IFSB Guiding Principles on Stress Testing for Islamic Financial Institutions

i EXPOSURE DRAFT-13 GUIDING PRINCIPLES ON STRESS TESTING FOR INSTITUTIONS OFFERING ISLAMIC FINANCIAL SERVICES [OTHER THAN ISLAMIC INSURANCE (TAKĀFUL) INSTITUTIONS AND ISLAMIC COLLECTIVE INVESTMENT SCHEMES] Comments on this Exposure Draft should be sent to the IFSB’s Secretariat not later than 12 January 2012 at email ifsb_sec@ifsb.org or facsimile +603-9195 1402 12 October 2011

ii TECHNICAL COMMITTEE Chairman Dr Abdulrahman A. Al-Hamidy – Saudi Arabian Monetary Agency Deputy Chairman Mr Osman Hamad Mohamed Khair – Central Bank of Sudan (until 15 August 2009) Dr Mohammad Yousef Al Hashel – Central Bank of Kuwait (from 23 November 2009) Members* Dr Sami Ibrahim Al-Suwailem (until 13 December 2010) Islamic Development Bank Dr Salman Syed Ali (from 14 December 2010) Islamic Development Bank Mr Khalid Hamad Abdulrahman Hamad Central Bank of Bahrain Mr Gamal Abdel Aziz Ezzat Negm (until 13 December 2010) Central Bank of Egypt Mr Farag Abdul Hameed Farag (from 14 December 2010) Central Bank of Egypt Mr Ramzi Ahmad Zuhdi (until 5 April 2010) Bank Indonesia Dr Mulya Effendi Siregar (from 6 April 2010) Bank Indonesia Mr Hamid Tehranfar (until 31 March 2009) Central Bank of the Islamic Republic of Iran Mr Abdolmahdi Arjmand Nejad (from 1 April 2009) Central Bank of the Islamic Republic of Iran Mr Bakarudin Ishak (until 31 March 2009) Bank Negara Malaysia Mr Ahmad Hizzad Baharuddin (from 1 April 2009) Bank Negara Malaysia Dr Nik Ramlah Mahmood Securities Commission of Malaysia Dr Bashir Umar Aliyu (from 6 April 2010) Central Bank of Nigeria Mr Pervez Said (until 31 March 2009) State Bank of Pakistan Ms Lubna Farooq Malik (until 5 April 2010) State Bank of Pakistan Mr Saleemullah (from 6 April 2010) State Bank of Pakistan Mr Mu’jib Turki Al Turki Qatar Central Bank Professor Abdulaziz Abdullah Al Zoom Capital Market Authority of Saudi Arabia Mr Chia Der Jiun (until 13 December 2010) Monetary Authority of Singapore Mr Adrian Tsen Leong Chua (from 14 December 2010) Monetary Authority of Singapore Mr Mohammed Ali Elshiekh Terifi (until 31 March 2011) Central Bank of Sudan Mr Mohamed Elhassan Elsheikh (from 1 April 2011) Central Bank of Sudan Mr Saeed Abdulla Al-Hamiz (until 31 March 2009) Central Bank of the United Arab Emirates Mr Khalid Omar Al-Kharji (from 1 April 2009) Central Bank of the United Arab Emirates

• In alphabetical order of the country the member’s organisation represents

iii STRESS TESTING WORKING GROUP Chairman Dr Mohammad Yousef Al Hashel – Central Bank of Kuwait Deputy Chairman Mr Mohamed Elhassan Elsheikh – Central Bank of Sudan (from February 2011) Mr Mohammed Ali Elsheikh Terifi – Central Bank of Sudan (until February 2011) Members* Dr Dadang Muljawan Islamic Development Bank Dr Salman Syed Ali Islamic Development Bank Dr Sami Ibrahim Al-Suwailem Islamic Development Bank Dr Rifki Ismal Bank Indonesia Ms Noura Khalid Al-Ghareeb Central Bank of Kuwait Ms Joelle El Gemayel Banque Du Liban Mr Mohamad Muhsin Mohd Anas Bank Negara Malaysia Mr Kamarudddin Hashim Securities Commission of Malaysia Mr Mohd Radzuan Ahmad Tajuddin Securities Commission of Malaysia Dr Mohammad Akram Laldin International Shariah Research Academy for Islamic Finance, Malaysia Mr Abdul-Azeez Barau Central Bank of Nigeria Mr Haruna Bala Mustafa Central Bank of Nigeria Mr Nizamuddin Arshad State Bank of Pakistan Mrs Fatma Abdulla Essa Al-Muftah Qatar Central Bank Mr Ali Al-Sadiq Saudi Arabian Monetary Agency Dr Mahmood Saad I. Alsahafi Saudi Arabian Monetary Agency Mr Mansour Al-Najashi Saudi Arabian Monetary Agency Ms Mashair M. Ibrahim Sabir Central Bank of Sudan Mr Adel Ali Al Saygh Central Bank of the United Arab Emirates Mr Prasanna Seshachellam Dubai Financial Services Authority, UAE

• In alphabetical order of the country the member’s organisation represents ISLAMIC DEVELOPMENT BANK SHARĪ`AH COMMITTEE* Chairman Sheikh Mohamed Mokhtar Sellami Deputy Chairman Sheikh Saleh Bin Abdulrahman Bin Abdulaziz Al Husayn Sheikh Dr Abdulsattar Abu Ghuddah Member Sheikh Dr Hussein Hamed Hassan Member Sheikh Mohammad Ali Taskhiri Member Sheikh Mohamed Hashim Bin Yahaya Member
• In alphabetical order SECRETARIAT, ISLAMIC FINANCIAL SERVICES BOARD Mr Jaseem Ahmed Secretary-General (from 1 May 2011) Professor Datuk Rifaat Ahmed Abdel Karim Secretary-General (until 29 April 2011) Professor Simon Archer Consultant Mr Jamshaid Anwar Chattha Member of the Secretariat

iv TABLE OF CONTENTS ACRONYMS.................................................................................................................................... v SECTION 1: INTRODUCTION AND BACKGROUND ................................................................... 1 1.1 Main Premises and Objectives .................................................................................... 2 1.2 Scope of Application .................................................................................................... 3 1.3 Stock-Taking Initiative.................................................................................................. 4 1.4 Implementation Date.................................................................................................... 5 1.5 Executive Summary of the Guiding Principles............................................................. 5 SECTION 2: NECESSARY CONDITIONS FOR AN EFFECTIVE STRESS TESTING REGIME.. 9 2.1 Stress Testing as a Set of Tools within a Risk Management Framework ................... 9 2.2 Data Quality and Effective Management Information Systems ................................. 10 2.3 Relevance of Stress Testing and Sophistication of IIFS............................................ 10 2.4 Availability of Models and Modelling Expertise.......................................................... 11 2.5 Supervisory Considerations and Guidance on Stress Testing for IIFS ..................... 11 SECTION 3: GUIDING PRINCIPLES ON STRESS TESTING FOR IIFS .................................... 12 3.1 Governance Aspects of the Stress Testing Framework ............................................ 12 3.2 Identification of Risk Factors and Coverage of Scenarios......................................... 17 3.3 Specific Elements of IIFS in Stress Testing............................................................... 23 3.4 Stress Testing Methodologies.................................................................................... 37 3.5 Frequency of Stress Testing ...................................................................................... 41 3.6 Outputs of Stress Testing and Remedial Actions ...................................................... 41 3.7 Disclosure of the Stress Testing Programme ............................................................ 44 SECTION 4: GUIDING PRINCIPLES ON STRESS TESTING FOR SUPERVISORY AUTHORITIES .............................................................................................................................. 45 4.1 Regular and Comprehensive Assessments of IIFS’ Stress Testing.......................... 45 4.2 Supervisory Evaluation of an IIFS’s Stress Testing Methodology ............................. 46 4.3 Designing and Implementing System-Wide Stress Tests and Specific Scenarios.... 47 4.4 Corrective Actions Based on Stress Test Results ..................................................... 49 4.5 Regular Supervisory Dialogue and Home-Host Coordination ................................... 50 4.6 Frequency of Conducting Stress Testing and Reporting Format .............................. 51 DEFINITIONS................................................................................................................................ 52

v ACRONYMS ALCO Asset and liability committee BCBS Basel Committee on Banking Supervision BOD Board of directors CAR Capital adequacy ratio CEBS Committee of European Banking Supervisors CMT Commodity Murābahah transactions DCR Displaced commercial risk EBA European Banking Authority (formerly known as the CEBS) EU European Union GN-2 IFSB Guidance Note in Connection with the Risk Management and Capital Adequacy Standards: Commodity Murābahah Transactions, December 2010 GN-3 IFSB Guidance Note on the Practice of Smoothing the Profits Payout to Investment Account Holders, December 2010 GN-4 IFSB Guidance Note in Connection with the IFSB Capital Adequacy Standards: The Determination of Alpha in the Capital Adequacy Ratio, March 2011 IAHs Investment account holders ICAAP Internal capital adequacy assessment process ICIS Islamic Collective Investment Schemes IFSB Islamic Financial Services Board IFSB-1 IFSB Guiding Principles of Risk Management, December 2005 IFSB-2 IFSB Capital Adequacy Standard, December 2005 IFSB-3 IFSB Guiding Principles on Corporate Governance, December 2006 IFSB-4 IFSB Disclosure to Promote Transparency and Market Discipline, December 2007 IFSB-5 IFSB Guidance on Key Elements in the Supervisory Review Process, December 2007 IFSB-6 IFSB Guiding Principles on Governance for Islamic Collective Investment Schemes, December 2008 IFSB-7 IFSB Capital Adequacy Requirements for Sukūk, Securitisations and Real Estate Investment, January 2009 IFSB-10 IFSB Guiding Principles on Sharīah Governance System, December 2009 IFSI Islamic financial services industry IIFS Institutions offering Islamic financial services in banking segments (which, for the purpose of this document only, shall also include Islamic windows operations) [other than Islamic insurance (Takāful) institutions and Islamic collective investment schemes] IRR Investment risk reserve NPF Non-performing financing OTC Over-the-counter PER Profit equalisation reserves PDs Probabilities of defaults PSIA Profit-sharing investment account RMC Risk management committee RW Risk weight RWA Risk-weighted assets SPE Special purpose entity SSB Sharīah Supervisory Board STWG Stress Testing Working Group VaR Value-at-risk

1 Bismillahirrahmanirrahim Allahumma salli wasallim ‘ala Sayyidina Muhammad wa’ala alihi wasahbihi SECTION 1: INTRODUCTION AND BACKGROUND

1. In line with its mandate to promote the soundness and stability of the Islamic financial services industry (IFSI), the Council of the Islamic Financial Services Board (IFSB) in its 15th meeting, held on 23 November 2009 in Kuala Lumpur, Malaysia, approved the formation of a Stress Testing Working Group (STWG) with the task of preparing Guiding Principles on Stress Testing for institutions in the banking segment of the IFSI. These Guiding Principles are intended to complement existing and future IFSB standards and guidelines in the banking segment of the IFSI. In attempting to address the specificities of institutions offering Islamic financial services (IIFS) in the banking segment with respect to stress testing, the STWG intends that this document shall complement other existing internationally recognised frameworks that set out sound principles and best practices pertaining to stress testing for conventional counterparts.
2. In particular, two seminal documents dealing with stress testing have been published in response to the financial crisis that started in mid-2007. In May 2009, the Basel Committee on Banking Supervision (BCBS) published its Principles for Sound Stress Testing Practices and Supervision, and in August 2010 the Committee of European Banking Supervisors (CEBS)1 issued its CEBS Guidelines on Stress Testing. As stated in these documents, stress testing is a key risk management tool within financial institutions. Stress testing alerts management to adverse unexpected outcomes related to a variety of risks and, among other things, provides an indication of how much capital might be needed to absorb losses if large shocks should occur. While by itself stress testing cannot address all risk management weaknesses, as part of a comprehensive approach it has a leading role to play in strengthening the resilience not just of individual banks but of the financial system as a whole. It is a tool which plays a particularly important role in the following aspects of risk management: • providing forward-looking assessments of risk; • overcoming limitations of models and historical data, with particular reference to low￾frequency, high-impact events; • feeding into capital planning procedures, including the internal capital adequacy assessment process (ICAAP) and liquidity planning procedures; • facilitating the development of risk mitigation or contingency plans across a range of stressed conditions; and • various aspects which concern corporate governance, including: o informing the setting of an institution’s risk tolerance; and o supporting internal and external communications with regard to the above.
3. The points noted above support the proposition that stress testing is particularly important after long periods of benign financial and economic conditions. It is also a key risk management tool when innovation leads to new products, the volume of which grows rapidly and for which little or no history of loss data is available. One of the prudential concerns has been to enhance and strengthen the existing stress testing framework from a financial stability point of view, through introducing better stress testing regimes and improved stress testing techniques. The recent crisis has indicated that the scope of stress testing practised by financial institutions remained limited to local markets, thus missing the contagion effect and cross-border systemic risk implications. It was also observed that there was insufficient integration into institutions’ risk management frameworks, that scenarios were not sufficiently severe, that the dangers considered in "extreme" scenarios were not extreme enough (e.g. Irish banks that had failed disastrously passed the European Union (EU) stress testing

1 It is worth noting that the CEBS has been replaced with the European Banking Authority (EBA), which was established as of 1 January 2011 and has taken over all existing and ongoing tasks and responsibilities from the CEBS. The reference to the CEBS Guidelines on Stress Testing is maintained in this document.

2 exercise), and there was lack of consideration of confluences of events, risk concentrations and second-round effects. 4. The BCBS document sets out 15 “principles” for banks and 6 for supervisors, while the CEBS document contains 17 “guidelines” for banks and 5 for supervisors. The IFSB intends that its Guiding Principles as set out in this document should incorporate the above while making appropriate adaptations to take account of the specificities of IIFS in terms of their risk exposures. 5. Although it has emerged that IIFS were resistant to the financial crisis to a certain extent,2 especially with respect to “first-round effects”, however, when the financial crisis turned into an economic crisis, IIFS were exposed to “second-round effects”, being affected by the general downturn and the fall in the value of assets.3 With regard to the specificities of IIFS, the question remains of how well IIFS will be able to absorb stresses and shocks that are more specific to the Islamic financial market, with regard to credit, market, operational and (perhaps particularly) liquidity risks. This implies an approach to stress testing (including various specific scenarios) that differs in some respects from that applicable to conventional institutions, which this document aims to set out and to explain. 6. The IFSB notes that, from the IFSI perspective, stress testing for risk management is one of the most under-developed areas where much work at all levels, including by supervisory authorities and market players, is required. The IFSB has mentioned in earlier standards the significance of using stress testing both for IIFS and supervisory authorities. For instance, paragraph 31 of the IFSB Guiding Principles of Risk Management for IIFS, issued in December 2005 (hereinafter “IFSB-1”), requires IIFS to have stress testing techniques in place; however, IFSB-1 did not give specific consideration to: (i) how to apply and conduct stress testing; and (ii) what should be the stress scenarios, the calibration of shocks to be applied, etc. Similarly, Guidance on Key Elements in the Supervisory Review Process for IIFS, issued in December 2007 (hereinafter “IFSB-5”), highlights the role of supervisory authorities in evaluating risk management processes. The supervisory authority can require IIFS to adopt forward-looking stress testing that identifies possible events or changes in market conditions that could adversely affect the IIFS’s financial soundness. However, specific guidance is required for supervisory authorities on the way to assess the stability of the IIFS from a systemic or macro perspective. The guiding principles in this document aim to complement both IFSB-1 and IFSB-5 in the above respects. 7. There are particular considerations to be borne in mind in the case of IIFS. In the first place, stress testing should be conducted in all aspects and scenarios with special attention to the position of the investment account holders (IAHs) and its implications for risk management. In addition to conventional banking risks, the IIFS are also exposed to other unique risks, such as rate of return risk and displaced commercial risk (DCR), and specific aspects of operational and reputational risk such as Sharīah non-compliance risk and fiduciary risk. In addition, Sharīah-compliant risk mitigation techniques, Sharī`ah-compliant securitisation, real estate investment, and issues related to commodity Murābahah transactions (CMT) need to be taken into account while designing and conducting stress testing exercises. 1.1 Main Premises and Objectives 8. As set out in the objectives of the IFSB as mandated under its Articles of Agreement, the STWG should not “reinvent the wheel” but instead, wherever appropriate, reinforce the existing internationally recognised frameworks or standards for stress testing so that IIFS stand on a “level playing field” with their conventional counterparts, subject to due consideration being given to the

2 In particular, thanks to Shari’ah restrictions, IIFS were not exposed to the market risk of speculative trading and derivatives, to the credit risk of “toxic” securities such as collateralised debt obligations, or to the effects of excessive leverage, some or all of which affected many conventional banks. 3 For instance, exposures by IIFS to real estate assets, both as investments and through financing by Ijārah Muntahia Bittamleek, exposed them to the effects of declining property prices.

3 specificities of Islamic finance. The Guiding Principles are thus intended to complement the existing stress testing framework so as to contribute to the soundness and stability of the IIFS particularly, and the IFSI as a whole. 9. Hence, this document is constructed on the basis of the following premises and objectives. It should be understood that delivering these objectives requires a rigorous stress testing framework (see Sections 2 and 3) designed to take account of system-wide implications: a. The stress testing framework for IIFS needs to take into consideration the specificities of IIFS, as well as the lessons learned from the financial crisis, while complementing the existing international standards on stress testing. b. The framework should guide IIFS in assessing and capturing vulnerabilities under various stress testing scenarios, including extreme but plausible shocks, in order to achieve the following, inter alia: i. identify how different portfolios respond to changes in key economic variables (e.g. benchmark rates4 , foreign exchange rates , credit quality, etc.); ii. assess the quality of assets to identify existing and potential loss exposures; iii. evaluate potential threats to the IIFS’s ability to meet its financial obligations at any time arising from either funding or market liquidity exposures; iv. estimate the impact of stress events on baseline profit (as profits normally act as the first line of defence before dipping into capital); and v. analyse the IIFS’s ability to meet its capital requirements at all times throughout a reasonably severe economic recession. c. For supervisory authorities, stress testing can be used (i) as a surveillance tool for periodically testing the safety and soundness of the financial system, and (ii) from a financial stability perspective, to identify “weaknesses” in the financial system and structural (systemic) vulnerabilities arising from the specific risk profiles of IIFS individually and collectively. 10. Based on these premises and objectives, the following 28 guiding principles (hereinafter collectively referred to as the “Guiding Principles”) are put forward for adoption and implementation by IIFS. The Guiding Principles are divided into two parts: (i) 22 Guiding Principles on stress testing for IIFS; and (ii) 6 Guiding Principles on stress testing for supervisory authorities.5 However, in order to be effective in promoting risk management, and for IIFS to develop a rigorous and robust stress testing framework, stress testing by IIFS would need to be complemented by a set of infrastructure components that serve as the necessary conditions. These components are outlined in Section 2. 1.2 Scope of Application 11. In general, the scope and application of the Guiding Principles are subject to the adoption of the other applicable IFSB Standards and Guiding Principles. The Guiding Principles are primarily intended to serve the full-fledged banking IIFS with due consideration to proportionality taking account of their size, sophistication and complexity.6 Such IIFS mobilise funds as deposits and investment accounts in accordance with Sharīah rules and principles, and invest them in Sharīah￾compliant investment and financing instruments. These IIFS include, but are not limited to, commercial banks, investment banks, and other fund mobilising institutions, as determined by the respective supervisory authorities, that offer services in accordance with Sharī`ah rules and principles. Supervisory authorities may, at their discretion, extend the application of these Guiding

4 Benchmark rates include market-based reference interest rates such as LIBOR (London Interbank Offer Rate), EIBOR (Emirates Interbank Offer Rate), etc. 5 The term “supervisory authority” in these Guiding Principles has been used in a general sense to refer to the institution which is responsible for supervising the operations of IIFS in a given jurisdiction. In this context, this term may refer to a central bank, monetary authority, financial supervisor, Ministry of Finance or other overseer of the operations of IIFS in a jurisdiction, depending on the structure of the financial supervisory system in the relevant jurisdiction. 6 The STWG believes that consideration should also be given to addressing the application of stress testing to risk management in other IFSI segments such as Takāful and capital market firms.

4 Principles to Islamic “window” operations that are self-contained or other institutions offering Islamic financial services that fall within their jurisdictions.7

12. The Guiding Principles will be applicable to any IIFS that falls within the scope as stated above, on a fully consolidated basis at the holding company level within a group or sub-group of IIFS, or as appropriate, on an individual basis subject to approval of the supervisory authorities. The Guiding Principles are not intended to be applied at the consolidated level to a group or sub-group that consists of entities other than (banking) IIFS as defined in paragraph 11 above.
13. The term “stress testing” is used in these Guiding Principles to refer not only to the mechanics of applying specific individual tests, but also to the wider environment within which the tests are developed, evaluated and used within the decision-making process. The Guiding Principles describe both qualitative and quantitative aspects of stress testing while keeping in view the principle of proportionality; that small and simple IIFS may focus on the qualitative aspects while larger, more complicated IIFS will require more sophisticated quantitative stress testing techniques. The principle of proportionality is applicable to all aspects of these Guiding Principles, including the governance process, risk identification and scenarios development, methodology, disclosures, as well as the frequency and the degree of detail of the stress tests.
14. The Guiding Principles provide some examples of current practices that can be considered as best practices; with due recognition that these practices will and should change as markets change and as technology, financial engineering and improved coordination between supervisory authorities make other strategies available. It is not the intent of the Guiding Principles to prescribe every possible control procedure. Instead, the IFSB will review and revise these recommendations from time to time. 1.3 Stock-Taking Initiative
15. In the course of developing these Guiding Principles, the STWG carried out its own survey (hereinafter referred as to the “Survey”) in September 2010 as a stock-taking exercise to provide insight into the actual stress testing practices of the IIFS in different jurisdictions.8 The main purpose of the Survey was to identify stress testing practices, as well as challenges and limitations facing IIFS in implementing stress testing techniques in selected IFSB member countries, while also taking into account the relevant policies and practices of the supervisory authorities in those countries. This exercise enabled the STWG to gauge the level of stress testing coverage applied by the various IIFS, as well as the regulation and supervision of these practices by the respective supervisory authorities. These Guiding Principles aim to reflect the best practices that were identified while addressing the notable gaps in the context of stress testing. The following is the synopsis of the identified gaps: a. In general, the Survey revealed that stress testing is being practised by most of the IIFS in the industry and is being regulated by a few jurisdictions. Nevertheless, there is no specific or detailed regulatory guidance for stress testing by IIFS and no prescriptive stress scenarios provided by the supervisory authority to IIFS, although some of the supervisory authorities are planning to provide guidance on stress testing to IIFS. b. Scenario analysis and sensitivity tests appeared to be the most frequently used techniques of stress testing by IIFS. However, other techniques – such as the maximum loss approach, extreme value theory, and reverse stress testing – are not much used.

7 Refer to paragraphs 56 and 57 of IFSB-5 for a definition of Islamic window operations, including “self-contained”. 8 The Survey consisted of two sets of questions: Set A and Set B. Set A was meant for market players (i.e. IIFS), while Set B was designed specifically for the supervisory authorities. The Survey Questionnaires were distributed to the relevant supervisory authorities, including central banks and monetary authorities who were members of the IFSB, for their onward distribution to the IIFS within their respective jurisdictions. The Survey received a total of 131 responses (comprising 115 responses from various types of IIFS and 16 from supervisory authorities) representing 15 jurisdictions.

