ICAAP Guidelines

RESERVE BANK OF MALAWI
GUIDELINES ON INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS (ICAAP) Bank Supervision Department March 2013

Table of Contents
1.0 INTRODUCTION ............................................................................................ 2
2.0 MANDATE ...................................................................................................... 2
3.0 RATIONALE ................................................................................................... 3
4.0 OBJECTIVES ................................................................................................... 3
5.0 DEFINITIONS ................................................................................................. 3
6.0 SCOPE OF ICAAP APPLICATION ............................................................... 4
7.0 THE ICAAP FRAMEWORK .......................................................................... 4
7.1 Board and Senior Management Oversight .................................................... 5
7.2 Sound Capital Assessment ............................................................................ 6
7.3 Comprehensive Risk Management Policies and Procedures ........................ 8
7.4 Monitoring and Reporting ............................................................................. 9
7.5 Internal Control Review ..............................................................................11
7.6 Quantitative and Qualitative Approaches in ICAAP ..................................12
7.7 Stress tests and scenario analyses ................................................................12
7.8 ICAAP Methodologies ................................................................................13
7.9 Reporting Requirements to the Registrar ....................................................13
8.0 APPENDICES ................................................................................................13
8.1 Appendix 1: ICAAP Document (suggested format) ...................................13
8.2 APPENDIX 2: ALTERNATIVE ICAAP METHODOLOGIES ................21

1.0 INTRODUCTION
The Basel II framework, under Pillar II, requires that banks have an Internal Capital Adequacy Assessment Process (ICAAP) to assess their overall capital adequacy in relation to their risk profile, and strategy for maintaining capital levels. Thus, under the Framework, bank management has the responsibility to develop an ICAAP, and set capital targets that are commensurate with the bank’s individual circumstances and needs, taking into account the bank's risk profile, control environment and level of sophistication of its operations. The Registrar of Financial Institutions (Registrar) bears the responsibility of evaluating bank's ICAAPs and their capital adequacy through the Supervisory Review Process (SRP), the results of which will be taken into account in determining the bank's minimum Capital Adequacy Ratio (CAR). The guidelines therefore, seek to provide guidance on how a bank should establish, operate and maintain its ICAAP, and define the expectations of the Registrar with regard to implementation of the ICAAP. These guidelines apply to all banks licensed under the Financial Services Act, 2010.
2.0 MANDATE
This document sets out guidelines issued under Section 96 of the Financial Services Act 2010. The Guidelines may be cited as Internal Capital Adequacy Assessment Process (ICAAP) Guidelines. These guidelines shall apply to all banking institutions licensed under the Banking Act, 2010 in

Malawi. The purpose of this document is to provide guidance on how a bank should establish, operate and maintain its ICAAP.
3.0 RATIONALE
A bank is expected to have an ICAAP, in order to effectively assess its overall capital adequacy in relation to its risk profile. Its chosen internal capital targets should be well founded and consistent with its overall risk profile and current operating environment.
4.0 OBJECTIVES
a) To ensure that banks put in place a consistent approach, process, and methods for proactive internal capital planning, capital adequacy assessment, and maintenance of adequate capital. b) To ensure that banks undertake risk-based capital allocations in relation to all material risks.
5.0 DEFINITIONS
For purpose of these Guidelines, the following definitions shall apply:
“Act” - means the Banking Act 2010
“bank” – means banking institution as defined in Section 1 of the Banking Act 2010.

"Financial Group" - i.e. means a group of financial insitutions as defined in
section 1 of the Financial Services Act 2010.
6.0 SCOPE OF ICAAP APPLICATION
The ICAAP must be prepared on a solo basis for each bank. For banks within a banking group, it must be prepared on a solo basis for each bank, and for the consolidated banking group.
7.0 THE ICAAP FRAMEWORK
The Registrar will not prescribe the format of the ICAAP; as such, a bank should design its own ICAAP to cater for its individual circumstances and needs. However, at a minimum the ICAAP should incorporate the following main features:
a) Board and senior management oversight; b) Sound capital assessment; c) Comprehensive risk management policies and procedures; d) Monitoring and reporting; e) Internal control and review; f) Quantitative and qualitative approaches in ICAAP; g) Stress testing and scenario analysis; h) Methodologies; and i) Reporting requirements to the Registrar.

