Reserve Bank of Malawi Stress Testing Framework Guidelines

RESERVE BANK OF MALAWI STRESS TESTING FRAMEWORK GUIDELINES Bank Supervision Department April, 2013

1 Table of Contents 1 INTRODUCTION ..................................................................................... 3 2 MANDATE ................................................................................................ 6 3 OBJECTIVE .............................................................................................. 6 4 APPLICABILITY OF THE GUIDELINES ............................................. 6 5 DEFINITIONS ........................................................................................... 6 6 USE AND LIMITATIONS OF STRESS TESTS ..................................... 7 7 PRINCIPLES AND GUIDELINES ........................................................ 10 7.1 Board Responsibilities ......................................................................... 10 7.2 Stress Testing Programme Supported By An Effective Infrastructure . 11 7.3 Stress Testing Programme Should Inform Decision Making ............... 13 7.4 Implementation Of The Stress Testing Programme .............................. 14 7.5 Regular Review Of The Stress Testing Programme ............................. 15 7.6 Stress Testing Methodologies .............................................................. 17 7.7 Portfolio, Individual Risk And Bank-Wide Stress Testing ................... 28 7.8 Outputs Of Stress Testing Programmes And Management Intervention Actions ......................................................................................................... 30 7.9 Stress Testing Under Internal Capital Adequacy Assessment Process (Icaap) .......................................................................................................... 33 8 ANNEXES ................................................................................................ 36 8.1 Annex 1: Individual Risk Areas ........................................................... 36 8.2 Annex 2: Guidance On Stress Testing Methodologies ......................... 51

2 8.3 Annex 3: Guidance On Good Stress Testing ........................................ 55 8.4 Annex 4: Elaboration On Use Of Stress Tests ...................................... 57 8.5 Annex 5: An Illustration Of How To Develop Stress Scenarios ........... 59

3 1 INTRODUCTION Stress testing generally is used as a generic term for the assessment of the vulnerability of individual banks or the banking system to shocks. Typically, application of “what if” scenarios, especially interested in the problematic identification of low frequency but high severity events; and identifying expected and unexpected losses including non-linearities. It focuses on capturing the impact of “large, but still plausible events”; and understanding the overall risk profile in a coherent and consistent framework, including impact analysis on earnings, solvency and liquidity. The two key words used to define a stress event are 'exceptional' and 'plausible'. Although stress events should be low-probability events, they should not be so far-fetched as to stretch the limits of plausibility. This is because lack of plausibility can limit the importance attached to results of stress tests, i.e. the event might be deemed so unrealistic that nobody believes it will ever happen and hence no importance will be assigned to the stress tests. Stress testing involves testing beyond normal operational capacity, often to a breaking point, in order to observe the results. Stress testing can also involve more sophisticated techniques that provide information on the major vulnerabilities of a country's financial system. In this case, the techniques are usually referred to as macro, or aggregate, stress tests. This approach can use a bottom-up or a top-down approach or the combination of both. Under Pillar II of the Basel II framework, banks are expected to perform rigorous, forward-looking stress testing that identifies possible events or

4 changes in market conditions that could adversely impact the bank. Further, banks are required to have a routine, robust process for stress testing and scenario analysis in order to support their measures of capital adequacy, such as establishing events or environmental changes that could lead to adverse development, identifying the impact of such events given current positions, and determining the strategy and processes for managing their portfolios and risks given such events. The range of stress tests that banks should undertake as part of their stress testing programmes should be complementary. For example, stress testing of a credit portfolio is likely to inform a broader credit risk stress test and, similarly, bank-wide scenario stress testing is likely to draw on experience from individual risk stress tests, whilst recognising that simple aggregation is unlikely to be as sufficient. The guidelines describe both quantitative and qualitative aspects of stress testing while noting the principle of proportionality, which takes into account the nature, scale, complexity and risk profiles of a bank. For instance, small banks may focus more on the qualitative aspects whilst larger more complex banks may require more sophisticated stress testing techniques. However, in all cases, it is expected that there will be a key qualitative narrative running through the stress testing programme that will identify possible links between a bank’s risk appetite, its business strategy and the potential impact of external and internal events on its business model. The Board should take particular interest in ensuring this narrative is coherent and in keeping with the bank's stated risk appetite and strategy. The principle of proportionality applies to all aspects of these guidelines, including the methodology, as well as the frequency and the degree of

5 detail of the stress tests. The Registrar of Financial Institutions (Registrar) acknowledges that smaller and/or less complex banks may not be able to perform complex bank-wide macro-economic scenario based stress tests. However, they should still address stress testing, at least in a qualitative manner, while quantitatively limiting themselves to simpler sensitivity analysis of the specific risk types to which they are most exposed. This will allow all banks to identify, assess and test their resilience to shocks relating to the material risks confronting them. In developing stress testing programmes all banks should consider possible interactions between risks. For example, intra- or inter-risk concentrations, rather than simply focusing on the analysis of single risk factors in isolation. To this end, the qualitative approach to reverse stress testing discussed in these guidelines may be beneficial. Banks are expected to have an appropriate infrastructure in place to undertake a variety of stress tests that are covered in these guidelines. Stress testing programmes of large and complex banks should include rigorous bank-wide stress tests covering all material risks and entities, as well as the interactions between different risk types. Further, cross-border banks are expected to implement these guidelines and set up stress testing programmes covering the consolidated level and, where applicable, material entities and/or business lines, subject to the principle of proportionality and relevance.

The Registrar recognises that stress testing is more than a simple capital assessment and is one of the risk management tools which allows for better understanding of a banking institution’s risk profile and its resilience to internal and external shocks. However, given the natural limitations of the methodologies, parameters and data used, the overall uncertainty about

6 forward looking assessments and the actual occurrence of assumed scenarios and the output from stress testing must be treated with caution. Stress testing should be used by banks in combination with other risk management and control tools in order to help make informed business decisions. Similarly, supervisors shall not rely solely on the results of stress tests to make a decision regarding the risk profile and capital adequacy of a bank, but use it in combination with other supervisory tools. 2 MANDATE These guidelines are issued pursuant to Section 96 of the Financial Services Act 2010. 3 OBJECTIVE The objectives of these guidelines are to: (a) enable banks conduct stress testing as part of risk management in evaluating the potential impact of a specific event and/or movement in a set of financial variables. (b) assist in the assessment of the vulnerability of an individual bank or the banking system to shocks. 4 APPLICABILITY OF THE GUIDELINES The guidelines apply to all banks. 5 DEFINITIONS In these Guidelines, unless the context otherwise requires: ‘bank’ shall have the same meaning as ascribed in the Banking Act. ‘bottom up stress testing’ means exercises implemented by a bank using its internal data and models, but based on common assumptions provided by a central authority (central bank or supervisory agency)

7 ‘executive officer’ means an officer at the most senior level of management of the licensed bank (whether or not he/she is director) who effectively manages that licensed bank. ‘internal control ’ ,means a process effected by the bank’s board of directors, management and other personnel designated to provide reasonable assurance regarding the achievement of objectives such as effectiveness and efficiency of operations, reliability of financial reporting and compliance with applicable laws and regulations. ‘internal audit’ means an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations and which helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. ‘reverse stress testing’ involves identifying a significant negative outcome and then identifying the causes and consequences that could lead to such an outcome. ‘stakeholder’ means an individual or group, in addition to shareholders, who have an interest in, and/or influence over, the bank’s operations and the achievement of the bank’s goals, such as creditors, employees, suppliers, customers and the community. ‘top down stress testing’ exercises implemented by a central authority using (supervisory and/or public) bank-by-bank data and common assumptions and methodologies . 6 USE AND LIMITATIONS OF STRESS TESTS Stress testing permits a forward-looking analysis and a uniform approach to identifying potential risks generated by exceptional but plausible shocks to individual banks and/or the banking system as a whole. It also examines