5 c. Credit-, market- and liquidity risk-related aspects are being considered by most of the IIFS; nonetheless, certain specific areas – such as the presence of IAHs, capital adequacy, real estate, DCR, and Sharīah non-compliance risk – receive some consideration. In addition, indications were received that the STWG should highlight the specificities of certain types of risks and stress events arising from the business activities of IIFS (see (d) below). d. The disclosure related to stress testing practices appeared to be very weak in the industry. The development of potential scenarios peculiar to IIFSs’ products, and of stress test methodologies for assessing the specific risk factors, is still in the initial stages. e. Another fragile area found was the use made of the stress test results: they are largely confined to increasing risk awareness, whereas they should be used for risk mitigation as well as being integrated into the business and strategic planning processes. f. The findings also revealed that amongst the biggest challenges for IIFS in implementing stress testing is the “availability of models and modelling expertise”, “quality of the data”, and the “inadequate guidance from the supervisory authority on conducting the stress testing”. 1.4 Implementation Date 16. The implementation of the Guiding Principles should be undertaken in compliance with Sharīah and within the legal framework of the jurisdictions in which IIFS operate and should be commensurate with the size, complexity and nature of each IIFS in line with the IFSB-1. The IFSB will expect its members to apply the present Guiding Principles by January 2013, meaning that by this date the guidelines should be transposed into national supervisory guidelines and be reflected in the national supervisory manuals/handbooks, where applicable, and implemented in supervisory practices. 1.5 Executive Summary of the Guiding Principles GUIDING PRINCIPLES ON STRESS TESTING FOR IIFS Governance Aspects of the Stress Testing Framework Principle 3.1: Stress testing should form an integral part of the overall governance of the IIFS. The ultimate responsibility for the overall stress testing programme of the IIFS should be with the Board of Directors (BOD). BOD and senior management involvement in the stress testing programme is essential for its effective operation. Stress testing programmes should be acted upon and should influence decision-making at all appropriate levels of management in an IIFS. Principle 3.2: A stress testing programme should be an integral part of an IIFS’s risk management framework and be supported by a suitably robust infrastructure, which is sufficiently flexible to accommodate different and possibly changing stress tests at an appropriate level of granularity. Principle 3.3: IIFS should operate a stress testing programme that promotes risk identification and control and provides a complementary risk perspective to other risk management tools. Stress testing programmes should take account of views from across the organisation including the Governance Committee (or an equivalent committee) and Sharī`ah supervisory board and should cover a range of perspectives and techniques. Principle 3.4: IIFS should have: (i) written policies and procedures, (ii) clear responsibilities, and (iii) allocated resources to facilitate the implementation of the stress testing programme. The operation of the programme should be appropriately documented at all levels. Principle 3.5: An IIFS should regularly review its stress testing framework and assess its effectiveness and robustness regularly and independently.

6 Identification of Risk Factors and Coverage of Scenarios Principle 3.6: An IIFS should identify and cover in its stress testing programme a range of relevant material risks to which an IIFS is, or is likely to become, exposed, both at the business unit level and the IIFS level. An IIFS should be able to integrate effectively and meaningfully in the stress testing activities all the risks and business areas, taking into account possible risk correlations, in order to deliver a complete picture of IIFS-wide risk. Principle 3.7: A stress testing programme should cover a broad range of scenarios (including “dynamic and forward-looking scenarios”), and aim to take into account system-wide interactions, feedback effects, and dynamics. IIFS should identify appropriate and meaningful mechanisms for translating scenarios into relevant internal risk parameters that provide an IIFS-wide view of risks. Principle 3.8: Stress testing should be based on “exceptional but plausible events” or “low frequency–high-impact events which may not be reflected in historical data”. The stress testing programme should identify different severities in each scenario (including scenarios which reflect a severe economic downturn) considered along with the assumptions damaging the reputation of an IIFS. An IIFS should also specify how its stress testing programme handles “second-round effects” and “fat tails extreme events” with respect to the unique risk factors threatening the viability of the IIFS. Specific Elements of IIFS in Stress Testing Principle 3.9: An IIFS should include in its stress testing programme the specific scenarios to account for the various perspectives of profit sharing IAHs, unrestricted IAHs and, in some circumstances, restricted IAHs. The Governance Committee (or an equivalent committee) as an integral part of the overall governance for the stress testing programme should be involved when developing stress scenarios related to IAHs and subsequently assessing the results of stress testing on the IAHs. Principle 3.10: An IIFS’s stress testing programme should include a sufficient element of capital assessment, capturing various unique perspectives at all times under the defined scenarios. IIFS should evaluate the reliability of their capital planning (including the assumptions used) based on stress test results. Stress tests under ICAAP should be consistent with an IIFS’s risk appetite and strategy, and incorporate credible mitigating management actions. IIFS should assess and be able to demonstrate their ability to remain above the regulatory minimum capital requirements during a stress situation that is consistent with their stated risk appetite. Principle 3.11: An IIFS should take into account various aspects of credit risk in its stress testing techniques covering, inter alia, non-performing financing and highly leveraged counterparties, in order to determine the overall soundness of the IIFS, particularly in the case of economic downturns. Stress testing should assess future credit exposures and changes in capital requirements due to, for example, changes in credit quality and collateral values. It should also encompass securitisation exposures as originator, issuer, sponsor, manager, etc. as reflected by credit conversion factors (CCFs). The effectiveness of risk mitigation techniques that are Shariah-compliant should be systematically challenged. Principle 3.12: IIFS should take into account various positions in the Sharīah-compliant financial instruments in trading portfolios considering a range of exceptional but plausible market shocks as part of their IIFS-wide stress testing. Dependencies among different markets and sectors, and consequentially increasing correlations, should be factored into stress testing. Stress testing for holders of Shariah-compliant securitisation should consider, inter alia, exposure to market risk of the underlying assets, including their exposures to systematic market factors, market liquidity factors, as well as legal risk and relevant contractual arrangements and embedded triggers in Shariah￾compliant securitisation structures.

7 Principle 3.13: IIFS should perform stress testing on specific portfolios covering, inter alia, consumer credit portfolios (i.e. Murābahah and Ijārah consumer financing), home purchase mortgage financing portfolios (whether by Murābahah, Ijārah or Diminishing Mushārakah contracts), real estate (including investment and financing), commodity Murābahah transactions, and equity investments (i.e. Mu
ārabah and Mushārakah investments). Consideration should be given to changes in correlations between risks that the IIFS identifies for a given portfolio. Principle 3.14: An IIFS should assess a broad range of liquidity risk factors and various unique perspectives in its stress testing techniques with the aim of enabling it to evaluate its ability (i) to meet its financial obligation at any time arising from funding and assets/market liquidity exposure, and (ii) to identify sources of potential liquidity strain, ensuring that current exposures remain in accordance with the IIFS’s established liquidity risk tolerance. As part of liquidity risk stress testing, an IIFS should aim to take account of simultaneous pressures in funding and asset markets, and the impact of a reduction in market liquidity on exposure valuation. An IIFS should also identify appropriate areas in which the results of liquidity stress tests will be used. Principle 3.15: An IIFS should include in its stress testing programme various aspects pertaining to Sharīah non-compliance risk leading to legal and related reputational risk. An IIFS should be able to quantify the potential impact of Sharīah non-compliance risk in its stress testing programme under defined scenarios, and ensure that appropriate contingency plans or remedies are in place to effectively manage the Sharī`ah non-compliance risk and potential systemic implications for the IFSI. Principle 3.16: The stress testing programme should capture off-balance sheet exposures that may have the potential to damage the reputation of the IIFS. Stress Testing Methodologies Principle 3.17: IIFS should develop and employ comprehensive stress testing methodologies including, at least, (i) sensitivity analyses (univariate) and (ii) scenario analyses (multivariate) addressing all material risks at various levels, business areas and specific portfolios of the IIFS. Principle 3.18: IIFS should develop reverse stress tests as one of their risk management tools to complement the range of stress tests they undertake. Principle 3.19: An IIFS should review and update its stress testing methodologies, taking into account: (i) changing market conditions; (ii) changes in the nature, size or complexity of the IIFS’s business model and activities; and (iii) actual experiences in stress situations. An IIFS should have a process in place to review the adequacy and reasonableness of its stress test methodology and assumptions. Frequency of Stress Testing Principle 3.20: An IIFS should conduct stress tests on a regular basis, with appropriate intervals at all levels in accordance with the nature of the risks covering its banking portfolios and trading portfolios, IIFS wide and on an ad-hoc basis. Outputs of Stress Testing and Remedial Actions Principle 3.21: Stress tests should be used to support a range of decisions. IIFS should identify credible management actions that address the outputs of stress tests and are aimed at ensuring their ongoing solvency throughout the stressed scenario. Stress test outputs should permit management to assess the ability of the IIFS to withstand difficult conditions, in terms of measuring the impact particularly on liquidity, capital adequacy and profitability.

8 Disclosure of the Stress Testing Programme Principle 3.22: An IIFS should make available the key information, both qualitative and quantitative, on its stress testing programme for internal and external communication by using an appropriate disclosure methodology within the existing reporting mechanism. GUIDING PRINCIPLES ON STRESS TESTING FOR SUPERVISORY AUTHORITIES Regular and Comprehensive Assessments of IIFS’ Stress Testing Principle 4.1: Supervisory authorities should regularly undertake comprehensive assessments of an IIFS’s stress testing programme. They should review stress testing outputs as part of the supervisory review process as per IFSB-5 in order to assess the resilience of an IIFS to adverse economic conditions and whether it is able to maintain sufficient capital and liquidity under stressed conditions. Supervisory Evaluation of IIFS’s Stress Testing Methodology Principle 4.2: Supervisory authorities should ensure that they have the capacity and adequate skills to assess an IIFS’s stress testing programme. In particular, they should have in place a process of evaluating the IIFS’s stress testing methodologies. Supervisory authorities should challenge the scope, severity, assumptions and mitigating actions of IIFS-wide stress tests. Designing and Implementing System-Wide Stress Tests and Scenarios Principle 4.3: Supervisory authorities should consider the financial soundness of an individual IIFS and aggregation of all IIFS’ estimates and evaluate the impact of economic stress on the banking sector. They should design and implement system-wide supervisory stress test exercises based on common scenarios as a part of their assessment of the overall system’s resilience to shocks, and may also consider recommending specific scenarios to IIFS. Supervisory authorities should also take into account the cross-border and cross-sectoral implications of the Islamic financial services industry (IFSI) in the stress testing programmes. Corrective Actions Based on Stress Test Results Principle 4.4: Supervisory authorities should review the range of remedial actions envisaged by an IIFS in response to the results of the stress testing programme and should require the IIFS to take corrective actions if material deficiencies in the stress testing programme are identified or if the results of stress tests are not adequately taken into consideration in the decision-making process. Regular Supervisory Dialogue and Home-Host Coordination Principle 4.5: Supervisory authorities should regularly engage in a dialogue with IIFS and the industry to identify systemic vulnerabilities in the IFSI. In the case of an IIFS operating cross-border, appropriate discussions should be held between the consolidating and host supervisory authorities to ensure coordination of supervisory activities, including the stress testing activities undertaken at group level, so as to address all the material risks of the IIFS. Frequency of Conducting Stress Testing and Reporting Format Principle 4.6: Supervisory authorities should conduct stress tests at the macro level in their respective jurisdictions at suitable intervals, as well as identifying particular IIFSs that are more sensitive to economic stress in their jurisdictions. They should determine the appropriate qualitative and quantitative disclosures with respect to stress testing to be submitted by the IIFS in their jurisdiction. Supervisory authorities should also provide a standardised reporting format to IIFS that carry out stress testing exercises.

9 SECTION 2: NECESSARY CONDITIONS FOR AN EFFECTIVE STRESS TESTING REGIME 17. For stress testing to be effective in promoting risk management, and for an IIFS to develop a rigorous and robust stress testing framework, it needs to be complemented by the observance of international standards for stress testing and by the availability of a set of other infrastructure components that serve as the necessary conditions for an effective stress testing regime. A number of these infrastructure components are identified as necessary conditions in this section. This is not necessarily an exhaustive enumeration, but includes the following: a. stress testing as a set of tools within a risk management framework; b. data quality and management information system; c. relevance of stress testing and sophistication of IIFS; d. availability of models and modelling expertise; and e. supervisory consideration and guidance on stress testing. 18. In addition to the above-mentioned conditions, which are explained in more detail below, IIFS should also be aware of the costs of developing and implementing such a stress testing programme. It is recognised that these costs may seem high for some IIFS, particularly small or medium-sized ones. However, the costs must be weighed against the potential loss mitigation, the value of the information and risk control gained, and the capital management that will result from an effective, well-designed stress testing programme. Such a programme would enable the IIFS to better understand its risk profile, improve its portfolio management practices, and avoid making costly errors in credit decisions in the future by modifying key practices and improving risk identification. Improved business and capital planning and assessment are also potential positive outcomes of appropriately designed stress testing programs. 2.1 Stress Testing as a Set of Tools within a Risk Management Framework 19. As noted in paragraph 17 above, one of the cardinal principles of stress testing is that it should be used as a set of tools within the overall risk management framework. This will require the integration of stress testing by IIFS into their formal risk management framework, with a comprehensive understanding of the specific risk issues faced by IIFS. As noted above in Section 1.2, the IFSB recognises that the specific stress testing practices adopted by each IIFS as part of its risk management framework will vary in scope and content depending on the size and nature of its activities, which will determine the likely impact of any potential risk scenarios. Therefore, it is essential for an IIFS’s Board of Directors (BOD)9 to set the “tone at the top” with respect to stress testing, to delegate responsibility to appropriate levels of senior management, and to oversee the implementation of the framework (see Principle 3.1 below). In addition, regulatory requirements for stress testing and/or guidance from supervisory authorities should be seen as an additional level of control to ensure compliance, and not as the reason for undertaking a stress testing exercise.

9 The term “board of directors” has been used in these Guiding Principles not to identify a legal construct but rather to label a top decision-making function within an IIFS (or other entity). In a single-tier system, such as those in most IFSB member countries, the “board of directors” includes both non-executive and executive directors, and plays the role of a monitoring and supervisory organ assisted by certain key committees with the non-executive directors representing shareholders and other outside interests, and the executive directors heading at least some of the top executive functions. In jurisdictions that adopt a two-tier system, this system comprises a “supervisory board" and a "management (or executive) board". In the latter system, the “supervisory board” includes only non-executive directors, and is charged with the monitoring and supervision of the “management (or executive) board”. The “management (or executive) board”, on the other hand, includes the members of senior management heading the top executive functions, being charged with the management of the entity, and being accountable to the “supervisory board”. Another main difference between the single and dual systems is that in the former, executive management powers are delegated by the “board of directors” and can theoretically be changed at any time, whereas the powers of the “management (or executive) board” in a dual system are mostly vested by law and cannot be reduced even by a shareholders' resolution on amendments to the Articles. References to the “board of directors” in these Guiding Principles are to be understood as designating the body that is charged with the top executive functions in the entity, namely the BOD in a single-tier system and the management or (executive) board in a dual-tier system. References to “senior management” designate the heads of the main executive functions in the entity in their functional capacities, rather than as members of a top executive body.

10

20. It is important for IIFS to understand and take account of the implications for risk management arising from the differences between their operations and balance sheet structures and those of their conventional counterparts (see Section 3.3 for more details). Furthermore, a unique feature in the case of IIFS is the fact that market risk arises together with credit risk in the context of Sharī`ah-compliant financing operations, giving rise to what may be termed “market risk in the banking book”.10
21. In regard to the above, prior to conducting stress testing, the implementation of IFSB-1 would enhance the stress testing programme. IFSB-1 provides a set of guidelines on best practice for establishing and implementing effective risk management in IIFS. It also provides guidance on risk management controls from the perspective of an IIFS identifying the unique risk characteristics of Islamic financial transactions and contracts.11 IFSB-1 provides specific guidance for each category of risk, drawn from discussions of industry practices. Furthermore, the role of the supervisory authority in respect of risk management for IIFS is highlighted in IFSB-1. Reflecting the different nature of the operations of IIFS compared to conventional banking and the specificities of the risks faced by IIFS, supervisory authorities are urged to adopt a risk-based approach when evaluating IIFSs’ risk management practices. (See discussion of the role of the supervisory authority in respect of risk management for IIFS as set out in paragraphs 138 to 152 of IFSB-1.) 2.2 Data Quality and Effective Management Information Systems
22. Lack of an adequate database has been a major challenge for IIFS (as for many conventional banks) in conducting stress testing exercises. Some IIFS may indicate that they have insufficient data to conduct credible stress tests. In some situations, there is also a possibility that the data may not be up to date or the IIFS may not have access to the breadth of data needed for proper stress testing.12 Lack of the necessary data constitutes a management limitation that must be rectified within a reasonable period of time. In this regard, up-to-date, comprehensive and high￾quality data are needed when conducting stress tests either at the portfolio level (e.g. the financing portfolio or investment portfolio) or IIFS-wide level. IIFS management need to recognise that with inadequate data they may be more limited in their ability to recognise risk exposures and how to manage them. The management of an IIFS should establish a strategy and a plan, with the involvement and approval of the BOD, for acquiring the data needed for a credible stress testing programme based on the composition and characteristics of the IIFS’s asset portfolio and sources of funding. The IT platforms and data warehousing facilities should be developed so as to be adequate to support the quantification and effective management of the stresses that could affect the IIFS. The information technology (IT) and management information system (MIS) resources should be commensurate with the complexity of the techniques and the coverage of stress tests carried out. 2.3 Relevance of Stress Testing and Sophistication of IIFS
23. The managements of IIFS should recognise that the application of stress testing to different IIFS will vary in scope and complexity depending on the size and nature of operations of each institution. Some IIFS are relatively small and have fairly simple asset portfolios. The management and BOD of such IIFS may feel that they have an intimate knowledge of their IIFS’s asset portfolio and its inherent risks. They may believe that stress testing is unnecessary for their IIFS. Indeed, such IIFS may not require a sophisticated stress testing programme, comparable to what is needed

10 For instance, in a Murābahah transaction, the market risk “transforms” into credit risk, in the sense that the market risk exposure to the subject matter of the contract which is applicable when the latter is held by the IIFS prior to the sale is replaced after the sale by the credit risk exposure to the counterparty if the payment is on deferred terms. Moreover, in Salam financing, the IIFS, having paid the purchase price of the subject matter in advance of its delivery, is exposed not just to the credit risk (potential default) of the counterparty but also to the market risk of the subject matter to be delivered. 11 IFSB-1 sets out 15 guiding principles of risk management for IIFS, grouped into six categories of risks – namely, credit, equity investment, market, liquidity, rate of return, and operational risks. In addition to these six categories, IFSB-1 further discusses the sub-categories of these risks that are unique to the IIFS, such as displaced commercial risk, Sharī`ah non￾compliance risk, fiduciary risk, etc. 12 The fact that the available data are incomplete does not preclude stress testing; nevertheless, it is incontestable that the better the data, the better and more useful are the stress testing results.

11 for a large and more complex IIFS. Nevertheless, the economic and financial environment in which even small IIFS operate has become very complex and extremely volatile. In such an environment, a stress testing programme suited to the needs of a small, non-complex IIFS can greatly enhance its risk management and protect the interests of its shareholders and IAH. However, as a general rule, more sophisticated IIFS may use a combination of qualitative and quantitative aspects together with scenario tests and sensitivity analysis, whereas smaller and less complex IIFS may develop a less technically demanding approach that is more focused on qualitative aspects (see also paragraph 13 above). Scenarios with greater coverage across product lines or geographical regions, and taking account of second-round effects, may be employed by large and complex IIFS. 2.4 Availability of Models and Modelling Expertise 24. Managements of IIFS should also be aware that the existence of relevant models and modelling expertise is vital for the proper functioning of stress testing exercises. In addition, lack of adequate models may weaken the capacity of IIFS to take account of sectoral interlinkages as well as contagion risk. IIFS with little or no experience of portfolio stress testing may not know where to obtain the appropriate models and necessary analytical tools. Some may feel they do not have the modelling and/or analytical expertise to implement a stress testing programme. This represents a management constraint that must be addressed within a realistic time frame. The models for stress testing, whether obtained from elsewhere (e.g. from software vendors) or developed in-house (possibly with the help of consultants) should be appropriate given the size and complexity of the IIFS, and enable it to address its particular risks. Nevertheless, stress testing is an important enough function to warrant the implementation of strategies to acquire such expertise, whether by hiring staff with the appropriate expertise or contracting with outside consultants to enable the institution to implement an appropriate stress testing programme. Following the development or acquisition of a model, the model needs to be validated. Model validation requires the inclusion of an expert opinion for the effectiveness of the models that would be used in the stress testing programme by the IIFS. 2.5 Supervisory Considerations and Guidance on Stress Testing for IIFS 25. IIFS will benefit from specific guidance and periodic reviews provided by their industry supervisory authorities in establishing and maintaining an effective stress testing framework. In the Survey, most of the IIFS revealed that stress testing should be imposed by the regulator/supervisor to make it a requirement for IIFS to conduct stress tests following standard procedures for stress testing applicable throughout the banking industry. The Survey also indicated the prevalence of a view that the BOD and/or the management of an IIFS would not take seriously a fiduciary duty to undertake stress testing unless it was imposed by the regulator or supervisor. Besides the issue of stress testing being a regulatory requirement or a fiduciary duty, respondents to the Survey also raised concerns to the effect that they would require detailed specific guidance from the respective regulator or supervisor while conducting stress testing. 26. There are certain desiderata that supervisory authorities should bear in mind with a view to establishing effective stress testing regimes in their jurisdictions. These include: (i) clear and comprehensive specific guidance to IIFS on supervisory expectations for stress testing, including that of board and senior management involvement in setting stress testing objectives, defining scenarios (i.e. robust scenario generation and the parameterisation process), discussing the results of stress tests, clarity on “proportionality” in the scope and complexity of stress testing requirements, and on assessing outcomes and subsequent decisions and actions; (ii) adequate infrastructure and resources, including IT systems to support effective data delivery and processing; (iii) a unified and standardised reporting mechanism; (iv) appropriate methods for supervisory validation of IIFSs’ stress testing procedures, including evaluation of the reliability of IIFSs’ risk assessments and self￾reported figures;13 and (v) periodic discussion with IIFS and independent assessment of their vulnerabilities at both the micro (institution) and macro (systemic) levels.

13 Unreliability in these areas for certain countries in the European Union’s stress testing programme helps to explain why, for example, several Irish banks which appeared sound on the basis of the stress tests failed less than a year later. The main factor involved in this case would appear to have been a failure to allow for a possible major deterioration in asset quality, which in fact did occur during the crisis.