7.1 Board and Senior Management Oversight
The board of directors and senior management of a bank have primary responsibility for ensuring that the bank has adequate capital to support its risks, operate as a going concern and provide for business growth. In addition, the board and senior management of a bank should view capital planning and capital management as crucial elements in achieving the bank’s strategic objectives. The board and senior management should; a) Establish a capital management policy which, at a minimum, includes:
i. The bank’s current and future capital requirements in relation
to its strategic objectives;
ii. Approved capital targets, consistent with the bank’s tolerance
for risks;
iii. Measures that would be taken in the event capital falls below
statutory/targeted levels;
iv. An outline of the bank’s capital needs, anticipated capital
expenditures, desirable capital level, and external capital sources; b) Maintain other policies that supplement the capital management policy and ensure that management effectively communicates these throughout the organisation;

c) Develop internal control systems to effectively monitor compliance with regulatory capital standards and internal policies. The ICAAP should form an integral part of bank’s risk management processes to enable the board and senior management assess, on an on-going basis, the effects on capital arising from material risks inherent in the bank’s activities. This could range from using the ICAAP in more general business decisions (e.g. expansion plans) and budgets, to more specific decisions such as allocating capital to business units or credit decision processes.
7.2 Sound Capital Assessment
The ICAAP should at least possess the following characteristics:
a) Be risk-based, i.e. capital targets should be consistent with the risk profile and operating environment of the bank, with adequate focus on management of those risks which are less readily quantifiable; b) Be comprehensive enough to cover Pillar 1 risks, Pillar 2 risks (e.g. interest rate risk in the banking book, concentration risk, liquidity risk, reputation and strategic risk), and risk factors external to the bank (e.g. those that may arise from the regulatory, economic or business environment); c) Be forward- looking and take into account factors such as changes in the bank’s strategic plans. It is important for both the board and

senior management to examine a bank’s current and future capital requirements in relation to its strategic business objectives. The strategic plan should clearly delineate the bank’s near- and longer￾term capital needs, capital expenditures required for the foreseeable future, target capital levels, and external capital sources. Capital planning and budgeting should be a key feature in the strategic planning process. d) Be appropriate for a range of business conditions at different points in the business cycle. The bank should also perform rigorous and forward-looking stress tests that identify plausible severe loss events or adverse changes in market conditions, and assess their impact on the bank’s capital adequacy. e) Be formally documented, reviewed and approved by the board of directors and senior management of the bank; f) Produce a reasonable estimate of overall capital required and the bank should be able to explain to the Registrar, strategies to address any deficiencies in the actual capital compared to the estimated ICAAP figure, g) Be reviewed at least annually to ensure that risks are adequately covered and that capital reflects the risk profile of the bank.

h) Take into account bank’s strategic plans and how they relate to macro economic factors. The bank should develop an internal strategy for maintaining capital levels, which can incorporate factors such as loan growth expectations, future sources and uses of funds, dividend policy, and pro-cyclical variation of minimum regulatory capital requirements. Conversely, the results and findings of the ICAAP should feed into bank’s evaluation of its strategy and risk appetite. i) Banks should also have an explicit, board-approved capital plan which states their objectives and the time horizon for achieving those objectives, and in broad terms the capital planning process and the responsibilities for that process. The plan should also lay out how banks will comply with capital requirements in the future, any relevant limits related to capital, and contingency plan for dealing with divergences and unexpected events (for example, raising additional capital, restricting business, or using risk mitigation techniques).
7.3 Comprehensive Risk Management Policies and Procedures
The policies and procedures to identify, measure and report the risks faced by a bank in the conduct of its activities should meet the following standards:
a) Risk measurement systems should be comprehensive and rigorous to capture the nature and magnitude of the risks faced by the bank;

b) Adequate controls should be in place to ensure objectivity and consistency of risk identification, measurement, and that all material risks are addressed; c) Risk measurement techniques should be accurate and based good quality data; d) Qualitative assessment and management judgment should be used for risks that are not easily quantifiable; e) Changes in the risk profile of the bank should be promptly incorporated into the risk measures; and f) Stress tests should be conducted to assess the impact of possible adverse events on the bank’s capital.
7.4 Monitoring and Reporting
The bank should establish an adequate system for monitoring and reporting risk exposures and assessing how it's changing risk profile affects the need for capital. The bank should have adequate systems to ensure that reports on its risk profile and capital needs are submitted to senior management or board of directors on a regular basis. These reports should allow senior management to:

a) Evaluate the level and trend of material risks and their effect on capital levels; b) Evaluate the sensitivity and reasonableness of key assumptions used in the capital assessment measurement system; c) Determine whether the bank holds sufficient capital against the various risks and is in compliance with established capital adequacy goals; and d) Assess its future capital requirements based on the bank’s reported risk profile and make necessary adjustments to the bank’s strategic plan accordingly. The ICAAP should be reviewed by the board and senior management at least annually, or as often as is deemed necessary to ensure that risks are covered adequately and that capital level reflects the actual risk profile of their bank. Moreover, any changes in a bank’s strategic focus, business plan, operating environment or other factors that materially affect assumptions or methodologies used in the ICAAP should initiate appropriate adjustments to the ICAAP. New risks that occur in the business of a bank should be identified and incorporated into the ICAAP. The ICAAP and its review process should be subject to independent internal or external review. Results thereof should be communicated to the board and senior management.

7.5 Internal Control Review
The bank’s internal control review is essential to the capital assessment process. Effective control of the capital assessment process includes an independent review by either internal or external audits. The bank should conduct periodic reviews of its risk management process to ensure its integrity, accuracy, and reasonableness. The frequency of the review and audit may vary depending on the size and complexity of individual banks but should be at least annually. Areas that should be reviewed include at a minimum:
a) Appropriateness of the bank’s capital assessment process given the nature, scope and complexity of its activities; b) Identification of all risks under Pillar I and Pillar II; c) Accuracy and completeness of data inputs into the bank’s assessment process; d) Reasonableness and validity of scenarios used in the assessment process; and stress testing and analysis of assumptions and inputs. Any deficiencies in the ICAAP and non-compliance with internal policies and/or minimum capital requirements must be reported to the board of directors for timely rectification.

7.6 Quantitative and Qualitative Approaches in ICAAP
To assess overall capital adequacy, banks should not only consider quantitative techniques, but also include elements of qualitative assessment or management judgment of both capital model inputs and outputs. For Pillar I risks, banks shall use quantitative techniques in the measurement of their capital requirements, as per the respective guidelines issued by the Registrar. However, for Pillar II and other risks, both quantitative and quantitative approaches shall be used. Banks are likely to ascertain that some risks they face are easier to quantify than others. An ICAAP can hence involve a mixture of rigorous risk-capital estimates and more judgment-based estimates. Risks should be included if they are material, even if they are hard to quantify. However, there could be a trade-off between the importance of allocating capital to such risks, and the robustness of the bank’s approach to mitigating and managing these risks.
7.7 Stress tests and scenario analyses
The bank should, at a minimum, conduct relevant stress tests periodically, particularly in respect of it's material risk exposures, in order to evaluate it's potential vulnerability to unlikely but plausible events or movements in the market conditions that could have an adverse impact. The use of stress testing can provide a bank with a

better understanding of its likely exposure in extreme circumstances. In this context, refer to Registrar’s Stress Testing Guidelines.
7.8 ICAAP Methodologies
Banks may use simple or model-based ICAAP methodologies (please see Appendix 2 for description of the different broad classification of methodologies). However, at a minimum, the Registrar expects banks to adopt an ICAAP based on the minimum regulatory capital requirement under the Framework.
7.9 Reporting Requirements to the Registrar
The ICAAP document should be approved by the board, and submitted to the registrar once a year, not later than 120 days after the financial year end.
8.0 APPENDICES
8.1 Appendix 1: ICAAP Document (suggested format)
The RBM expects that there would be a fair degree of variation in the length and format of submissions since banks’ business and risk profiles differ. As such the ICAAP document should be proportional to the size, nature and complexity of a bank’s business. This format has been provided as a starting point. Banks are not obligeed to adopt this format. However, adopting this format may be convenient for banks as it covers the minimum issues which typically would be the subject of review by the RBM and may therefore make the review

process more efficient for both the bank and the RBM. Equally, use of this template is not a substitute for being aware of the relevant rules. What is an ICAAP document? An ICAAP document is a bank’s explanation to the RBM of its internal capital adequacy assessment process. While this may be based on existing internal documentation from numerous sources, the RBM will clearly find it helpful to have a summary prepared to communicate the key results and issues to it at a senior level. Since the RBM will be basing many of its views on the information contained in the ICAAP document, the bank’s Board of Directors and senior management should have formally approved its contents. As such, the RBM would expect the ICAAP document to be in a format that can be easily understood at a high level and to contain all the relevant information that is necessary for the bank and RBM to make an informed judgment and decision as to the appropriate capital level and risk management approach. Where appropriate, technical information on risk measurement and capital methodologies, and all other works carried out to validate the approach (e.g. board papers and minutes, internal or external reviews) could be contained in appendices.

