Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP)

Saudi Arabian Monetary Authority (SAMA) Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) October 2020

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 2 of 26 Table of Content A. Introduction...........................................................................................................................................3 B. ILAAP Construction .............................................................................................................................3

1. General Definition of the ILAAP......................................................................................................3
2. Objectives of the ILAAP...................................................................................................................3
3. Scope and Proportionality.................................................................................................................4
4. Major Building Blocks of the ILAAP...............................................................................................4
5. The ILAAP Process ..........................................................................................................................5 C. Reporting Format and Content..............................................................................................................9
6. Background.......................................................................................................................................9
7. Executive Summary ..........................................................................................................................9
8. Objectives of an ILAAP..................................................................................................................10
9. Governance and Risk Management ................................................................................................10
10. Summary of Bank's Strategies.........................................................................................................11
11. Liquidity Adequacy and ILAAP......................................................................................................11
12. Approach and Methodology............................................................................................................16
13. Details on Models Employed..........................................................................................................17
14. Liquidity Specific Stress-testing .....................................................................................................18
15. Liquidity Transferability Between Legal Entities ...........................................................................18
16. Aggregation and Diversification .....................................................................................................18
17. Challenge and Adoption of the ILAAP ...........................................................................................19
18. Use of the ILAAP within the Bank .................................................................................................19
19. Future Refinements of ILAAP ........................................................................................................20 Annexure (1): Stress-testing and Contingency Funding Plan (CFP) ..........................................................21 A. Stress-testing.......................................................................................................................................21
20. Stress-testing Under Pillar 1............................................................................................................21
21. Stress-testing Under Pillar 2............................................................................................................23
22. Other Aspects Related to Stress-testing...........................................................................................24 B. Early Warning Indicators....................................................................................................................24 C. Contingency Funding Plan (CFP).......................................................................................................25

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 3 of 26 Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) A. Introduction These guidelines shall supersede the existing SAMA Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) issued vide SAMA circular no. 381000120488 dated 3/12/1438AH. The updated guidelines “these guidelines” shall be effective starting from the ILAAP submission for 2021. B. ILAAP Construction

1. General Definition of the ILAAP The Internal Liquidity Adequacy Assessment Process (ILAAP) is defined as “the processes for the identification, measurement, management and monitoring of liquidity implemented by the bank pursuant to SAMA liquidity risk management regulations”. It thus contains all the qualitative and quantitative information necessary to underpin the risk appetite, including the description of the systems, processes and methodology to measure and manage liquidity and funding risks. These ILAAP guidelines shall only serve as a starting point in supervisory dialogues with banks. Therefore, they should not be understood as comprehensively covering all aspects necessary to implement a sound, effective and comprehensive ILAAP. It is the responsibility of the bank to ensure that its ILAAP is sound, effective and comprehensive duly taking into account the nature, scale and complexity of its activities.
2. Objectives of the ILAAP The main objectives of the ILAAP are as follows: i. Enhances corporate governance and risk management processes in banks and the financial system in general. ii. Establishes the minimum liquidity required for regulatory purposes and helps identify planned sources of liquidity to meet these objectives.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 4 of 26 iii. For a bank's Board of Directors to proactively assess its liquidity requirements in line with its strategies, business plans and risks. In additions, the ILAAP document should be for Senior Management to inform the Board of Directors and SAMA on the ongoing assessment of the bank's liquidity risk profile, liquidity risk appetite, strategic plan and liquidity adequacy. It also documents how the bank intends to manage these risks, and how much liquidity is necessary for its future plans. 3. Scope and Proportionality i. These guidelines shall be applicable to all locally incorporated banks licensed and operating in the Kingdom of Saudi Arabia. ii. The ILAAP is, above all, an internal process, and it remains the responsibility of individual banks to implement it in a proportionate and credible manner. The bank’s ILAAPs has to be proportionate to the nature, scale and complexity of the activities of the bank. 4. Major Building Blocks of the ILAAP 4.1 Banks’ Roles and Responsibilities for the ILAAP i. A Bank should produce, at least once per year, an ILAAP approved and signed by the Board of Directors. ii. A bank is required to demonstrate to SAMA that its ILAAP processes are comprehensive, rigorous and ensures that it has liquidity that is commensurate with its risk profile. iii. A bank is required to put in place ILAAP processes and methodologies based on SAMA requirements and on its strategic and operational plans as set by its Board of Directors. 4.2 ILAAP as Part of Pillar 2 The Pillar 2 liquidity framework should focus on liquidity risks not captured, or not fully captured, under Pillar 1 requirements. It is incumbent on banks to undertake their own assessment of liquidity risks, including Pillar 2 risks, and take appropriate measures to reduce or manage these risks.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 5 of 26 5. The ILAAP Process 5.1 ILAAP Governance The ILAAP process should remain the responsibility of the Board of Directors and Senior Management of the bank. The ILAAP should be well integrated into the bank’s processes and decision-making culture. In this regard, banks are required to ensure the following: i. The Board of Directors has the ultimate responsibility for the implementation of the ILAAP, and the Board of Directors or its delegated authority is required to approve an ILAAP governance framework with a clear and transparent assignment of responsibilities, adhering to the segregation of functions. The governance framework should include a clear approach to the regular internal review and validation of the ILAAP. ii. All of the key elements of the ILAAP should be approved by the Board of Directors or its delegated authority, and be consistent with the risk appetite set by the Board of Directors, and with the bank’s approach for measuring and managing liquidity and funding risks. iii. The Board of Directors or its delegated authority, Senior Management and relevant committees are required to discuss and challenge the ILAAP effectively. iv. Each year, the Board of Directors or its delegated authority is required to provide its assessment of the liquidity adequacy of the bank, supported by ILAAP outcomes and any other relevant information, by reviewing and approving the bank’s ILAAP. 5.2 Strategic and Liquidity Planning i. The ILAAP should support strategic decision-making and, at the same time, be operationally aimed at ensuring that the bank maintains adequate liquidity on an ongoing basis, thereby promoting an appropriate relationship between risks and rewards. All methods and processes used by the bank to steer its liquidity as part of the strategic or operational liquidity management process are expected to be approved, thoroughly reviewed, and properly included in the ILAAP and its documentation. The quantitative and qualitative aspects of

