Capital Adequacy Assessment

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-1 ONLY THE HEBREW VERSION IS BINDING Capital Adequacy Assessment Table of contents Topic Location in Transitional Directive* Page Introduction Paragraph 719 211-2 Importance of capital adequacy assessment Paragraphs 720-724 211-2 Four key principles of capital adequacy assessment Paragraphs 725-760 211-3 Specific issues to be addressed as part of the capital adequacy assessment process Paragraph 761 211-14 Interest rate risk in the banking book Paragraphs 762-764 211-15 Credit risk Paragraphs 765-777 211-15 Operational risk Paragraphs 778 211-23 Market risk Paragraphs 778(i)-778(ii) 211-23 Capital adequacy assessment process for securitization transactions Paragraphs 784-807 211-24

Working Framework for Measurement and Capital Adequacy (Transitional Directive), December 2008

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-2 ONLY THE HEBREW VERSION IS BINDING Introduction 719. This directive discusses the key principles of capital adequacy assessment, risk management guidance and reporting transparency and accountability which have been adopted by the Supervisor of Banks in Israel with respect to banking corporations’ risks, including, among others, the treatment of interest rate risk in the banking book, credit risk (stress testing, definition of default, residual risk, and credit concentration risk), operational risk, enhanced cross-border communication and cooperation, and securitization. The importance of capital adequacy assessment 720. Banking corporations will allocate adequate capital to support all the risks in their business and also will develop and use better risk management techniques in monitoring and managing their risks. 721. Banking corporation management is responsible for developing an internal capital assessment process and setting capital targets that are commensurate with the banking corporation’s risk profile and control environment. Banking corporation management bears responsibility for ensuring that the banking corporation has adequate capital to support its risks beyond the core minimum requirements. 722. Repealed 723. A banking corporation is required to link the amount of capital it holds to the strength and effectiveness of its risk management and internal control processes. However, increased capital should not be viewed as the only option for addressing increased risks confronting the banking corporation. Other means for addressing risk, such as strengthening risk management, applying internal limits, strengthening the level of provisions and reserves, and improving internal controls, must also be considered. Furthermore, capital should not be regarded as

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-3 ONLY THE HEBREW VERSION IS BINDING a substitute for addressing fundamentally inadequate control or risk management processes. 724. There are three main areas that might be particularly suited to treatment within the framework of capital adequacy assessment: risks considered within the framework of minimum capital requirements that are not fully captured in that framework (e.g. credit concentration risk); those factors not taken into account by the process specified in the minimum capital requirements (e.g. interest rate risk in the banking book, business and strategic risk); and factors external to the banking corporation (e.g. business cycle effects). A further important aspect of capital adequacy assessment is the evaluation of compliance with the minimum standards and disclosure requirements of the more advanced methods in the minimum capital requirements, in particular Proper Conduct of Banking Business Directive number 204. Banking corporations will ensure that these requirements are being met, both as qualifying criteria and on a continuing basis. Four key principles of capital adequacy assessment 725. The Supervisor has adopted four key principles of capital adequacy assessment: Principle 1: Banking corporations should have a process for assessing their overall capital adequacy in relation to their risk profile and a strategy for maintaining their capital levels. 726. Banking corporations must be able to demonstrate that chosen internal capital targets are well founded and that these targets are consistent with their overall risk profile and current operating environment. In assessing capital adequacy, banking corporation management needs to be mindful of the particular stage of the business cycle in which the banking corporation is operating. Rigorous, forward￾looking stress testing that identifies possible events or changes in market conditions that could adversely impact the banking corporation should be

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-4 ONLY THE HEBREW VERSION IS BINDING performed. Banking corporation management clearly bears primary responsibility for ensuring that the banking corporation has adequate capital to support its risks. 727. The five main features of a rigorous process are as follows:  Board and senior management oversight;  Sound capital assessment;  Comprehensive assessment of risks;  Monitoring and reporting; and  Internal control review.