8 potential vulnerabilities faced by banks that may not be revealed by quantitative risk management models. Stress testing supplements the output of quantitative risk management models such as Value at Risk (VAR), and have the advantage over VAR of explicitly linking potential large losses with specific events. Stress testing also enables management to better understand the nature of risks embedded in business lines and may also help to initiate dialogue in order to quantify the effects of exceptional events on various risk types in isolation and on combinations of risks. Finally, stress tests can assist banks in conducting appropriate contingency planning for periods of stress and contribute to the process of allocating capital within the banking institution. While in general stress testing is a risk management tool that banks can use based on their own judgment and needs, under Pillar II of the Basel II framework, banks are expected to perform “rigorous, forward-looking stress testing that identifies possible events or changes in market conditions that could adversely impact the bank.” Further, banks are required to have a routine, robust process for stress testing and scenario analysis in order to support their measures of capital adequacy, such as establishing events or environmental changes that could lead to adverse development, identifying the impact of such events given current positions, and determining the strategy and processes for managing their portfolios and risks given such events. According to the Basel II guidelines, the processes for stress testing should cover events such as: economic or industry downturns, market events and decreased liquidity. Likewise, under Pillar II, banks are expected to substantiate that their current capital levels are sufficient to resist a “range of severe but plausible events” and that different approaches are utilised to determine of the firm’s overall capital.

9 It is important to note that stress tests only give an indication of the bank's risk exposures to a specific event, and not the probability of such an event occurring. Stress testing attempts to answer questions such as “how much would be lost given the event occurring?” But it does not answer the question “how much is likely to be lost?” In addition, assumptions must be made in the specification of a stress test. These assumptions rely, to a greater extent, on the subjective judgement and experience of those who conduct the stress tests. There is thus no guarantee that the “right” scenarios and methods will be chosen, or that the results are interpreted in a satisfactorily way. Stress tests may also impose a high computational cost, particularly in collecting input data from diverse business units and the need to revalue complex options-based positions.

10 7 PRINCIPLES AND GUIDELINES 7.1 Board Responsibilities Principle I The Board of Directors has ultimate responsibility for the overall stress testing programme of the bank. Its engagement is essential for the effective operation of stress testing. The Board should be able to understand the impact of stress events on the overall risk profile of the bank. Guidelines The Board has ultimate responsibility for the overall stress testing programme. This is essential in order to ensure the authority of the stress testing programme at all levels of the bank and to ensure that the Board fully understands the impact of stress events on the overall risk profile of the bank. Their engagement will also help to maximise effective use of the programme, especially with respect to bank-wide stress testing and capital planning. Practical aspects of stress testing, such as identification of risk drivers, implementation, management, etc., may be delegated to senior management. However, the Board (or relevant designated committee) should actively be engaged in the discussion, and where necessary challenge key modelling assumptions and scenario selection. It is also expected to question assumptions underlying the stress tests from a common/business sense perspective. The Board should take responsibility for agreeing on and where necessary challenging the credibility of management intervention and mitigating

11 actions based on stress test results (as one of a range of risk management tools). The Board may also consider engaging stress testing committee where discussions with risk managers about the design, assumptions, results, limitations and implications of the stress testing programme are conducted. 7.2 Stress Testing Programme Supported By An Effective Infrastructure Principle II The stress testing programme should be an integral part of a bank's risk management framework and be supported by an effective infrastructure. Guidelines Stress testing should be integrated into a bank’s risk management processes. For example, the stress test programme should: a. analyse the aggregate of a bank's businesses and risk types as well as the separate components of portfolios, risk types and business lines; b. factor in the relationships between risk types; c. support bottom-up and top-down stress testing, including reverse stress-testing; d. have a flexible platform that enables modelling of a wide variety of stress tests across business lines and risk types as and when required; e. draw data from across the organisation, as needed; and

12 f. enable intervention to adjust assumptions in a clear manner. Stress testing should be an integral part of the Internal Capital Adequacy Assessment Process (ICAAP). The ICAAP should demonstrate that stress testing reports provide the Board and senior management with thorough understanding of material risks to which the bank may be exposed. Stress tests should be undertaken with appropriate frequency and allow for ad hoc stress tests. The frequency of stress tests should be proportionate to risk areas and the need for overall bank-wide stress testing. In some risk areas, stress testing is necessarily done frequently while overarching bank-wide stress testing may be done with lower frequency. For large complex banks they will have a number of risk areas requiring frequent stress testing e.g. market risk, which will inform the broader stress testing framework. Smaller, simpler banks may not have the same range of need. The stress testing programme should be supported by an appropriate infrastructure and/or data framework allowing for both flexibility and appropriate levels of quality and control. Infrastructure and/or data frameworks should also be proportionate to the size, complexity, risk and business profile of a bank, and allow for the performance of stress tests covering all material risks a bank is exposed to. A bank should ensure that it devotes sufficient resources to developing and maintaining such infrastructures and/or data frameworks including appropriate resources and IT systems, where applicable, that facilitate effective data delivery and as well as quantitative and qualitative processing.

13 The stress testing infrastructure and/or data framework of a cross￾border group, should allow stress tests to be conducted at various levels of the organisation, including at the consolidating level, but also at the level of material entities. Alternatively, where the bank applies a centralised approach to risk management, and stress tests are being conducted predominantly at the consolidated level, the design of the stress testing programme should allow for articulation of the impact/results of the group (consolidated) level and material entities level or business lines. 7.3 Stress Testing Programme Should Inform Decision Making Principle III Stress testing programmes should be actionable and inform decision making at all appropriate management levels of a bank. Guidelines The stress testing programme must support different business decisions and processes including strategic decisions, capital and contingency planning. Such decisions should take into consideration shortfalls of stress testing and limitations of the assumptions used. The Board and senior management must have responsibility for evaluating relevant output from the stress testing programme and for taking appropriate management actions. These measures or actions may vary depending on the circumstances and other available information. Examples of such actions, although not exhaustive are:

14 a. reviewing the set of limits, especially in cases where regulatory requirements indicate that the results of the stress tests should be reflected in the limits set by banks (i.e. requirements relative to market risks and to credit risk mitigation techniques); b. use of risk mitigation techniques; c. reducing exposures or business in specific sectors, countries, regions or portfolios; d. reconsidering the funding policy e. reviewing capital and liquidity adequacy; f. reviewing strategy; g. reviewing the risk appetite; and h. reviewing the contingency framework or development of a framework where one does not exist. The results of stress tests should also inform the process of establishing a bank’s risk appetite and fixing exposure limits as well as a planning tool to determine the effectiveness of new and existing business strategies and their impact on capital utilisation. Thus, stress testing results could mean that a bank is comfortable with the risk￾return consequences or it could decide to de-risk its portfolio. Stress tests are also a suitable tool to identify tail risk, for which explicit risk appetite levels may be set. 7.4 Implementation Of The Stress Testing Programme Principle IV A bank should have clear responsibilities; allocate resources and written policies and procedures to facilitate the implementation of the stress testing programme.