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 6 of 26 the ILAAP should be consistent with each other and with the bank’s business strategy and risk appetite. ii. The ILAAP should be aligned with the business, decision-making and risk management processes of the bank. It should also be consistent and coherent throughout the group. 5.3 Documentation Banks are required to maintain sound and effective overall ILAAP architecture and documentation of the interplay between the ILAAP elements and the integration of the ILAAP into the bank’s overall governance and management framework. 5.4 Comprehensive Risk Quantification The ILAAP should ensure that risks, that a bank is or may be exposed to, are adequately quantified. The bank is required to do the following: i. Implement risk quantification methodologies that are tailored to its individual circumstances, i.e. they are expected to be in line with the bank’s risk appetite, market expectations, business model, risk profile, size and complexity. ii. Determine sufficiently conservative risk figures, taking into consideration all relevant information. iii. Ensure adequacy and consistency in its choice of risk quantification methodologies. iv. Ensure that key parameters and assumptions cover, among other things, confidence levels and scenario generation assumptions. 5.5 Stress-testing Banks should conduct a comprehensive, robust stress-testing that is consistent with SAMA Stress-testing Rules, taking into consideration the following: i. The impact of a range of severe but plausible stress scenarios on the bank’s cash flows, liquidity resources, profitability, solvency, asset encumbrance and survival horizon. ii. Selecting stress scenarios that reveal the vulnerabilities of the bank’s funding. In addition to performing a tailored and in-depth review of the bank’s vulnerabilities, capturing all material risks on an institution-wide basis that