1. Board and senior management oversight173
2. A sound risk management process is the foundation for an effective assessment of the adequacy of a banking corporation’s capital position. Banking corporation management is responsible for understanding the nature and level of risk being taken by the banking corporation and how this risk relates to adequate capital levels. It is also responsible for ensuring that the formality and sophistication of the risk management processes are appropriate in light of the risk profile and business plan.
3. The analysis of a banking corporation’s current and future capital requirements in relation to its strategic objectives is a vital element of the strategic planning process. The strategic plan should clearly outline the banking corporation’s capital needs, anticipated capital expenditures, desirable capital level, and external capital sources. Senior management and the board should view capital planning as a crucial element in being able to achieve its desired strategic objectives.
4. The banking corporation’s board of directors has responsibility for setting the banking corporation’s tolerance for risks. It should also ensure that management establishes a framework for assessing the various risks, develops a system to

173 Repealed

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-5 ONLY THE HEBREW VERSION IS BINDING relate risk to the banking corporation’s capital level, and establishes a method for monitoring compliance with internal policies. It is likewise important that the board of directors adopts and supports strong internal controls and written policies and procedures and ensures that management effectively communicates these throughout the organization. 2. Sound capital assessment 731. Fundamental elements of sound capital assessment include:  Policies and procedures designed to ensure that the banking corporation identifies, measures, and reports all material risks;  A process that relates capital to the level of risk;  A process that states capital adequacy goals with respect to risk, taking account of the banking corporation’s strategic focus and business plan; and  A process of internal controls, reviews and audits to ensure the integrity of the overall management process. 3. Comprehensive assessment of risks 732. All material risks faced by the banking corporation should be addressed in the capital assessment process. While the Supervisor recognizes that not all risks can be measured precisely, a process should be developed to estimate risks. Therefore, the following risk exposures, which by no means constitute a comprehensive list of all risks, should be considered. 733. Credit risk: Banking corporations should have methodologies that enable them to assess the credit risk involved in exposures to individual borrowers or counterparties as well as at the portfolio level. For more sophisticated banking corporations, the credit review assessment of capital adequacy, at a minimum, should cover four areas: risk rating systems, portfolio analysis/aggregation, securitization/complex credit derivatives, and large exposures and risk concentrations.

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-6 ONLY THE HEBREW VERSION IS BINDING 734. Internal risk ratings are an important tool in monitoring credit risk. Internal risk ratings should be adequate to support the identification and measurement of risk from all credit exposures, and should be integrated into an institution’s overall analysis of credit risk and capital adequacy. The ratings system should provide detailed ratings for all assets, not only for criticized or problem assets. Loan loss reserves should be included in the credit risk assessment for capital adequacy. 735. The analysis of credit risk should adequately identify any weaknesses at the portfolio level, including any concentrations of risk. It should also adequately take into consideration the risks involved in managing credit concentrations and other portfolio issues through such mechanisms as securitization programs and complex credit derivatives. 736. Operational risk: Similar rigor should be applied to the management of operational risk, as is done for the management of other significant banking risks. The failure to properly manage operational risk can result in a misstatement of an institution’s risk/return profile and expose the institution to significant losses. 737. A banking corporation will develop a framework for managing operational risk and evaluate the adequacy of capital in accordance with Proper Conduct of Banking Business Directive number 206. The framework should cover the banking corporation’s appetite and tolerance for operational risk, as specified through the policies for managing this risk, including the extent and manner in which operational risk is transferred outside the banking corporation. It should also include policies outlining the banking corporation’s approach to identifying, assessing, monitoring and controlling/mitigating the risk. 738. Market risk: Banking corporations will have methodologies that enable them to assess and actively manage all material market risks, wherever they arise, at

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-7 ONLY THE HEBREW VERSION IS BINDING position, department (“desk”), business line or firm-wide levels. For more sophisticated banking corporations, their assessment of internal capital adequacy for market risk, at a minimum, should be based on both VaR modeling and stress testing, including an assessment of concentration risk and the assessment of illiquidity under stressful market scenarios, although all firms’ assessments should include stress testing appropriate to their trading activity. 738.(i) VaR is an important tool in monitoring aggregate market risk exposures and provides a common metric for comparing the risk being run by different desks and business lines. A banking corporation’s VaR model should be adequate to identify and measure risks arising from all its trading activities and should be integrated into the banking corporation’s overall internal capital assessment as well as subject to rigorous on-going validation. A VaR model’s estimates should be sensitive to changes in the trading book risk profile. 738(ii) Banking corporations must supplement their VaR model with stress tests (factor shocks or integrated scenarios whether historic or hypothetical) and other appropriate risk management techniques. In the banking corporation’s internal capital assessment it must demonstrate that it has enough capital to not only meet the minimum capital requirements but also to withstand a range of severe but plausible market shocks. In particular, it must factor in, where appropriate:  Illiquidity/gapping of prices;  Concentrated positions (in relation to market turnover);  One-way markets;  Non-linear products/deep out-of-the money positions;  Events and jumps-to-defaults;  Significant shifts in correlations;  Other risks that may not be captured appropriately in VaR (e.g. recovery rate uncertainty, implied correlations, or skew risk).