15 Guidelines The stress testing programme should be governed by board approved internal policies and procedures. Clear responsibilities should be assigned for the overall stress testing programme in the bank. The following aspects should be detailed in policies and procedures governing the stress testing programme: a. he types of stress testing and the main purpose of each component of the programme; b. frequency of stress testing exercises, which is likely to vary depending on type and purpose; c. the methodological details of each component, including the definition of relevant scenarios and the role of expert judgement; and d. the range of business assumptions and remedial actions envisaged, based on the purpose, type and result of the stress testing, including an assessment of the feasibility of corrective actions in stress situations and a changing business environment. A bank should ensure that it develops explicit procedures to undertake rigorous, forward-looking stress testing and document assumptions and fundamental elements for each stress testing exercise. These should include the reasoning and judgements underlying the chosen scenarios and the sensitivity of stress testing results to the range and severity of the scenarios, and to the range of business assumptions and planned remedial actions. 7.5 Regular Review Of The Stress Testing Programme Principle V

16 A bank should regularly review its stress testing programme, assess its effectiveness and fitness for purpose. Guidelines The effectiveness and robustness of stress tests should be assessed regularly, both qualitatively and quantitatively, in light of changing conditions to ensure that they are up-to-date. The frequency of assessment of different parts of the stress testing programme should be set appropriately. An independent control function should play a key role in the process. The following areas of assessment of the stress testing programme should be considered: a. he effectiveness of the programme in meeting its intended purposes; b. the need for improvement on the work; c. systems implementation; d. management oversight; e. assumptions used; f. data quality; and g. documentation. A sound and robust stress testing programme (e.g. design, scenarios, use of judgement and results) should be challenged by views from across the organisation. This requires dialogue between risk managers, economists, business managers and other relevant experts before it goes to senior management for vetting. Challenge between risk managers and business managers is likely to focus on the use and appropriateness of the stress testing programme from a business

17 perspective while insight of specialists within macro-economic analysis are likely to be most valuable in the process of scenario selection and validation of stress test results. Involvement of different experts would help ensure that the stress test programme stands a better chance of relevance to the bank. 7.6 Stress Testing Methodologies The use of appropriate methodologies in stress testing programmes is key to fulfilling their purposes. In general sense, an effective stress testing programme should consist of sensitivity analysis (single and simple multi-factor analysis), scenario analysis addressing all material risks at various levels of the bank, and reverse stress testing (refer to section 13.4). The combination of approaches as well as the level of detail will depend on the size and complexity of the specific bank. A smaller bank may place greater emphasis on the qualitative elements of its stress testing programme supported by quantitative outputs of the balance sheet, whereas large sophisticated banks would be expected to run more complex models which would be complemented by appropriate qualitative oversight. Sensitivity analysis Principle VI A bank should perform sensitivity analysis for specific portfolios or risks. Guidelines Sensitivity analysis is the simple stressing of one risk driver to assess the sensitivity of the bank to that risk driver. For example, a bank might choose a simple interest rate shift stress or a straight forward

18 shift in probabilities of defaults (PDs), or the default of its largest counterparties, or a decline in value of liquid assets. Such analysis provides information about key risks and enhances understanding about potential risk concentrations in one or several risk factors. The use of simpler ‘what if tests’ have the advantage of soliciting buy in particularly when the regime is being introduced because of simplicity and potential comprehensibility. A bank should identify relevant risk drivers in particular: macro￾economic risk drivers (e.g. interest rates), credit risk drivers (e.g. a change in bankruptcy law or a shift in PDs), financial risk drivers (e.g. increased volatility in financial instruments markets), and external events (e.g. operational risk events, market events, events affecting regional areas or industry sectors etc). The bank should then stress the identified risk drivers using different degrees of severity. The severity of single factor shocks is likely to be influenced by long-term historical experience but a bank is advised to supplement this with hypothetical assumptions to test the bank’s vulnerability to specific risk factors that can be envisaged with plausibility. A bank can conduct sensitivity analysis at a level of individual exposures, portfolios or business units, as well as bank-wide, against specific risk areas as sensitivity analysis is likely to lend itself to risk￾specific stress factors.

19 Furthermore, single factor analysis can be supplemented by simple multi-factor sensitivity analysis, where a combined occurrence is assumed, without necessarily carrying out a scenario analysis. Scenario analysis Principle VII A bank should undertake scenario analysis as part of its set of stress tests which should be (i) dynamic and forward- looking and (ii) incorporate the simultaneous occurrence of events across the bank. Guidelines Forward-looking hypothetical scenario analysis is a core part of the suite of stress tests that a bank should include in its stress testing programmes. The development of a hypothetical scenario can start from historically observed realisations of risk parameters, but relying solely on historical scenarios has proved to be insufficient. Pure historical scenarios can give insights into impact but not into the confluence of events that may occur. Moreover, as historical scenarios are purely backward-looking, they tend to neglect recent developments and current vulnerabilities. Therefore, scenario design should take into account systematic and bank-specific changes in the present and near future and thus be forward-looking. A range of scenarios should be considered encompassing different events and degrees of severity. The varying degrees of severity might be captured in the analysis of different events but would ideally

20 encompass a program of several events with several degrees of severity. Moreover, scenarios should: a. address all the material risk types of a bank (e.g. credit risk, market risk, operational risk, interest rate risk and liquidity risk). No material risk type should be overlooked; b. address main risk factors the bank may be exposed to. In this regard, the results obtained from single factor analysis, which aim at providing information about the sensitivity towards single risk factors, may be used to identify other scenarios that include a stress of a combined set of highly plausible risk factors. No material risk factor should be left unstressed or unconsidered; c. address major bank-specific vulnerabilities. These should take into account the regional and sectoral characteristics of a bank, specific products or business line exposures and funding policies. Therefore, concentration risk, both intra- and inter–risk types, should be identified a priori; d. contain a narrative scenario which should include various trigger events, such as monetary policy, financial sector developments, commodity prices, political events and natural disasters. Narrative in this regard means that the co-movement of risk factors and the corresponding reaction of market participants are not implausible or paradoxical but yield a consistent picture of a possible overall future state; e. be internally consistent so that identified risk drivers behave in ways which are consistent with the other risk drivers in a stress; f. take into account developments in technology such as newly developed and sophisticated financial products and their interaction with the valuation of more traditional products; and

21 g. be forward-looking and include severe outcomes. A bank should determine the time horizon of stress testing in accordance with the characteristics of the portfolio of the bank such as maturity and liquidity of the stressed positions, where applicable, as well as the risk profile and purposes of the particular exercise. Principle VIII A bank should identify appropriate and meaningful mechanisms for translating scenarios into relevant internal risk parameters that provide a bank-wide view of risks. Guidelines The formulation of a scenario includes explicit estimates/assumptions about the dependence structure between the main underlying economic and financial drivers such as interest rates, gross domestic product (GDP), unemployment, equity, consumer and property prices, etc. The chosen scenario should be applied to all relevant positions (on- and off-balance sheet) of the bank. It is key that the scenario composition, as well as the translation from macro-economic variables to internal risk parameters, is done consistently. Two main challenges emerge: a. he formulation of a scenario that soundly incorporates all facets of an economic environment; and b. the transformation of these into internally consistent loss parameters {e.g. PD, loss given default (LGD), write-offs, fair value haircuts etc.}.