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 7 of 26 result from the bank’s business model and operating environment in the context of stressed macroeconomic and financial conditions. The review should be conducted on a yearly basis and more frequently, when necessary, depending on individual circumstances. On the basis of this review, the bank is required to define an adequate stress-testing programme for both normative and economic perspectives. As part of the stress-testing programme, the bank is required to determine adverse scenarios to be used under both perspectives, taking into account other stress-tests it conducts. iii. Conducting reverse stress-testing in a proportionate manner. iv. Continuously monitoring and identifying new threats, vulnerabilities and changes in its environment to assess whether its stress-testing scenarios remain appropriate and, if not, adapt them to the new circumstances. v. Regularly updating the impact of the scenarios. In the case of material changes, the bank should assess its potential impact on its liquidity adequacy. The degree of conservatism of the stress-testing scenarios adopted and assumptions made by the bank should be discussed in the ILAAP document. 5.6 Review and Independent Validations The ILAAP shall be subject to a regular internal review, at least once a year, taking into consideration the following: i. Both qualitative and quantitative aspects, including, for example the use of ILAAP outcomes, the stress-testing framework, risk capture, and the data aggregation process. ii. Establishing a defined process to ensure proactive adjustment of the ILAAP to any material changes that occur, such as entering new markets, providing new services, offering new products, or changes in the structure of the bank. iii. Adequately back-testing and measuring the performance of the ILAAP outcomes and assumptions, covering, for example, liquidity planning, scenarios, and risk quantification. iv. Conducting a regular independent validation of the ILAAP risk quantification methodologies, taking into account the materiality of the risks quantified and the complexity of the risk quantification methodology. The overall conclusions of the validation process should be reported to Senior

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 8 of 26 Management and the Board of Directors, used in the regular review and adjustment of the quantification methodologies, and taken into account when assessing liquidity adequacy. 5.7 ILAAP Reporting to SAMA i. The ILAAP shall be submitted to SAMA by 31st of August each year using 30th of June as a reference date. ii. Banks are required to provide, at minimum, details on all items mentioned in these guidelines or explain why any item is not relevant for their respective banks, taking into account the size, complexity and business model of the bank.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 9 of 26 C. Reporting Format and Content The ILAAP document should include, at minimum, the following sections:

1. Background This section is for introductory text describing the following: i. Business model, Bank/Group structure, balance sheet risks, relevant financial data, the reach and systemic presence of the bank. ii. Internal and external changes since the last ILAAP. iii. Changes in the scope of the document since the last review by the Board of Directors. iv. Justifications of the comprehensiveness and proportionality of the bank’s process.
2. Executive Summary This section should present an overview of the ILAAP methodology and results. This overview should include: i. The purpose and coverage of the ILAAP. ii. The main findings of the ILAAP analysis: − How much and what composition of liquidity the bank considers it should hold as compared with the liquidity resource requirement ‘pillar 1’ calculation. − The adequacy of the bank’s liquidity risk management processes. iii. A summary of the financial projections, including the strategic position of the bank, its balance sheet strength, and future profitability. iv. Brief descriptions of liquidity plans; how the bank intends to manage liquidity going forward and for what purposes. v. Commentary on the most material liquidity risks, why the level of risk is acceptable or, if it is not, what mitigating actions are planned. vi. Commentary on major issues where further analysis and decisions are required. vii. Who has carried out the assessment, how it has been challenged, and who approved it.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 10 of 26 3. Objectives of an ILAAP This section should present a description of the bank's specific objectives relating to liquidity, such as shareholder returns, rating objectives for the bank as a whole or for certain securities being issued, avoidance of regulatory intervention, protection against uncertain events, depositor protection, working liquidity and liquidity held for strategic acquisitions etc., along with sufficient liquidity resources to cover the nature and level of the liquidity risk to which it is or might be exposed, the risk that the bank cannot meet its liabilities as they fall due, and the risk that its liquidity resources might in the future fall below the level, or differ from the quality and funding profile from those considered as appropriate by SAMA. 4. Governance and Risk Management This section should describe the governance and management arrangements around the ILAAP including the involvement of the Board of Director, in addition to the risk management framework. At least the following areas should be covered: i. Description of the process for the preparation and updating of the ILAAP. ii. Description of the process for reviewing the ILAAP. iii. Definition of the role and functions assigned to the Board of Directors and Senior Management for the purposes of the ILAAP. iv. Definition of the role and functions assigned to various corporate functions for the purposes of the ILAAP (for example, internal audit, compliance, finance, risk management, branches and other units). v. Indication of internal regulations relevant to the ILAAP. vi. The overall risk management framework and how it pertains to liquidity and funding risks. vii. Bank’s internal limits and control framework, including the limits and controls around liquid asset buffers, and the appropriateness of the limit structure to the risk appetite.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 11 of 26 5. Summary of Bank's Strategies This section would be a major component of a bank's strategic and operational plans. It should include the following: i. The present financial position of the bank and expected changes to the current business profile, the environment in which it expects to operate, its projected business plans (by appropriate lines of business), projected financial position and cash flow positions, projected liquidity available and projected liquidity resource required based on future plans. ii. The starting balance sheet, cash flow statement and the date over which the assessment was carried out. iii. The projected balance sheet and cash flow statement (for at least one year horizon), which should clearly indicate the major lines of business which are going to be attested by the bank's strategic initiatives, environmental changes and assumption over the planning period and the impact on liquidity requirements by major lines of business. 6. Liquidity Adequacy and ILAAP This section should, at minimum, cover the following: 6.1 Liquidity Risk Appetite In this section, banks should describe their liquidity risk appetite, how it was devised, approved, monitored and reported, and how it is communicated throughout the bank. Banks should, at a minimum, cover the following key areas: i. A full and clear articulation of the bank’s liquidity risk appetite and a discussion of why the risk appetite is appropriate. ii. A discussion on how the bank’s liquidity risk appetite is used to define and assess liquidity levels and limits, including, at minimum, the following: − An outline of all relevant liquidity risk management limits as derived from the risk appetite and a discussion of how the limits support the risk appetite.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 12 of 26 − Limits for each of the liquidity risk drivers the bank assesses. Given that not all limits will necessarily be quantitative; some may be qualitative and describe subjective risk metrics. − A brief outlining the bank’s risk appetite and liquidity risk limits, I.e. monitoring limits on periodic dates used for reporting of the Liquidity Coverage Ratio (LCR), Net Stable Funding Ratio (NSFR), Loan to Deposit Ratio (LDR) and SAMA Liquidity Ratio and a demonstration of how the liquidity limits are reflected in SAMA’s returns. − A brief outlining the limits and positions against limits under “normal” and “stressed” liquidity environments, with a full and complete discussion of positions against limits. 6.2 Disclosure of Liquidity Requirements This section should provide a distinction from the bank's perspective of the following liquidity measures indicating their purpose, minimum requirements and other attributes: i. Regulatory Liquidity requirements under LCR, NSFR, LDR, and SAMA Liquidity Ratio. ii. Liquidity requirements internally specified by Treasurer based on limits. 6.3 Funding Strategy This section should provide full details of a bank’s three-year funding strategy, with more detail on the first 12-18 months of the funding strategy. The following requirements should be met: i. The strategy should be approved by the Board Directors or its delegated authority. ii. The strategy should demonstrate how it will support the projected business activities in both business as usual and stress, implementing any required improvements in the funding profile and evidencing that the risk appetite and key metrics will not be breached by the planned changes. iii. Risks to the plan should be discussed. iv. Where a funding strategy is new, implementation procedures should be detailed.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 13 of 26 v. The funding risk strategy and appetite, and the profile, both the sources and uses should be described. Banks should analyse the stability of the liabilities within the funding profile and the circumstances in which they could become unstable. This could include market shifts such as changes in collateral values, excessive maturity mismatch, inappropriate levels of asset encumbrance, concentrations (including single or connected counterparties, or currencies). Banks are also required to analyse market access and current or future threats to this access, including the impact of any short-term liquidity stresses or negative news. 6.4 Risks Covered and Assessed in the ILAAP In this section, banks are required to identify, measure and provide mitigation strategies for the most significant liquidity risks they are exposed to. At a minimum, the ILAAP should describe, assess and analyse the following pillar 2 liquidity risk drivers: i. Wholesale secured and unsecured funding risk a. Identification of risk, and behavior under normal and stress conditions b. Deposit concentration risk – exposures concentrated on a limited number of customers, industries, certain sectors or geographic area, etc. entailing vulnerability. ii. Retail funding risk a. Gross retail outflows under liquidity stresses. b. Higher than average likelihood of withdrawal. iii. Intra-day liquidity risk c. Net amount of collateral and cash requirement under stresses. iv. Intra-group liquidity risk d. Access to other groups, Central Bank funding, Parent Company and other commitments. v. Cross-currency liquidity risk e. Significant outflows and inflows with respect to maturities under stress. f. Foreign Exchange (FX) mismatch risks – banks typically assume that currencies are fungible given the depth of liquidity in the spot FX and