12 SECTION 3: GUIDING PRINCIPLES ON STRESS TESTING FOR IIFS 3.1 Governance Aspects of the Stress Testing Framework 3.1.1 Ultimate responsibility for the overall stress testing programme Principle 3.1: Stress testing should form an integral part of the overall governance of the IIFS. The ultimate responsibility for the overall stress testing programme of the IIFS should be with the Board of Directors (BOD). BOD and senior management involvement in the stress testing programme is essential for its effective operation. Stress testing programmes should be acted upon and should influence decision-making at all appropriate levels of management in an IIFS. 27. It should be noted that the general requirements for risk management in IIFS, as stipulated in Principle 1.0 of IFSB-1 for risk management, apply fully to the governance and oversight of stress testing programmes. 28. The BOD (as the ultimate internal policy-maker) should have ultimate responsibility for the overall stress testing programme, whereas senior management should be accountable for the programme’s implementation, management and oversight. Practical aspects of stress testing, such as identification of risk drivers, implementation, management, etc., may be delegated to senior management who are actively involved throughout the process. The BOD and senior management should actively engage in the discussion to maximise effective use of the programme, especially with respect to IIFS-wide stress testing and capital planning, in terms of the outputs and limitations of the stress tests. This is essential in order to ensure both the authority of the stress testing programme at all levels of the IIFS and that the BOD fully understands the impact of stress events on the overall risk profile of the IIFS. The BOD should take responsibility for agreeing on and, where necessary, challenging the key modelling assumptions and scenario selection and is expected to question assumptions underlying the stress tests from a common/business sense perspective – for instance, whether the assumptions about correlations in a stressed environment are reasonable, and management’s intervention and mitigating actions are credible based on stress test results. 29. The BOD should be able to identify and clearly articulate the IIFS’s risk appetite and understand the impacts and implications of stress events on the risk profile of the IIFS. Senior management should participate in the review and identification of potential stress scenarios, as well as contribute to risk mitigation strategies. In addition, senior management should consider an appropriate number of well-understood, documented, utilised and sufficiently severe scenarios that are relevant to their IIFS (see also Principle 3.7). The rationale for particular choices, as well as their principal implications, should be explained and documented so that the BOD and senior management are aware of the limitations and implications of the stress tests performed (e.g. key underlying assumptions, and the extent of judgment in evaluating the impact of the stress test or the likelihood of the event occurring). 30. The Governance Committee14 (or an equivalent committee15) should be actively involved in the development of the scenarios with respect to investment account holders, particularly in the context of unrestricted IAHs (as their funds are commingled with the IIFSs’ own funds) as presented in Principle 3.9 (i.e. on IAHs-related stress testing). This committee’s involvement will be significant

14 It should be noted that in this document the “Governance Committee” is not a committee specifically responsible for stress testing. (IIFS can have different committees for this purpose.) Instead, the Governance Committee is another Board committee, as recommended in IFSB Guiding Principles on Corporate Governance (hereinafter “IFSB-3”), established by the BOD, and specifically mandated to protect the interest of the IAHs. The recommendation for IIFS to have a Governance Committee whose functions are distinctly different from a conventional Audit Committee is made particularly because IIFS operate investment accounts (under the principle of Mu
ārabah) which are not in the form of debt contract (as in the case of conventional fixed deposits). To see the details of the recommendation, please refer to IFSB-3. 15 While highly recommending the establishment of a separate Governance Committee, as suggested in IFSB-3, depending on the organisational framework of an individual IIFS, the suggested role can be performed by some other BOD committee provided it is chaired by an independent BOD member and is explicitly mandated to monitor the governance policy framework of the IIFS and safeguard the interests of IAHs.

13 when conducting stress testing with respect to the impact of stressed conditions on the income and capital of IAHs and subsequently assessing the results of such stress testing on IAHs’ interests. The significance of IAHs as a source of funds for IIFS, the particular risk characteristics of such accounts, and the unique fiduciary duties that they entail for the IIFS as Mu
ārib under the principle of Mu
ārabah, imply the need for the involvement of a committee such as the Governance Committee in such stress testing. 31. A stress testing programme as a whole should be acted upon and feed into the decision￾making process at the appropriate management level, including strategic business decisions of the BOD or senior management. Stress tests should be used to support a range of decisions. In particular, but not exclusively, stress tests should be used as an input for setting the risk appetite of the IIFS or setting exposure limits. Stress tests should also be used to support the evaluation of strategic choices when undertaking and discussing longer-term business planning. Importantly, stress tests should feed into the capital and liquidity planning process. The detail of the action plans and a range of decisions are outlined in Principle 3.21. 3.1.2 Appropriate robust infrastructure for a stress testing programme Principle 3.2: A stress testing programme should be an integral part of an IIFS’s risk management framework and be supported by a suitably robust infrastructure, which is sufficiently flexible to accommodate different and possibly changing stress tests at an appropriate level of granularity. 32. The BOD and senior management should foster a culture within the IIFS that promotes stress testing as an important risk management tool by integrating it into its IIFS’s risk management processes. This requires the existence of an organisational structure in IIFS for stress testing. As stated earlier, prior to conducting stress testing at the IIFS, the implementation of IFSB-1 (which provides guidance on risk management controls from the perspective of an IIFS identifying the unique risk characteristics of Islamic financial transactions and contracts) would enhance the stress testing program at the IIFS level. For example, the stress test programme should: (i) analyse the aggregate of an IIFS’s businesses and risk types as well as the separate components of portfolios, risk types and business lines; (ii) factor in the relationships between risk types; (iii) support bottom-up and top-down16 stress testing using either scenario or sensitivity analysis, including reverse stress testing (see Section 3.4 for more details); (iv) have a flexible platform that enables modelling of a wide variety of stress tests across business lines and risk types as and when the senior management require; (v) draw data from across the organisation, as needed; and (vi) enable senior management intervention to adjust assumptions. 33. As one component of demonstrating that the stress testing programme is embedded in risk management, supervisory authorities expect to see stress testing as an integral part of the internal capital adequacy assessment process (ICAAP). The ICAAP should be forward-looking and take into account a severe scenario that could impact the IIFS. The ICAAP should demonstrate that stress testing reports provide the BOD and senior management with a thorough understanding of the material risks to which the IIFS may be exposed. Stress testing should also be a central tool in identifying, measuring and controlling funding liquidity risks, in particular for assessing the IIFS’s liquidity profile and the adequacy of liquidity buffers in the case of both IIFS-specific and market-wide stress events. (See Principle 3.14 for more details on liquidity risk stress testing.17)

16 Bottom-up stress testing generally means stress testing specific exposures and risk factors and then the results are aggregated. Top-down stress testing means stress testing exposures at an aggregated level and then allocating the results to relevant entities/business lines. 17 See also Principles for Sound Liquidity Risk Management and Supervision, BCBS, September 2008, and IFSB Exposure Draft Guiding Principles on Liquidity Risk Management for IIFS, October 2011.

14 34. In an IIFS, in line with the principle of proportionality,18 an IIFS should have suitably flexible infrastructure as well as data of appropriate quality and granularity. The infrastructure should enable an IIFS on a timely basis to aggregate its exposures to a given risk factor, product or counterparty, and to modify methodologies to apply new scenarios as needed. The infrastructure should also be sufficiently flexible to allow for targeted or ad-hoc stress tests at the business-line or IIFS-wide level to assess specific risks in times of stress. System flexibility is crucial in order to handle customised and changing stress tests and to aggregate comparable risks and exposures across an IIFS. IIFS should build up a “stress library”19 with extensive data tags20 as a part of the infrastructure which would allow them to build and store varieties of scenarios covering IIFS-wide aspects. An IIFS should ensure that it devotes sufficient resources to developing and maintaining such infrastructures and/or data frameworks, including appropriate resources and IT systems, where applicable, that facilitate effective data delivery and processing in a quantitative and qualitative manner. 35. The stress testing infrastructure and/or data framework of a cross-border group should allow stress tests to be conducted at various levels21 of the organisation, including at the fully consolidated basis at the holding company level within a group or sub-group of the IIFS, or as appropriate on an individual basis subject to approval of the supervisory authorities. The Survey revealed that stress testing is an integral part of the overall governance and risk management culture of the IIFS. However, some of the IIFS have also demonstrated, inter alia, that: (i) they are in the process of integrating results with business and strategic planning; (ii) they have just developed risk management standard operating procedures for their IIFS as they spin off from conventional banks/groups; (iii) stress testing is done as part of a consolidated stress test done by conventional banks; (iv) stress testing is done for a conventional bank as a whole, not separately for IIFS; and (v) they are considering introducing stress testing as part of the ICAAP. 3.1.3 Stress testing promoting risk identification and taking views across the IIFS Principle 3.3: IIFS should operate a stress testing programme that promotes risk identification and control and provides a complementary risk perspective to other risk management tools. Stress testing programmes should take account of views from across the organisation, including the Governance Committee (or an equivalent committee) and Sharī`ah supervisory board, and should cover a range of perspectives and techniques. 36. A stress testing programme is an integrated strategy for meeting a range of purposes (i.e. origination, development, execution and application of a suitable range of stress tests) requiring a range of techniques since stress testing is not a one-size-fits-all approach. To promote risk identification and control, stress testing should be included in the risk management activities of IIFS at various levels. This includes the use of stress testing for the risk management of individuals or groups of borrowers and transactions, for portfolio risk management, as well as for adjusting an IIFS’s business strategy. In particular, it should be used to detect vulnerabilities such as (i) unidentified existing risk concentrations, (ii) possible IIFS-wide risk (by uncovering hidden concentrations), and (iii) potential interactions between types of risk that could threaten the viability of the IIFS. (See Principle 3.21 for more details on the use of stress testing.) As stated earlier, stress testing should also form an integral part of the ICAAP, which requires IIFS to undertake rigorous, forward-looking stress testing that identifies severe events or changes in market conditions that could adversely impact the IIFS.

18 That is, the infrastructure should be proportionate to the size, complexity and risk profile of an IIFS, and allow for the performance of stress tests covering all material risks to which an IIFS is exposed. 19 The term "stress library" refers to part of an internal data bank, providing access to a collection of useful and relevant stress scenarios and their implications, developed either internally over a period of time or outsourced by the IIFS, for use in stress testing. 20The standard tags used in a stress library may include: name of the scenario; description of the scenario (including assumptions, rationale and methodology); time-horizon of the scenario; types of scenario; driving market factors and leading indicators; probability; and severity. 21 Where the IIFS applies a centralised approach to risk management, and stress tests are being conducted predominantly at the consolidated level, the design of the stress testing programme should allow for articulation of the impact/results of the group (consolidated) level stress tests to material entities and/or business lines.

15 37. Stress testing should provide a complementary and independent risk perspective to other risk management tools such as value-at-risk (VaR),22 economic capital, and various statistical measures (such as correlation and multiple regression analysis). Stress tests should complement risk management approaches that are based on complex, quantitative models using backward￾looking data and estimated statistical relationships. In particular, stress testing outcomes for a particular portfolio can provide insights into the validity of statistical models at high confidence intervals – for example, those used to determine VaR. 38. The stress testing programmes should take account of views from across the organisation, and use multiple perspectives and a range of techniques,23 in order to achieve comprehensive coverage. The range of perspectives and techniques are presented in detail in Sections 3.2 and 3.4. IIFS should note that the identification of relevant stress events, the application of sound modelling approaches and the appropriate use of stress testing results each require the collaboration of different senior experts within an IIFS, such as risk controllers, economists and business managers. A stress testing programme should ensure that the opinions of all relevant experts and specific organs (such as the Governance Committee and Sharīah Supervisory Board (SSB)) are taken into account, in particular for IIFS-wide stress tests covering, among other matters, those related to Sharīah non-compliance risk. The unit with responsibility for implementing the stress testing programme should organise appropriate dialogue among these experts and organs, challenge their opinions, check them for consistency (e.g. with other relevant stress tests), and decide on the design and implementation of the stress tests, ensuring an adequate balance between usefulness, accuracy, comprehensiveness and tractability. 3.1.4 Written policies and procedures with clear responsibilities Principle 3.4: IIFS should have (i) written policies and procedures, (ii) clear responsibilities, and (iii) allocated resources to facilitate the implementation of the stress testing programme. The operation of the programme should be appropriately documented at all levels. 39. The stress testing programme should be governed by internal policies and procedures, which should be appropriately documented. Clear responsibilities should be assigned for the overall stress testing programme in the IIFS. The programme should be documented particularly in relation to IIFS-wide stress tests. The role of the Governance Committee regarding the IAHs’ stress testing should be defined and documented in the policy development, and the committee should receive up￾to-date information on the operation of the stress testing programme together with documentation of policies, procedures and results (see also paragraphs 30 and 38). In addition, in preparing written policies and executing action plans as a result of the stress testing exercise, the SSB should be consulted to ensure that all aspects of Sharīah compliance are appropriately addressed so as to avoid any doubt with regard to the Sharīah aspect. The following aspects should be detailed in policies and procedures governing the stress testing programme: (i) the types of stress testing and the main purpose of each component of the programme; (ii) the frequency of the stress testing exercises; (iii) the methodological details of each component, including the definition of relevant scenarios and the role of expert judgement, and decisions as to who provides the scenarios for stress testing and who reviews the adequacy and reasonableness of the stress test methodology and assumptions; and (iv) the range of business assumptions and remedial actions envisaged, based on the purpose, type and result of the stress testing, including an assessment of the feasibility of corrective actions. 40. An IIFS should ensure that the scenarios are well documented with a description of the scenarios, including types of scenarios (i.e. historical, hypothetical, etc.), key assumptions, test frequency, fundamental elements, and data inputs for each stress testing exercise. The description

22 Value-at-risk can be defined as the worst loss that might be expected from holding a security or portfolio over a given period of time (say, a single day or ten days), given a specified level of probability (known as the confidence interval). Thus, VaR is used to provide a probabilistic prediction on losses that are likely to happen for a pre-specified holding period and confidence level. The main purpose of VaR is to quantify potential losses under normal market conditions. 23 These techniques include quantitative and qualitative techniques to support and complement the use of models and to extend stress testing to areas where effective risk management requires greater use of judgement.

16 of the scenarios may also include the reasoning and judgements underlying the chosen scenarios and the sensitivity of stress testing results to the range and severity of the scenarios. An evaluation of such fundamental assumptions should be performed regularly or in light of changing external conditions. Documentation requirements should not, however, impede the IIFS from being able to perform flexible ad-hoc stress testing, which by its nature needs to be completed quickly and often to respond to emerging risk issues. Furthermore, an IIFS should document the outcome of such assessments. An IIFS should ensure that it devotes sufficient resources, and develops explicit procedures, to undertake rigorous, forward-looking stress testing.24 3.1.5 Regular review of the stress testing framework Principle 3.5: An IIFS should regularly review its stress testing framework and assess its effectiveness and robustness regularly and independently. 41. The effectiveness and robustness of stress tests should be assessed regularly, qualitatively as well as quantitatively, given the importance of judgements and the severity of shocks considered, and in light of changing external conditions, to ensure that they are up to date. The frequency of assessment of different parts of the stress testing programme should be set appropriately. Since the stress test development and execution processes often imply judgemental and expert decisions (e.g. assumptions to be tested, calibration of the stress, etc.), an independent control function such as risk management and internal audit should play a key role in the process. Stress tests performed by IIFS should be independently reviewed to ensure their continued effectiveness. Generally, the review should cover the reasonableness, validity and robustness of methodologies, assumptions and scenarios, as well as the use of stress tests within the IIFS. Nevertheless, in regard to review and assessment, the following areas of assessment of the stress testing programme should be considered, inter alia: (i) the effectiveness of the programme in meeting its intended purposes; (ii) the need for development work; (iii) systems implementation; (iv) management oversight; (v) business and/or managerial assumptions used or any other assumptions used; (vi) data quality; and (viii) documentation. The quantitative processes should include benchmarking with other stress tests within and outside the IIFS. 42. A sound and robust stress testing programme (e.g. design, scenarios, use of judgement and results) should be challenged by views from across the organisation, including from the Governance Committee and the SSB (see also paragraph 38). This requires dialogue between risk managers, economists, business managers and other relevant experts before it goes to senior management for challenge. Challenge between risk managers and business managers is likely to focus on the use and appropriateness of the stress testing programme from a business perspective. The insights of specialists within macroeconomic analysis are likely to be most valuable in the process of scenario selection and in the validation of stress test results. Involvement of different experts will help to ensure that the challenge of the stress test programme is both quantitative and qualitative.

24 The Survey revealed that only just under half of the sample IIFS have written policies and procedures governing their stress testing practices. However, some of the IIFS have mentioned inter alia that: (i) they are preparing formal written policies for risk measurement, including a stress testing programme; (ii) they are planning to introduce stress testing as part of the ICAAP, including a properly documented stress testing methodology governing the stress testing approach; and (iii) the adequacy of assumptions is documented and being reviewed by one of the following: (a) the asset and liability committee (ALCO); (b) the risk management committee (RMC); (c) the BOD; (d) the BOD risk management committee; (e) the stress testing steering committee; and (f) the supervisory authority. There were also indications that stress testing methodology is being crafted together by business and risk management units and deliberated at the group ALCO level prior to onward submission for group RMC approval, followed by periodic inspection executed by the internal audit department which challenged the methodology and assumptions.

17 3.2 Identification of Risk Factors and Coverage of Scenarios 3.2.1 Identifying the list of risk elements subject to testing under different scenarios Principle 3.6: An IIFS should identify and cover in its stress testing programme a range of relevant material risks to which an IIFS is, or is likely to become, exposed, both at the business unit level and the IIFS level. An IIFS should be able to integrate effectively and meaningfully in the stress testing activities all the risks and business areas, taking into account possible risk correlations, in order to deliver a complete picture of IIFS-wide risk. 43. An IIFS should review the nature of its basic activities and the external environment in which it operates in order to identify the list of key risk variables/factors (including individual variables or combinations of variables) that must be tested under different scenarios in the stress testing. The main areas in which an IIFS has considerable exposure (i.e. exposure to various types of on- and off-balance sheet risks, which indicate its vulnerabilities to different shocks) should be those most thoroughly captured under a stress testing programme. The identification process should include a full range of material risks at both the business unit and IIFS levels. The range of risks may include general risk factors, specific risks and certain qualitative risk factors applicable and relevant to the IIFS. However, what is also important is the need to identify the risk drivers of these material risks, as this would assist in understanding the underlying factors that affect the risks and determining the appropriate remedial measures. The number of risk factors to be included will depend on the complexity of the portfolio and the risks faced by the IIFS. All IIFS should be able to justify their choice of factors included in the stress testing. 44. When constructing the stress tests, the general risk factors that the IIFS should consider may include, inter alia: (i) macroeconomic factors (e.g. foreign exchange rates, inflation, GDP growth, unemployment rate, asset prices, etc.); (ii) geographical and political factors (i.e. health of other economies, vulnerabilities to external events, and contagion effects); (iii) financial market conditions (i.e. both funding and market liquidity); (iv) concentration risks (i.e. counterparties’ industries, sectors and regions); (v) borrower risk characteristics that would affect obligor risks and increase the default probabilities (e.g. borrower type, demographics, industry); and (vi) transaction risk characteristics (e.g. product, collateral type, guarantees, seniority, etc.).The stress tests should also reflect the specific risk characteristics of the IIFS, including events such as mergers or strategic acquisitions. 45. In addition to the traditional banking risks (such as credit risk, market risk and liquidity risk), IIFS are also exposed to other specific risks (e.g. Sharīah non-compliance risk, equity investment risk and rate of return risk) as outlined in IFSB-1. The specific risk factors25 that should be considered by IIFS in their stress testing programme, depending on their relevance and applicability, include the following: (i) credit risk for Sukūk, for real estate financing, and for other exposures; (ii) market risk for equities, Sukūk, real estate investment, foreign exchange and other exposures; (iii) investment risk for Mu
ārabah and Mushārakah; (iv) liquidity risk; (v) rate of return risk; (vi) displaced commercial risk; and (vii) operational risk, including Sharīah non-compliance risk, fiduciary risk, reputational risk and legal risk. Such specific risks should be well captured particularly in stress testing scenarios, and in IIFS-wide stress testing as a whole. Some of these risk factors are addressed in detail in Principles 3.9 to 3.16 in Section 3.3. 46. An IIFS should not confine the stress testing exercises only to regular risk factors that it faces (such as market risk, liquidity risk, credit risk, etc.); it should also take into account certain qualitative risk factors or other types of risk that are more qualitative in nature which cannot be measured exactly (i.e. some types of operational risk, such as legislative risk, Sharī`ah non￾compliance risk, as well as reputational risk and strategic risk). For instance, if the level of risk of a specific category is material enough to make the IIFS vulnerable, the IIFS has to take the risk into account when assessing the adequacy of its ICAAP.

25 The specific risk factors in the Guiding Principles are not intended to be exhaustive; IIFS are expected to identify the risk factors that are material to their institutions.

18 47. Rate-of-return risk26 arises because the rate of return on certain categories of assets based on sale-based contracts such as Murābahah is fixed (by virtue of the applicable Sharī`ah rules and principles), whereas the market benchmark rate of return moves up or down. Thus, if an IIFS raises funds via unrestricted PSIA or via CMT-based term deposits with maturities shorter than those of its Murābahah assets, it will be exposed to rate-of-return risk (in addition to the liquidity risk resulting from maturity mismatches when CMT-based deposits are used). The rate-of-return risk, as well as the liquidity risk, needs to be captured through stress testing techniques. 48. The market turmoil that began in mid-2007 has highlighted the crucial importance of the linkages between credit risk (including counterparty credit risk), funding liquidity risk and market risk. An IIFS should be able to integrate, effectively and meaningfully, all the risks and business areas in the stress testing programme to deliver a complete picture of IIFS-wide risks. A comprehensive integration of risks across the IIFS would require taking into account the interactions among different types of risks (i.e. market, credit and liquidity risks) within an IIFS involving all its departments/units. For instance, an IIFS should capture not only risk interactions within market risk (through the use of correlations) but also credit events, or changes in liquidity conditions that may impact upon the market risk of positions. The IIFS-wide stress test or enterprise-wide stress test should consider all the risks, volatility (implied and actual volatility) and changing correlations among the various risk factors, markets, and different sectors in an enterprise to the broadest perimeter of consolidation. This should also include, as necessary, any relevant non-banking financial institutions in a group. In addition to the existing risks, IIFS should also be aware of the emergence of new risks, contingent risks and uncovered hidden concentrations which may arise from the emergent interaction of multiple interdependent risk factors (e.g. reputational risk precipitating a liquidity crisis, or exposure to seemingly diversified investments that are driven by similar underlying risk factors). IIFS should not only monitor, by means of its stress tests, potential precipitating events (such as trends, volatilities and outliers) but also identify potential “tipping points”. 49. Besides the risk factors identified above, IIFS should have in place a process of calibrating these risk factors into the range of scenarios (see Section 3.2.2 for more detail), magnitude of shocks applied to the data (see paragraph 57), and mechanisms for interpreting the results (see Section 3.6 for more details). In this regard, IIFS should first identify their points of vulnerability in order to stress the relevant risk factors that may affect their earnings/profitability or solvency. 3.2.2 Range of scenarios including dynamic and forward-looking scenarios Principle 3.7: A stress testing programme should cover a broad range of scenarios (including “dynamic and forward-looking scenarios”), and aim to take into account system-wide interactions, feedback effects, and dynamics. IIFS should identify appropriate and meaningful mechanisms for translating scenarios into relevant internal risk parameters that provide an IIFS-wide view of risks. 50. The effectiveness of stress testing depends, in particular, on the extent to which an IIFS chooses and constructs the right scenarios for stress tests. Scenarios should be simple, comprehensible and easy to explain, yet they need to be realistic and relevant. For an IIFS, it is not enough just to generate scenarios; they need also to be simulated (possibly through “fire drills”) in the context of the organisation. While it is difficult to identify an optimal number of scenarios, it is clear that the appropriate number will vary for different IIFS. Given that an infinite number of scenarios could be run, the total number needs to be limited, and an IIFS would need to balance maximising the coverage of the scenarios against managing the costs of running the scenarios and

26 Rate of risk arises from the possible impact on the net income of the IIFS arising from effect of changes in the market rates and relevant benchmark rates on the return on assets and on the returns payable on funding. Rate-of-return risk differs from interest rate risk in that IIFS are concerned with the returns on their investment activities at the end of the investment holding period and with the impact on net income after the sharing of returns with IAH. The rate-of-return risk leads to displaced commercial risk (DCR). DCR refers to the magnitude of risks that are transferred to shareholders in order to cushion the IAH from bearing some or all of the risks to which they are contractually exposed in Mu
ārabah funding contracts (see IFSB-1 for detail).

