basel II. o A comparison of Basel I, the Basel II simplified standardised approach, the Basel II standardised approach and the Basel II IRB approach would assist in reaching a decision on the appropriate approach to be adopted. o A comparison of Basel I and the intended approach in terms of Basel II would assist in quantifying the impact of moving from Basel I to Basel II.

5 • In respect of operational risk o A comparison of Basel I, the Basel II basic indicator approach, the Basel II standardised approach and the Basel II AMA if the last￾mentioned approach is being considered as the intended approach would assist in reaching a decision on the appropriate approach to be adopted. o A comparison of Basel I and the intended approach in terms of Basel II would assist in quantifying the impact of moving from Basel I to Basel II. In determining the base data for purposes of completion of QIS 4, the following, at times conflicting, considerations were taken into account: • The data to which one can attach the highest level of assurance: o Year-end data that is subject to an independent audit of unlimited scope carries the highest level of assurance. o Half-year-end data that is subject to a review of limited scope by the independent auditors carries the second highest level of assurance. • The most recent data, for example, the data for 31 December 2004. • Data as at a single common date, for example, 30 June 2004, to enable the compilation of an industry position as at a particular date. After due consideration, this Office decided against the imposition of a single common date and decided rather to request banks to determine the base data by applying a preference decision-tree. Any month-end date between and including 30 June 2004 and 31 December 2004 would be acceptable, subject to the following preferences: • The most preferred date would be a year-end date. • The second most preferred date would be a half-year-end date. • The third most preferred date would be the latest date. Banks are required to explain their choice of base date. Banks should indicate the data history on which the risk indicators computed for purposes of and used in this exercise were based. Banks that do not have available long-term data that reflects “through the cycle” conditions on which risk indicators can be based will have to indicate, by way of a separate motivation, how they had arrived at reasonable estimates of risk indicators. (Currently, banks are experiencing most benign business conditions, since the economy has been in an expansionary phase for almost four years.)

6 The document titled “Position Paper 21 (V.2) National Discretion Items” sets out the assumptions, in relation to national discretion items contained in Basel II, that banks should use when completing the QIS 4 worksheets. This document is available from the following address: http://www.reservebank.co.za/internet/Publication.nsf/Preview/d13abd58ca0237 4442256f7300480a90?OpenDocument&AutoFramed In addition, banks are required to complete the questionnaire contained in Annexure A hereto. Although not all questions are applicable to all approaches available in terms of Basel II, in answering the questions the purpose of the questionnaire should be kept in mind and relevant responses should be developed wherever possible. The purpose of the questionnaire is to obtain information on how the responses to QIS 4 were developed in order to understand the origin and related processes, thus enabling one to gauge the quality of the information. 6. Consolidated supervision Banks that have subsidiaries and banking groups are required also to complete the QIS 4 worksheets on the following bases: • aggregated capital requirements, being the current regulatory requirements; and • consolidated capital requirements, being the intended regulatory requirements. Currently, the Cross-border Implementation Task Group, a task group of the Risk Sub-committee of the South African Accord Implementation Forum, is developing a position paper on issues surrounding consolidated supervision. It is envisaged that this position paper will constitute an important input into guidelines to be published by 31 March 2005 relating to the completion of the QIS 4 worksheets and/or other worksheets that may be developed and prescribed to achieve the above-mentioned deliverables.

7. Capital management Basel II “recognises the responsibility of bank management in developing an internal capital assessment process and setting capital targets that are commensurate with the bank’s risk profile and control environment. In the Framework, bank management continues to bear responsibility for ensuring that the bank has adequate capital to support its risks beyond the core minimum requirements”. (Paragraph 721 of Basel II)

7 In the light of the above, banks and banking groups are required to describe comprehensively and in detail: • the current status, as at 31 December 2004, of the management of the capital of the banking group; and • the planned position, as at 1 January 2008, of the management of the capital of the banking group. A plan of action setting out deliverables, dates and responsible parties should be attached. When attending to this aspect, banks are requested to: • Define all key concepts. • Spell out clearly all assumptions used. • Describe the relevant governance structures. • Describe the relevant organisational structure/s. • Describe the duties and responsibilities of relevant employees. • Describe the roles of relevant stakeholders. • Where available, attach the latest available copies of all relevant documentation, including documentation of a policy and an operational nature, such as policies, minutes of meetings and management information. 8. Disclosure The attention of banks is directed to the contents, quoted below, of paragraphs 809 and 810 of Basel II. “809. The purpose of Pillar 3 ─ market discipline is to complement the minimum capital requirements (Pillar 1) and the supervisory review process (Pillar 2). The Committee aims to encourage market discipline by developing a set of disclosure requirements which will allow market participants to assess key pieces of information on the scope of application, capital, risk exposures, risk assessment processes, and hence the capital adequacy of the institution. The Committee believes that such disclosures have particular relevance under the Framework, where reliance on internal methodologies gives banks more discretion in assessing capital requirements. 810. In principle, banks’ disclosures should be consistent with how senior management and the board of directors assess and manage the risks of the bank. Under Pillar 1, banks use specified approaches/methodologies for measuring the various risks they face and the resulting capital requirements. The Committee believes that providing disclosures that are based on this common framework is an effective means of informing the market about a bank’s exposure to those risks and provides a consistent and understandable disclosure framework that enhances comparability.”