22 The link between underlying economic factors and internal losses or stressed risk parameters are likely to be based primarily on the bank experience and analysis, which may be supplemented by external research and at times supervisory guidance. Benchmarks, such as those based on external research, may be quantitative or qualitative. Due to the complexity involved in modelling hypothetical and macro￾economic based scenarios: a. bank should be aware of the model risk involved. A regular and conservative expert review of the model’s assumptions and mechanics are important as well as a conservative modelling approach to account for model risk; and b. degree of conservatism may be appropriate when making assumptions that are hard to measure in a quantitative way (e.g. diversification) but that influence the model’s outputs. Nevertheless, the bank is expected to be aware of the dependencies excluded and review their incorporation on a regular basis. The transformation of external variables or events into internal losses or increased risk parameters is another challenging task. A bank should be aware of the possible dynamic interactions among risk drivers, the effects on earnings, capital and off-balance sheet position. A deep (probabilistic) understanding of how macro-economic variables and bank specific effects would impact the bank at any given point in time is important in stress testing modelling. Ideally, this transformation should be based on quantitative modelling where

23 data is relatively rich and based on expert judgement with supporting quantitative analysis where data is relatively scarce. Principle IX System-wide interactions and feedback effects should be incorporated within scenario stress testing. Guidelines The stress test should explicitly identify interdependences, e.g. among economic regions and among economic sectors. The overall scenario should take into account system-wide dynamics – such as leverage building up across the system, closure of certain markets, risk concentrations in a whole asset class such as mortgages, and adverse feedback dynamics, for example through interactions among valuations, losses, margining requirements and insurance relations. The strong links between the real economy and financial economy as well as the process of globalisation have amplified the need to look at system-wide interactions and feedback effects. Such analysis can be very difficult to model quantitatively as it encompasses the reaction and behaviour of other market participants under adverse conditions. Thus, a bank may make qualitative assessments of the feedback effects of stress. For example, these effects would affect assumptions about management actions discussed below. More importantly, such assumptions should be documented and reviewed by senior management.

24 Severity of scenarios Principle X Stress testing should be based on exceptional but plausible events. The stress testing programme should cover a range of scenarios with different severities including scenarios which reflect a severe economic downturn. Guidelines Ensuring that a stressed scenario is appropriately severe is one of the elements required for ensuring that stress tests are: a. meaningful in terms of providing the appropriate type of information which is designed to promote the stability of the bank and the banking system at all points in the economic cycle; and b. consistently applied across the bank, recognising that identical scenarios are not necessarily severe for all business lines. Various degrees of severity should be considered for both sensitivity analysis and scenario stress testing but for capital planning at least a severe economic downturn is required. Severity is to be understood in the light of the specific vulnerabilities of the respective bank, which might not be equal to the perspective of the total economy, that is, a simple country or region specific macro￾economic stress scenario may be less relevant to a bank’s risk profile than others; for example, if it has a specific industry exposure which is counter-cyclical or if its risks are primarily international and less impacted by national scenarios.

25 The assumption of a linear response of the results to stressed parameters may not always hold and it is therefore crucial for a bank to achieve high awareness of non-linear interactions between macro parameters and stressed parameters. For example, it might be that only at a certain level of stress, certain hedging strategies might break down or – on the contrary - come into effect; a subsidiary may also fail to be liquid only at a certain level of stress triggering further repercussion throughout the group. A bank should consider its capital requirements and resources over a plausible macro-economic base case, as well as a more severe stress scenario. A bank should be able to provide the forecasts that underpin its base case capital planning. A bank may assess the appropriate level of severity of its capital planning stress against the scenario outlined in its reverse stress testing programme (see following section). Identifying how the capital planning stress relates to the reverse stress test may help senior management justify why the severe stress scenario is appropriately severe. In developing severe downturn scenarios, a bank should also consider plausibility to the fullest extent possible. For example, as an economy enters recession a bank should not necessarily always assume a further specific level of stress. There may be times when the stressed scenario is close to the base case scenario, but supplemented with specific shocks (e.g. interest rates, exchange rates).

26 Reverse stress testing Reverse stress testing consists of identifying a significant negative outcome and then identifying the causes and consequences that could lead to such an outcome. In particular, a scenario or combination of scenarios that threaten the viability of the bank’s business model is of particular use as a risk management tool in identifying possible combinations of events and risk concentrations within a bank that might not be generally considered in regular stress testing. A key objective of such stress testing is to overcome disaster myopia and the possibility that a false sense of security might arise from regular stress testing in which banks identify manageable impacts. The scenario considered should remain relevant to the bank. Principle XI A bank should develop reverse stress tests as one of its risk management tools to complement the range of stress tests undertakes. Guidelines No single definition of reverse stress testing methodology is provided for the purposes of these guidelines. Reverse stress tests evolve around causes, consequences and impact, all of which are relevant and any of which can be taken as a starting point. Moreover, qualitative and quantitative approaches are appropriate, depending on the size and complexity of the bank. For example, a reverse stress test for a simple and small bank could be a qualitative discussion of key risk factors and their possible combination in relation to the bank’s risk profile. Alternatively, a more sophisticated quantitative approach could be used in identifying a specific loss level, or some other impact on the balance sheet (e.g. movements in capital ratios), and

27 working backwards in a quantitative manner to identify the macro￾economic risk drivers, and the required amplitude of movement, that would cause it. Reverse stress testing is seen as one of the risk management tools usefully complementing the “usual” stress testing, which examines outcomes of predetermined scenarios. Reverse stress testing can help to understand potential fault lines in the business. It is not expected to result in capital planning and capital add-ons. Instead, it is used as a risk management tool in identifying scenarios, and the underlying dynamism of risk drivers in those scenarios, that could cause a bank’s business model to fail. This analysis would be useful in assessing assumptions made about the business model, business strategy and the capital plan. Reverse stress test results may also be used for monitoring and contingency planning. Reverse stress testing should be carried out regularly by all banks at the same level of application as ICAAP. As a starting point reverse stress testing may be carried out in a more qualitative manner than other types of stress testing as senior management consider the types of events likely to lead to insolvency. Even for large and complex banks, reverse stress testing may be undertaken in a more qualitative manner, focusing on the events and materialisation of risk concentrations that could cause their business models to become unviable. As experience is developed, this might then be mapped into more sophisticated qualitative and quantitative approaches developed for other stress testing. Even in a qualitative sense, the impact of macro-economic shocks on a banking

28 institution’s solvency should consider first round and feedback effects as far as possible. Given the importance of a clear narrative running through the reverse stress test to identify business vulnerabilities and to develop an understanding of feedback and non linear effects, reverse stress testing is more than a simple sensitivity analysis e.g. simply shifting one relevant parameter to some extreme. 7.7 Portfolio, Individual Risk And Bank-Wide Stress Testing Stress testing programmes should encompass all the material risks (both on- and off-balance sheet) relevant for the banking group. To be effective, stress testing should consist of a multi-layered approach to capture risks at various levels in a bank. In this regard, according to the proportionality principle, the scope of stress testing could vary from simple portfolio level sensitivity analysis to comprehensive bank-wide scenario stress testing referring to the broadest perimeter. Principle XII A bank should perform stress tests on specific portfolios and the specific types of risk that affect them. Consideration should also be given to changes in correlations between risks that the bank identifies for a given portfolio. Guidelines It is important to perform stress tests on an individual portfolio basis using both sensitivity and scenario analysis. A bank should identify stresses that are severe with respect to a specific portfolio. A bank should ensure it stresses portfolios and business units to identify risk concentrations that may arise across its book. For example, a credit risk stress across asset classes and portfolios may