1. Executive Summary
   The purpose of the Executive Summary is to present an overview of the ICAAP methodology and results. This overview would typically include:

i. The purpose of the report and which group entities are covered by
the ICAAP;
ii. The main findings of the ICAAP analysis:

• How much and what composition of internal capital the bank
  considers it should hold as compared with the capital adequacy requirement under the existing RBM Risk-Based Capital Adequacy Framework and
• The adequacy of the bank’s risk management processes given
  the risks assumed;
  iii. A summary of the financial position of the business, including the
  strategic position of the bank, its balance sheet strength, and future profitability;
  iv. Brief descriptions of the capital and dividend plan; how the bank
  intends to manage capital going forward and for what purposes;
  v. Commentary on the most material risks, why the level of risk is
  acceptable or, if it is not, what mitigating actions are planned;
  vi. Commentary on major issues where further analysis and decisions
  are required; and
  vii. Who has carried out the assessment, how it has been challenged,
  and who has approved it.

2. Background
   This section could cover the relevant organizational structure and business lines, and historical financial data for the bank, e.g., group structure (legal and operational), operating profit, profit before tax,

profit after tax, dividends, equity, capital resources held and as compared with regulatory requirements, total loans, total deposits, total assets, etc., and any conclusions that can be drawn from trends in the data which may have implications for the bank’s future.
3. Capital Adequacy
This section could start with a description of the risk appetite used in the ICAAP. It is vital for the RBM to understand whether the bank is presenting its view regarding: 1) the amount of capital required to meet minimum regulatory needs, or 2) the amount of capital that a bank believes it needs to meet its business objectives (e.g., whether the capital required is based on a particular desired credit rating, or includes buffers for strategic purposes, or minimizes the chances of breaching regulatory requirements). A description of the methodology used to assess the bank’s capital adequacy should also be included. The section would then include a detailed review of the capital adequacy of the bank. The information provided would include:
Timing
i. The effective date of the ICAAP calculations together with
consideration of any events between this date and the date of submission which would materially impact the ICAAP calculation together with their effects; and
ii. Details of, and rationale for, the time period over which capital has
been assessed.

Risks analyzed
i. An identification of the major risks faced in each of the following
categories:

• credit risk,
• market risk,
• interest rate risk in the banking book,
• liquidity risk,
• operational risk,
• compliance risk,
• strategic/business risk, and
• reputation risk;
  ii. And for each, an explanation of how the risk has been assessed
  and, where appropriate, the quantitative results of that assessment;
  iii. Where relevant, a comparison of that assessment with the results of
  the assessment under the Framework (specifically for credit risk, market risk, and operational risk);
  iv. A clear articulation of the bank’s risk appetite by risk category if
  this varies from the assessment; and
  v. Where relevant, an explanation of any other methods apart from
  capital used to mitigate the risks.
  The discussion here would make clear which additional risks the bank considers material to its operation and, thus, would warrant additional capital on top of that required for credit risk, market risk, and operational risk under the Framework.

Methodology and assumptions
A description of how assessments for each of the major risks have been approached and the main assumptions made. At a minimum, the RBM expects banks to base their ICAAP on the results of the capital adequacy requirement under the Framework and additional risks, where applicable, should be assessed separately. Capital transferability Details of any restrictions that may curtail the management’s ability to transfer capital into or out of the business(es) covered, for example, contractual, commercial, regulatory or statutory restrictions that apply.