8 In the light of the above, banks and banking groups are required to compile a set of generally accepted accounting practice compliant financial statements that incorporate the disclosure prescriptions contained in the document titled Position Paper 12 Additional Disclosure Requirements under Basel II. This document is available from the following address: http://www.reservebank.co.za/internet/Publication.nsf/Preview/c6f8ed38416c34d d42256f7300471186?OpenDocument&AutoFramed Should it be found that any of the particular prescriptions contained in the above￾mentioned document do not yield a fair reflection of the position, results and movements, banks are required to point these out and simultaneously make proposals to overcome such problems and shortcomings. 9. Acknowledgement of Receipt Two additional copies of this circular are enclosed for the use of your institution’s independent auditors. The attached acknowledgement of receipt, duly completed and signed by both the chief executive officer of the institution and the said auditors, should be returned to this Office at the earliest convenience of the aforementioned signatories. E M Kruger Registrar of Banks The previous circular issued was Banks Act Circular 1/2005 dated 3 January 2005.

9 Annexure A - QIS-4 Questionnaire (Issued by the USA Federal Financial Institutions Examination Council, amended by BSD) The purpose of this questionnaire is to support the interpretation of QIS-4 survey results by providing an overview of how the data reflected in QIS-4 responses were developed. Emphasis is placed on the data sources and computations used to develop estimates, on key decisions regarding the slotting of particular types of exposure or business lines, and on identifying key assumptions or approximations that materially influence the results. Ultimately, the aim of the questionnaire is to ensure a more complete understanding of the degree of precision in the reported information in the QIS-4. Respondents should provide any information they believe is needed by supervisors to better understand, evaluate and analyze data submissions. Respondents should also respond clearly and concisely to the questions below. Responses that are candid and informative will best support interpretation of the numbers. It is recognized that data and systems relevant to IRB are still in development at many institutions, and supervisors understand that institutions will be assembling estimates on a best efforts basis to approximate quantitative information that would be available using a more complete IRB or AMA infrastructure. In that regard, throughout this questionnaire, institutions should note where simplifying assumptions or approximations were necessary given current system constraints Respondents are encouraged to attach any documentation (such as internal policies or analyses) that might support interpretation of the QIS-4 results; such documents may help reduce the need for follow-up discussions. General The questions in this section apply to both wholesale and retail worksheets.

1. Describe material instances in which exposure amounts included in each worksheet were approximated based on available information because systems were not adequate for generating exposure data in the specific form requested.
2. For each portfolio type, describe material instances where the IRB inputs (PD, LGD, BEEL, M, or EAD) had to be estimated on a best-efforts basis and these estimates are subject to greater than usual uncertainty. (Such instances may arise when data or systems limitations require that the institution develop best-efforts workarounds in order to provide more complete portfolio coverage in QIS-4.)
3. Identify material credit portfolios or obligor types, if any, where implied third-party support (support that is inferred but not backed by enforceable written agreements) is a