19 filtering results into a form that can be discussed and taken on board by the BOD and translated into action. 51. An effective stress testing programme should comprise scenarios along a spectrum of events and severity levels which will help to deepen management’s understanding of vulnerabilities. A range of scenarios covering products, range of risks (i.e. general risk factors, specific risks and certain qualitative risk factors as presented in Principle 3.6), business areas, portfolios as well as the IIFS as a whole, and encompassing different events and degrees of severity, should be employed. There are several types of stress testing scenarios (see Section 3.4.1) that can be applied to an IIFS; however, an IIFS should determine the development and appropriateness of these scenarios in light of the characteristics of the risks of the IIFS, taking into account the interdependence or integration among the various scenarios to configure the scenario analysis (see Section 3.4.1). In regard to who should provide the scenarios, it could be done by one or a combination of the following (the list is not intended to be exhaustive): the BOD, senior management, the risk management committee or the BOD’s risk management committee (BRMC), the respective department heads, or the ALCO. 52. A range of scenarios designed and considered by the IIFS encompassing different events and varying degrees of severity should address, inter alia, the following aspects (taking into account both external systemic amplifiers and internal management response): a. Reflecting the nature of the IIFS’s activities and covering all the material risks or risk factors facing the IIFS (see Principle 3.6 for details). No material risk type should be left unconsidered. b. Analyses of potential IIFS-wide losses – particularly on (i) general financing, (ii) real estate financing and investment, (iii) trading assets and securities portfolios, and (iv) any off-balance sheet commitments and contingent liabilities/exposures, under defined scenarios over a certain time horizon. c. Major IIFS-specific vulnerabilities – these vulnerabilities should (i) take the regional and cross-sectoral characteristics of an IIFS into account, as well as considering specific product or business line exposures and funding policies, and (ii) provide insight into the IIFS-wide impact of severe stress events on an IIFS’s financial strength and allow for an assessment of its ability to react to events. d. Various trigger events considering co-movement of risk factors and inherent correlation (e.g. sovereign debt defaults/problems as the greatest threat to credit markets and the implications across the industry, shifts in monetary policy, declining assets, commodity and stock prices, political events and natural disasters). e. Dynamic and forward-looking scenarios27 – to incorporate changes in portfolio composition, new information and emerging risk possibilities that are not covered by relying on historical risk management or replicating previous stress episodes. The compilation of forward-looking scenarios requires combining the knowledge and judgement of experts across the organisation. The scenarios should be based on senior management dialogue and judgements. The challenge is to stimulate discussion and to use the information at different levels of the IIFS, including the opinions of the SSB on Sharī`ah-compliance perspectives in a productive way (see paragraph 38). f. Reflecting the materiality of particular business areas (e.g. real estate, CMT and Mu
ārabah- and Mushārakah-related exposures) and their vulnerability to changes in economic and financial conditions, and their impacts on: (i) the balance sheet; (ii) accounting and economic profit and loss; (iii) regulatory capital/risk-weighted assets (RWA) or economic capital requirements; and (iv) liquidity and funding gaps. g. Selection of the test assumptions – identifying the detailed basis of the stress test focusing on the following: (i) quantum – the degree of extreme price movement to be

27 IIFS should note that the financial crisis has shown that estimating ex-ante the probabilities of stress events is problematic. The statistical relationships used to derive the probability tend to break down in stressed conditions. In this respect, the crisis has underscored the importance of giving appropriate weight to expert judgement in defining relevant scenarios with a forward-looking perspective.

20 nominated representing a balance between too small a change (not useful) and too large a change (considered unlikely/improbable); (ii) correlations – the historical correlations to be reviewed to determine likely behaviours of relative price movements under extreme market conditions. A common approach is to assume that correlations go to “1” (no diversification effect) or “0” (no correlation between price/rate movements); (iii) market liquidity conditions; and (iv) market structure – consideration will have to be given to the possible changes in market regimes under stressed conditions.28 h. Assessing the nature of linked risks across portfolios and across time – scenarios should include various time horizons depending on the risk characteristics of the analysed exposures and intended purpose of the particular test (i.e. tactical or strategic use purpose). For example, deriving a coherent scenario for market and credit risk is not straightforward, as market risk materialises quickly whereas credit risk will need a longer time horizon to feed through the system. In the case of complex securities (e.g. certain Sukuk credit exposures), they may not be easy to identify. Further, an IIFS may consider covering substantially longer periods (i.e. longer time horizons) in liquidity risk, as liquidity conditions can change rapidly in stressed conditions. i. Taking account of the latest developments in the market or any developments in technology such as newly developed and sophisticated Sharīah-compliant financial products and their interaction with the valuation of more traditional products. 53. When analysing the potential impact of a set of macroeconomic and financial shocks, an IIFS should aim to take into account system-wide interactions and feedback effects such as credit rating downgrade feedback effects – that is, default events or collateral triggers linked to rating downgrades. (For details of contagion and second-order effects from system-wide interactions, see Principle 3.8.) IIFS should note that developing coherent stress testing scenarios on an IIFS-wide and system-wide basis may be a difficult task as risk factors for different portfolios differ widely and horizons vary across the system. However, the stress test scenarios should explicitly identify interdependences – for example, among economic regions or economic sectors. The strong links between the real economy and the financial economy, as well as the process of globalisation, have amplified the need to look at system-wide interactions and feedback effects.29 Such analyses can be very difficult to model quantitatively as they encompass the reactions and behaviours of the other market participants under adverse conditions. Thus, IIFS may make qualitative assessments of the feedback effects of stress. 54. The overall scenario should also take into account system-wide dynamics – such as leverage building up across the system, “tipping points” in various portfolios and sectors leading to systemic risk, closure of certain markets, and risk concentrations in a whole asset class such as real estate, CMT, Sharīah-compliant securities (i.e. Sukūk), etc. In order to address risk concentrations adequately, the scenario should be IIFS-wide and comprehensive, capturing the multi-dimensional enterprise threat and covering, as appropriate, on- and off-balance sheet assets, contingent and non-contingent risks, independent of their contractual nature. Further, stress tests should identify and address potential changes in market conditions that could adversely impact the IIFS’s exposure to risk concentrations of different dimensions, such as: (i) single name concentrations; (ii) concentrations in regions, industries or sectors; (iii) concentrations in single risk factors; (iv) concentrations that are based on correlated risk factors that reflect subtler or more situation￾specific factors, such as previously undetected correlations between market and credit risks, as well as between those risks and liquidity risk; (v) concentrations in indirect exposures via posted collateral

28 These changes may include possible changes in the regulatory environment (imposition of trading controls, FX controls, position size limits), or changes in market behaviours (changes in traditional relationships between variables) or behaviours of market participants (reduction in credit limits, withdrawal from or curtailment of trading activity by market makers). 29 Recent events have demonstrated that these effects have the capacity to transform isolated stress events into a global crisis, threatening even large, well-capitalised financial institutions, as well as systemic stability. As they occur rarely, they are generally not contained in historical data series used for daily risk management. A stress test supplemented with expert judgement can help to address these deficiencies in an iterative process and thereby improve risk identification. A reference is made to BCBS’s Guiding Principles of Sound Stress Testing, published in May 2009.

21 or hedge positions; and (vi) concentrations in off-balance sheet exposure, contingent exposure, and non-contractual obligations due to reputational reasons. 55. It is important that the formulation of the scenarios, as well as the translation from macroeconomic variables to internal risk parameters, should be done consistently. The formulation of a scenario includes explicit estimates/assumptions about the dependence structure between the main underlying economic and financial drivers such as GDP, unemployment, equity (stock), etc. The IFSB notes that establishing the links between underlying economic factors and internal risks of losses or stress parameters is likely to be based primarily on the IIFS’s own experience and analysis, which may be supplemented by external research and at times supervisory guidance. The transformation of external variables or events into internal losses or increased risk parameters may appear to be a challenging task. However, a deep (probabilistic) understanding of how macroeconomic variables and IIFS-specific effects could impact the IIFS at any given point in time is important in stress test modelling. This assessment of the impact of external variables should be based on quantitative modelling and on expert judgement with supporting quantitative analysis when data is relatively scarce. The chosen scenarios should be applied to all relevant positions (on- and off-balance sheet) of the IIFS, and an IIFS should be aware of the possible dynamic interactions among risk drivers, and the effects on earnings and the off-balance sheet positions.30 3.2.3 Range of scenarios with different severities Principle 3.8: Stress testing should be based on “exceptional but plausible events” or “low￾frequency–high-impact events which may not be reflected in historical data”. The stress testing programme should identify different severities in each scenario (including scenarios which reflect a severe economic downturn) considered along with the assumptions damaging the reputation of an IIFS. An IIFS should also specify how its stress testing programme handles “second-round effects” and “fat tails extreme events” with respect to the unique risk factors threatening the viability of the IIFS. 56. Stress tests should be designed by the IIFS to take into account larger movements reflecting “exceptional but plausible events” or “low-frequency–high-impact events which may not be reflected in historical data” and taking into account new concentrations of risks that may emerge, contagion effect and the failure of hedging techniques. It should be noted that exceptional events or “low￾frequency–high-impact events would be fairly rare and have a large magnitude or impact on the portfolio to be stress tested. Plausible events cannot be so extreme that no IIFS would withstand such a shock or they have zero probability of occurring. 57. Ensuring that a stressed scenario is appropriately severe is one of the elements required for ensuring that stress tests are: (i) meaningful in terms of providing the appropriate type of information, which is designed to promote the stability of the IIFS and the financial system at all points in the economic cycle; and (ii) consistently applied across the IIFS. The stress testing at various stages should identify the severities in each scenario considered along with the assumptions behind each scenario.31 This requires IIFS to assess the magnitudes of both the severity and the duration of the stresses. However, an IIFS may vary the level of stress (from mild to severe shocks) to assess its vulnerability under different scenarios and depending on different risk factors. Accordingly, an IIFS should determine the magnitude of shocks to be run for each risk factor. Historical data, judgement or expert opinions are among the options for determining the magnitude of shocks. However, selecting the worst movement in the previous one-year period may not be optimal, as the period may not include any stressful event. Therefore, the time interval for an appropriate portfolio should include at least one complete business cycle – that is, a pattern of alternating periods of growth (recovery) and decline (recession), characterised by changing employment and industrial productivity, amongst other factors. The magnitude of a shock used in modelling should be greater than that implied by a

30 A reference is made to CEBS’s Guidelines on Stress Testing, published in August 2010. 31 Severity is to be understood in the light of the specific vulnerabilities of the respective IIFS, which might not be equal to the perspective of the total economy; that is, a simple country- or region-specific macroeconomic stress scenario may be less relevant to some IIFS’ risk profile than others – for example, if they have a specific industry exposure which is countercyclical, or if their risks are primarily international and less impacted by national scenarios.

22 conservative estimate of potential losses over the business cycle. The shocks applied by the IIFS should have some reference to, but not be bound by, historical events nor be so large that the exercise becomes purely hypothetical. 58. In accordance with the principle of proportionality, stress tests should feature the most material business areas and events that might be particularly damaging for the IIFS. This could include not only events that inflict large losses but also those which subsequently cause damage to the IIFS’s reputation. IIFS management should have appropriate policies in place to identify sources of reputational risk when entering new markets, products or lines of activity. In addition, an IIFS’s stress testing procedures should take account of reputational risk so that management has a firm understanding of the consequences and second-round effects of reputational risk.32 In regard to reputational risk, the stress testing programme should pay particular attention to Sharīah non￾compliance risk, as well as to fiduciary risk which may result in reputational risk, having systemic implications for both IIFS and the IFSI. (See Section 3.3.7 for further detail on Sharīah non￾compliance risk.) 59. It is also important for IIFS to pursue more thorough analyses of risk transmission and contagion mechanisms (including “ripple and reinforcing effects” from a primary stress scenario extending to other markets or products) and also to reflect better risk correlations which may vary in stressed conditions. In addition to taking into account the cross-sectoral effects, an IIFS should also consider taking into account the contagion effects or risk transmission between the conventional financial system and the Islamic financial system (i.e. risks arising from practices in the conventional system impacting the IIFS, and vice versa), due to the interconnectedness of the counterparties in the overall financial system. Hence, an IIFS should construct scenarios of potential magnitude bearing in mind the extent of second-round effects of the intensification of international market duress. An IIFS should capture the second-round effects that might arise from the original shock (e.g. the increase in real estate prices is likely to affect the retail consumers’ and investors’ debt servicing capability as well as the property sector).33 The stress testing techniques should also be able to account endogenously for cross-border transmission channels for risk, including cross-border contagion between IIFS. The specific methodology to determine the relevance of the second-order effects to its business, and to link the second-layer risk elements to the first-layer risk factors, is left to the IIFS. The IFSB acknowledges the challenges of incorporating these second-round effects and understanding the complexity of the links between the scenarios. However, an IIFS may wish to consider the second-round effects via their impact on macroeconomic factors. IIFS should note that certain macroeconomic factors that may not have been directly affected by the original shock may be affected by the consequences of that shock (i.e. when one event subsequently triggers another event, requiring IIFS to include “correlation and multi-correlation” analysis in the stress testing). 60. Distributions are said to have “fat tails” when extreme events that would appear highly unlikely according to a normal probability distribution are shown as being substantially more likely if the distribution is recognised as having “fatter” tails than the normal distribution. Hence, assuming a normal distribution may be misleading and dangerous if a fat-tailed non-normal distribution is more descriptive of the actual distribution of the events. Extreme events lying under the “fat tails” of such non-normal distributions should be incorporated in the stress testing (along with the internal and external considerations) by employing multiple-scenario stress tests to differentiate the severity of the downside risks for such extreme events (i.e. the risk of multiple standard deviation moves that are highly unlikely according to the normal distribution) that could expose the portfolio of the IIFS to vulnerability. Although, in the main, stress tests are developed through scenario analysis, the scenarios should not be limited to the macroeconomic situations, but should include other potential events that are triggered by regulatory or market changes. All stress testing scenarios should be accompanied by an indication of the estimated probability of the event occurring. An action plan

32 See BCBS’s consultative document on “Proposed Enhancements to the Basel II Framework”, January 2009. 33 Similarly, for instance, an IAH’s withdrawal risk and Sharī`ah non-compliance risk can have severe second-round effects in terms of affecting IIFS’s liquidity and reputational risk that need to be captured in the stress testing.

23 containing triggers and related management action should be developed and executed if the results of the stress test lead to concerns.34 3.3 Specific Elements of IIFS in Stress Testing 61. Given the specificities of IIFS, as part of an overall stress testing programme an IIFS should aim to take account of specific elements in the programme. Hence, the approach of stress testing to be applied to the IIFS’s operations may differ from that applied to its conventional counterparts. The specific elements that require stress testing coverage which must be covered in the stress testing programme include, but are not limited to, the following: (i) funding composition, including IAHs; (ii) various perspectives on capital adequacy; (iii) credit risk factors and the effectiveness of Sharīah￾compliant risk mitigation techniques; (iv) market risk factors, including Sharīah-compliant securitisation; (v) specific portfolios; (vi) liquidity risk factors and various unique perspectives; (vii) Sharī`ah non-compliance risk leading to legal and related reputational risk; and (viii) off-balance sheet exposures. With respect to specific elements, it should be noted that the list described above is not exhaustive for IIFS. For this list, the Guiding Principles do not provide the relative weights that elements should be given in reaching conclusions on stress testing from an IIFS and supervisory perspective. However, IIFS should consider the range of scenarios with different severities and appropriate magnitudes of shocks for these elements in the stress testing methodologies employed at the IIFS level. These elements are presented in detail in Principles 3.9 to 3.16. 3.3.1 Specific scenarios to account for the presence of IAHs Principle 3.9: An IIFS should include in its stress testing programme the specific scenarios to account for the various perspectives of profit sharing IAHs, unrestricted IAHs and, in some circumstances, restricted IAHs. The Governance Committee (or an equivalent committee) as an integral part of the overall governance for the stress testing programme should be involved when developing stress scenarios related to IAHs and subsequently assessing the results of stress testing on the IAHs. 62. The majority of IIFS get a major part of their funding from unrestricted IAHs. Stress tests need to encompass the assets financed by unrestricted IAHs which are commingled with those financed by the IIFSs’ own funds, current accounts, etc. While in principle unrestricted IAHs bear the credit and market risks arising from the assets financed by their funds, shocks to these assets cannot be ignored as they are likely to have repercussions for the IIFS, such as DCR. In contrast, restricted IAHs are separate managed funds which are not commingled with other funds of the IIFS. Shocks to the assets of these funds will generally not have the same repercussions as shocks to those of unrestricted IAHs. This indicates a need for specific stress testing scenarios to account for the various perspectives of IAHs and their treatment by IIFS in practice. The specific stress testing issue relating to the IAHs (either unrestricted IAHs and/or restricted IAHs) can help the IIFS understand the impact on its liquidity and, possibly, solvency. However, for the reasons noted above, this requires a distinction between unrestricted IAHs and restricted IAHs, whether reported on￾balance sheet or off-balance sheet. 63. IIFS should assess the following aspects in different scenarios while conducting stress testing on IAHs: a. how IAH are treated in the IIFS in its respective jurisdiction (i.e. whether (i) IAHs are like investors who bear all risks of losses on their investment (absent misconduct or negligence on the part of the IIFS), so that the PSIA or IAH are risk absorbent in regard to the assets financed by their funds; or (ii) IAHs are a liability of the IIFS and hence the

34 The Survey indicated that stress testing provides a reasonable assessment of potential losses which assist an IIFS to better understand the nature of its risks. It also revealed that some IIFS use the “Monte Carlo” simulation method for pre-defined scenarios of their exposures, in which the simulation tool will run various scenarios using a statistical tool within defined parameters and will pick the worst scenarios within defined confidence intervals. The scenarios chosen will indicate a “worst case scenario or maximum loss possible”; as a result, the IIFS ensures that it has adequate capital and liquidity to handle extreme events.

24 IIFS bears all the risks of losses on their investment; or (iii) IAHs are only partially risk absorbent so that the IIFS bears part of the risks of losses on their investment); b. the likelihood of the IIFS’s paying the principal and profit to the IAHs on maturity in normal circumstances and in a financial distress situation; c. DCR and the IIFS’s ability to maintain a competitive rate of return to unrestricted IAHs; d. withdrawal risk of IAHs’ funds; e. the existence of reserves such as the profit equalisation reserve (PER) and investment risk reserve (IRR); and their possible mitigating effect on DCR and withdrawal risk; f. impacts of unrestricted IAHs’ (and possibly restricted IAHs’) funding on the IIFS’s liquidity and solvency; and g. explicit or implicit Sharīah-compliant deposit insurance (Takāful) schemes, and any other schemes such as government or central bank guarantees, protecting unrestricted IAHs. 64. Given the practice of smoothing the profits payouts to IAHs across jurisdictions, IIFS should be aware while conducting stress testing that there is an essential difference between “smoothing” profit payouts by reducing the shareholders’ share, and covering losses, which is not Sharīah￾compliant unless an IRR is used or it is by “donation without any contract” (i.e. Hibah). (See IFSB Guidance Note on the Practice of Smoothing the Profits Payout to IAHs, hereinafter “GN-3”.) 65. The Governance Committee (or an equivalent committee) as an integral part of the overall governance for the stress testing programme should be involved when: (i) developing stress scenarios related to IAHs; (ii) conducting stress testing related to IAHs by taking into account the factors mentioned above; (iii) subsequently assessing the results of stress testing on the IAHs; and (iv) reviewing the severity of the scenarios in terms of their potential impact on the IAHs. The role of the Governance Committee regarding the stress testing from the perspective of the unrestricted IAHs should be well defined and the committee should receive up-to-date information on the stress testing operations related to unrestricted IAHs (see also paragraphs 30, 38 and 39). 3.3.2 Capital assessment capturing various unique perspectives Principle 3.10: An IIFS’s stress testing programme should include a sufficient element of capital assessment, capturing various unique perspectives at all times under the defined scenarios. IIFS should evaluate the reliability of their capital planning (including the assumptions used) based on stress test results. Stress tests under ICAAP should be consistent with an IIFS’s risk appetite and strategy, and incorporate credible mitigating management actions. IIFS should assess and be able to demonstrate their ability to remain above the regulatory minimum capital requirements during a stress situation that is consistent with their stated risk appetite. 66. An increase in capital requirements by regulators/supervisors may push the IIFS to cut financing and thus decrease the availability of financing for individuals and corporations. The possibility of such an increase should be included by IIFS in their stress testing programmes, with appropriate reference to the capital adequacy standard (IFSB-2). Such stress testing programmes should determine whether an IIFS is well capitalised under normal and stressed conditions. Where an IIFS has raised funds in the form of PSIA (and especially unrestricted PSIA), the programme should take account of them as indicated in paragraph 63(a) above. IIFS should give special attention to the absorption element of PSIA and its impact on capital adequacy. 67. Other issues such as procyclicality should be included in stress testing programmes with reference to additional capital buffers that may be required. IIFS should also be mindful of the recent changes to the capital framework presented in the international framework while conducting the stress testing on their capital assessment. In addition, IIFS should include the following factors in stress testing related to capital adequacy: a. expectations regarding economic conditions; b. inherent risks of the IIFS’s exposures and business activities; c. the quality of the IIFS’s balance sheet assets and off-balance sheet commitments;

25 d. the amount of its off-balance sheet commitments; e. the composition and quality of its eligible capital; f. the sources of additional capital (e.g. ordinary shares or Sukūk) when supervisory authorities determine that the institution requires additional capital; and g. the time-period permitted by the industry supervisor for raising additional capital if events have led to a lack of capital adequacy. 68. While calculating the capital adequacy of an IIFS, when the supervisory discretion version of the capital adequacy ratio (CAR) formula is applied, a proportion – “α (alpha)”35 – of the RWA financed by PSIA is included in the denominator of the CAR. In other words, the risk weights are applied to the proportion α (alpha) of the assets financed by PSIA, and the result is included in the denominator of the CAR. IIFS should cover in stress testing the impact on capital adequacy of a hypothetical supervisory adjustment of “α (alpha)” to a higher value under normal conditions and under stressed conditions. This should help an IIFS to know how its capital adequacy will be affected under different values of the “α (alpha)” and the implications of the stressing. To account for the potentially higher DCR during stressed conditions, IIFS should aim to incorporate historical data from significant stressed periods, where available, to reflect the “stressed alpha”. In regard to α (alpha), IIFS should refer to the IFSB Guidance Note in Connection with the IFSB Capital Adequacy Standards: The Determination of Alpha in the Capital Adequacy Ratio (hereinafter “GN-4”). 69. In this connection, IIFS should note that DCR is likely to be higher during stressed conditions, as investment returns tend to be lower, increasing the need for an IIFS to draw upon its reserves/shareholders’ funds in order to maintain the same level of payout to IAHs. Account also needs to be taken of special reserves such as PER and IRR, which may be utilised to mitigate DCR, and whether they are sufficient to cover unexpected losses at IIFS. Different stress testing scenarios will be needed to absorb abnormal shocks in times of stress. IIFS should bear in mind that the practice of forgoing part or all of the shareholders’ profits may adversely affect the IIFS’s own capital and hence its capital adequacy. 70. Stress test results should be used to assess the viability of the IIFS’s capital plan in adverse circumstances. To be effective for capital planning purposes, a range of scenarios should be considered, including at least an adverse economic scenario that is severe but plausible, such as a severe economic downturn and/or a system-wide shock to liquidity. The stress should be IIFS-wide and cover all relevant risk areas and material entities within the IIFS, and scenarios used for the capital planning stress test should take account of all relevant material risks to which the IIFS is exposed. In this perspective, the objective of the capital planning-related stress testing should be to indicate how an IIFS can meet its capital requirements at all times throughout a reasonably severe economic recession. Stress tests under ICAAP should be consistent with an IIFS’s risk appetite and strategy, and contain credible mitigating management actions (see paragraph 33).36 In this context, IIFS are expected to exhibit a clear link between their risk appetite, business strategy, capital planning and stress testing programmes. 71. In particular, an IIFS should assess and be able to demonstrate (by credible management actions, plans and other concrete steps, including changes in business strategy, reinforcing the capital base and/or other contingency plans) its ability to remain above regulatory minimum capital requirements during a stressed situation that is consistent with its stated risk appetite. The assumptions used in the capital planning stress tests should be accurate with respect to the IIFS’s possible behaviour during a time of stress and should be consistent with its stated risk appetite and business strategy. Resulting management actions based on changes to business strategy should be identified, discussed and agreed at the most senior levels of the organisation if they are to be considered credible. Mitigating management actions designed to reduce the impact of a stressed

35 “Alpha (α)“ refers to the proportion of assets funded by unrestricted PSIA the credit and market risks of which are deemed to be borne by the IIFS and which is to be determined by the supervisory authorities. The value of α would therefore vary based on the supervisory authorities’ discretion on a case-by-case basis. If “alpha” is 0, then all RWA corresponding to the unrestricted IAH funds are excluded from the denominator. If “alpha“ is 1, then traditional CAR applies, with CAR applying to all on-balance sheet assets. 36 IIFS should note that the ICAAP promotes the adoption of a more forward-looking approach to capital management and encourages them to develop and employ more rigorous risk management techniques.