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-8 ONLY THE HEBREW VERSION IS BINDING The stress tests applied by a banking corporation and, in particular, the calibration of those tests (e.g. the parameters of the shocks or types of events considered) should be reconciled back to a clear statement setting out the premise upon which the banking corporation’s internal capital assessment is based (e.g. ensuring there is adequate capital to manage the traded portfolios within stated limits through what may be a prolonged period of market stress and illiquidity, or that there is adequate capital to ensure that, over a given time horizon to a specified confidence level, all positions can be liquidated or the risk hedged in an orderly fashion). The market shocks applied in the tests must reflect the nature of portfolios and the time it could take to hedge out or manage risks under severe market conditions. 738(iii). Concentration risk should be pro-actively managed and assessed by firms and concentrated positions should be routinely reported to senior management. 738(iv). Banking corporations will design their risk management systems, including the VaR methodology and stress tests, to properly measure the material risks in instruments they trade as well as the trading strategies they pursue. As their instruments and trading strategies change, the VaR methodologies and stress tests should also evolve to accommodate the changes. 738(v). Banking corporations will demonstrate how they combine their risk measurement approaches to arrive at the overall internal capital for market risk. 739. Interest rate risk in the banking book: The measurement process should include all material interest rate positions of the banking corporation and consider all relevant repricing and maturity data. Such information will generally include current balance and contractual rate of interest associated with the instruments and portfolios, principal payments, interest reset dates, maturities, the rate index used for repricing, and contractual interest rate ceilings or floors for adjustable-

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-9 ONLY THE HEBREW VERSION IS BINDING rate items. The system should also have well-documented assumptions and techniques. 740. Regardless of the type and level of complexity of the measurement system used, banking corporation management will ensure the adequacy and completeness of the system. Because the quality and reliability of the measurement system is largely dependent on the quality of the data and various assumptions used in the model, management should give particular attention to these items. 741. Liquidity risk: Liquidity is crucial to the ongoing viability of any banking organization. Banking corporations’ capital positions can have an effect on their ability to obtain liquidity, especially in a crisis. Each banking corporation must have adequate systems for measuring, monitoring and controlling liquidity risk. Banking corporations should evaluate the adequacy of capital given their own liquidity profile and the liquidity of the markets in which they operate. 742. Other risks: Although ‘other’ risks, such as reputational and strategic risk, are not easily measurable, the banking system will further develop techniques for managing all aspects of these risks. 4. Monitoring and reporting 743. The banking corporation will establish an adequate system for monitoring and reporting risk exposures and assessing how the banking corporation’s changing risk profile affects the need for capital. The banking corporation’s senior management or board of directors should, on a regular basis, receive reports on the banking corporation’s risk profile and capital needs. These reports should allow senior management to:  Evaluate the level and trend of material risks and their effect on capital levels;  Evaluate the sensitivity and reasonableness of key assumptions used in the capital assessment measurement system;

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-10 ONLY THE HEBREW VERSION IS BINDING  Determine that the banking corporation holds sufficient capital against the various risks and is in compliance with established capital adequacy goals; and  Assess its future capital requirements based on the banking corporation’s reported risk profile and make necessary adjustments to the banking corporation’s strategic plan accordingly. 5. Internal controls review 744. The banking corporation’s internal control structure is essential to the capital assessment process. Effective control of the capital assessment process includes an independent review and, where appropriate, the involvement of internal or external audits. The banking corporation’s board of directors has a responsibility to ensure that management establishes a system for assessing the various risks, develops a system to relate risk to the banking corporation’s capital level, and establishes a method for monitoring compliance with internal policies. The board should regularly verify whether its system of internal controls is adequate to ensure well-ordered and prudent conduct of business. 745. The banking corporation will conduct periodic reviews of its risk management process to ensure its integrity, accuracy, and reasonableness. Areas that should be reviewed include:  Appropriateness of the banking corporation’s capital assessment process given the nature, scope and complexity of its activities;  Identification of large exposures and risk concentrations;  Accuracy and completeness of data inputs into the banking corporation’s assessment process;  Reasonableness and validity of scenarios used in the assessment process; and  Stress testing and analysis of assumptions and inputs.