29 identify potential concentrations between retail and corporate exposures. A bank should perform stress tests taking into account changes in correlations between risks recognising interactions between risk types, such as market and credit risk, particularly in times of stress. Bank-wide stress testing Principle XIII Stress testing should be conducted on a bank-wide basis covering a range of risks in order to deliver a complete and holistic picture of the bank’s risks. Guidelines Risks at the bank-wide level may not be well reflected by simple aggregation of stress tests on individual risk areas or business units. Correlations, off-setting of individual exposures and concentrations may not be adequately captured and there may either be double counting of risks or underestimation of the impact of a stress scenario. Alternatively, specific group risks may arise at a bank-wide level. Therefore stress tests should be undertaken at a bank-wide level for all material risks. Once the material risks have been identified, a bank should derive material risk drivers to inform the bank-wide stress. When looking at risks at a bank-wide level particular attention should be paid to risk concentrations on a holistic basis. Better insight can be obtained with respect to the correlations between and within risk categories. Notably, in times of stress correlations between risk

30 categories tend to increase (for instance between market and funding liquidity risk). Depending on the organisational structure and business model of a particular bank, a complete evaluation of all the risks affecting the bank would require the performance of stress test exercises at both consolidated and the level of material entities, which might be at the solo and/or a sub-consolidated level if appropriate. For instance, financial conglomerates are also expected to take into account the risks stemming from their insurance and security market activities. Furthermore, a bank which is internationally active is also expected to perform stress tests at the level of business units in specific geographic regions or business sectors or business lines. The added value is that a severe stress scenario differs for different businesses and different geographic regions. Bank-wide stress tests should be embedded in the risk management framework of the bank and should incorporate views from parties across the organisation. This is also the case for bank-wide scenario selection and any assumptions used in stress testing programmes. 7.8 Outputs Of Stress Testing Programmes And Management Intervention Actions Principle XIV A bank should identify outputs in relation to its regulatory capital and resources, and also relevant balance sheet and P&L impacts, as a result of its stress testing programme.

31 Guidelines One essential output from a stress testing exercise is the estimate of the losses under a range of scenarios. The aim is to assess the capacity of a bank to absorb losses stemming from various shocks applied in the scenarios. When undertaking stress testing, it is crucial to estimate potential losses which can derive from a specific configuration of macro￾economic variables determined internally or exogenously. These potential losses mainly depend on: a. the risks already taken by a bank at a certain point in time - the starting point of the exercise; and b. developments in the volume, asset quality and prices of investment and funding activities under the scenarios contemplated. When stress- testing over a specific time period consideration should be given to appropriate conservative adjustments to profit and loss forecasts. Notably, loss assumptions in the stress do not have to coincide with accounting losses shown at that specific point in time. Principle XV A bank should identify credible management actions addressing the outputs of stress tests and aimed at ensuring its on-going solvency through the stressed scenario. Guidelines A bank is expected to consider a broad range of mitigating techniques and contingency plans against a range of plausible stressed conditions

32 (not necessarily reverse stress tests) with a focus on at least a severe but plausible negative scenario. To assess its possible responses to a stressed situation a bank should consider the actions that are most relevant and when it would have to take them. Some actions may be required immediately. Others might be contingent on specific events happening, in which case clearly defined triggers for action should be identified beforehand. Others may be actions which the management would take, but these should be clearly agreed upon beforehand (for example, shareholders should be aware that dividends would be cut in some circumstances). A bank should not overestimate its ability to take mitigating management actions recognising the possible impact of the stressed scenarios on other market participants (e.g. capital raising in stressed market conditions can be challenging). When considering the impact of management actions, a bank should explain the impact of the stress on both gross and net bases. Gross would obviously include assumptions about strategy, growth and associated revenue but exclude specific management actions in a stress such as winding down a business line or raising capital. One of the measures available to management may be the raising of additional capital. The presence of a capital buffer, of appropriate quality, can be a significant mitigating factor as higher levels of capital increase the degree of freedom management has when taking mitigating actions.

33 A contingency plan should contain emergency actions in case standard measures turn out to be inadequate in the face of the most adverse scenarios. When defining its contingency plans a bank should take into consideration the reduction of the efficiency as a consequence of extremely severe stressed situations. 7.9 Stress Testing Under Internal Capital Adequacy Assessment Process (ICAAP) Principle XVI Banks should evaluate the reliability of their capital planning based on stress test results Guidelines Stress test results should be used to assess the viability of the bank’s capital plan in adverse circumstances. To be effective for capital planning purposes, a range of scenarios should be considered including at least an adverse economic scenario that is severe but plausible, such as a severe economic downturn and/or a system-wide shock to liquidity. The stress should be bank-wide covering all relevant risk areas and material entities within the bank. The stress tests should be forward-looking, cover the same period as the bank’s ICAAP, be updated at least as regularly as the ICAAP and reflect all entities on which ICAAPs for the group are required. Selection of an appropriate time horizon for the forward-looking capital planning stress test will vary with the size and complexity of a bank, but all capital planning stress tests undertaken by banks should cover a period of at least two years.

34 The scenarios used for the capital planning stress test should take into account of all relevant material risks that the bank is exposed to including all Pillar 1 risks and any relevant Pillar 2 risks (as per bank-wide stress testing). This may involve banks combining individual stresses of specific risk areas or undertaking a holistic bank-wide stress. Principle XVII Stress tests under ICAAP should be consistent with bank’s risk appetite and strategy. It should also contain credible mitigating management actions. Guidelines As a part of their stress testing programmes, banks should develop bank-wide stress tests that are consistent with the risk appetite and overall (i.e. including business) strategy of the bank as set by management. Banks are expected to demonstrate a clear link between their risk appetite, their business strategy, their capital planning and stress testing programmes. In particular, banks should assess and be able to demonstrate (by credible management actions, plans and other concrete steps, including changes in business strategy, reinforcing the capital base and/or other contingency plans) their ability to remain above regulatory minimum capital requirements during a stress that is consistent with their stated risk appetite. The assumptions used in capital planning stress tests should be accurate with respect to banks’ possible behaviour in a time of stress and should be consistent with their stated risk appetite and business

35 strategy. Resulting management actions based on changes to business strategy should have been identified, discussed and agreed at the most senior levels of the organisation if they are to be considered credible. Banks should document results of their stress tests both gross and net of management actions. Mitigating management actions designed to reduce the impact of a stressed event should be clearly documented including explanations that justify the credibility and feasibility of those actions in a stressed environment. For example, actions such as asset sales, capital raising, capital injections from other parts of the group and rapid shifts in business strategies should all be treated with caution in times of stress. For further enquiries please contact: The Director Bank Supervision Reserve Bank of Malawi P. O. Box 565 Blantyre Tel: +265 (0) 1 820 299/444 Fax: 265 (0) 822 118 Email: basu@rbm.mw

36 8 ANNEXES 8.1 Annex 1: Individual Risk Areas The following annexes illustrate some practices in relation to stress testing in individual risk areas with the aim of enhancing risk management and capital planning processes. These examples should not be considered as an exhaustive list of practices. They do not intend to duplicate or propose new regulatory requirements affecting capital or liquidity regimes, and they acknowledge that there is no one way of setting up stress testing practices, but rather different ways that fit in with each bank’s approach to the management of risks. Bearing in mind the principle of proportionality, stress tests are conducted by banks with material exposure to any of the following risks. 8.1.1 Market Risk i. Market risk is the risk of losses in on- and off-balance￾sheet positions arising from movements in market prices (e.g. stock prices, interest rates, foreign exchange rates) ii. Interest rate risk in trading book positions is a component of market risk. iii. Stress tests are usually conducted by all banks for their positions in financial instruments in the trading book as part of their bank-wide stress testing as well as for market risk management approaches and measures purposes. iv. If applicable, banks can consider a range of exceptional but plausible market shocks or scenarios for their trading book positions. For example, “exceptional” changes in