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 14 of 26 FX swap markets, particularly in reserve currencies. However, a bank may not be able to access FX markets as normal in times of stress vi. Off-balance sheet liquidity risk. g. Impact on cash flows arising from derivatives, contingent liabilities, commitments and liquidity facilities. vii. Franchise-viability risk. h. Stresses where the bank does not have sufficient liquidity resources to maintain its core business and reputation. viii. Marketable assets risk (under normal and stressed forced sale conditions). a. High Quality Liquid Assets (HQLA) monetisation risk – a bank may not be able to monetise sufficient non-cash HQLA to cover cumulative net outflows under the LCR stress on a daily basis, because of limitations to the speed with which cash can be raised in the repo market or through outright sales. ix. Non-marketable assets risk (under normal and stressed forced sale conditions). x. Funding concentration risk e.g. Flexible funding strategy according to instrument type, currency, counterparty, liability term structure and market for their realization. xi. Other risks e.g. a. Liquidity correlation factors associated with other risks i.e. reputational risk, asset concentration risk, Profit Rate Risk in the Banking Book (PRRBB), strategic risks etc. which have a bearing on Bank’s overall liquidity position. b. Balance sheet mismatch risk - assess whether a bank would have sufficient cash from the monetisation of liquid assets and other inflows to cover outflows on a daily basis, under a defined stress scenario. c. Macroeconomic and Business cycle risks – risks relating to changes in macroeconomic country specific variables such as oil prices, government spending and GDP. d. Initial margin on derivatives contracts, where during a period of stress counterparties may, for a number of reasons, increase a bank’s initial margin requirements. e. Securities margin financing liquidity risks.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 15 of 26 The quantification of liquidity risk should fully incorporate the following: i. Product pricing – it should include significant business activities and both on and off balance sheet products. ii. Performance measurement and pricing incentives. iii. Clear and transparent attribution to business lines. iv. Management of collateral – clearly distinguishing between pledged and unencumbered assets. v. Management of liquidity risks between intra-day, overnight keeping in view uncertainty or potential disruption. vi. Managing liquidity across legal entities, business lines and currencies. vii. Funding diversification and market access keeping in view: − Business planning process. − Correlations between market conditions and ability to access funds. − Adequate diversification keeping in view limits according to maturity, nature of depositor, level of secured and unsecured funding, instrument type, currency and geographic market. viii. Regular testing the capacity to raise funds quickly from choosing funding sources to provide short, medium and long term liquidity. ix. An explanation of how each of the above risks have been identified, assessed, measured and the methodology and models currently or to be employed in the future, and the quantitative results of that assessment. x. Where relevant, a comparison of that assessment with the results of the LCR and NSFR calculations. xi. A clear articulation of the bank's risk appetite by risk category. xii. Where relevant, an explanation of method used to mitigate these risks.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 16 of 26 6.5 Intraday Liquidity Risk In this section, banks should describe the following: i. How intraday risk is created within their business, whether part of the payments system or not, their appetite for and approach to managing intraday liquidity risk of both cash and securities accounts and in both business as usual and stress conditions. ii. Details of how the bank assesses the adequacy of the process of measuring intraday liquidity risks, especially that resulting from the participation in the payment, settlement and clearing systems. iii. Details of how the bank adequately monitors measures to control cash flows and liquid resources available to meet intraday requirements and forecasts when cash flows will occur during the day. iv. How the bank carries out adequate specific stress-testing for intraday operations. 7. Approach and Methodology 7.1 Current Methodology In this section, banks should describe the framework and IT systems for identifying, measuring, managing and monitoring and both internal and external reporting of liquidity and funding risks, including intraday risk. The assumptions and methodologies adopted should be described, key indicators should be evidenced, and the internal information flows described. 7.2 Future Approach and Methodology Banks may provide a summary on the future models and methodologies being considered and developed including their strengths and weaknesses. 7.3 Internal Models: Pillar 1 and ILAAP Comparisons Should the internal models vary from any regulatory methodologies approved for LCR and NSFR purposes, this section would provide a detailed comparison explaining both the methodological and parameterization differences between the