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-11 ONLY THE HEBREW VERSION IS BINDING Principle 2: The Supervisor will review and evaluate banking corporations’ internal capital adequacy assessments and strategies, as well as their ability to monitor and ensure their compliance with regulatory capital ratios. The Supervisor will take appropriate supervisory action if he is not satisfied with the result of this process. 746-747. Repealed. Adequacy of risk assessment 748. Internal targets and processes must incorporate the full range of material risks faced by the banking corporation. Risk measures used in assessing internal capital adequacy will also be used operationally in setting limits, evaluating business line performance, and evaluating and controlling risks more generally. Assessment of capital adequacy 749. The banking corporation must demonstrate that:  Target levels of capital chosen are comprehensive and relevant to the current operating environment;  These levels are properly monitored and reviewed by senior management; and  The composition of capital is appropriate for the nature and scale of the banking corporation’s business. 750. The banking corporation must provide for unexpected events in setting its capital levels. This analysis must cover a wide range of external conditions and scenarios, and the sophistication of techniques and stress tests used should be commensurate with the banking corporation’s activities. Assessment of the control environment 751. Repealed.

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-12 ONLY THE HEBREW VERSION IS BINDING 752. In all instances, the capital level at an individual banking corporation will be determined according to the banking corporation’s risk profile and adequacy of its risk management process and internal controls. External factors such as business cycle effects and the macroeconomic environment should also be considered. Supervisory review of compliance with minimum standards 753. In order for certain internal methodologies, credit risk mitigation techniques and asset securitizations to be recognized for regulatory capital purposes, banking corporations will need to meet a number of requirements, including risk management standards and disclosures. In particular, banking corporations will be required to disclose features of their internal methodologies used in calculating minimum capital requirements. 754. The minimum standards and qualifying criteria are to be viewed as a useful set of benchmarks that are aligned with banking corporation management expectations for effective risk management and capital allocation. 755. Various instruments that can reduce minimum capital requirements are to be utilized and understood by the banking corporation as part of a sound, tested, and properly documented risk management process. 756. Repealed. Principle 3: The Supervisor expects banking corporations to operate above the minimum regulatory capital ratios and can require that they hold capital in excess of the minimum. 757. Minimum capital requirements will include a buffer for uncertainties surrounding the framework for determining the minimum capital requirement and which affect the banking system as a whole. Banking corporation-specific uncertainties will be

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-13 ONLY THE HEBREW VERSION IS BINDING treated as part of this directive. It is anticipated that such buffers will be set to provide reasonable assurance that a banking corporation with good internal systems and controls, a well-diversified risk profile and a business profile well covered by the minimum capital requirement framework, and which operates according to the requirements established by Proper Conduct of Banking Business Directives number 203-208, will meet the minimum goals for soundness. However, the Supervisor will consider whether the particular features of the markets for which they are responsible are adequately covered. Banking corporations will be required to operate with a buffer, over and above the standard set by minimum capital requirements. Banking corporations will maintain this buffer in the case of a combination of the following situations: (a) Many banking corporations, for their own reasons, aspire to a level of creditworthiness that is higher than the minimum standards set by the minimum capital requirements. For example, most international banking corporations appear to prefer to be highly rated by internationally recognized rating agencies. Thus, banking corporations are likely to choose to operate above minimum thresholds established by Proper Conduct of Banking Business Directives number 203-208 for competitive reasons. (b) In the normal course of business, the type and volume of activities will change, as will the different risk exposures, causing fluctuations in the overall capital ratio. (c) It may be costly for banking corporations to raise additional capital, especially if this needs to be done quickly or at a time when market conditions are unfavorable. (d) For banking corporations to fall below minimum regulatory capital requirements is a serious matter. It may place banking corporations in breach of the relevant law and/or prompt non-discretionary corrective action on the part of the Supervisor.

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-14 ONLY THE HEBREW VERSION IS BINDING (e) There may be risks, either specific to individual banking corporations, or more generally to the economy at large, that are not taken into account by the framework for minimum capital requirements. 758. There are several means available to the Supervisor for ensuring that individual banking corporations are operating with adequate levels of capital. Among other methods, the Supervisor has the authority to set trigger or target capital ratios or define categories above minimum ratios (e.g. well capitalized and adequately capitalized) for identifying the capitalization level of the banking corporation. Principle 4: The Supervisor will intervene at an early stage to prevent capital from falling below the minimum levels required to support the risk characteristics of a particular banking corporation and will require rapid remedial action if capital is not maintained or restored. 759. The Supervisor will consider a range of options if a concern arises that a banking corporation is not meeting the requirements embodied in the supervisory principles outlined above. These actions may include intensifying the monitoring of the banking corporation, restricting the payment of dividends, requiring the banking corporation to prepare and implement a satisfactory capital adequacy restoration plan, and requiring the banking corporation to raise additional capital immediately. The Supervisor has the discretion to use the tools best suited to the circumstances of the banking corporation and its operating environment. 760. Repealed. III. Specific issues to be addressed as part of the capital adequacy assessment process 761. There are a number of important issues that banking corporations should particularly focus on when carrying out the capital adequacy assessment process.