37 market prices, shortages of liquidity in the markets and defaults of large market participants can be taken into account. Dependencies between different markets and consequentially increasing correlations can also be factored in. v. The stress tests applied and the calibration of those tests may reflect. The nature of the portfolios; vi. The trading strategies of the bank; and vii. The possibility and time it could take, to hedge out or manage risks under severe market conditions. viii. As instruments and trading strategies change, the stress tests evolve to accommodate the changes. 8.1.2 Credit Risk and Counterparty Risk i. All banks exposed to credit risk as a material risk are subject to credit risk stress testing. An important aspect of testing is the method applied for capital requirement calculations. As Credit risk concentration and credit risk parameters are subject to stress testing. Credit risk concentration stress tests play an important role for Pillar 2 risk. Banks using the standardised method for calculation of credit risk capital requirements are exposed to credit risk as a material risk and the requirements for stress testing apply. ii. Stress tests may have to assess future credit losses and changes in capital requirements due to, for example, changes in credit quality and collateral values.For credit losses, the estimation of future losses in stress tests may in some cases rely on banks’ credit risk parameters

38 although these would not be applied in the calculation of capital requirements. Credit risk model approaches for losses and approaches which challenge historical relations and data are encouraged. iii. Banks may simulate credit quality migrations among categories of exposure and provide an estimate of the losses. iv. Collateral values of residential real estate may be a relevant risk driver for banks using the standardised approach. v. Credit quality effects include changes in risk weights of externally rated companies and changes in past due credits. vi. In computing the effect of stress tests on capital requirements, banks may use methodologies coherent with the standardised framework. This requires developing a link between internal risk parameters and regulatory weights. If the bank uses external ratings it can infer, by the movements of the internal risk estimation, the rating migration. Credit stock volume may be treated in various ways in stress tests; as a risk driver in sensitivity analysis, part of a scenario or an indirect effect from a scenario. Whether the volume change is part of the scenario or an indirect effect from the scenario, careful consideration is given to market factors. Different banks may end up with different views about market factors such as credit supply, credit demand and competitors’ behaviour in a stress situation which may limit the use of the result.

39 8.1.3 Operational Risk i. Banks will use the Basic Indicator Approach to calculate the capital requirements for operational risk. Banks should ensure that operational risks are sufficiently and adequately stressed. ii. The stress assumptions may be different from the ones used in credit and market risk stressed scenarios and should be based on external (for example damage to tangible assets due to a natural disaster) and internal events (such as new products, systems, areas of business and outsourced activities.). Especially in new areas with a lack or scarcity of loss data, stress tests may be based on scenario analysis. iii. A robust analysis of major operational risks includes stresses and analysis of historical and hypothetical operational risk events, and assessments of the adequacy of the capital calculated against these stressed events. iv. Stress tests should be based on severe, but plausible, operational risk events. Historical and plausible hypothetical operational risk events (e.g. rogue trader scenarios, natural disasters) used for stress testing have the nature of low frequency and high severity. The stressed operational risk exposure in Pillar 2 should also take account of the overall operational risk exposure. v. The analysis of operational risks may be based on a top￾down or bottom-up assessment of the risk or may comprise both elements. The chosen approach should be consistent with the size and complexity of the business (proportionality principle).

40 vi. The analysis of the stress test events could involve expert opinion and include the macro-economic environment (e.g. to reflect increasing fraud risk in an economic downturn) and other external risks and factors. 8.1.4 Liquidity Risk i. Liquidity risk has two dimensions: a. funding liquidity risk: the current or prospective risk arising from an bank’s inability to meet its liabilities/obligations as they fall due without incurring unacceptable losses; and b. Market liquidity risk: the risk that a bank cannot easily offset or sell a position without influencing the market price (and incurring a significant loss) because of inadequate depth in the market or market disruption. ii. Each bank is expected to manage its individual funding liquidity risk, taking into account the possible impact of market liquidity risk. iii. All material liquidity risk drivers are expected to be considered in identifying the potential liquidity gap. The drivers incorporate both asset and liability side factors. The methodology used for calculating the shock effects is to estimate the net cash flows. For each scenario, at each stress level, the bank identifies cash inflows and outflows that can be expected to occur in each future time period and the resulting net cash flows. iv. Liquidity risk arises from both the liability side and asset side. Both are considered when identifying liquidity risk

41 drivers. The liability side includes diminishing ability to raise new funding, failure to roll over liabilities and withdrawal risk (e.g. unforeseen withdrawal of deposits). The asset side (on– and off-balance sheet) includes the unexpected utilisation by customers of committed credit lines, back-up/stand-by facilities and other lending facilities. In asset side scenarios declines in market liquidity and/or value of liquid assets may also have to be taken into account as they determine the amount of liquidity a banking institution is able to generate from them. Asset side shocks could also cause declines in asset values which might lead to liquidity stress through margin calls (when those assets are pledged).In each scenario at each stress level there are two types of cash flows that can be expected to occur, the contractual cash inflows and outflows, either discretionary or non-discretionary, e.g. liquidity drains from margin calls and required posting of collateral; and the cash inflows and outflow resulting from customer behaviour. They may also cover the following, where applicable: a. impact of covenants; b. impact of non-contractual liquidity support (reputation linked); c. impact of liquidity back-up/stand-by facilities. v. By summing up all the cash flows a bank may end up with the forecast liquidity requirement for each time period in each scenario at each stress level. It may then calculate the net cash flow for each time bucket in each scenario at each

42 stress level. This is the amount by which the forecast cash inflows exceed (or fall short of) the forecast outflows. vi. Potential liquidity gaps are identified and quantified through liquidity stress testing in specified stress scenarios, as well as means of closing those gaps and the funding cost. The liquidity gaps are created by loss of available funding (e.g. reduction in deposits) and/or increased demand for liquidity (e.g. funding contingent liabilities). The bank may define the different ways at its disposal to close those gaps according to the scenario contemplated (unsecured funding if assumed to be available, secured funding). Changes of business structure like reducing credit expansion may be contemplated for long-lasting stress scenarios depending on the business model of the bank. In each case the funding cost is an important parameter. vii. Three types of stress scenarios are expected to be applied: a. specific, b. market-wide, and c. a combination of the two. The specific stress might assume no rollover of unsecured wholesale funding and some outflows of retail deposits. viii. The market-wide stress might assume a decline in the liquidity value of some assets and deterioration in funding market conditions. In addition, market stress scenarios can involve market disruptions or changes in the macro-

43 economic environment in which the bank is operating, or the downgrading of countries in which the banking is operating. ix. To provide a complete view of the various risk positions, stresses testing of other risks are considered in constructing ‘alternative liquidity scenarios’. x. Banks increasingly rely on funding sources that are more sensitive to interest rate, market, credit, and reputation risks. Therefore, in assessing stress testing scenarios the impact of other risks on liquidity risk may be considered. As these other risks can generate liquidity drains (through increased funding costs or through margin calls or required posting of collateral, for example), sound management of these risks helps but does not provide sufficient liquidity risk mitigation. xi. Furthermore, assumptions used when constructing liquidity stress scenarios should be proportionate with other risks’ stress scenarios (results and assumptions). As, when other risks materialise, they usually have an impact on the liquidity position of a bank and so it is necessary to acknowledge the assumptions and results of other risks’ specific stress testing to attain a coherent system of stress tests. In particular the impact of market risk on assets value, credit risk on assets value and expected cash flows and reputation risk can be appropriately incorporated into all liquidity stress scenarios.