10 material factor in assigning obligor or facility ratings/estimates. For each such portfolio or obligor type identified, indicate: a. The types of implied support considered (e.g., support agreements, keep well letters, verbal assurances, etc.), and b. Whether the inclusion of such support had a material impact on the assigned ratings i.e., produced more favourable ratings. 4. For each of the wholesale and retail worksheets, describe the process for PD quantification, with particular emphasis on the following: a. Describe the characteristics of the data used for estimation (“reference data”) particularly with regard to scope and coverage (e.g., time periods, geographic scope, industry coverage, etc.). Describe the internal and external reference data sources used. For corporate portfolios, describe what adjustments, if any, were made to the reference data for sub-portfolios such as middle market, asset￾based lending, non-retail small business, etc. b. If reference data sources cover multiple time periods, how were data or results from the different time periods combined? c. If multiple data sources were used, how were the results combined? d. How, if at all, does the definition of default in the historical reference data set differ from the IRB definition outlined in the QIS-4 instructions? e. Describe how you calculated the PD estimate from the reference data set, including significant judgmental adjustments. f. To what extent do the resulting PD estimates reflect a “long-run average” in the sense used in the draft corporate and retail guidance? 5. How did your definition of default for wholesale and retail exposures in the existing portfolio differ, if at all, from the definitions given in the QIS-4 instructions? 6. For each of the wholesale and retail worksheets, describe the process for LGD estimation, with particular emphasis on the following: a. Consider the same factors noted in (a) through (c) of question 6 above. b. Provide a general description of the process that produced estimates of LGD from the underlying reference data. In particular, describe how seniority, collateral, facility type, third party enhancements, or other factors were incorporated into the LGD estimation process. c. To what extent do the data incorporate opportunity costs or discounting to measure economic loss? To what degree are material direct and indirect workout costs reflected in the estimates? d. Describe any adjustments, including significant judgmental adjustments, made to the LGD estimates to account for factors that are not reflected in the reference data set, but which affect the estimate of the economic downturn LGD. e. The QIS instructions state that institutions may use “averages of loss severities observed during periods of high credit losses, forecasts based on appropriately conservative assumptions, or other similar methods” to estimate downturn LGDs. For each portfolio describe the period of high credit losses or forecast assumptions used to estimate downturn LGDs.

11 f. For each portfolio describe with as much specificity as possible the relationship between your estimates of economic downturn LGDs and corresponding long-run default-weighted average LGDs. g. Describe any portfolios where LGD is not expected to vary with the economic cycle. 7. For each of the wholesale and retail worksheets, describe the process for applying LGD estimates to exposures (e.g., loss severity grades, LGD models, etc.). a. Briefly describe the criteria employed by the severity grades or model to estimate LGD b. To what extent were simplifying assumptions made regarding LGD estimates due to IT system limitations regarding facility characteristics such as collateral values, etc.? 8. Describe the process used to develop best estimates of material economic loss (BEEL) for exposures to obligors in default (corporate) or defaulted exposures (retail). 9. Describe the process used to develop estimates of potential LGD (PLGD) for exposures to obligors in default (corporate) or defaulted exposures (retail). 10. Provide a general description of the method used to estimate EADs and CCFs, with particular emphasis on the following: a. Consider the same factors noted in (a) through (d) of question 6 above. b. Provide a general description of the process that produced estimates of CCF from the underlying reference data including significant judgmental adjustments. c. Describe the nature of any adjustments made to the EAD estimates to reflect factors that are not reflected in the reference data set, but which reflect the impact of economic downturns on additional usage of undrawn lines. The following questions apply to the wholesale worksheets 11. For each wholesale worksheet, to what extent do the rows of the spreadsheet (the distinct PD levels) correspond to internal obligor risk ratings used by the institution? If the rows do correspond to internal risk ratings, address the following: a. Were some grades combined into a single row for QIS-4 reporting purposes? b. If the internal risk rating systems differ for some of the exposures included in the worksheet, how was a correspondence established between different systems to allow the exposures to be reported in a unified way? 12. If the PD rows discussed in the previous question do not correspond to internal obligor grades, how were the exposures in a particular row determined to have the PD indicated for that row? 13. For each of the wholesale worksheets, to what extent do the column headings (the distinct LGD levels) correspond to internal loss-severity risk ratings used by the institution? If the columns do correspond to internal risk ratings, address the following: a. Were some grades combined into a single column for QIS-4 reporting purposes?

12 b. If the severity rating systems differ for some of the exposures included in the worksheets, how was a correspondence established between different systems to allow the exposures to be reported in a unified way? 14. If the LGD columns discussed in the previous question do not correspond to internal loss severity grades, how were the exposures in a particular column determined to have the LGD indicated for that column? 15. For the wholesale worksheets, describe the process used to complete the effective maturity matrix (the block of cells from AT30 to BH49). 16. For the wholesale worksheets, what proportion of total corporate exposure is hedged by (a) single-name credit default swaps, (b) basket credit derivatives (excluding synthetic securitizations), (c) total rate of return swaps, (d) other credit derivative instruments, (e) guarantees, (f) letters of credit, and (g) other credit risk mitigants? Is any portion of these credit risk mitigants not reflected in your QIS-4 results? 17. Describe how undrawn advised lines were quantified. Sovereign-Bank-Corporate 18. Is translation risk taken into account by directly adjusting the obligor PD or through a facility LGD adjustment? 19. In estimating PFE for repo-style transactions, which of the three methods (a VaR model, own-estimate haircuts, or supervisory haircuts) did you use? 20. Provide the total dollar volume by portfolio of project, object, and commodity finance included in the “Sovereign”, “Bank” and ”Corporate” worksheets. SME Corporate 21. Describe how SME credits were identified and slotted into the six reporting categories. HVCRE and IPRE 22. Explain how PD and LGD estimates for ADC lending were derived. 23. Indicate if ADC loans are rated using the corporate loan rating system and then assigned PDs that correspond to the corporate rating. 24. Do the PD and LGD estimates for ADC lending include the mini-perm phase, or are they limited to the construction phase? General Retail Questions In addition to these questions that relate directly to retail, please be sure to answer the relevant questions in the General section that also pertain to retail exposures. For the following questions, please provide a separate set of answers for each significant retail worksheet category.