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 17 of 26 internal models and the regulatory models and how those affect the liquidity measures for ILAAP purposes. Further, the explanation of the differences between results of the internal models for LCR, NSFR would be set out at the level at which the ILAAP is applied. SAMA would expect the explanation to be sufficiently granular to show the differences at the level of each of the Pillar 1 risks. 8. Details on Models Employed In this section, banks should present the list of models utilized in the formulation of the ILAAP, giving relevant and appropriate details as given below: i. The key assumptions and parameters within the liquidity modeling work and background information on the derivation of any key assumptions. ii. How parameters have been chosen including the historical period used and the calibration process. iii. The limitations of the model. iv. The sensitivity of the model to changes in the key assumptions or parameters chosen. v. The validation work undertaken to ensure the continuing adequacy of the model. vi. Whether the model is internally or externally developed. If externally acquired, its generic name and details on the model developer. vii. The extent of its acceptance by other regulatory bodies, users in the international treasurers’ community, overall reputation and market acceptance. viii. Specific details on the applications within the bank. ix. Major merits and demerits of the chosen models. x. Results of the model validation obtained through:

• Back testing / Scenario testing.
• Analysis of the internal logic. xi. Major methodologies or statistical technique used, i.e. Value at risk models, employing methods such as variance/co-variance, historical simulation and Monte Carlo method.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 18 of 26 xii. Confidence levels embedded for regulatory liquidity or economic liquidity purposes. xiii. Data definition, i.e. whether the source is external or internal and if any data, manipulation of external data has been done for it to conform to the internal data. 9. Liquidity Specific Stress-testing In this section, banks should undertake, at least, the following: i. Analyse the internal liquidity risk stress-testing framework, including the process and governance of and challenge to scenario design, derivation of assumptions and design of sensitivity analysis, and the process of review and challenge and relevance to the risk appetite. ii. Scrutinise the process by which the stress results are produced, and incorporated into the risk framework and strategic planning, and the liquidity recovery process. iii. Analyse the results and conclusions, with breakdown by each relevant risk driver. Details of further stress-testing requirements are in Annexure (1). 10.Liquidity Transferability Between Legal Entities In this section, banks should provide details of any restrictions on the management's ability to transfer liquidity during stressed conditions into or out of the businesses covered. These restrictions, for example, may include contractual, commercial, regulatory or statutory nature. A regulatory restriction could be the minimum liquidity ratio acceptable to SAMA. 11.Aggregation and Diversification This section should describe how the results of the various risk assessments are brought together and an overall view taken on liquidity adequacy. At the general level, the overall reasonableness or the detailed quantification approaches might be compared with the results of an analysis of liquidity planning and a view taken by senior management as to the overall level of liquidity that is appropriate.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 19 of 26 In aggregating the risks, the following aspects of the aggregation process should be described: i. Any allowance made for diversification, including any assumed correlations within risks and between risks and how such correlations have been assessed including in stressed conditions. ii. The justification for diversification benefits between and within legal entities, and the justification for the free movement of liquidity between legal entities in times of financial stress. 12.Challenge and Adoption of the ILAAP This section should describe the extent of challenge and testing of the ILAAP. Accordingly, it would include the testing and control processes applied to the ILAAP models or calculations, and the senior management and Board of Directors review and sign off procedures. In making an overall assessment of a bank's liquidity needs, matters described below should be addressed: i. The inherent uncertainty in any modeling approach. ii. Weaknesses in bank's risk management procedures, systems or controls. iii. The differences between regulatory liquidity and available liquidity. iv. The reliance placed on external consultants. v. An assessment made by an external reviewer or internal audit. 13.Use of the ILAAP within the Bank In this section, banks should demonstrate the extent to which liquidity management is embedded within the bank's operational and strategic planning. This would include the extent and use of ILAAP results and recommendations in the ongoing reviews and assessment of liquidity, day to day decision making, Contingency Funding Plan (CFP) and overall strategic, operational and liquidity planning process. Important elements of ILAAP including growth and profitability targets, scenario analysis, and stress-testing may be used in setting of business plans, management policy and in pricing decisions. This could also include a statement of the actual

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 20 of 26 operating philosophy and strategy on liquidity management and how this links to the ILAAP submitted. 14.Future Refinements of ILAAP A bank should detail any anticipated future refinements within the ILAAP, highlighting those aspects which are work-in-progress, and provide any other information that will help SAMA review a bank's ILAAP.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 21 of 26 Annexure (1): Stress-testing and Contingency Funding Plan (CFP) A. Stress-testing Stress-testing is a generic term for the assessment of vulnerability of individual financial institutions and the financial system to internal and external shocks. Typically, it applies ‘What if’ scenarios and attempts to estimate expected losses from shocks, including capturing the impact of ‘large, but plausible events’. Stress￾testing methods include scenario tests based on historical events and information on hypothetical future events. They may also include sensitivity tests. A good stress￾test should have attributes of plausibility and consistency and ease of reporting for managerial decisions.