44 xii. To the extent that liquidity risks may derive from other sources of risk positions, ‘alternative liquidity scenarios’ may be designed in liaison with other risks. When other risks materialise, they may impact the liquidity position of a bank. Those spill-over effects may be analysed and measured within a globally consistent stress test framework. As an example, the impact of market risk on asset value, credit risk on asset value and expected cash flows and reputation risk may be appropriately incorporated into liquidity stress scenarios. Another example is when a bank relies on funding sources that are sensitive to interest rate, market, credit, and reputation risks. xiii. A survival period of at least one month is applied in specifying the chosen stress scenarios. Within this period, a shorter time horizon of at least one week may also be considered to reflect the need for a higher degree of confidence over the very short term. The time period considered may be divided into two phases: a short acute phase of stress (for example, up to one or two weeks for specific risks in order to cover such periods without having to change the business model) followed by a longer period of less acute but more persistent stress (for example, up to one or two months for more general liquidity risk). This approach has the merit of looking at different levels of severity for the stress scenarios. Beyond these basic time horizons, longer time horizons may be considered (for

45 example, 1 year to cover the structural liquidity position) and alternative remedial measures such as a contingency funding plan, activity adjustment, business model change, etc. xiv. A set of behavioural assumptions may have to be designed for each different scenario and time horizon. The behaviour of depositors and funds providers will be driven by several factors influencing their actions with regard to the specific bank. The degree to which these factors will result in withdrawal or withholding of funds is determined by their sensitivities to the perception of the soundness of the bank. This behaviour can be analysed and some assumptions can be made when constructing the stressed liquidity scenarios. xv. The basic impact of the liquidity shock is on the net cash flow. However, the analysis may be extended to other metrics, such as liquidity ratios, liquidity buffer. Although net cash flows is the basic measure for liquidity stress testing, the impact may be extended. The bank may have to continue the analysis by calculating the effect on its liquidity ratios and liquidity buffer. The liquidity ratios can be simple liquidity ratios (e.g. loans/deposits) or more complicated supervisory liquidity ratios. Thus the liquidity ratios should comply with regulatory minima after the conduct of the stress test exercise. xvi. When conducting liquidity stress testing exercises on a consolidated basis, possible strains on transfers of liquidity

46 among the entities in the group are considered and may have to be incorporated into the relevant scenarios. xvii. All-in-all, the results of the stress tests can provide input into adjusting and improving liquidity risk management, including internal policies, limits and contingency funding plans. xviii. Interest rate risk from non-trading activities For the purposes of these annexes, interest rate risk is the exposure of banks’ positions to adverse movements in interest rates. For the purposes of this Annex, positions in the banking book only are considered, as positions in the trading book are considered as an element of market risk and subject to the market risk stress tests. Interest rate risk includes current and future effects on the bank’s earnings and capital. xix. All sources of interest rate risk in the banking book are relevant for stress testing interest rate risk in the non￾trading book, namely,` re-pricing risk, yield curve risk, basis risk and option risk. However, the purpose of this annex is to demonstrate that a simple parallel shift may not suffice. Therefore, banks may have to consider movements and changes in the shape of their yield curves in their scenario analysis, as a non-parallel shift in the curve can entail additional declines in both the net interest income and the economic value of a bank.

47 xx. Basis risk is an important aspect of interest rate risk. Basis risk can arise from mismatching between funding and investments with regard to a reference interest rate, despite the funding and investments being matched in terms of time. xxi. In adverse situations, the holder of an embedded option may make use of the right to terminate the contract early, which can force the bank into a new transaction on less favourable terms. xxii. The complexity of interest rate risk varies from bank to bank with regard to the sophistication of the financial instruments used. Where less complex financial instruments are employed, the effect of a shock can be calculated by the bank using sensitivity analysis (without identification of the origin of the shock, and by means of the simple application of the shock to the portfolio). Where a bank uses more complex financial instruments on which the shock has multiple and indirect effects, it should use more advanced approaches with specific definition of the adverse (stress) situations. 8.1.5 Concentration Risk i. Considerations affecting concentration risk (both intra￾and inter-risk) are an important part of the stress testing framework, since stress tests can be helpful in revealing

48 interrelationships between risk drivers and their impact on a bank under adverse economic conditions. ii. Stress testing is a key tool in the identification of concentration risk. Such analysis, like concentration risk management, is most useful when it is performed on a bank-wide basis and is able to transcend business unit or risk type focus on concentrations, to which it can be a useful complement. iii. In addition, stress testing would allow banks to identify interdependencies between exposures, which may only become apparent in stressed conditions as well as hidden concentrations, even though the probability of such adverse scenarios is significantly low. iv. In stress testing, especially bank-wide stress testing, banks could identify risk concentrations taking into account single risk concentrations and interrelated risk types considering on- and off-balance sheet exposures, as well as banking, trading and hedging positions. v. Stress tests are expected to take into account changes in the business environment that may occur which would lead to risk concentrations materialising. In particular, stress tests may consider unusual but plausible changes in correlations between various types of risk drivers as well as extreme and unusual changes in risk parameters, going beyond single risk drivers or risk types, to look at scenarios that take account of interrelated risk drivers and that feature not only first round effects but also feedback effects.

49 vi. The link between a macro-economic scenario and the impact on a particular concentrated risk factor, such as geographic region or industry sector can be identified. The way in which concentrated exposures perform in response to the same risk drivers may be factored into the stress tests, including the risk of short-term large increases in losses as a result of concentrated exposures across, say, the retail and corporate credit books or across different entities in a group. vii. Banks would also consider inter-risk concentrations, aggregating across risk types notably market and credit risk, to gain a better understanding of their potential credit, liquidity and trading book risk concentrations in a stress. Banks may identify potential links between exposures and question assumptions about correlations between risk types in a stress. viii. Banks may have to consider these correlations in extreme events and question what confluence of events could lead to correlations of such magnitude that they would threaten the viability of the bank. It is in this regard that banks may have to consider the use of reverse stress testing that would allow them to test the plausibility of the assumptions that have been made for main case business planning. Analysis of unlikely but still plausible events that lead to unusual correlations allows the bank to consider in its risk analysis and mitigation programme. ix. Stress tests are expected to be performed both on a solo basis for individual legal entities in order to take account of potential risk concentrations specific to local markets,

50 as well as on the type of concentrations that can materialise at group level. The results of concentration risk stress tests could be communicated within the bank and used in decision making processes and limit setting as part of concentration risk management.

51 8.2 Annex 2: Guidance On Stress Testing Methodologies The most common stress-testing techniques involve the determination of the impact on the portfolio of a bank or business unit of an assumed move in a particular risk factor (a simple sensitivity test) or of a simultaneous move in a number of risk factors, reflecting an exceptional but plausible event that the bank believes may occur in the foreseeable future (scenario analysis) or identifies events that could threaten the viability of the bank (reverse stress testing). i. Sensitivity Tests – A sensitivity analysis isolates the short-term impact on a portfolio’s value of a series of predefined moves in a particular risk factor or set of closely related risk factors (such as a yield curve) without specifying the reasons for such movements. Sensitivity tests are used by senior managers in a number of banks to form a first approximation of the impact on the firm of a move in a financial variable. They are widely used at the trading desk and business line level. Sensitivity tests can reflect the subjective views of risk managers about plausible changes in risk factors. Alternatively, sensitivity tests can be based on standardized shocks. Drawbacks – the analysis lacks historical and economic content thereby limiting its usefulness for longer term risk management decisions. In addition, a single factor shock lacks plausibility, because when a stress event occurs, it would be rare that only a single risk factor would be affected.