13 25. Describe the segmentation system and risk drivers used to assign loans to different segments (homogeneous pools) for purposes of estimating PDs, LGDs, and EADs. Discuss the process used to aggregate the segment level PD, LGD, and EAD estimates into the worksheets. Discuss how the institution chose the cut-off values for PD/LGD bands and the PD/EAD bands. 26. Discuss how seasoning and prepayments were incorporated into PD estimation. 27. How were future unpaid accrued interest and fees included in the EAD estimates for HELOCs and QREs? Residential Mortgages 28. What dollar amount of the bank’s total residential mortgage portfolio has PMI coverage? For loans with PMI coverage, how much did the average LGD decrease (in percentage points – not the percent decrease) compared to what the average LGD would have been absent PMI coverage? Retail Business Exposures 29. Describe any difficulty in distinguishing sub-portfolios that should be treated as a retail exposure from the treatment of larger business loans that involve more individual treatment and judgmental underwriting? Other Retail Exposures 30. Identify the significant product types at your institution – including retail leases, if they are segmented separately – reported in the “Other Retail” worksheet. What percentage does each represent of the total exposures reported in this worksheet? For each of these significant portfolios, list the average PD, average LGD, and total EAD. (For leases, EAD is equal to the discounted remaining lease payment stream.) Dilution Risk 31. Does your institution conduct material activities other than factoring that incur dilution risk, and to what degree were such dilution risks reflected in your QIS-4 results? Securitization 32. Please describe any material assumptions made to complete the “Securitization” worksheet.

14 33. For liquidity facilities to ABCP programs on an aggregate basis, what is the proportion of the total notional amount and the amount that can be drawn as of the report date? 34. Did you have any non-rated exposures for which an inferred rating was used? If so, for what types of structures were inferred ratings used? 35. Did you have exposures for which you had sufficient information to use either the SFA or the IAA? If so, which approach did you choose to use? 36. How often did the KIRB cap apply? If applicable, please describe the methodology used to exclude exposures from risk weighting or deduction. Were there particular asset types or securitization vehicles for which the maximum capital requirement was applicable more often? 37. Did you choose to deduct the entire CEIO from Tier 1 rather than deduct gain-on-sale from Tier 1 and the remaining portion of the CEIO equally from Tier 1 and Tier 2? 38. What were the types of exposures (e.g., synthetic securitizations, liquidity facilities) for which you used the SFA? What was the predominant exposure type for which you used the SFA? 39. What proportion of the exposures where you used the SFA involved ABCP programs? 40. For roughly what proportion of SFA exposures did you use the simplified methods for computing N or LGD? 41. For any non-rated securitization exposures acquired as an investor, were you able to apply the SFA, and if so, what process was implemented to obtain the required inputs, especially KIRB and the pool's exposure-weighted average LGD? 42. What types of exposures constituted the largest proportion reported in the non-IRB treatment section? 43. Were there any transactions or exposures for which you could not apply any of the IRB securitization approaches? If so, what types of exposures were involved and what were the reasons that none of the approaches were applicable? 44. Outside of credit card securitizations, did you have any other structures that were subject to the early amortization capital charges? What types of structures were affected and what are the triggers? Do you have securitizations for which an early amortization trigger is exclusively based on a performance factor other than excess spread? 45. For securitization exposures subject to the early amortization charge, did the KIRB cap apply?