26 event should be clearly documented, including explanations that justify the credibility and feasibility of those actions in a stressed environment. For example, actions such as asset sales, capital raising, capital injections from other parts of the group and rapid shifts in business strategies should all be treated with caution in times of stress. 3.3.3 Credit risk factors and effectiveness of risk mitigation techniques Principle 3.11: An IIFS should take into account various aspects of credit risk in its stress testing techniques covering, inter alia, non-performing financing and highly leveraged counterparties, in order to determine the overall soundness of the IIFS, particularly in the case of economic downturns. Stress testing should assess future credit exposures and changes in capital requirements due to, for example, changes in credit quality and collateral values. It should also encompass securitisation exposures as originator, issuer, sponsor, manager, etc. as reflected by credit conversion factors (CCFs). The effectiveness of risk mitigation techniques that are Sharīah-compliant should be systematically challenged. 72. IIFS exposed to credit risk as a material risk are subject to credit risk stress testing. For credit risk, the role of stress testing is to identify the possible changes in economic conditions that could have unfavourable effects on credit exposures, like the downturns in the economy in general and in particular parts of the economy, market risk events and liquidity conditions. However, IIFS should be aware that it may be a difficult task to stress test the financing portfolio, as it includes stressing a number of variables such as probability of default, recovery rates, collateral values, and rating migration probabilities. In regard to stressing the IIFS’s financing portfolio, an individual financing portfolio may be stressed based on materiality (see also “consumer credit portfolio stress testing” under Principle 3.13) or the significant counterparties, or the total financing portfolio may be stressed. Stress testing a credit financing portfolio should provide an IIFS with insight into a borrower’s ability to withstand adversity from various factors, thereby facilitating a more constructive approach to extend the financing and more accurate pricing commensurate with the risk. 73. In particular, the stress scenarios taking account of non-performing financing (NPF) may be highly relevant in determining the overall soundness of the IIFS, particularly in the case of economic downturns. In this perspective, stress testing will reflect how an IIFS will be affected given various defaults that increase NPF and erode net income and capital. IIFS should make a comprehensive assessment of the possible defaults (on either total or selected portfolios) in the stress testing given certain restrictions on recovery mechanisms under various Sharīah-compliant contracts such as Murābahah, Mu
ārabah and Mushārakah, Dimishing Mushārakah, Ijārah or Ijārah Muntahia Bittamlīk (IMB). IIFS should also include the following factors in stress testing related to credit risk: a. decline in domestic economic activity; b. assessment of eligible counterparties (retail, corporate or sovereign) in different Sharī`ah￾compliant contracts; c. impacts of rating migrations of counterparties (i.e. historical default experience of IIFS of counterparties within specific rating classes (AAA, AA, A, etc.) available from rating agencies) under the standardised approach and it impacts on RWA in capital adequacy; d. increased capital requirements on certain counterparty credit risk; e. recovery rates and shifts in NPF; f. permissible and enforceable collateral and guarantees, and limits on the degree of reliance and the enforceability of collateral and guarantees; g. early settlements which are permissible; h. risks associated with own exposures in parallel transactions (e.g. Istisna and Salam); i. sufficient Takāful coverage of the value of the assets subject to availability; j. policy for determining and allocating provisions for doubtful debts (including counterparty exposures) and for estimated impairment in value of leased assets; k. the forced defaults (due to cash flow shortages) and planned defaults (higher probability of default by counterparties and loss given default); l. deterioration of macroeconomic variables (e.g. significant rise in benchmark rates affecting an IIFS’s net financing margin); and

27 m. likelihood of legal or regulatory risks in the case of default based on the jurisdiction involved (i.e. country risk considerations where the transaction is cross-border) and experience with counterparties based on the jurisdiction. 74. Enhancing stress testing approaches for highly leveraged counterparties is appropriate when considering vulnerability to specific asset categories or market movements, and when assessing potential wrong-way risk related to Sharīah-compliant risk mitigating techniques. IIFS may have large gross exposures to leveraged counterparties including financial guarantors, investment banks and CMT counterparties that may be particularly exposed to specific asset types and market movements. Under normal conditions, these exposures may be secured by Sharīah-compliant collateral; nevertheless, in cases of severe market shocks, these exposures may increase abruptly and potential cross-correlation of the creditworthiness of such counterparties with the risks of the assets being hedged may emerge (i.e. “wrong-way risk” or “wrong-way exposure”).37 IIFS may enhance their stress testing approaches related to these counterparties in order to capture adequately such correlated tail risks. IIFS engaged in international financing may face additional risk, the most important of which is country risk (or sovereign risk), which encompasses the entire spectrum of risks posed by the macroeconomic, political and social environment of a country that may affect the performance of clients and should be well captured. 75. IIFS should note that, although they use the standardised approach for calculation of credit risk capital requirements, they need to challenge in stress testing the assumptions behind these standardised risk weights in stress testing their credit risk exposures. In this perspective, stress tests should assess future credit exposures and changes in capital requirements due to, for example, changes in credit quality and collateral values. Collateral values of residential real estate may be a relevant risk driver for IIFS using the standardised approach, whereas credit quality effects include changes in the risk weights of externally rated companies (i.e. those rated by external credit assessment institutions) and changes in past due credits. IIFS should also consider changes in credit quality not only in financing but also in trading, which raises counterparty credit risk issues. In computing the effect of stress tests on capital requirements, IIFS may use methodologies coherent with the standardised approach, which require developing a link between internal risk parameters and regulatory weights. When an IIFS uses external ratings it can infer, by movements of the internal risk estimation, the rating migration (see also paragraph 73(c) above). Evaluation of credit risk in stress testing should also encompass an IIFS securitisation exposure as originator, issuer, sponsor, manager, etc. as reflected by credit conversion factors (CCFs)38 . 76. IIFS should bear in mind that Sharīah requirements restrict what risk mitigation techniques may be used (e.g. IIFS cannot buy credit swaps, credit protection through options and derivatives, CDS, etc.) and this may have an impact on the need for collateral. It is recognised that the Sharīah￾compliant risk mitigation techniques used by IIFS may vary in scope, nevertheless, IIFS should consider challenging in their stress testing the effectiveness of their existing Sharīah-compliant risk mitigation techniques in relation to credit risk and other risks such as market risk and liquidity risk. Stress testing should facilitate the development of Sharīah-compliant risk mitigation or contingency plans across a range of stressed conditions. The performance of risk mitigating techniques such as Sharīah-compliant hedging and the use of collateral should be challenged and assessed systematically under stressed conditions when markets may not be fully functioning and multiple IIFS could be simultaneously pursuing similar risk mitigating strategies. IIFS should refer to IFSB-2, which has outlined the possible Sharīah-compliant risk mitigation techniques which are employed by the IIFS while managing credit risk.

37 The terms “wrong-way risk” and “wrong-way exposure” are often used interchangeably. The concept of wrong-way exposure can be extended to any specific risk factor. Wrong-way risk arises when exposure to a counterparty is adversely correlated with the default risk of that counterparty. That is, it arises when default risk and credit exposure increase together. There are a number of ways to deal with the problem of wrong-way exposures, including model correlation and sensitivity analysis. 38 When referring to securitisations, it is customary to use the term “exposures” referring to either (the credit risk of) assets involved in the securitisation, or other exposures such as those resulting from credit enhancements or from acting as issuer, manager, sponsor or servicer. See IFSB-7 for more details.

28 3.3.4 Market risk factors and stress tests for Sharīah-compliant securitisation Principle 3.12: IIFS should take into account various positions in the Sharīah-compliant financial instruments in trading portfolios considering a range of exceptional but plausible market shocks as part of their IIFS-wide stress testing. Dependencies among different markets and sectors, and consequentially increasing correlations, should be factored into stress testing. Stress testing for holders of Sharīah-compliant securitisation should consider, inter alia, exposure to market risk of the underlying assets, including their exposures to systematic market factors, market liquidity factors, as well as legal risk and relevant contractual arrangements and embedded triggers in Sharīah-compliant securitisation structures. 77. With respect to market risk stress testing, IIFS should test their positions in Sharīah￾compliant financial instruments in trading portfolios along with underlying risk factors and a range of exceptional but plausible market shocks as part of their IIFS-wide stress testing. An IIFS should calculate the changes in the market value of its trading portfolios on the basis of pre-defined scenarios. Stress testing should, as far as possible, be conducted on an IIFS-wide basis, taking into account the effects of unusual changes in market and non-market risk factors. Such factors may include prices, volatilities, market liquidity, historical correlations and assumptions in stressed market conditions, the IIFS’s vulnerability to worst case scenarios or the default of a large counterparty, and maximum cash inflow and outflow assumptions. IIFS should note, particularly, its portfolio is consists of many financial assets as presented below, including (among others) investments in Sukūk, which are prone to market shocks, therefore stressing that Sukūk investment is crucial for the IIFS. The results of market risk stress testing should be reflected in the policies and limits regarding market risk exposures, especially where stress tests reveal a particular vulnerability to a given set of circumstances. The following aspects should be included in an IIFS’s stress testing to capture portfolio-specific and overall risk: a. different types of Sukūk investment in a trading book and/or banking book; b. fluctuations in values in tradable, or marketable, assets (including Sukūk); c. equities (stocks) (including those in liquid and non-liquid markets); d. current and future volatility of market values of specific assets (e.g. the commodity price of Salām assets, the market value of Sukūk, and the market value of Murābahah assets held in inventory to be delivered over a specific period); e. foreign exchange fluctuations and volatility arising from general foreign exchange spot rate changes in cross-border transactions (i.e. having short and/or long positions in foreign exchange); f. valuation of assets where no direct market prices are available; and g. position limits (whether short, long or net), stop-loss provisions (i.e. a predetermined loss￾exposure market limit) and stressed VaR. 78. The market risk factors cited above are not exhaustive. Depending on the Sharīah￾compliant instruments traded by an IIFS, exposure to other factors may also arise. The IIFS’s consideration of market risk should capture all risk factors to which it is exposed, and it should manage these risks soundly as market risk is often propagated by other forms of financial risk such as credit and market-liquidity risks. For example, a downgrading of the credit standing of an issuer could lead to a drop in the market value of Sharīah-compliant securities (i.e. Sukūk) issued by that issuer. Likewise, a major sale of a relatively illiquid Sharīah-compliant security by another holder of the same security could depress the price of the security. IIFS should also supplement the VaR technique with stress testing techniques employed for certain market risk portfolios. 79. Dependencies between different markets and sectors, and consequentially increasing correlations (i.e. correlations between markets, and between categories of risk when evaluating its risk positions), should also be factored in. These correlations could result in the transmission of shocks from stressed conditions in one market to other markets, or may significantly increase the aggregate risk to the IIFS, although individual risks, such as market and credit risks, may appear manageable when viewed independently. Due to such correlated risks, an IIFS's risk tolerance could be exceeded and the IIFS could incorporate risk correlations in their risk assessments through

29 appropriately constructed scenarios in stress testing. However, stress tests should assume that if volatility increases then the correlation may not hold; therefore, higher volatility is associated with larger losses. An IIFS may choose scenarios based on either analysing historical data or empirical models of changes in market risk factors. The objective should be to allow the IIFS to assess the effects of sizeable changes in market risk factors on its holdings and financial condition. The stress tests applied, and the calibration of those tests, may reflect, inter alia: (a) the nature of the portfolios; (b) the trading strategies of the IIFS; and (c) the possibility, and time it could take, to hedge out or manage risks under severe market conditions. An IIFS whose trading and other Sharīah-compliant financial activities are limited in volume, scope and complexity may use less sophisticated methodologies (see Section 3.4.1 for details). 80. The significance of conducting stress testing on Sukūk as a result of Sharīah-compliant securitisation emerges from the fact of some recent Sukūk defaults which have highlighted the importance of conducting stress testing for IIFS, whether they act in the capacity of a Sukūk investor, or an originator or servicer of a Sukūk issuance. (See IFSB Capital Adequacy Requirements for Sukūk, Securitisations and Real Estate Investment, hereinafter “IFSB-7”, for more detail on securitisation exposures.) In the current situation, where Sukūk are not actively traded due to the fact that most of them are held for liquidity purposes and not for trading, the major risk arising from Sukūk could be the credit risk or default risk. However, as the Sukūk market develops, market risk arising from Sukūk held for trading may be material. Different perspectives associated with all these roles require IIFS to include in their stress testing programmes various aspects of Sharīah-compliant securitisations. Amongst the factors to be included in the stress testing programme should be the following: a. market risk from holding securitisation exposures; b. relevant contractual arrangements and embedded triggers in securitisation structure; c. careful assessment of the risks associated with commitments to off-balance sheet vehicles (i.e. special purpose entities (SPE)) and other related entities in their stress testing programmes;39 d. exposure to market risk of the underlying assets and their exposure to systematic market factors, market liquidity factors and legal risk; e. risks of losses associated with underlying assets and nature of the ownership of the assets underlying Sukūk; f. whether the Sukūk are subject to refinancing or restructuring; g. assessment of the possibility of a ratings migration downward (i.e. when a rating is downgraded by several notches suddenly by the external credit assessment institution and its related impacts on the Sukūk issuance; h. liquidity facilities available for securitisation exposures and the effectiveness of credit enhancement in normal and stressed conditions; i. structures that are exposed to exchange rate movements and the effectiveness of Sharīah-compliant hedging, if part of the structure; j. effects related to the subordination level of the specific tranches; k. default and legal risk (i.e. legal risk arising from the interaction between a Sharī`ah contract and civil law, particularly relevant to the issuance of certain Sukūk, such that the downside risk of the Sukūk includes legal risk. Further, in certain jurisdictions judicial precedents may have no binding effect on subsequent decisions, thus amplifying legal uncertainty and hence legal risk); and l. capital treatment for the securitisation exposures where the IIFS is involved in different roles as stated above.

39 It should include scenarios assessing the size and soundness of such vehicles relative to their own financial, liquidity and regulatory capital positions. This analysis could include structural, solvency, liquidity and other risk issues, including the effects of covenants and triggers.

30 3.3.5 Stress tests on specific portfolios Principle 3.13: IIFS should perform stress testing on specific portfolios covering, inter alia, consumer credit portfolios (i.e. Murābahah and Ijārah consumer financing), home purchase mortgage financing portfolios (whether by Murābahah, Ijārah or Diminishing Mushārakah contracts), real estate (including investment and financing), commodity Murābahah transactions, and equity investments (i.e. Mu
ārabah and Mushārakah investments). Consideration should be given to changes in correlations between risks that the IIFS identifies for a given portfolio. 81. Stress testing programmes should encompass all the material risks at various levels arising from specific portfolios using both sensitivity and scenario analysis. This requires IIFS to identify stresses that are severe with respect to a specific portfolio. For instance, in the case of a home purchase (mortgage) portfolio, a large decrease in house price, high unemployment and a decline in GDP provide a severe scenario. Other portfolios, such as CMT-based financing and equity-related exposures as discussed below, are exposed to different risk drivers; therefore, a different stress scenario should be applied. IIFS should ensure they stress portfolios and business units in order to identify risk concentrations (see paragraph 54) that may arise. For example, a credit risk stress across asset classes and portfolios may identify potential concentrations between retail and corporate exposures. IIFS should perform stress tests taking into account changes in correlations between risks in various portfolios and recognising interactions between risk types, such as market and credit risk, particularly in times of stress (see paragraphs 48 and 79). 82. IIFS should be aware that having concentrated exposures in a specific portfolio such as a consumer credit portfolio, real estate (including investment and financing), CMT-based financing or equity investment (under Mu
ārabah and Mushārakah) may have the potential to expose them to the increased risks of investment losses on the one hand, and rising NPF on the other, adding to the vulnerability of the IIFS. An IIFS may be exposed to real estate market risk through both real estate investments and financing of real estate acquisitions by clients through IMB contracts. The proper assessment of any disproportionate exposures demands the establishment of a rigorous stress testing programme that enables an IIFS to make periodical assessments of these exposures and their implications. The illustrations of certain portfolios as discussed below based on their vulnerabilities are not exclusive and should be referred to as examples. Therefore, IIFS should specify their own portfolios according to risk profiles and concentrations. For instance, the exposures arising from real estate related portfolios may be an issue in some jurisdictions but not in others. The IFSB notes that as the market develops, these examples may be replaced with new ones, or new portfolios may be considered in addition to existing portfolios that would need to be captured in the stress testing. Consumer credit portfolios (retail portfolios) 83. For IIFS that are active in the retail market, consumer credit portfolios based on Sharī`ah￾compliant contracts such as Murābahah, Mu
ārabah and Mushārakah, Dimishing Mushārakah, Ijārah or IMB should be well captured in their stress testing programmes. Stress testing of consumer credit portfolios may require a more granular approach and entail more demanding data requirements than corporate credit portfolios Various aspects listed under credit risk (see Principle 3.11), market risk (see Principle 3.12) and liquidity risk (see Principle 3.14) can be applied by the IIFS to stress test consumer credit portfolios while bearing in mind the interaction of these risks. 84. The following aspects, inter alia, should be borne in mind by IIFS in designing their stress testing programmes for credit portfolios: a. both idiosyncratic (borrower-specific) and systemic (economic) factors; b. various concentration dimensions to be assessed, including industry sector, geographic spread, credit rating, customer segment, and exposure to single counterparties or groups of related counterparties; c. strong seasonal effects in consumer credit losses, and effects from product and operational policies;

31 d. consumer retail portfolios including, among others, credit cards/lines of credit cards, instalments financing, etc., based on various Sharīah-compliant contracts; e. delinquencies or loss rate increase by certain basis points (bps) and falling credit scorecard; f. failure in collections systems and processes; and g. secured vs. unsecured consumer credit. Real estate risk concentration 85. Real estate risk concentrations are common among IIFS, and such exposures may also be subject to geographic concentration. Such concentrated exposures in real estate can expose IIFS to the various prudential risks that need to be addressed in stress testing, especially as Sharīah￾compliant hedging may not be available, and risk transfer via Sharī`ah-compliant securitisation may be difficult to achieve. For instance, in the case where IIFSs in the same jurisdiction have homogenous exposures to the real estate market, if many IIFS are making pessimistic assumptions about the real estate projects they are funding, there may be systemic effects such that industry members as a whole may find it difficult to exit from their investments without substantial losses or within a reasonable time frame. IIFS should refer to IFSB-7 on the matter of the capital adequacy implications for real estate exposures from investment and from financing. A stress scenario should factor in the following aspects in real estate related stress testing: a. type of activity (i.e. financing or investment, or both, as applicable); b. concentration level of risks, including both investment and financing where applicable; c. exposure limits (i.e. limits to individual developer, allowable investment limits, types of properties and overall sectoral exposure) set by the BOD and/or regulator for investment and/or financing; d. significant drop in property prices and considerable drops in other markets; e. related macroeconomic variables (e.g. cost of capital); f. a fall in forced sale values of mortgage collaterals or IMB asset values; g. a surge in the cost of construction; h. rating migrations of counterparties representing credit risk concentrations; i. diversification of investment and/or financing; and j. legal framework or legislation for real estate.

86. To avoid excessive sectoral exposure risk, IIFS should institute appropriate and effective controls including stress testing to determine whether the overall exposure to real estate is consistent with the IIFS’s business strategy and within the tolerance level defined by the internal policies as approved by the BOD. While the range of possible scenarios being considered by IIFS for the exposures in real estate will vary from micro to macro perspectives, an IIFS should consider plausible scenarios taking into account the above-mentioned aspects for the real estate sector and continuously assess any potential adverse implications of prevailing market conditions for the exposures. An IIFS may relate its range of scenarios with respect to real estate to “sensitivity tests” as discussed in Section 3.4.1. Commodity Murābahah transactions
87. Commodity Murābahah transactions may give rise to various types of exposures on either side of the balance sheet which need to be included in stress testing programmes. (See the IFSB Guidance Note on CMT, hereinafter “GN-2”.) CMT with short maturities may be used for liquidity management as a substitute for the conventional interbank market. Such CMT on the assets side give rise to counterparty credit risk, while those on the liabilities side may give rise to refinancing risk. In addition, CMT may be used as follows: (i) to take term deposits (via reverse Murābahah) which are typically fairly short-term and must be repaid on maturity, thus entailing refinancing risk40 under

40 Refinancing (or rollover) risk is the risk of being short of liquidity if rollover of funding does not occur, and can be a very serious factor in liquidity risk. Rollover occurs when parties to the CMT renew or roll over a CMT arrangement upon its

32 stressed conditions; and (ii) to originate term loans, which involve credit risk. GN-2 has highlighted several prudential risks, including additional counterparty credit risk (i.e. exposure to broker) in the case of over-the-counter (OTC)41 transactions arising out of CMT, which should be included by IIFS in their stress testing programmes. Similarly, IIFS should also take into account the possible acute asset–liability mismatches when CMT deposits are used to finance longer-term assets. 88. One of the issues that need to be stressed is “market impact risk” arising from CMT. For instance, heavy use of CMT by a large number of IIFS could have an impact on commodity prices through “crowded trades” (i.e. numerous IIFS having homogenous exposures in CMT in a particular commodity in a market with insufficient depth, with a consequent risk of high unwind costs or illiquidity in a rush for the exit, which could result in a form of systemic risk in times of stress). The “crowded trades” can inflate prices during a bubble, and they often collapse violently in a "rush to the exits" on the way down. IIFS may not realise the extent to which everyone else in the market is exposed to the same risk. IIFS should handle the “market impact risk” through stress testing exercises for possible systemic impact. The stress testing on CMT should be comprehensive enough to consider all types of possible scenarios that may trigger the systemic “market impact risk”.42 To limit excessive leverage or over-concentration through CMT contributing to systemic risks, IIFS may stress, inter alia, ex-ante caps, in terms of intra-day gross turnover and/or cumulative net outstanding positions in CMT at any point in time in normal and distressed circumstances. Equity investment (under Mu
ārabah and Mushārakah) exposures 89. The distinct risk profile of Mushārakah and Mu
ārabah contracts which is a form of equity participation may expose the IIFS to various types of risks, such as counterparty credit risk, market risk, liquidity risk and reputational risk. Based on the materiality or significant involvement of the IIFS in Mushārakah- and Mu
ārabah-related exposures, the IIFS should establish and conduct a rigorous stress testing that enables periodic assessment of the invested entities and portfolios, and of any implications for the equity position of the IIFS. Appropriate policies and procedures on stress testing for Mushārakah- and Mu
ārabah-related exposures should be clearly specified and communicated. There should be a systematic process to regularly review and update the Mushārakah and Mu
ārabah policies, processes and limits, to take into account the risk appetite of the IIFS and changes that take place in the IFSI. Stress testing should be able to detect and provide best estimates of losses and determine a prudent level of provision for the exposures to Mushārakah and Mu
ārabah contracts. IIFS should recognise that, by nature, equity investment is exposed to a confluence of risks associated with a Mu
ārib or Mushārakah partner, business activity and operations. The capital adequacy requirements as stated in IFSB-2 for exposures based on Mushārakah and Mu
ārabah should be subject to the stress testing. 90. As mentioned in IFSB-1, the capital invested through Mushārakah and Mu
ārabah may be: (i) used to purchase shares in a publicly traded company or privately held equity; or (ii) invested in a specific project or portfolio, or through a pooled investment vehicle. In the case of a specific project, IIFS may invest at different investment stages. In terms of option (ii), IIFS should be prepared for delays and variations in cash-flow patterns and possible difficulties in executing a successful exit strategy. This requires IIFS to stress these cash flows by identifying and monitoring the transformation of risks at various stages of investment life cycles. When IIFS employ different financing instruments (one of which may include Mushārakah) at different contract stages, each of which may give rise to different risks, they should stress those factors that may affect the expected

maturity. IIFS should be cautious in their use of rollover (or refinancing) because Sharī`ah does not allow the rollover (or refinancing) unless the initial contract is being terminated before the customer can enter into a new contract. 41 Since the majority of commodity trades are done through OTC contracts traded through a network of brokers and dealers, commodity markets are particularly opaque. Consequently, since OTC data are not available through exchanges, it is difficult to know precisely what the market is trading at any given time. In addition, since IIFS are engaged in multiple trading relationships, IIFS may not have a full picture of the counterparty’s leverage or its other risk exposures. A reference is made to IFSB GN-2; see GN-2 for more details. 42 GN-2 noted that extensive use of CMT, and larger exposures in CMT using trades in commodities (e.g. metals, CPO, etc.) in some jurisdictions, induces greater volatility in the prices of these commodities, which eventually introduces greater market risk – that is, the volatility of prices at which these commodities can be bought and sold.