52 ii. Scenario Analysis – It is currently the leading stress testing technique. It seeks to assess the potential consequences for a firm of an extreme, but possible, set of circumstances. It specifies the shocks that might plausibly affect simultaneously a number of risk factors (e.g. non-performing loans, equity prices, foreign exchange rates or interest rates) if an extreme, but possible, event occurs. Risk managers identify a portfolio’s key risk drivers and then formulate scenarios in which these drivers are stressed beyond standard or expected levels. The scenarios are developed either by drawing on a significant event experienced in the past (historical scenarios) or by thinking through the consequences of a plausible event that has not yet happened (hypothetical scenarios). It is also common to develop scenarios that are informed by historical movements but are not necessarily linked to a specific event (hybrid scenarios). The usefulness of the scenarios is enhanced when they are run at periodic intervals, allowing the firm’s exposure to be tracked over time. iii. Historical Scenarios – they reflect shocks that occurred in real life. For example, days in the past that were “stressful” are identified, and the observed changes in risk factors on those days define the stress event, e.g. the large stock market declines of October 1987, the bond market declines of 1994, the finance crisis of 2007-2008, among others. Historical scenarios have a number of advantages that arise from the fact that they reflect an actual stressed market environment.

53 Drawbacks – Banks may (consciously or unconsciously) structure their risk-taking to avoid losing money on shocks that have occurred in the past, rather than anticipating future risks that do not have a precise historical parallel. Also, the number of usable historical scenarios is limited, because stress events are rare by definition. It may be difficult to apply to products that did not exist at the time of the historical event in question or to risk factors whose behaviour has changed in a significant way since that event. Historical scenarios may not be comparable to current risks or may not reflect the new ways in which financial risk is being packaged. iv. Hypothetical Scenarios –Hypothetical scenarios use a structure of shocks thought to be plausible in some foreseeable, but unlikely, circumstances for which there is no exact parallel in recent history. Examples include testing the potential impact of the Y2K bug, the adoption of the euro as the common currency for the euro area in 1999 and the sub-prime crisis in the U.S, before these events took place. Another example is stress testing the implications of a potential outbreak of avian flu virus. A key advantage is that they allow risk managers to challenge the common tendency to pay more attention to past events than to future dangers. Drawbacks – The task of specifying a fully articulated and sensible hypothetical scenario is immense. For example, in some cases, thousands of different market prices and rates are used to value positions in a financial bank’s trading portfolio. Specifying how each market risk factor behaves during the

54 stress event can be an enormous task. Another drawback is the trade-off between realisms and comprehensibility. The more fully articulated the scenario is the more complicated and less comprehensible the contents may become. v. Hybrid Scenarios - Scenarios that are informed by historical market movements but are not necessarily linked to a specific event. vi. Reverse Stress Testing - Identifies situations that threaten the viability of the bank, e.g. how large do loan-losses have to be in order to wipe out the capital buffers? It is easy to explain and communicate results.

55 8.3 Annex 3: Guidance On Good Stress Testing The goal of stress testing is to uncover potential risks and concentrations of risks and make them more transparent. Good stress tests should therefore: a) be relevant to current exposures - A concentrated portfolio with large risks may incur substantial losses from relatively small movements in certain risk factors. b) consider changes in all relevant risk factors - Stress scenarios should consider all potential changes in a complete set of risk factors. A stress scenario in isolation does not reflect reality, as risk factors don’t move in isolation (especially when they are extreme).examine potential structural changes - A key question in developing a stress scenario is whether current risk parameters will hold or break down under extreme conditions. It is key to know if observed correlations hold or increase, or to what extent a structural change (i.e. decoupling of risk factors) could occur. For example, during large equity shocks (e.g. the 1987 crash, the 1997 and 1998 sell-offs), and the 2007 – 2008 financial crisis a flight to safety often results in a reversal of the normally highly positive correlation between stocks and government bonds: as stocks plummet, bonds rise because investors move into safer and more liquid assets. In the market turmoil of September 1998, LTCM experienced this problem when credit spreads widened and interest rates fell due to a flight to safety. c) consider market illiquidity - Stressed markets are often characterized by material loss of liquidity. Liquidity can be

56 viewed from two perspectives: the ability to trade positions without moving the prices and the ability to fund positions. d) consider the interplay of market and credit risk - Stressed markets often give rise to counterparty exposures that may be much more significant than pure market impacts. While market rates and creditworthiness are unrelated for small market moves, large market movements could precipitate credit events, and vice versa.

57 8.4 Annex 4: Elaboration On Use Of Stress Tests i. Stress tests used to understand the risk profile of a bank Banks use stress tests to better understand their own risk profiles. A stress test of a corporate customer, for example, may reveal exposures which at the individual business unit level are not significant, but which, in aggregate, may have a large negative effect on the overall business. Alternatively, it may highlight off-setting positions in other parts of the business. ii. Stress tests used for capital allocation or verification Stress testing may be used by senior management as a basis for making informed decisions about how much risk they are willing to take and identifying where the vulnerabilities in their portfolios actually lie. Such stress tests help to evaluate their tolerance for risks - at both the bank and division level - and understand the combinations of risks that can produce large losses. This is then being linked, both directly and indirectly, to capital allocations. iii. Stress tests used to evaluate the business risk One of the innovations in stress testing is its application to business plans. In some financial banks, a stress event is looked at in the context not only of changes in the value of on and off￾balance sheet items of the firm, but also of the effect that it has on revenue sources over subsequent years. This overlay assists management in deciding whether this type of event is a threat to their underlying business and whether the

58 capital supporting the business is appropriate. In some cases, for example, banks are testing the effect on their profitability of a long period of low interest rates.

59 8.5 Annex 5: An Illustration Of How To Develop Stress Scenarios Risk Category Stress Scenarios Magnitude 1.Credit Risk 1.1 Default of large borrowers 1.2 Sector shocks:

• Energy price shock

• Agricultural shock 1.3 Other shocks to NPL and provisions 1.4 Sensitivity analysis - NPL and provisions 1 st to 8th largest becoming NPL X% provisioning rate X% of loans in sector becoming NPL

• Construction, trade, manufacturing and other sectors X% of loans in sector becoming NPL

• Agriculture, trade, manufacturing and other sectors

60 X% provisioning rate X% increase in NPL from existing NPL X% provisioning rate New level of NPL is X% of total loans X% provisioning rate 2. Liquidity Risk 2.1 Withdrawal of deposits X% withdrawal of deposits per day (for 1 to 5 days) 3. Exchange rate (FX) risk 3.1 Direct FX risk (on net FX positions) 3.2 Indirect FX risk (credit risk) (3.3 Decline in income from FX activities) X% depreciation (or appr.) of MKW X% of FX loans becoming NPL X% provisioning rate X% decline in income from FX trading 4. Interest rate risk 4.1 Direct interest rate risk 4.2 Indirect interest rate risk (4.3 Decline in net interest income) X% change in nominal interest rate (no separate lending/deposit rate) No function for this in spread sheet X% decline in net interest income 5. Equity risk 5.1 Decline in value of local held stocks X% decline in nominal value

61 5.2 Decline in value of other securities X% decline in nominal value 6. Interbank contagion 6.1 Domestic banks’ not able to repay interbank loans Failure of Bank X as a result of… 7. Combination of shocks 7.1a One of the four credit shocks 7.1b Liquidity shock 7.1c Exchange rate shock 7.1d Interest rate shock 7.1e Equity shock 7.2a Shock to net interest income 7.2b Shock to FX trading income 7.3 Combination of all shocks Effect on key banking figures, including Tier 1 ratio Effect on Tier 1 ratio and ROA Effect on key banking figures