4. Current and Projected Financial and Capital Positions
   This section would explain the current and expected changes to the business profile of the bank, the environment in which it expects to operate, its projected business plans (by appropriate lines of business), and projected financial position for, say three to five years. The starting balance sheet and date as of which the assessment is carried out would be set out. The projected financial position might consider both the projected capital available and projected capital resource requirements to support strategic/business initiatives. These might then provide a

baseline against which adverse scenarios (please see Capital Planning below) might be compared. Given these business plans, this section would also discuss the bank’s assessment on whether additional capital is necessary on top of that assessed to cover their existing risk exposures, as well as future planned sources of capital.
5. Capital Planning
This section would explain how a bank would be affected by an economic recession or downswings in the business or market relevant to its activities. The RBM is interested in how a bank would manage its business and capital so as to survive a recession/market disruption while meeting minimum regulatory standards. The analysis would include financial projections forward for, say, three to five years based on business plans and solvency calculations. Likewise, a bank should disclose here the key assumptions and other factors that would have significant impact on its financial condition, in conducting scenario analyses/stress testing. Typical scenarios would include how an economic downturn/market disruption would affect:
i. the bank's capital resources and future earnings, and
ii. the bank’s capital adequacy requirement under the Framework
taking into account future changes in its projected balance sheet.

It would also be helpful if these projections showed separately the effects of management potential actions to change the bank's business strategy and the implementation of contingency plans. In addition, banks are encouraged to include an assessment of any other capital planning actions that would be necessary to enable it to continue to meet its regulatory capital requirements throughout a recession/market disruption such as new capital injections from related companies or new share issues. Given the projected capital needs arising from an economic recession or business/market downswings, this section would also discuss the bank’s assessment on whether additional capital is necessary on top of that assessed to cover their existing risk exposures and business plans.
6. Challenge and adoption of the ICAAP
This section would describe the extent of challenge and testing of the ICAAP. Banks should describe the review and sign-off procedures used by senior management and the board. It might also be helpful if a copy of any relevant report to senior management or the board and their response were attached. Details of the reliance placed on any external suppliers would also be detailed here, e.g. for generating economic scenarios.

In addition, a copy of any report obtained from an external reviewer or internal audit would also be included.
7. Use of the ICAAP within the Bank
This section would describe the extent to which capital management is embedded within the bank including the extent and use of scenario analysis and/or stress testing within the bank's capital management policy, e.g. in business decisions (e.g. expansion plans) and budgets, or in allocating capital to business units, or in individual credit decision process. Banks should include a statement of the actual operating philosophy on capital management and how this links to the ICAAP. For instance differences in risk appetite used in the ICAAP as compared to that used for business decisions might be discussed. Lastly, it would be helpful if details on any anticipated future refinements within the bank’s ICAAP (highlighting those aspects which are work-in-progress), as well as any other information that would help the RBM review the bank’s ICAAP could be provided.
8.2 APPENDIX 2: ALTERNATIVE ICAAP METHODOLOGIES
This appendix outlines ICAAP methodologies which banks may adopt in lieu of that based on the minimum regulatory capital requirement under the RBM Risk-Based Capital Adequacy Framework. However, the choice of methodology should clearly be commensurate with banks’ ability to collect the necessary information and to calculate the necessary inputs in a reliable manner.

Structured approach – In this case, banks will need to set the internal capital requirement at a starting point of zero capital and then build on capital due to all risks (both those captured under the Framework and those that are not) and external factors. This methodology could be seen as a simple model for calculating economic capital and is not based on the minimum regulatory capital requirement. A sensitivity analysis could form the starting point. The sensitivity analysis should be based on an exceptional but plausible scenario. Risks which are not included in the sensitivity analysis should also be considered in terms of the structured approach. Allocation-of-risk-taking approach – In this approach, banks might start with its actual capital and break it down to all its material risks. This step in the process requires quantification or at least an estimation method for various risks. The amount of capital provided for each risk category is determined by the current and envisaged amount of risk in each category, a risk buffer and their risk appetite. Banks will decide which type of risk quantification/estimation method is suitable and sufficient for its particular use. If the allocated capital seems insufficient, either the risk has to be reduced or capital has to be raised. The allocated amounts of the capital will therefore work as a limit system, which assists and facilitates banks in balancing their risk-taking capacity and their risks.

Formal economic capital models – These are expected to be used eventually by banks that use advanced approaches in determining the minimum regulatory capital requirement, or those that have substantial derivatives and structured products transactions (i.e., those that have expanded dealer authority). For further enquiries please contact:
The Director
Bank Supervision
Reserve Bank of Malawi
P. O. Box 565
Blantyre
Tel: +265 (0) 1 820 299/444
Fax: 265 (0) 822 118
Email: basu@rbm.mw