33 volume and timing of cash flows for both returns and capital gains arising from equity investments. In all cases, the stress testing should include considerations as to the quality of the partner (i.e. the risk profiles of potential partners: a Mu
ārib and/or Mushārakah partner), underlying business activities and ongoing operational matters. 3.3.6 Liquidity risk factors and simultaneous pressures in funding and asset markets Principle 3.14: An IIFS should assess a broad range of liquidity risk factors and various unique perspectives in its stress testing techniques with the aim of enabling it to evaluate its ability (i) to meet its financial obligation at any time arising from funding and assets/market liquidity exposure, and (ii) to identify sources of potential liquidity strain, ensuring that current exposures remain in accordance with the IIFS’s established liquidity risk tolerance. As part of liquidity risk stress testing, an IIFS should aim to take account of simultaneous pressures in funding and asset markets, and the impact of a reduction in market liquidity on exposure valuation. An IIFS should also identify appropriate areas in which the results of liquidity stress tests will be used. 91. While an IIFS typically manages liquidity under “normal” circumstances, it should also be prepared to manage under stressed conditions. An IIFS should perform stress tests on a regular basis in order to identify and quantify its exposures to possible future liquidity stresses, analysing possible impacts on its cash flows, liquidity position, profitability and solvency. Regardless of how strong an IIFS’s current liquidity situation appears to be, it should consider the potential impact of severe stress scenarios. Liquidity risk-related stress testing appears to be crucial due to the following considerations, inter alia: (i) IIFS’ limited access to Sharīah-compliant funding currently available in the market (i.e. limited access to Sharīah-compliant facilities from central banks, interbank facilities, cross-border liquidity facilities, etc.); (ii) maturity mismatches being potentially more acute compared to conventional counterparts and being a major source of liquidity problems; (iii) a need for specific types of stress tests in the light of the typical IIFS’s balance sheet structure; (iv) liquidity management being made more complex with the lack of an organised money market infrastructure; (v) the fact that the banking book of an IIFS may contain non-financial assets held by the institutions as a part of various Murābahah, Salām and Ijārah contracts; and (vi) an IIFS’s dual role, with respect to liquidity, in meeting the withdrawal rights of its current account holders and the liquidity expectations of its unrestricted IAHs. 92. IIFS should consider short-term and protracted, as well as IIFS-specific and market-wide, stress scenarios in their liquidity stress testing. They should take a conservative approach when setting stress testing assumptions. Based on the type and severity of the scenario, an IIFS needs to consider the appropriateness of a number of assumptions or factors, potentially including (but not limited to) those in the following illustrative list, bearing in mind that each IIFS should use factors and assumptions which are relevant to its business: a. the predominant element in the IIFS’s funding (e.g. PSIA, or CMT-based deposits or current accounts) and its volatility; b. the degree of symmetry between the assets and liabilities in terms of maturities, currencies and other relevant aspects; c. the correlation between assets while stressing multiple scenarios; d. interaction of liquidity risk, asset and liability management, and funding strategy; e. relationship between liquidity and credit and asset prices, taking account of amplification feedback loops; f. possible Sharīah-compliant funding arrangements with the central bank (i.e. assuming that central funding will be available in the event of a market crunch) and other Sharīah￾compliant facilities available for meeting liquidity shortages; g. the run-off or withdrawal risk of IAHs and refinancing risk of CMT-based deposits;

34 h. a simultaneous drying up of market liquidity in several markets and linkages between reductions in market liquidity and resultant constraints on funding liquidity; 43 i. the impact of credit rating triggers; j. severe constraints in accessing secured and unsecured Sharīah-compliant funding; k. restrictions on currency convertibility; l. contingent claims and, more specifically, potential draws on committed lines extended to third parties or the bank's subsidiaries, branches or head office; m. the ability to transfer liquidity across entities, sectors and borders taking into account legal, regulatory, operational, and time zone restrictions and constraints; n. liquidity reserves, regulatory required ratios, and specific liquidity ratios including the assessment of the Liquidity Coverage Ratio44 (i.e. to promote the short-term resiliency of the liquidity risk profile of IIFS by ensuring that they have sufficient high-quality liquid resources to survive an acute stress scenario lasting for one month) and the Net Stable Funding Ratio45 (i.e. to promote the resiliency over longer-term time horizons by creating additional incentives for IIFS to fund their activities with more stable sources of funding on an ongoing structural basis);46 and o. a simulation of contingency funding plans in IIFS. 93. In addition to the above considerations, IIFS should also identify and include in stress testing any future shortfalls in liquidity by preparing forecasts (of the “maturity ladder” type) based on appropriate time-buckets for expected cash inflows and outflows arising from various categories of asset and liability positions, incorporating: (i) known cash flows (Murābahah, CMT-based assets, Ijārah, Ijārah Sukūk and Diminishing Mushārakah on the assets side, and CMT-based liabilities on the liabilities side); (ii) conditional but predictable cash flows (Salām and Istisnā receivables); and (iii) conditional but unpredictable cash flows (Mushārakah and Mu
ārabah investments on the assets side and unrestricted PSIA on the liabilities side). All these cash-flow forecasts need to be stressed with a view to identifying potential liquidity shortfalls, taking account of geographical factors and concentrations with respect to counterparties on the assets side. In identifying potential liquidity gaps in these future cash flows, all material liquidity risk drivers along with interactions between the risks should be considered. The drivers should incorporate both asset and liability side factors. The methodology used for calculating the cash-flow effects of shocks is to estimate the net cash positions in each time-bucket. For each scenario (either idiosyncratic, or market-wide, or a combination of the two), at each stress level, IIFS should identify cash inflows and outflows that can be expected to occur in each future time period and the resulting net cash flows. 94. Stress testing should also enable IIFS to analyse the impact of stress scenarios on consolidated group-wide liquidity positions, as well as on the liquidity position of individual entities and business lines within the group. Stress testing should reflect accurate time frames for the settlement cycles of assets that might be liquidated, and the time required to transfer liquidity across borders. In addition, if an IIFS relies upon liquidity outflows from one system (i.e. jurisdiction) to meet obligations in another, it should consider the risk that operational or settlement disruptions might prevent or delay expected flows across systems. This is particularly relevant for IIFS relying upon intra-group transfers or centralised liquidity management.

43 See also Principles for Sound Liquidity Risk Management and Supervision, BCBS (September 2008). 44 The Liquidity Coverage Ratio (LCR) is a development of liquidity coverage ratio methodologies such as those used internally by IIFS to assess exposure to contingent liquidity events. It identifies the amount of unencumbered, high-quality liquid assets an IIFS holds that can be used to offset the net cash outflows it would encounter under an acute short-term stress scenario specified by supervisory authorities. The specified scenario entails both IIFS-specific and systemic shocks built upon actual circumstances experienced in the global financial crisis. The scenario entails, inter alia: (i) a significant downgrade of the IIFS’s public credit rating; (ii) a partial loss of deposits; (iii) a loss of unsecured wholesale funding; and (iv) a significant increase in secured funding haircuts. 45 The Net Stable Funding Ratio (NSFR) measures the amount of longer-term, stable sources of funding employed by an IIFS relative to the liquidity profiles of the assets funded and the potential for contingent calls on funding liquidity arising from off￾balance sheet commitments and obligations. This requires a minimum amount of funding that is expected to be stable over a one-year time horizon based on liquidity risk factors assigned to assets and off-balance sheet liquidity exposures. 46 The IFSB shares the view that these ratios for liquidity risk supervision developed by the BCBS will also be applicable to IIFS and need to be included in stress tests. However, details of these ratios will be addressed by the IFSB in a separate document in the future.

35 95. IIFS should note that funding and asset markets may be strongly interrelated, particularly during periods of stress. As part of an overall stress testing programme, an IIFS should aim to take account of simultaneous pressures in funding and asset markets, and the impact of a reduction in market liquidity on exposure valuation. Where appropriate, IIFS should give specific consideration to unrestricted PSIA as a main source of their funding and to the implications of asset illiquidity. For instance, some of the asset illiquidity is due to the inability to sell financial assets such as Murābahah receivables in the market because of Sharīah prohibitions, and the lack of liquid secondary markets for other Sharīah-compliant assets such as those based on Ijārah. These considerations raise concerns about the availability of Sharīah-compliant funding to address the potential liquidity shocks that may result in stressed conditions. It was noted from the crisis that financial institutions did not address, in their risk management approaches, significant linkages between asset and funding liquidity.47 In this perspective, IIFS should enhance their stress testing practices by considering important interrelations between various factors, including: (i) price shocks for specific asset categories; (ii) the drying-up of corresponding asset liquidity; (iii) the possibility of significant losses damaging the IIFS’s financial strength; (iv) growth of liquidity needs as a consequence of liquidity commitments; and (v) diminished access to secured or unsecured funding markets. 96. The extent to which liquidity risk-related stress tests are used will naturally vary among IIFS depending on their liquidity risk profile and complexity. Nevertheless, the results of the stress tests should be used as an input for adjusting and improving liquidity risk management. IIFS should consider using the results of stress testing in the following areas: a. to identify and quantify sources of potential liquidity strain; b. to analyse possible impacts on the IIFS’s cash-flow position, profitability and solvency; c. to ensure that current exposures are consistent with the IIFS’s established liquidity risk tolerance; d. to take remedial or mitigating actions, and to set various types of internal limits including concentration limits on the IIFS’s liquidity exposures; e. to decide the level of liquidity cushion/buffer needed; f. to ensure that intraday secured and unsecured Sharīah-compliant funding will be available in order to make payment and settlement system requirements; g. to find the level of unencumbered, high-quality liquid assets that can be sold or pledged to obtain Sharīah-compliant funds in a range of stress scenarios; and h. to shape the IIFS’s contingency planning and help in determining the strategy and tactics to deal with events of liquidity stress. 3.3.7 Sharīah non-compliance risk leading to legal and related reputational risk Principle 3.15: An IIFS should include in its stress testing programme various aspects pertaining to Sharīah non-compliance risk leading to legal and related reputational risk. An IIFS should be able to quantify the potential impact of Sharīah non-compliance risk in its stress testing programme under defined scenarios, and ensure that appropriate contingency plans or remedies are in place to effectively manage the Sharīah non-compliance risk and potential systemic implications for the IFSI. 97. In addition to addressing existing parameters in operational risk, the stress testing programme should give particular attention to Sharīah non-compliance risk which may result in legal and related reputational risk with implications for the business of the IIFS and potential systemic implications for the IFSI. For instance, certain stakeholders in the IFSI (such as Sharīah ‘scholars, SSBs, National Sharīah Councils or other authoritative bodies) may issue Fatāwa about the Sharīah non-compliance of certain products or structures which are already being used. Therefore, it is conceivable that an IIFS may at some point have its adherence to Sharīah placed in question, an event which could inflict severe reputational damage leading to loss of business and a potential liquidity crisis. In addition, a failure in Sharīah compliance could invalidate a contract with costly consequences. Reference should be made to the sections on managing Sharīah non-compliance

47 A reference is made to the BCBS Guiding Principles of Sound Stress Testing, published in May 2009.

36 risk in other IFSB Standards such as IFSB-1, IFSB-3 and IFSB Guiding Principles on the Sharīah Governance System (hereinafter “IFSB-10”). 98. An IIFS should be aware of precedents in certain jurisdictions involving certain Sharīah￾compliant contracts, where Sharīah non-compliance has led to legal and related reputational risk. In addition, the Sharīah compliance of certain structures is a matter of controversy, which underlines the importance of conducting stress testing for Sharīah non-compliance.48 Regarding potential Sharīah non-compliance, an IIFS should identify and quantify the following: (i) how Sharīah non￾compliance or the non-compliance of a particular contract might impact the IIFS in terms of (inter alia) funding and financing risk, income and profitability, withdrawal risk, and legal and related reputational risk; and (ii) the magnitude of the cost to the IIFS both directly and indirectly. 99. The following potential risk factors pertaining to Sharīah non-compliance risk leading to legal and related reputational risk should be included in an IIFS’s stress testing, with particular reference to failures in Sharīah compliance that could severely damage the reputation of an IIFS: a. contract documentation not complying with Sharīah rules and principles; b. breach of contract involving Sharīah violations; c. customer seeking a court declaration that a particular contract offered by the IIFS is not valid in Sharīah, so that the customer is not bound by the contractual obligations; d. a likelihood that a majority of scholars will rule that a particular product or structure is not Sharīah compliant, resulting in potential reputational risk and a resulting risk of loss of business and liquidity problems; e. different fatawa regarding certain products or structures in different jurisdictions; and f. legislative risk. 100. It would be a challenging task for an IIFS to quantify the potential impact of Sharīah non￾compliance risk leading to legal and related reputational risk in the stress testing. However, in this regard, consideration should be given to the following aspects by the IIFS. Further, to mitigate reputational spillover effects and maintain market confidence, an IIFS should develop methodologies to measure the effect of reputational risk on other risk types, with a particular focus on credit, liquidity and market risks: a. reduction in net income (i.e. profits) attributed to Sharīah non-compliance; b. compensation or damages paid to customers for Sharīah non-compliance; c. erosion of an IIFS’ earnings when large provisions are put aside as specified by banking supervisory authorities for Sharīah non-compliance; d. reputational risk leading to IAHs withdrawing funds, or rollover risk on commodity Murābahah-based deposits; and e. cost of court proceedings. 101. As mentioned earlier in Principle 3.3, management should involve the SSB while conducting Sharīah non-compliance-related stress testing. In addition to the above-mentioned aspects, an IIFS should enhance its Sharīah governance framework dealing with the interaction of its operations (i.e. ensuring that the SSB is adequately briefed about the products, and that there is continuous flow of communication within the IIFS with the SSB having the necessary interactions with other relevant departments). An IIFS should also have in place appropriate contingency planning to deal with the potential consequences of Sharīah non-compliance.

48 One particular issue is concerned with the use of CMT to originate credit and/or to obtain deposits, or for short-term liquidity purposes (see IFSB GN-2: Guidance Note in Connection with the Risk Management and Capital Adequacy Standards: Commodity Murābahah Transactions). For example, if an IIFS were dependent on CMT for deposits and these transactions were subsequently to be considered non-permissible, what would be the resulting liquidity stress, and how would it be managed? If credits based on CMT were subsequently to be considered non-permissible, what credit risks might result? It will be clear that an IIFS’s SSB needs to be involved in stress testing for such contingencies.

37 3.3.8 Off-balance sheet exposures Principle 3.16: The stress testing programme should capture off-balance sheet exposures that may have the potential to damage the reputation of the IIFS. 102. In addition to stressing on-balance sheet assets, an IIFS should also capture off-balance sheet exposures in its stress tests to determine the effects on its credit, liquidity and market risk profiles. For instance, off-balance sheet exposures such as restricted funds or special purpose entities (SPE) managed by the IIFS should be taken into account in the stress testing to deliver a complete picture of IIFS-wide exposures. This will be a significant concern for IIFS who derive substantial income from off-balance sheet portfolios which they manage as Mu
ārib, since any losses to those portfolios will result in the IIFS receiving no management fee. In the case of funds management, whether in the form of restricted investment accounts (RIAH) or an Islamic collective investment schemes (ICIS) (as defined in the IFSB Guiding Principles on Governance for Islamic Collective Investment Schemes (hereinafter “IFSB-6”)), the IIFS’s ability to repay the net asset value on maturity may be problematic, as may be its ability to realise the fund assets in the case of withdrawals of funds in stressed conditions. Such vulnerabilities should be captured in stress testing, taking account of the different market factors that might affect the IIFS’s portfolio and its vulnerability to extreme shocks. Various aspects of stress testing for Sharī`ah-compliant securitisation (i.e. for Sukūk) through off-balance sheet vehicles (i.e. SPE) are discussed under Principle 3.11 and Principle 3.12. 3.4 Stress Testing Methodologies 3.4.1 Sensitivity analyses (univariate) and scenario analyses (multivariate) Principle 3.17: IIFS should develop and employ comprehensive stress testing methodologies including at least (i) sensitivity analyses (univariate) and (ii) scenario analyses (multivariate) addressing all material risks at various levels, business areas and specific portfolios of the IIFS. 103. The use of appropriate and comprehensive methodologies in stress testing programmes is crucial in realising the purpose of the stress testing. However, given the varying risk management cultures among IIFS, the models and methodology developed and employed by IIFS may differ among IIFS. These Guiding Principles do not intend to prescribe any particular methodologies; instead, they are designed to enhance IIFS’ practices in stress testing, in particular by identifying the types of methodologies that should be considered by IIFS in designing stress testing programmes proportionate to their size and complexity. In particular, an IIFS’s stress testing methodology should consider: (i) the range of material risks at various levels, business areas and specific portfolios; and (ii) the range of potential scenarios with their severity and appropriate magnitude of shocks as described in the Principles in Sections 3.2 and 3.3 above. In general, an effective stress testing programme should consist of both sensitivity analyses (univariate) and scenario analyses (multivariate), addressing (i) and (ii) above.49 The combination of approaches, as well as the level of detail, will depend on the size and complexity of the specific IIFS. A smaller IIFS may place greater emphasis on the qualitative elements of its stress testing programme supported by quantitative outputs of the balance sheet, whereas a large, sophisticated IIFS would be expected to run complex models which would be complemented by appropriate qualitative oversight.

49 The IFSB recognises that there are other stress testing methodologies such as Simulation (using Monte Carlo), Maximum Loss Approach and Extreme Value Theory, which have emerged in recent years, but these approaches have been confined to a limited number of IIFS, owing to their complexities, sophistication and limited usage in the conventional sector (see also Section 1.3(b)).

38 Sensitivity analysis (univariate tests) 104. Sensitivity analysis (univariate tests) measures the change in the value of a portfolio resulting from shocks of various degrees due to different risk factors, while the underlying relationships between the risk factors are not considered (e.g. a straightforward shift in probabilities of defaults (PDs), or the default of an IIFS’s largest counterparties, or a decline in value of assets). Such analyses provide information about key risks and enhance understanding about potential risk concentrations in one or several risk factors. A sensitivity test isolates the impact on a portfolio’s value of one or more pre-defined moves in a particular market risk factor or a small number of closely linked market risk factors on a ceterus paribus basis (i.e. holding all other factors constant). For example, if the risk factor were an exchange rate, the shocks might be exchange rate changes of +/– 2%, 4%, 6% and 10%, while the relationship between such a change and other risk factors – for example, benchmark rates, expected rates of return, asset values, etc. – is not considered. 105. For sensitivity analysis, an IIFS should identify relevant risk factors or events, and in particular: (i) credit risk drivers (e.g. a shift in PDs); (ii) market risk drivers (e.g. increased volatility in financial instruments markets such as Sukūk, commodities, etc.); (iii) macroeconomic risk factors (e.g. GDP, unemployment, inflation, benchmark rates and expected rates of return); and (iv) external events (e.g. operational risk events, market events, events affecting regional areas or industry sectors, etc.). Having identified the various risk factors and events (see Principle 3.6), an IIFS should then stress these using different degrees of severity and shocks (see Principle 3.8). An IIFS can conduct sensitivity analyses at the level of individual exposures, portfolios or business units, as well as IIFS-wide, against specific risk areas, as sensitivity analysis lends itself to risk-specific stress testing. Furthermore, a single factor analysis can be supplemented by simple multifactor sensitivity analyses, where a combined occurrence is assumed, without necessarily having a scenario in mind. Scenario test analysis (multivariate tests) 106. In contrast, scenario analysis (multivariate tests) specifies a set of concurrent events comprising a possible scenario that might occur. It encompasses the situation where a change in one risk factor affects a number of other risk factors. Scenario analysis contains simultaneous moves in a number of risk factors (e.g. equity prices, foreign exchange rates, benchmark rates, etc.), reflecting a set of concurrent events that the IIFS’s risk managers believe might possibly occur in the foreseeable future. A stress test scenario can be based on a significant market context experienced in the past (a historical scenario or backward-looking approach) or on a plausible market context that has not yet happened (a hypothetical scenario or forward-looking approach or pre-defined scenario based on expert judgement).50

107. Scenario analysis assesses potential losses by analysing the value of an instrument or portfolio under different scenarios. As mentioned under Principle 3.7, such a scenario may be a one￾factor scenario, such as a change in the expected benchmark rate of return; or it may be a multifactor scenario, such as a range of rate of return risk scenarios combined with a change in foreign exchange rates. Finally, in what is known as the “most sophisticated” or “modern” scenario analysis, an assumption is generally made of some correlation of future market movements affecting asset values, which is adequate when the scenarios might be anticipated in a relatively normal condition. However, in scenario analysis, the types of scenarios being covered by an IIFS should fully take into account the risk factors mentioned under Principle 3.6 and aspects related to scenario design mentioned under Principle 3.7. An IIFS should identify a number of scenarios considered for each of the risk factors and the frequency of conducting the stress testing (i.e. number of times per

50 The historical scenario involves the reconstruction of historical events and involves less judgement as it reflects the actual stressed market conditions. Since historical scenarios are backward looking, they may not be the worst that can happen and may lose relevance over time due to market and structural changes. Hypothetical scenarios involve simulating the shocks caused by events that have not yet happened or which have no historical precedent. Key areas of focus in a hypothetical scenario include market volatility, trading liquidity and risk linkages. Hypothetical scenarios can be more relevant, flexible and forward looking, but they involve more judgement and management support. In addition, at times hypothetical scenarios are very difficult to analyse and may generate confusing outcomes, so it is important to take care in crafting hypothetical analysis.