1. Stress-testing Under Pillar 1 i. A Bank must conduct on a regular basis appropriate stress-tests so as to: a) Identify sources of potential liquidity strain:

• Loss of confidence – justified/unjustified.
• Contagion – financial sector weakness, corporate failures, etc.
• External factors – market disruption, risk aversion, flight to quality, etc.
• Uncorrelated events – operational disruptions, natural disasters, terrorist attacks, etc. b) Ensure that current liquidity exposures continue to conform to the liquidity risk tolerance established by that bank's governing body. c) Identify the effects on that bank's assumptions about pricing. d) Analyse the separate and combined impact of possible future liquidity stresses on its:
• Cash flows.
• Liquidity position.
• Profitability.
• Solvency. ii. A bank must consider the potential impact of institution-specific, market-wide and combined alternative scenarios. iii. In conducting its stress-testing, a bank should also, where relevant, consider the impact of its chosen stresses on the appropriateness of its assumptions relating to:

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 22 of 26

• Correlations between funding markets.
• The effectiveness of diversification across its chosen sources of funding.
• Additional margin calls and collateral requirements.
• Contingent claims, including potential draws on committed lines extended to third parties or to other entities in that bank's group.
• Liquidity absorbed by off-balance sheet activities.
• The transferability of liquidity resources.
• Access to central bank market operations and liquidity facilities.
• Estimates of future balance sheet growth.
• The continued availability of market liquidity in a number of currently highly liquid markets.
• Ability to access secured and unsecured funding (including retail deposits).
• Currency convertibility.
• Access to payment or settlement systems on which the bank relies. iv. A Bank should ensure that the results of its stress-tests are:
• Reviewed by its senior management.
• Reported to the bank's Board of Directors or its deleted authority, specifically highlighting any vulnerabilities identified and proposing appropriate remedial action.
• Reflected in the processes, strategies and systems.
• Used to develop effective contingency funding plans.
• Integrated into that bank's business planning process and day-today risk management.
• Taken into account when setting internal limits for the management of that bank's liquidity risk exposure. v. Among more qualitative criteria that banks would have to meet before they are permitted to use a models based approach are the followings:
• Rigorous and comprehensive stress-testing program should be in place.
• Cover a range of factors that can create extraordinary losses or gains in trading portfolios.
• Major goals of stress-testing are to evaluate the capacity of the bank’s liquidity to absorb potential large losses and to identify steps the bank can take to reduce its risk and conserve liquidity.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 23 of 26

• Results of stress-testing should be routinely communicated to senior management and periodically, to the bank’s board of directors. vi. Results of stress-tests should be reflected in the policies and limits set by the management. vii. Scenarios to be employed:
• Historical without simulation.
• Historical with simulation – this means relating to specific profile and idiosyncratic nature of the bank. e.g. if deposits are highly concentrated with top three customers, if one customer goes for an early withdrawal or partial withdrawal, how this simulation would affect historical analysis?
• Adverse events, based on individual portfolio characteristics of institutions.

2. Stress-testing Under Pillar 2 Under the Supervisory Review Process, SAMA will initially review the Pillar 1 stress-testing requirement for LCR and NSFR. SAMA will also assess stress-testing under Pillar 2 with specific reference to detailed Contingency Funding Plan (CFP). Some of the scenarios which can be used are: i. Example of First Liquidity Stress An unforeseen, name-specific, liquidity stress in which:

• Financial market participants and retail depositors consider that in the short-term the bank will be or is likely to be unable to meet its liabilities as they fall due.
• The bank's counterparties reduce the amount of intra-day credit which they are willing to extend to it.
• The bank ceases to have access to foreign currency spot and swap markets.
• Over the longer-term, the bank's obligations linked to its credit rating crystallize as a result of a reduction in that credit rating. For the purpose, a bank must assume that the initial, short-term, period of stress lasts for at least two weeks.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 24 of 26 ii. Example of Second Liquidity Stress An unforeseen, market-wide liquidity stress of three months duration. A bank must assume that the second liquidity stress is characterised by:

• Uncertainty as to the accuracy of the valuation attributed to that bank's assets and those of its counterparties.
• Inability to realise, or ability to realise only at excessive cost, particular classes of assets, including those which represent claims on other participants in the financial markets or which were originated by them.
• Uncertainty as to the ability of a significant number of banks to ensure that they can meet their liabilities as they fall due.
• Risk aversion among participants in the markets on which the bank relies for funding.