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-15 ONLY THE HEBREW VERSION IS BINDING These issues include some key risks which are not directly addressed in Proper Conduct of Banking Business Directives number 203-208. A. Interest rate risk in the banking book 762. Interest rate risk in the banking book is a potentially significant risk which merits support from capital. 763. The revised guidance on interest rate risk recognizes banking corporations’ internal systems as the principal tool for the measurement of interest rate risk in the banking book. To facilitate the Supervisor’s monitoring of interest rate risk exposures across institutions, banking corporations will provide the Supervisor with the results of their internal measurement systems, expressed in terms of economic value relative to capital, using a standardized interest rate shock. 764. Repealed. B. Credit risk

1. Stress tests under the IRB approaches
2. A banking corporation should ensure that it has sufficient capital to meet the minimum capital requirements and the results (where a deficiency has been indicated) of the credit risk stress test performed as part of the capital requirements specified in the IRB minimum requirements (Paragraphs 434 to 437 of Proper Conduct of Banking Business Directive number 204). The results of the stress test will thus contribute directly to the expectation that a banking corporation will operate above the regulatory capital ratios set by the minimum capital requirements.
3. Definition of default
4. A banking corporation will use the reference definition of default for its internal estimations of PD (probability of default) and/or LGD (loss given default) and EAD (exposure at default).

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-16 ONLY THE HEBREW VERSION IS BINDING 3. Residual risk 767. Proper Conduct of Banking Business Directive number 203 allows banking corporations to offset credit or counterparty risk with collateral, guarantees or credit derivatives, leading to reduced capital charges. While banking corporations use credit risk mitigation (CRM) techniques to reduce their credit risk, these techniques give rise to risks that may render the overall risk reduction less effective. Accordingly these risks (e.g. legal risk, documentation risk, or liquidity risk) to which banking corporations are exposed are of concern to the Supervisor. Where such risks arise, and irrespective of fulfilling the minimum requirements set out in Proper Conduct of Banking Business Directive number 203, a banking corporation could find itself with greater credit risk exposure to the underlying counterparty than it had expected. Examples of these risks include:  Inability to seize, or realize in a timely manner, collateral pledged (on default of the counterparty);  Refusal or delay by a guarantor to pay; and  Ineffectiveness of untested documentation. 768. Banking corporations will have in place appropriate written CRM policies and procedures in order to control these residual risks. A banking corporation may be required to submit these policies and procedures to the Supervisor and must regularly review their appropriateness, effectiveness and operation. 769. In its CRM policies and procedures, a banking corporation must consider whether, when calculating capital requirements, it is appropriate to give the full recognition of the value of the credit risk mitigant as permitted by the minimum capital requirements and must demonstrate that its CRM management policies and procedures are appropriate to the level of capital benefit that it is recognizing. 4. Credit concentration risk

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-17 ONLY THE HEBREW VERSION IS BINDING 770. A risk concentration is any single exposure or group of exposures with the potential to produce losses large enough (relative to a banking corporation’s capital, total assets, or overall risk level) to threaten a banking corporation’s health or ability to maintain its core operations. Risk concentrations are arguably the single most important cause of major problems in banking corporations. 771. Risk concentrations can arise in a banking corporation’s assets, liabilities, or off￾balance-sheet items, through the execution or processing of transactions (either product or service), or through a combination of exposures across these broad categories. Because lending is the primary activity of most banking corporations, credit risk concentrations are often the most material risk concentrations within a banking corporation. 772. Credit risk concentrations, by their nature, are based on common or correlated risk factors, which, in times of stress, have an adverse effect on the creditworthiness of each of the individual counterparties making up the concentration. Concentration risk arises in both direct exposures to obligors and may also occur through exposures to protection providers. Such concentrations are not addressed in the capital charge for credit risk as set out in the minimum capital requirements. 773. Banking corporations will have in place effective internal policies, systems and controls to identify, measure, monitor, and control their credit risk concentrations. Banking corporations should explicitly consider the extent of their credit risk concentrations in their internal assessment of capital adequacy under this directive. These policies should cover the different forms of credit risk concentrations to which a banking corporation may be exposed. Such concentrations include:  Significant exposures to an individual counterparty or group of related counterparties. The Supervisor has defined limits for exposures of this nature, which are described in Proper Conduct of Banking Business Directive number 313 (Limits on the Liability of a Borrower and Group of Borrowers). Banking