39 year) with regard to each risk factor. (See Section 3.5 for details on frequency of conducting stress testing.) 108. A scenario analysis in an IIFS can be through either a portfolio-driven approach or an event￾driven approach. In the former approach, vulnerabilities in the portfolio are identified and plausible scenarios are then formulated under which these vulnerabilities are stressed (e.g. what are the risk parameter changes which result in a portfolio loss?; what events might bring about these changes?), while in the latter approach, the scenario is formulated based on plausible events and how these events might affect the relevant risk factors in the IIFS’s portfolio (e.g. identifying a risk source that causes changes in financial markets and by how much risk parameters change if such an event occurs). Further, a scenario analysis may also be driven by a particular type of asset (e.g. commodities, real estate, etc.) or by the specific region (e.g. the U.S., the Middle East, emerging markets, Europe, etc.). Regardless of any particular approach, the scenario analysis should be designed to encompass both movements in a number of risk factors and the changes in the underlying relationships between these variables (e.g. volatilities and correlations). In identifying and conducting scenario testing, an IIFS should take into account how changes in circumstances might impact upon: (i) the nature, scale and mix of future activities; and (ii) the behaviours of counterparties, and of the IIFS itself. 109. In particular, it is important to distinguish between sensitivity analysis and scenario analysis. The latter is more powerful if used properly, since it can reflect the effects of several adverse conditions occurring simultaneously (e.g. a property price fall plus a credit freeze). In addition, scenario tests are characterised by a more complicated structure and include a simulation of several variables at the same time. Such an analysis is more valuable than a univariate one, because it takes into account the possible inverse correlation between the impacts of individual risks. For example, an increase in the volume of financing originated by an IIFS increases its profitability, but it will also tend to increase credit risk and (through maturity mismatches) liquidity risk. There are circumstances where IIFS use the combination of both approaches depending on their risk profile and strategic decisions. A less sophisticated IIFS may use sensitivity analysis to form a first approximation of the impact. Often a combination of both approaches may result in more resilience and diversification of the scope of analysis, by taking into account different severities and perspectives. IIFS should ensure that they inform the sensitivity analyses and scenario analyses by using appropriate models (i.e. deterministic or stochastic, etc.),51 data and parameters (i.e. historical or hypothetical), and forecasting periods (i.e. long-term or short-term). 3.4.2 Reverse stress tests Principle 3.18: IIFS should develop reverse stress tests as one of their risk management tools to complement the range of stress tests they undertake. 110. Reverse stress testing starts from a known stress test outcome (such as breaching regulatory capital ratios, or a liquidity crisis) and then asking what events could lead to such an outcome for the IIFS. Reverse stress testing is a risk management tool that can be applied either to a single entity and on a group basis, with an appropriate mix of quantitative and qualitative analyses (i.e. proportionate applications) performed at least annually. It requires an IIFS to assess scenarios and circumstances that would put its survival in jeopardy, thereby identifying potential IIFS-wide business vulnerabilities. Prior to the financial crisis, such an analysis was considered of little value by most senior management, on the grounds that such events had only a remote chance of happening. However, financial institutions (including IIFS)52 now experience the need to examine high-impact

51 Deterministic models allow an analysis without taking into account the probabilities of events that shape the score size. Their main advantage is primarily comprehension, reliability of the results, and the fact that they provide clear answers to the problems in certain conditions. On the other hand, stochastic (or probabilistic) models are more sophisticated, and they take into account the likelihood of occurrence of certain risk factors. One of the more frequently used simulations in the stochastic approach is the “Monte-Carlo” method. 52 The Survey revealed that only few IIFS are using reverse stress testing to identify risk concentrations and vulnerabilities.

40 “tail” events53 and to assess the actions required to deal with them. This has led to developing reverse stress tests as one of their risk management tools. 111. As part of the overall stress testing programme, it is important to include some extreme scenarios which would cause the IIFS to be insolvent (i.e. stress events which threaten the viability of the whole IIFS). A reverse stress test induces an IIFS to consider scenarios beyond its normal business settings and leads to events with contagion and systemic implications. Reverse stress testing has important quantitative and qualitative uses, such as informing senior management about the assessment of vulnerabilities. Areas that may benefit from the use of reverse stress testing are business lines where traditional risk management models indicate an exceptionally good risk/return trade-off; new products and new markets which have not experienced severe strains; and exposures where there are no liquid two-way markets. However, an IIFS should bear in mind that there is no single right way to produce a reverse stress test, and the approach may be different from one IIFS to another. A reverse stress test should be built onto the existing stress testing framework as a complement, not a substitute. 3.4.3 Review and updating stress testing methodologies Principle 3.19: An IIFS should review and update its stress testing methodologies, taking into account: (i) changing market conditions; (ii) changes in the nature, size or complexity of the IIFS’s business model and activities; and (iii) actual experiences in stress situations. An IIFS should have a process in place to review the adequacy and reasonableness of its stress test methodology and assumptions. 112. Review of stress testing methodologies should be part of the review of the overall stress testing framework as discussed under Principle 3.5. Given changing market conditions; changes in the nature, size or complexity of the IIFS’s business model and activities; and actual experiences in stress situations, IIFS should consider periodically whether their stress test methodologies are still adequate or require an update. In particular, IIFS should ensure that assumptions regarding their risk profile and the external environment are still valid over time. And an IIFS should perform the review at least once a year, or more often when the changes in its portfolios or changes in its working environment are material. This assessment should cover in particular, inter alia: a. the scope and size of exposures captured under the stress testing process; b. a review of stress testing methodologies for various risk factors; c. the validity of the assumptions; and d. the stability of the management information system, and the accuracy of the data and its completeness. 113. Where models are used, an IIFS should bear in mind that it cannot exactly replicate the real world; hence the use of the model itself poses modelling and parameter risks. While conducting stress testing, if the results show that a certain model is unstable or does not work as originally intended with extreme inputs, then management should consider rethinking the model, modifying certain parameters, or at least putting less weight on the accuracy of model output.54 In this respect, an expert opinion (which can provide an IIFS with adequate feedback and input on the effectiveness of models used in its stress testing) should be considered by the IIFS for model validation purposes. Any proposed amendments to the methodology of stress testing and its procedures should be approved by senior management of the IIFS.55 Further, from the perspective of supervisory authorities, the latter should have in place a process of evaluating and validating IIFS’ stress testing methodologies to ensure that IIFS are employing up-to-date methodologies and that their assumptions reflect the risk profile of the IIFS (see Principle 4.2 for more details).

53 Such events fall under the tails of the relevant probability distributions, but if these distributions have “fat tails” the events are not as improbable as might be thought, and if they have high impacts the failure to have considered them in risk management can have catastrophic consequences. 54 A reference is made to BCBS’s Guiding Principles of Sound Stress Testing, published in May 2009. 55 In regard to reviewing the adequacy and reasonableness of the stress test methodology and assumptions, the Survey revealed that, inter alia, it is the ALCO, RMC, the BOD and senior management which review the adequacy and reasonableness of the stress test methodology and assumptions.

41 3.5 Frequency of Stress Testing Principle 3.20: IIFS should conduct stress tests on a regular basis, with appropriate intervals at all levels in accordance with the nature of the risks covering its banking portfolios and trading portfolios, IIFS-wide and on an ad-hoc basis. 114. In order for stress testing to be a meaningful part of the risk management framework, stress tests should be undertaken with appropriate frequency in the light of the nature of the risks to which the IIFS are exposed and the types of tests performed. With regard to conducting stress testing, IIFS should specify appropriate frequency of the stress tests (i.e. how many times stress testing activities should be conducted at the IIFS level, depending on the nature of the portfolios and exposures as well as other circumstances). It may be the case that some stress tests need to be conducted daily, or monthly, while others should be performed semi-annually or annually. In addition to the frequency of the stress testing, an IIFS should determine the time horizon of stress testing in accordance with the maturity and liquidity of the positions stressed. Generally, the trading portfolio56 should be subject to more frequent stress testing than the banking portfolio. Basically, the testing of the on-balance sheet portfolios that are most sensitive to changes in the market (such as portfolios of Sharī`ah￾compliant securities for trading, and other marketable assets, and exposures of foreign exchange) should be done more frequently (e.g. on a daily or weekly basis), while the portfolios of a less volatile nature (such as Murābahah receivables and Ijārah-based financing) should be subjected to stress testing for longer periods (e.g. on a monthly or quarterly basis). 115. It should be noted that in some of an IIFS’s risk areas, stress testing is necessarily performed frequently, while overarching IIFS-wide stress testing may be done with a lower frequency. Furthermore, large and sophisticated IIFS will have a number of risk areas requiring frequent stress testing (e.g. market risk for commodities held for trading) which will enlarge the broader stress testing framework. Smaller and simpler IIFS may not have the same range of requirements and exposures. Thus, the frequency of stress tests should be proportionate to risk areas and exposures and the need for overall IIFS-wide stress testing. 116. Stress tests should be performed regularly enough to take account of changing market conditions and IIFS’ changing risk profile. Similarly, in times of greater volatility and unstable market conditions, more frequent stress testing should be conducted. However, IIFS should also undertake necessary testing for a specific purpose – that is, ad-hoc stress tests related to specific areas – when this is desirable in certain circumstances. For example, given the rapid deterioration in the economic conditions in a particular jurisdiction, the IIFS with operations in that jurisdiction should conduct a rapid assessment of the potential impact on their exposures in that jurisdiction. Ad-hoc stress tests may also be required to assess the impact of an observed deterioration that an IIFS had not taken into account, or to assess the impact of similar stress conditions across the industry. 3.6 Outputs of Stress Testing and Remedial Actions Principle 3.21: Stress tests should be used to support a range of decisions. IIFS should identify credible management actions that address the outputs of stress tests and are aimed at ensuring their ongoing solvency throughout the stressed scenario. Stress test outputs should permit management to assess the ability of the IIFS to withstand difficult conditions, in terms of measuring the impact particularly on liquidity, capital adequacy and profitability. 117. An IIFS may perform a variety of stress tests throughout the year, focusing on specific aspects of the IIFS’s operations. However, the use of the stress test results depends on the purposes of those tests. In particular, an IIFS should clearly identify appropriate and meaningful

56 The time horizon over which stress and scenarios testing would need to be carried out for the market risk arising from the holding of investments would depend upon: (i) the extent to which there is a regular, open and transparent market in those assets, which would allow fluctuations in the value of the investment to be more readily and quickly identified; and (ii) the extent to which the market in those assets is liquid (and would remain liquid in the changed circumstances contemplated in the scenarios test) which would allow the IIFS, if needed, to sell its holding so as to prevent or reduce its exposure to future price fluctuations.

42 mechanisms for translating the stress test results into actions. Hence, stress test results should be used to support a range of decisions. In particular, stress tests should be used as inputs to the process of establishing an IIFS’s risk appetite and setting exposure limits, as well as being a planning tool to determine the effectiveness of new and existing business strategies and their impact on the capital and liquidity planning process (see detail of actions below in paragraph 119). Stress test results should also be used to support the evaluation of strategic choices when undertaking and discussing longer-term business planning. The use of various stress tests should help IIFS to detect vulnerabilities such as unidentified risk concentrations or potential interactions between types of risk that could threaten the viability of the IIFS but may be undetected when reliance is placed purely on historical data when using statistical risk management tools. 118. IIFS should have strategies approved in advance with regard to the actions that would be taken based on the results of the stress test in identifying the points requiring remedial actions, such as those provided in the next paragraph. The level of authority for such actions should be the BOD and senior management, with appropriate documentation and implementation. IIFS should note that some actions may be required immediately, while others might be contingent on specific future events. IIFS should not overestimate their ability to take mitigating management actions, and should recognise the possible impact of the stressed scenarios on other market participants (e.g. capital raising in stressed market conditions can be especially challenging). 119. The BOD and senior management have responsibility for evaluating the relevant outputs from the stress testing programme, and for taking appropriate management actions while integrating stress testing outputs into the IIFS’s decision-making process. These measures or remedial actions may vary depending on the circumstances of each IIFS and other available information. Some examples of actions to be undertaken by senior management are the following: a. Identifying key risks and the effectiveness of risk mitigants. One main function of the stress tests is to seek an understanding of the nature of the IIFS’s exposures (in terms of credit and market risk) to extreme market conditions and to trigger remedial actions. Use of the stress test results can help the IIFS to mitigate the identified and potential risks – for example, through examining the effectiveness of Sharī`ah-compliant risk mitigation techniques. b. Understanding portfolio structure and adjusting positions. A major use of stress tests is to identify key areas where an asset portfolio is exposed to “excess” risk. With respect to adjusting positions, the stress test results may reveal unacceptable risks or combinations of risks that may dictate adjustments to trading and non-trading positions within the portfolio, requiring IIFS to reduce their exposures in specific sectors, countries or regions in order to decrease the vulnerability of the portfolio to large losses in the event of the stress conditions. c. Measuring exposure to extreme (fat tail) events. This may be a significant application of stress testing. The intent is to comprehend the impact of extreme events on the performance of an asset portfolio. VaR provides a measure of likely loss assuming that the likelihood of risks follows a normal distribution. In contrast, stress tests should be designed to include risks that appear unlikely if the likelihood follows a normal distribution but may be more probable if the distribution has fat tails (as opposed to the thin tails of a normal distribution). The potential loss indicated by a stress test (such as sensitivity or scenario analysis) may be such as would materially impair the financial condition of the IIFS. This can encompass the impact on the ability of the IIFS to continue to maintain access to funding and the credit standing required to allow normal trading and operations. d. Assessing the impact. The results can be used by IIFS to analyse the impact on the IIFS’s strategy, financial position, profitability and reputation. They will help the IIFS in reviewing its strategy and setting the risk appetite. e. Establishing validity of models/valuations. Stress test results can expose valuation model weaknesses when the assumptions behind the model do not hold. In this way,

43 stress tests can isolate whether the problem is one of the riskiness of the position, or one relating to the valuation model. f. Assessing liquidity adequacy and capital allocation. The stress test results should be used to review the adequacy of liquidity to reconsider the funding policy (i.e. making necessary arrangements to meet a shortage of liquidity in difficult conditions). The results can also be used to examine the adequacy of capital (i.e. establishing the solvency capital)57 deployed against trading and non-trading portfolios (risk). In effect, results define the capital and liquidity buffer that is required to ensure the IIFS survives an extremely adverse set of market conditions. The use of stress testing to establish solvency capital should be contrasted to capital allocated to individual activities. g. Reviewing risk limits. The stress test results should be used to ensure compliance, especially in cases where legislative requirements indicate that the results of the stress tests should be reflected in the limits set by IIFS (i.e. requirements relative to market risks and to credit risk mitigation techniques). Where no formal stress test risk limit exists, the results of the stress tests may be compared to existing risk limits. Nevertheless, IIFS should use stress testing to effectively set boundaries on risk to extreme outcomes and to establish risk limits (either hard limits (no breach allowed) or soft (breach triggers review) limits).58 h. Reviewing contingency plans. A contingency plan should contain emergency actions in case standard measures turn out to be inadequate in the face of the most adverse scenarios. When defining their contingency plans, IIFS should take into consideration the reduction of the efficiency as a consequence of extremely severe stressed situations. 120. An IIFS should identify outputs particularly in relation to its regulatory capital and resources, as well as relevant balance sheet and profit and loss impacts, as a result of its stress testing programme. One essential output from a stress testing exercise is the estimate of the losses under a range of scenarios. The aim is to assess the capacity of an IIFS to absorb losses stemming from various shocks applied in the scenarios. These potential losses mainly depend on: (i) the risks already taken by an IIFS at a certain point in time – the starting point of the exercise; and (ii) developments in the volume, asset quality and prices of investment and funding activities under the scenarios contemplated. When conducting stress testing over a specific time period, consideration should be given to appropriately conservative adjustments to profit and loss forecasts. Notably, loss assumptions in the stress do not have to coincide with accounting losses shown at that specific point in time. With regard to credit risk, IIFS need to be aware of the impact of their ratings philosophies on the outcome.59

121. After reviewing the stress test results and having considered certain possible remedial actions as stated above, an IIFS may subject itself to further stress testing with some adjustments. For instance, as a result of a first round of stress testing, if the results indicate a certain weakness or material deficiencies in stress testing, or if management is not satisfied with the stress testing outcomes related to certain products, portfolios or IIFS-wide, then management should require its IIFS to undertake further stress testing. In this context, the results of further stress testing – carried out by changing certain assumptions or altering certain models – may require different remedial actions compared to what was stated above. While using stress testing to complement their regular

57 One of the measures available to management may be the raising of additional capital. The presence of a capital buffer, of appropriate quality, can be a significant mitigating factor as higher levels of capital increase the degree of freedom management has when taking mitigating actions. However, IIFS should be aware that capital raising in stressed market conditions would be quite challenging, so that considering other possible alternatives may be necessary. 58 While VaR is generally used to establish risk limits, some IIFS use stress tests to establish additional limits on risk taking. However, a risk limit based on stress tests alone is not useful. Risk limits based on stress tests ideally would entail a hierarchy of limits such as based limits (i.e. lowest type of limit), secondary limit (i.e. designed to control more difficult conditions, preventing large losses), and final risk limits (i.e. preventing a catastrophic loss that has the potential to threaten the viability of the IIFS). 59 A reference is made to CEBS’s Guidelines on Stress Testing, published in August 2010.

44 risk management procedures, IIFS should bear in mind that their failure to address the outputs resulting from the stress tests might leave them exposed to certain vulnerabilities that have been identified. 3.7 Disclosure of the Stress Testing Programme Principle 3.22: An IIFS should make available the key information, both qualitative and quantitative, on its stress testing programme for internal and external communication by using an appropriate disclosure methodology within the existing reporting mechanism. 122. Stress testing plays an important role in the communication of risk within the IIFS (i.e. to inform the BOD) as well as in external communication to the supervisory authorities through periodic reports and public disclosures through the periodic financial reporting process. This should provide the market at large with an insight into the IIFS’s stress testing programme. Information to be disclosed might include any major stress test limitations, underlying assumptions, governance process, appropriate frequency, the methodologies used, and an evaluation of the impact of the stress test (i.e. the impact on the IIFS’s profitability, capital and asset quality, etc.).60 123. It should be noted that the main raison d'être of stress test-related external disclosure is to provide qualitative and quantitative information on the stress testing programme, with a view to achieving transparency and promoting market discipline consistent with IFSB Disclosures to Promote Transparency and Market Discipline (hereinafter “IFSB-4”). The key information which needs to be disclosed should be subject to respective supervisory requirements (see Principle 4.6). The disclosure methodology should be consistent with IFSB-4, which states that disclosures could be provided either as part of the disclosure requirements associated with periodic financial reporting, or any other appropriate means (e.g. such as via the Internet or via the public portion of regulatory reports filed with the supervisor) agreed by the management. These Guiding Principles recommend that the appropriate medium, as well as the scope and frequency of the external disclosures, should be a matter for management discretion but also for supervisory requirements (see Principle 4.6). Therefore, IIFS and supervisory authorities have to determine appropriate regimes under which the stress testing-related information could be disclosed, keeping in mind issues of reliability and materiality.

60 Current IIFS’s stress testing-related disclosure practices indicate significant gaps. The Survey also revealed that: (i) few IIFS publish stress test results; (ii) most IIFS publish stress test results for internal purposes only (i.e. to inform the BOD); and (iii) very few IIFS publish stress test results as a regulatory requirement.

45 SECTION 4: GUIDING PRINCIPLES ON STRESS TESTING FOR SUPERVISORY AUTHORITIES 124. Supervisory review and assessment of stress testing programmes are crucial. Supervisory authorities should assess IIFS’ compliance with sound stress testing practices, and in particular with the aspects (i.e. Guiding Principles on Stress Testing for IIFS) outlined in Principles 3.1to 3.22 in Section 3 of these Guiding Principles, taking into account the principles of proportionality and relevance. 4.1 Regular and Comprehensive Assessments of IIFS’ Stress Testing Principle 4.1: Supervisory authorities should regularly undertake comprehensive assessments of an IIFS’s stress testing programme. They should review stress testing outputs as part of the supervisory review process as per IFSB-5 in order to assess the resilience of an IIFS to adverse economic conditions and whether it is able to maintain sufficient capital and liquidity under stressed conditions. 125. Supervisory authorities should undertake regular and comprehensive assessment of an IIFS’s stress testing programme. In their review, supervisory authorities should evaluate the extent to which stress testing is embedded in an IIFS’s risk management framework (i.e. verifying that stress testing forms an integral part of the IIFS’s risk management framework). Supervisory authorities should also ensure that: (i) stress testing conducted by IIFS has considered specific characteristics especially related to risk characteristics, capital adequacy and the position of IAHs as a capital buffer; and (ii) whether various perspectives on the presence of IAHs on the liability side (along with PER and IRR reserves) are being considered by the IIFS. They should also assess whether IIFS devote sufficient resources, and have adequate procedures in place, to undertake rigorous, forward￾looking stress testing in order to identify circumstances or possible events that could result in significant adverse impacts on the IIFS and threaten its viability. 126. Supervisory authorities should consider whether senior management has been sufficiently involved in the stress testing programme and the BOD sufficiently informed. They should also verify that the Governance Committee (or an equivalent committee) and SSB are involved in the stress testing programme, or at least are informed of the stress testing results and/or of the Sharī`ah compliance of the remedial actions based on the stress testing outputs. Supervisory authorities should engage in regular communication with senior managers to discuss their views on major macroeconomic and financial market vulnerabilities, as well as threats specific to the IIFS’s operations and ongoing business model. Such discussions will also address the extent to which reverse stress testing is used as a risk management tool. An important aspect of the supervisory review of stress testing programmes is the ongoing dialogue with an IIFS at all levels; both technical and management. (See Section 4.5 for more detail on regular supervisory dialogue.) In their reviews, supervisory authorities should consider all sources of information about stress testing programmes and methodologies, including IIFS’ own internal assessments and validation as well as reviews undertaken by independent control functions. (See Section 4.2 for more detail on supervisory validation of methodologies.) 127. Under the supervisory review process as per IFSB-5, supervisory authorities should examine an IIFS’s stress testing results as part of a supervisory review of both the IIFS’s internal capital assessment and its liquidity risk management. In particular, they should consider reviewing stress testing outputs in order to assess the resilience of individual IIFS to adverse economic conditions and whether they are able to maintain sufficient “capital and liquidity” (see following paragraphs). This assessment requires supervisory authorities to ask IIFS to submit IIFS-wide stress testing results to them on a regular basis (see Section 4.6 for more detail on reporting stress testing results), helping them to assess the extent of integration of stress testing outputs into decision-making throughout the IIFS, including the strategic business decisions of the BOD and senior management and the IIFS’s capital assessment and liquidity needs. 128. Supervisory authorities should review how IIFS-wide stress scenarios for capital planning impact total capital and capital needs, including details of the anticipated sequence of these impacts.

46 (For example, losses or reductions in an IIFS’s revenues and profits will negatively impact capital.) In this context, supervisory authorities should ensure that they have access to the details of the main assumptions and drivers of movements in capital and capital needs. To that end, supervisory authorities should assess whether the IIFS is able to remain above the minimum required regulatory capital ratios at all times in the event of a severe but plausible stressed event. This requires IIFS to have in place ICAAP for capital management. In this regard, supervisory authorities may require IIFS to implement an ICAAP framework to ensure that they maintain an appropriate capital buffer to support their operations at all times and absorb unexpected losses resulting from the risks incurred through the IIFS’s business activities. They may also consider how the quality of capital the IIFS is holding affects the results of the stress test and should ensure that capital is available to absorb losses and increases in regulatory capital requirements. In conducting this assessment, supervisory authorities should consider the following aspects in the assessment of an IIFS’s capital adequacy: a. future capital resources and capital needs of an IIFS under adverse scenarios; b. uncertainty about the potential impact on earnings and capital of current and prospective economic conditions; c. quality of assets and possible declining asset values; d. potential unanticipated losses and estimated resources to absorb those losses under normal conditions and more adverse cases; e. concentrations of credit exposures; f. off-balance sheet and contingent liabilities (e.g. implicit and explicit liquidity and credit commitments); g. assessment of capital adequacy under stressed conditions (also when determining “alpha”) against a variety of capital ratios, including regulatory ratios, as well as ratios based on an IIFS’s internal definition of capital resources; h. IIFS’s ability to raise additional capital through common stock and other forms of capital in the market; i. the composition, level and quality of capital; and j. transferability of capital during periods of severe downturn or extended market disruption, taking account of potential funding difficulties (i.e. the possibility that a crisis impairs the ability of even very healthy IIFS to raise funds at a reasonable cost) that may be expected in stressed conditions. 129. Supervisory authorities should examine the liquidity needs of IIFS under adverse scenarios and consider the adequacy of liquidity buffers under conditions of severe stress. They should review the use of stress test results to ensure that the potential impact on an IIFS’s liquidity is fully considered and discussed at senior management level. Where deficiencies are noted, supervisory authorities should certify that senior management takes appropriate actions, such as increasing the liquidity buffer of the IIFS, decreasing its liquidity risk, and strengthening its contingency funding plans. Further, in addition to overseeing liquidity mismatches in individual IIFS, supervisory authorities should monitor aggregate mismatches in the banking system as a whole. As for maturity mismatches, IIFS are often required to construct explicit “maturity ladders”, so that they can calculate excesses or deficits (liquidity gaps) at selected maturity dates – next day, next week, next month, next year. These estimates could be subject to stress tests by the supervisory authorities. Aggregating the liquidity gap analysis of individual IIFS to construct maturity ladders for the whole economy can be very useful for supervisory authorities to analyse liquidity risk in the banking system as a whole – giving early warning of liquidity shortfalls at particular maturities for the entire banking system – as part of the macroprudential dimension. More detailed information on liquidity risk is outlined in IFSB Exposure Draft on Guiding Principles on Liquidity Risk Management for IIFS. 4.2 Supervisory Evaluation of an IIFS’s Stress Testing Methodology Principle 4.2: Supervisory authorities should ensure that they have the capacity and adequate skills to assess an IIFS’s stress testing programme. In particular, they should have in place a process of evaluating the IIFS’s stress testing methodologies. Supervisory authorities should challenge the scope, severity, assumptions and mitigating actions of IIFS-wide stress tests.