3. Other Aspects Related to Stress-testing i. SAMA expects all banks to closely review the above recommendations on stress-testing and develop specific strategies and methodologies to implement those that are relevant and appropriate for their operations. ii. SAMA in its evaluation of banks method and systems under Pillar 1 and Pillar 2 will examine the implementation of these stress-test requirements. It will also review the stress-test methodologies and systems as part of its Supervisory Review Process. iii. As a minimum, a bank should carryout stress-tests at least on an annual basis. B. Early Warning Indicators An important component of liquidity risk management and the contingency funding plan is the early warning indicators including:

• Growing concentrations in assets or liabilities.
• Increases in currency mismatches.
• Repeated incidents of positions approaching or breaching internal or regulatory limits.
• Decrease of weighted average maturity of liabilities.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 25 of 26

• Significant deterioration in the bank’s earnings, asset quality, and overall financial condition.
• Credit rating downgrade.
• Widening debt or credit-default-swap spreads.
• Rising wholesale or retail funding costs compared to other banks.
• Counterparties requesting or increasing request for collateral for credit exposures or resisting to enter into new transactions.
• Increasing retail deposit outflows.
• Difficulty accessing longer-term funding. C. Contingency Funding Plan (CFP) i. Banks should detail the policies, procedures and action plans for responding to severe disruptions in the bank's ability to fund itself. The plan should be that which is contained within their Contingency Funding Plan (CFP) and it should be prepared as a standalone document and attached to the ILAAP document. ii. At a minimum, a bank should ensure that its Contingency Funding Plan (CFP) meets the followings: a) Outlines strategies, policies and plans to manage a range of stresses. b) Establishes a clear allocation of roles and clear lines of management responsibility. c) Formally documented. d) Includes clear invocation and escalation procedures. e) Regularly tested and updated to ensure that it remains operationally robust; this testing is mainly qualitative in nature which tests process, procedures, and appropriate governance to undertaken action on timely basis. This should test the following:
• Composition of liquidity crisis management team (LCMT).
• Roles and responsibilities of LCMT.
• Early warning signals using benchmark indicators i.e. Availability of credit lines, collection efficiency, positive cumulative outflow. These signals should have triggers based on 30% or 50% decline in collections for continuous three months.
• Liquidity stress-test consisting of four early warning signals.

Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) Version Number Issue Date Page Number 2.0 October 2020 26 of 26

• Minimum logistics and contact information.
• Communication strategy with SAMA.
• Undertaking only two transactions in interbank market or with SAMA to demonstrate it is working effectively. f) Outlines how the bank will meet time-critical payments on an intraday basis in circumstances where intra-day liquidity resources become scarce. g) Outlines the bank's operational arrangements for managing a retail funding run-off. h) In relation to each of the sources of funding identified for use in emergency situations, is based on a sufficiently accurate assessment of the amount of funding that can be raised from that source; and the time needed to raise funding from that source. i) Sufficiently robust to withstand simultaneous disruptions in a range of payment and settlement systems. j) Outlines how the bank will manage both internal communications and those with its external stakeholders. k) Establishes mechanisms to ensure that the bank's Board of Directors and senior management receive information that is both relevant and timely. l) Clear escalation/prioritization procedures detailing when and how each of the actions can and should be activated. m) Lead time needed to tap additional funds from each of the contingency sources. iii. In designing a contingency funding plan, a bank should ensure that it takes into account:
• The impact of stressed market conditions on its ability to sell or securities assets.
• The impact of extensive or complete loss of typically available market funding options.
• The financial, reputational and any other additional consequences for that bank arising from the execution of the contingency funding plan itself.
• Its ability to transfer liquid assets having regard to any legal, regulatory or operational constraints.
• Its ability to raise additional funding from central bank market operations and liquidity facilities.