15 Equity 46. Did you apply the definition of equity exposures contained in the QIS-4 instructions to all of the institution’s equity holdings? If not, please detail the types of holdings for which the definitions were not applied and the reasons for diverging from the instructions. Please identify the characteristics of instruments that you found difficult to characterize clearly as either a debt or equity holding. 47. Under the internal models approach, how were potential losses on equity exposures calculated? How were offsetting values for equity exposures calculated? How were hedges with maturity mismatches recognized in calculating offsetting values? Operational Risk 48. What analytical framework was used to quantify operational risk exposure? 49. What was the unit of measurement in the assessment of operational risk exposures (e.g., major business lines, second level business lines, across all loss types, etc.)? 50. Describe how the following elements were individually incorporated into this framework: a. Internal data. How were internal data incorporated into the model? Are there components of the model that rely solely on internal data? If so, how did you assess data sufficiency? b. External data. Were external data a direct input to your model? If so, describe the process for determining when external data were included. If external data were not used as a direct data input, how were they used (e.g. scenario analysis, fit severity distributions, and/or understanding industry experience, etc.)? c. Scenario analysis. Describe how scenario analysis was used in the analytical framework. Were scenarios a direct input into your model? If so, describe the process used to determine when scenarios were included. d. Business environment and internal control factor assessments (and any other qualitative adjustment factors). Were business environment and internal control factor assessments included in your model? What parameters did you incorporate into your model to adjust the operational risk exposure number to reflect these qualitative assessments? 51. What weighting scheme or methodology was used to incorporate each of the four components listed above? Did the weighting vary by business line and/or event type, or for different units of measurement? 52. What specific statistical distributions (e.g., frequency and severity) were used to fit loss data? Did these vary by data type (i.e. internal, external, scenario), business line, or event type? If so, how? 53. Were adjustments made to internal or external data to account for changes in the scale or scope of the business, or factors such as inflation? 54. Describe any correlation and diversification benefit assumptions used as part of the operational risk exposure calculation. Specifically, what model parameters were used as they relate to these assumptions (e.g., an x% correlation in operational losses across

16 different business units)? Describe how you arrived at these assumptions. If there is a diversification benefit, is that amount held at the consolidated entity level or allocated back to the business line? If so, how? 55. Does the operational risk exposure number, reflected in cell G104 represent the sum of expected losses (EL) plus unexpected losses (UL), or UL only? 56. If the operational risk exposure number represents UL only, provide the following information: a. Provide the EL amounts, and describe how EL is derived (e.g. statistically measured, subjective estimation, etc.). b. Describe how EL is accounted for. In particular, describe if operational risk EL is addressed through GAAP-compliant reserves/provisions, pricing or other internal business practices. c. Cells G114 and G115 seek specific information on fraud-related losses. Describe the methodology used to categorize these losses as UL or EL? 57. What loss data thresholds were used to collect the internal data underlying the calculations reported? Please be as specific as possible. If different thresholds were used for different business lines and/or event types, then each threshold should be listed together with a brief rationale for why that threshold value was chosen. Was there a mechanism through which losses under the threshold were reflected in either EL or in the estimate of the operational risk exposure (EL+UL)? 58. Describe the methodology used to take account of the effects of insurance. Legal Entity Information 59. Does your institution currently have the following information for each insured subsidiary? a. Estimates of minimum capital requirements – as determined under the IRB, AMA and Market Risk formulas; and b. Estimated weighted average risk parameters (PD, LGD, EAD, M) for significant credit portfolios. 60. If the information in the question above is not currently available, provide an estimate of when your MIS will be modified to supply it. 61. Do all of your insured subsidiaries use the same types of obligor rating philosophies – such as a "point-in-time" system or "through-the-cycle" system – to the same extent and manner as the reporting entity? 62. Do all of your insured subsidiaries compensate for any lack of LGD data to the same extent and manner as the reporting entity? 63. Do all of your insured subsidiaries use the same types of reference data sets, or sources of data, from which parameters are estimated to the same extent and manner as the reporting entity? 64. Do all of your insured subsidiaries use credit risk mitigants to the same extent and manner as the reporting entity?

17 Compliance Costs 65. Have you budgeted funds specifically for Basel II compliance? If so, please provide budget figures. 66. Are you investing in new IT systems that you will use for Basel II? 67. How much do you expect to spend on implementing Basel II (including the cost of personnel engaged in developing and operating Basel II systems)? If you have separate estimates for activities such as the following, please provide them: a. Upgrading or modifying internal rating systems and risk management and control systems for credit risk and for operational risk b. Upgrading or modifying IT systems c. Reconstituting historic databases d. Requirements going forward to preserve data on transactions e. Making Pillar III disclosures 68. Please indicate what portion of each of the costs in the previous question you think you would incur only if Basel II is adopted, and what fraction you would incur for internal risk management purposes even if Basel I remained in effect? 69. If you have separate estimates of one-time costs and recurring costs, please provide them. 70. If one-time costs are spread over several years, please indicate the time period and the approximate fraction of costs falling in each year. 71. How much of the funds allocated to Basel II implementation has already been spent?