47 130. Supervisory authorities should have adequate skills and ability to assess the scope and severity of stress scenarios and to form judgements on behavioural reactions, systemic interactions and feedback effects. For supervisory authorities to ensure that they have the capacity and adequate skills set to assess, either in-house or through the use of consultants, an IIFS’s stress testing programme, they should possess or have access to expertise in quantitative modelling that is sufficient to be able to meaningfully review an IIFS’s internal stress testing programmes. 131. Given a wide range of methodologies used for stress testing by IIFS, they may intentionally consider some stress testing techniques that provide them with favourable results. In such cases, IIFS’ supervisory authorities may underestimate the risk of individual IIFS and the whole banking sector during the stress situation. Given this possibility, supervisory authorities may consider putting the following aspects in place to review IIFS’ methodologies: (i) a process to evaluate the methodologies used by the IIFS – that is, the supervisory authorities should carefully evaluate the accuracy and reasonableness of the methodologies to ensure that they are appropriate, consistent with the IIFS’s underlying portfolio, and reflective of each IIFS’s particular business activities and risk profile; (ii) a process to ensure systemic risk coverage at the macro level; (iii) calibration of shocks to be applied; and (iv) a process to ensure that the IIFS considers its specificities. Further, supervisory authorities should question an IIFS’s methodology when the impact of stress tests seems unrealistically low or when mitigating actions are unrealistic. In this context, the supervisory assessment of the robustness of the stress testing methodology is critical as part of the capital planning (i.e. ICAAP), as IIFS are expected to assess the appropriateness of capital targets under ICAAP. 132. Supervisory authorities should consider the effectiveness of IIFS’ stress testing programmes in identifying relevant business vulnerabilities. This will include a review of the key assumptions used in stress testing in the light of current (at the time of the exercise) and future market conditions. They should ensure that an IIFS conducts stress tests at multiple levels in the organisation and that the IIFS’s stress tests are rigorous, include different types of tests, and incorporate a range of scenarios (from mild to severe). They should assess the scenarios chosen by the IIFS for consistency with its risk appetite and overall risk profile and business plan, and ensure that they include a severe and sustained downturn. The scenarios chosen should also include, where relevant, an episode of financial market turbulence or a shock to market liquidity. In their evaluations, supervisory authorities should review whether the IIFS uses output from sensitivity tests appropriately, and shares sensitivity analysis results within the organisation (such as with risk managers and senior management) and properly acts upon the results (e.g. by taking remedial actions if sensitivity tests show large adverse outcomes or reveal model weaknesses). 133. Supervisory authorities should assess the feasibility of proposed management actions in stressed conditions, challenge their credibility and, if necessary, require stress tests to be re-run with a range of different mitigating management actions. When challenging scenarios and assumptions, supervisory authorities may use appropriate benchmarking criteria and compare the severity of scenarios, their parameters and other assumptions, where applicable, with scenarios used in the relevant regional stress test exercises done by various authorities. In cases where material shortcomings are identified in the IIFS in regard to addressing the outputs of stress tests, or if mitigating management actions are not deemed credible, supervisory authorities should require the IIFS to take further remedial actions such as considering its strategy or future management actions to ensure its solvency during a stress. The range of remedial actions as an outcome of the supervisory review process is outlined in Principle 4.4. 4.3 Designing and Implementing System-Wide Stress Tests and Specific Scenarios Principle 4.3: Supervisory authorities should consider the financial soundness of an individual IIFS and aggregation of all IIFS’ estimates and evaluate the impact of economic stress on the banking sector. They should design and implement system-wide supervisory stress test exercises based on common scenarios as a part of their assessment of the overall system’s resilience to shocks and may also consider recommending specific scenarios to

48 IIFS. Supervisory authorities should also take into account the cross-border and cross￾sectoral implications of the Islamic financial services industry (IFSI) in the stress testing programmes. 134. Supervisory authorities should consider the financial soundness of individual IIFS and aggregate61 all IIFS’ estimates in order to evaluate the impact of an economic stress on the banking sector.62 Supervisory authorities should identify and apply various risk factors and aspects while conducting stress testing at the system level, including but not limited to: (i) idiosyncratic risk factors; (ii) systemic risk factors (i.e. macroeconomic risk factors such as GDP, unemployment, inflation, benchmark rate, etc.) and external events (e.g. market events, events affecting regional areas, etc.); (iii) concentration and systemic vulnerabilities (e.g. real estate bubbles, excessive leverage through CMT-based deposits, disproportionate concentration in certain areas, increasing cross-border funding and financing exposures, etc.); (iv) risk transmission and contagion mechanisms (i.e. conventional financial institutions’ practices impacting the IFSI and vice versa owing to interconnectedness); and (v) cross-border and cross-sectoral effects (see paragraph 138 for detail). This should be complemented by appropriate approaches such as “top down” and/or “bottom up”. 135. It is recognised that some supervisory authorities apply the shocks to individual IIFS and then apply the same/similar shocks to consolidated figures of the entire IIFS banking sector. IIFS￾specific stress testing, and macro-financial stress testing conducted by a supervisory authority, are both important in banking surveillance. Macro-financial stress testing should help supervisory authorities to identify systemically63 important IIFS that are more sensitive to economic stress. While IIFS-specific stress testing is crucial to inculcate a sound risk-based business and capital planning among IIFSs, supervisory authorities’ macro-financial stress testing (as a part of the macro￾prudential surveillance) is critical to identify potential emerging risks from the banking system and formulate supervisory actions and timely policy responses. Stress test outcomes as conducted by IIFS could, to a certain extent, provide useful information to a supervisory authority in formulating its macro-financial stress testing; however, this information may be limited by the varying degree of IIFS’ internal methodology advancements and differences in the assumptions used. 136. Supervisory authorities may ask IIFS to evaluate scenarios under which the IIFS’s viability is compromised, and to test scenarios for specific/significant lines of business, to assess the plausibility of events that could lead to significant strategic or reputational risk. IIFS should be aware that, as part of the supervisory review process, where supervisory assessments suggest that the scenarios used by IIFS are inconsistent with its risk profile, or where prevailing macroeconomic conditions require IIFS to use recommended scenarios or assumptions, then supervisory authorities may consider implementing recommended scenarios for IIFS to use, as well as requiring IIFS to undertake further stress tests, in addition to IIFS’ own stress testing. Further, as part of the supervisory authorities’ work in assessing the overall health of the system and its resilience to shocks, supervisory authorities should design and implement system-wide supervisory stress test exercises, based on common scenarios for IIFS within their given jurisdictions. Supervisory authorities should ensure that IIFS have a common understanding as to the scope of such tests and the manner in which they complement individual IIFS stress testing programmes.

61 From the perspective of supervisory authorities, the concept of aggregate stress testing is a measure of risk exposure of a group of reporting IIFS to a specified stress scenario. The process would require supervisory authorities aggregating information on the combined exposure of all reporting IIFS, as well as the distribution of exposures among reporting IIFS across markets and risk factors. An aggregate stress test could be based on a historical or hypothetical scenario. The primary application of an aggregate stress test should be to provide: (a) an analysis of market liquidity risk; (b) potential insights into the transmission of shocks and the process of changes in liquidity in financial markets; and (c) valuable information to supervisory authorities on the concentration of exposures in a market and its potential impact on liquidity. 62 The banking supervision and examination department may look after the stress testing of the individual IIFS (micro soundness indicators), while the systemic stability unit may look after the overall banking sectors by stress testing the aggregate figures of all IIFS (hence examining the financial soundness at a macro level). 63 An IIFS is considered systemically important if its failure would have economically significant spillover effects that could destabilise the financial system with a potentially negative impact on the real economy (e.g. when the losses at one IIFS are transmitted to other institutions through counterparty risk exposures or through payments systems, resulting in systemic risk due to connectedness and contagion).

49 137. It should be clearly acknowledged, both by IIFS and the supervisory authorities, that the scenarios and supervisory stress tests recommended by the supervisory authorities are not a substitute for IIFS’ own scenario setting or stress testing; rather, they should complement an IIFS’s own stress testing programme.64 Scenarios recommended by supervisory authorities can allow those authorities and IIFS to better understand the impact of specific stress events on the IIFS. Such scenarios could be used in both system-wide stress testing and individual IIFS-specific risk analysis. However, with regards to a system-wide supervisory stress test, supervisory authorities should be aware that a given set of assumptions may be very severe for one IIFS but less severe for another due to the differing characteristics of the underlying businesses. Furthermore, in regard to cross￾border IIFS activities, consolidating and host supervisory authorities may agree to prescribe certain scenarios for IIFS that reflect potential macroeconomic developments (see Principle 4.5 for more detail). 138. Supervisory authorities should take into account the cross-sectoral nature of the IFSI in their jurisdictions. GN-2 has highlighted that, due to the cross-border liquidity management practices of IIFS through CMT, and the interconnectedness of various counterparties (such as Islamic investment companies/banks, etc.) in IIFS, supervisory authorities may have concerns relating to cross-border and cross-sectoral transactions. In conducting stress tests on other than banking portfolios and banking-related risks, supervisory authorities should be mindful of the special requirements for the stress testing of such risks and activities set up by the respective supervisory authorities, where relevant. (For example, stress testing of insurance/Takāful operations might be subject to specific requirements put forward by insurance regulators/supervisory authorities.) 4.4 Corrective Actions Based on Stress Test Results Principle 4.4: Supervisory authorities should review the range of remedial actions envisaged by an IIFS in response to the results of the stress testing programme and should require the IIFS to take corrective actions if material deficiencies in the stress testing programme are identified or if the results of stress tests are not adequately taken into consideration in the decision-making process. 139. Supervisory authorities should review the range of remedial actions envisaged by an IIFS in response to the results of the stress testing programme and be able to understand the rationale for senior management decisions to take or not to take remedial actions. They should challenge whether such actions will be feasible in a period of stress and whether an IIFS will realistically be willing to carry them out. In making their assessments of an IIFS’s stress testing programme, supervisory authorities should assess the effectiveness of the programme in identifying relevant vulnerabilities, review the key assumptions driving the stress testing results, and challenge their continuing relevance in view of existing and potentially changing market conditions. Further, in cases where a supervisory assessment reveals material deficiencies in the stress testing programme and its use, supervisory authorities should require the IIFS to detail a plan of corrective action aimed at improving the stress testing programme. For example, where liquidity stress testing output is insufficiently integrated into the IIFS’s decision-making, supervisory authorities may suggest actions ranging from improvements in the stress testing framework to increasing the liquidity buffer of the IIFS until stress testing improves. 140. The range of remedial actions by supervisory authorities should take into consideration the magnitude and likelihood of potential stress events and be proportionate to the severity of the impact of the stress test, the overall IIFS’s risk management framework, and its risk mitigating policies. Further, the range of the remedial actions or corrective actions undertaken by the supervisory authorities with respect to any particular IIFS should be considered as one of the supervisory tools (such as on-site and off-site examination). The measures undertaken by supervisory authorities may involve, inter alia:

64 A reference is made to CEBS’s Guidelines on Stress Testing, published in August 2010.

50 a. identifying appropriate IIFS-specific (idiosyncratic) capital buffers65 and/or liquidity buffers; b. the review of limits (e.g. requiring an IIFS to raise the level of capital above the minimum Pillar 1 requirement to ensure that it continues to meet its minimum capital requirements over the capital planning horizon during a stress period); c. the recourse to risk mitigation techniques; d. the reduction of exposures to specific sectors, countries, regions or portfolios; and e. the revision of IIFS policies, such as those that relate to funding or capital adequacy; and the implementation of contingency plans. 4.5 Regular Supervisory Dialogue and Home-Host Coordination Principle 4.5: Supervisory authorities should regularly engage in a dialogue with IIFS and the industry to identify systemic vulnerabilities in the IFSI. In the case of an IIFS operating cross￾border, appropriate discussions should be held between the consolidating and host supervisory authorities to ensure coordination of supervisory activities, including the stress testing activities undertaken at group level, so as to address all the material risks of the IIFS. 141. It is a prudent practice for supervisory authorities to proactively engage in a dialogue with IIFS operating in their jurisdiction and industry, with the aim of discussing stress testing practices and identifying emerging risks and systemic vulnerabilities. Discussion could include ways in which scenarios could unfold and systemic interactions could crystallise. A constructive, systematic dialogue with the industry should help the financial community to understand how the behaviour of IIFS and other market participants may contribute to the build-up of financial imbalances and the crystallisation of systemic vulnerabilities (i.e. any arising systemic risk or boom-and-bust activities that might be taking shape, such as real estate bubbles, CMT-related exposures, etc.). The Survey revealed that a regular engagement of supervisory authorities with industry players enables them to provide holistic assessment and timely identification of potential vulnerabilities affecting the IFSI. For example, it is seen that real estate exposure is a very important element that should be focused on during stress tests. Also, a liquidity crunch causes a systemic problem or system-wide stress, so it would be quite natural for a supervisory authority to be in touch with its IIFS on a regular basis. 142. As part of the supervisory process, the supervisory authorities should convene with senior management of the IIFS to review and discuss the IIFS’s loss and revenue forecasts. Based on those discussions, the supervisory authorities should assess IIFS-specific potential losses and estimated internal resources to absorb those losses under the normal and more adverse cases, and determine whether the IIFS has a sufficient capital buffer necessary to ensure each IIFS has the amount and quality of capital necessary to perform their vital role in the economy. The outcome from this exercise would assist the supervisory authority in conducting an in-depth analysis of the impact on the IIFS across the banking sector and provide feedback through micro-surveillance for formulation of an action plan by the IIFS. Supervisory authorities should also stay abreast of any developments in the market. 143. Home-host supervisory cooperation and discussion, as elaborated on in IFSB-5, can play an essential role in the coordination of cross-border activities, including stress testing. In the case of a cross-border-operating IIFS, appropriate discussions should be held between consolidating and host

65 In the discussion on capital buffers, one should clearly distinguish between general or systemic buffers (e.g. countercyclical capital buffers) being created to address wider issues, such as procyclicality or systemic relevance of an IIFS, which are currently being debated, and IIFS-specific (idiosyncratic) capital buffers set in order to cover the specific features and risk profile of a given IIFS. Supervisory authorities may also require, where deemed necessary, an IIFS to maintain appropriate additional IIFS-specific capital buffers in the current time such that those reserves are available to absorb losses during a severe scenario. In order for this to be effective, supervisory authorities and IIFS need to understand that these capital buffers differ from other types of capital reserves that supervisory authorities expect IIFS to maintain, as these reserves are designed to be used during an economic downturn. In the case of a cross-border banking group, any discussion on the IIFS-specific capital buffers which might be required to mitigate the outcome of stress tests should take place in the course of the process of the joint decision regarding the consolidated and solo capital adequacy.

51 supervisory authorities to ensure coordination of supervisory activities, including the stress testing activities. Home and host supervisory authorities should assess the stress tests performed by a cross-border operating group as part of their stress testing programmes to ensure that all material risks to the group as a whole and all its material entities (subsidiaries) are adequately captured. In the case of cross-border operating groups, stress testing programmes and their results should be discussed by the respective supervisory authorities on a regular basis, in which, if deemed necessary, consolidating and host supervisory authorities may agree to prescribe a scenario reflecting potential macroeconomic developments. 4.6 Frequency of Conducting Stress Testing and Reporting Format Principle 4.6: Supervisory authorities should conduct stress tests at the macro level in their respective jurisdictions at suitable intervals, as well as identifying particular IIFSs that are more sensitive to economic stress in their jurisdictions. They should determine the appropriate qualitative and quantitative disclosures with respect to stress testing to be submitted by the IIFS in their jurisdictions. Supervisory authorities should also provide a standardised reporting format to IIFS that carry out stress testing exercises. 144. In order to assess the impact of adverse shocks on the financial system (including IFSI) through utilising information on balance sheet exposures submitted by IIFS, supervisory authorities should undertake stress testing at the macro level with appropriate intervals and frequency taking into account various risk factors and aspects mentioned in Principle 4.3. However, determination of time horizon and frequency of stress testing should be proportionate to risks covered and the rationale for conducting stress testing. It is worth mentioning that most of the supervisory authorities conduct stress testing semi-annually, as revealed in the Survey. The supervisory stress testing programme should also allow supervisory authorities for ad-hoc stress tests conduct the stress tests when deemed necessary ahead of any financial disorder to verify whether certain shocks will bring any significant change in the whole financial system (including IFSI). 145. In regard to Principle 3.22, supervisory authorities should determine the appropriate level of qualitative and quantitative disclosure to be submitted by the IIFS in their jurisdictions. Nonetheless, the information disclosed should be able to facilitate supervisory authorities to access the relevant and timely information on the stress tests results and their implications thereby enhancing their monitoring capacity. Other than reporting the quantitative results of the stress test (either in absolute amounts and key financial ratios) to supervisory authorities, IIFS should also provide an assessment of their vulnerability (i.e. identifying the main vulnerable areas and the main risk factor(s) that affect each of these areas. Supervisory authorities should ensure that this feedback and assessment submitted by the IIFS is supported by a sufficient level of detail (or granularity) to provide a meaningful understanding of the vulnerable areas and the causes of the stress losses. 146. The ability of an IIFS to report or submit stress test results to the supervisory authorities will depend upon the availability of an appropriate methodology (i.e. reporting format). In general, the frequency of conducting stress testing at the IIFS level should be determined by the IIFS itself; however, adherence to a reporting format for the results of stress testing submitted by the IIFS to the supervisory authorities across the financial system is vital to achieve consistency. In this regard, supervisory authorities should provide a standardised reporting format to those IIFS which carry out stress testing exercises.

52 DEFINITIONS The following definitions are intended to assist readers in their general understanding of the terms used in the Guiding Principles. The list is by no means exhaustive. Commodity Murābahah The term "Commodity Murābahah transactions as a tool for liquidity management (CMT)" means a Murābahah-based purchase and sale transaction of Sharī`ah-compliant commodities, whether on cash or deferred payment terms. Diminishing Mushārakah This form of Mushārakah is a means whereby an IIFS can provide term finance to a client on a profit- and loss-sharing basis. The IIFS enters into this type of Mushārakah with the objective of transferring the ownership to the partner/customer, where the IIFS acts as a joint owner of the asset with a promise by the partner to purchase the IIFS’s share, making a payment on one or more specified future dates. The IIFS’s selling price is normally based on the fair value of the partnership share being transferred on the date of each purchase, which may expose the IIFS to the risk of selling its share of ownership below the acquisition price. Displaced commercial risk (DCR) Displaced commercial risk is the consequence of the rate of return risk. It refers to the magnitude of risks that are transferred to shareholders in order to cushion the IAH from bearing some or all of the risks to which they are contractually exposed in Mu
ārabah funding contracts (see IFSB-1 for details). Fiduciary risk Fiduciary risk is the risk that arises from an IIFS’s failure to perform in accordance with explicit and implicit standards applicable to its fiduciary responsibilities (see IFSB-1 for details). Hibah A unilateral transfer of ownership of a property or its benefit to another without any counter-value from the recipient. Ijārah A contract to lease a specified asset for an agreed period against specified instalments of lease rental. Investment risk reserves (IRR) The amount appropriated by the IIFS out of the profit of IAHs, after allocating the Mu
ārib’s share of profit, in order to cushion against future investment losses for investment account holders. Istisnā A contract to order the manufacturing of an asset according to the buyer’s specifications at a predetermined selling price. The payment of the price and delivery of the asset will be on a specified future date. Various products such as project financing and construction financing are structured under Istisnā. Mu
ārabah A partnership contract between the capital provider (Rabbu al-Māl) and an entrepreneur (Mu
ārib) whereby the capital provider would contribute capital to an enterprise or activity that is to be managed by the entrepreneur. Profits generated by that enterprise or activity are shared in accordance with the percentage specified in the contract, while losses are to be borne solely by the capital provider unless the losses are due to the entrepreneur’s misconduct, negligence or breach of contracted terms. Various deposit (investment) products are structured using this concept. Murābahah A contract to sell a specified asset at an agreed profit margin plus cost (selling price), whereby the cost and profit margin shall be disclosed. The asset must be under complete ownership of the seller. Various products such as auto/vehicle financing, goods financing, property financing and equipment financing are structured under Murābahah. This is the most popular and dominant mode of financing among IIFS.

53 Mushārakah A partnership contract in which the partners (Shuraka’, sing: Sharik) agree to contribute capital to an enterprise, whether existing or new, or towards the ownership of an asset, either on a temporary or permanent basis. Profits generated by that enterprise or asset are shared in accordance with the percentage specified in the Mushārakah agreement, while losses are shared in proportion to each partner’s share of capital. Various products, such as financing imports, exports, working capital, project finance, etc., can be structured using this concept. Profit equalisation reserve (PER) The amount appropriated by the IIFS out of the Mu
ārabah profits, before allocating the Mu
ārib’s share of profit, in order to maintain a certain level of return on investment for unrestricted investment account holders. Salām A contract to purchase an asset (of which the price, quantity and quality are specified) to be delivered in the future. Sukūk Certificates that represent a proportional undivided ownership right in tangible assets, or a pool of assets that are Sharīah compliant. Sukūk securitisation (Sharīah￾compliant securitisation) Securitisation in Sukūk is broadly referred to as a process of issuing Sukūk involving the following steps: (i) origination of assets (in conventional finance, these are normally loans or other receivables, while in Islamic finance they are Sharī`ah-compliant assets such as the subject matter of Ijārah); (ii) transfer of the assets to a special purpose entity (SPE) which acts as the issuer by packaging them into securities (Sukūk); and (iii) issuing the securities to investors. For details see IFSB-7. Takāful A contract whereby a group of participants (Mushtarikīn) agree among themselves to support one another by contributing a sum of money into a common fund, which will be used for mutual assistance of the members against specified loss or damage. Unrestricted investment account holders (IAH) vs. Restricted IAH “Unrestricted IAH” refers to an account where the account holders authorise the IIFS to invest their funds based on Mu
ārabah or Wakālah investment without laying down any restrictions. The IIFS can commingle these funds with its own or other funds. However, “restricted IAH” refers an account where the account holders authorise the IIFS to invest their funds based on Mu
ārabah or Wakālah investment, with certain restrictions as to where, how and for what purpose these funds are to be invested. “Wakālah” refers to an agency contract where the customer (Muwakkil) appoints the IIFS as an agent (Wakīl) to carry out business on their behalf for a fee or without fee.