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-18 ONLY THE HEBREW VERSION IS BINDING corporations might also establish an aggregate limit for the management and control of all of its large exposures as a group;  Credit exposures to counterparties in the same economic sector or geographic region;  Credit exposures to counterparties whose financial performance is dependent on the same activity or commodity; and  Indirect credit exposures arising from a banking corporation’s CRM activities (e.g. exposure to a single collateral type or to credit protection provided by a single counterparty). 774. A banking corporation’s framework for managing credit risk concentrations will be clearly documented and should include a definition of the credit risk concentrations relevant to the banking corporation and how these concentrations and their corresponding limits are calculated. Limits should be defined in relation to a banking corporation’s capital, total assets or, where adequate measures exist, its overall risk level. 775. A banking corporation’s management should conduct periodic stress tests of its major credit risk concentrations and review the results of those tests to identify and respond to potential changes in market conditions that could adversely impact the banking corporation’s performance. 776. A banking corporation should ensure that, in respect of credit risk concentrations, it complies with the instructions of the Supervisor, including the instructions contained in Principles for the Management of Credit Risk (September 2000) and the more detailed guidance in Appendix 10 to that document. 777. Repealed. 5. Counterparty credit risk

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-19 ONLY THE HEBREW VERSION IS BINDING 777(i). As counterparty credit risk (CCR) represents a form of credit risk, this type of risk will be dealt with according to the rules set out in Proper Conduct of Banking Business Directive number 203 regarding stress testing, “residual risks” associated with credit risk mitigation techniques, and credit concentrations, as specified in the paragraphs above.

777(ii). The banking corporation must have counterparty credit risk management policies, processes and systems that are conceptually sound and implemented with integrity relative to the sophistication and complexity of a firm’s holdings of exposures that give rise to CCR. A sound counterparty credit risk management framework shall include the identification, measurement, management, approval and internal reporting of CCR. 777(iii). The banking corporation’s risk management policies will take into account the market, liquidity, legal and operational risks that can be associated with CCR and, to the extent practicable, interrelationships among those risks. The banking corporation must not undertake business with a counterparty without assessing its creditworthiness and must take due account of both settlement and pre-settlement credit risk. These risks must be managed as comprehensively as practicable at the counterparty level (aggregating counterparty exposures with other credit exposures) and at the firm-wide level. 777(iv). The board of directors and senior management must be actively involved in the CCR control process and must regard this as an essential aspect of the business to which significant resources need to be devoted. Where the banking corporation is using an internal model for CCR, senior management must be aware of the limitations and assumptions of the model used and the impact these can have on the reliability of the output. They should also consider the uncertainties of the market environment (e.g. timing of realization of collateral) and operational issues

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-20 ONLY THE HEBREW VERSION IS BINDING (e.g. pricing feed irregularities) and be aware of how these are reflected in the model. 777(v). In this regard, the daily reports prepared on a firm’s exposures to CCR must be reviewed by a level of management with sufficient seniority and authority to enforce both reductions of positions taken by individual credit managers or traders and reductions in the firm’s overall CCR exposure. 777(vi). The banking corporation’s CCR management system must be used in conjunction with internal credit and trading limits. In this regard, credit and trading limits must be related to the firm’s risk measurement model in a manner that is consistent over time and that is well understood by credit managers, traders and senior management. 777(vii). The measurement of CCR must include monitoring daily and intra-day usage of credit lines. The banking corporation must measure current exposure gross and net of collateral held where such measures are appropriate and meaningful (e.g. OTC derivatives, margin lending, etc.). Measuring and monitoring peak exposure or potential future exposure (PFE) at a confidence level chosen by the banking corporation at both the portfolio and counterparty levels is one element of a robust limit monitoring system. Banking corporations must take account of large or concentrated positions, including concentrations by groups of related counterparties, by industry, by market, customer investment strategies, etc. 777(viii). The banking corporation must have a routine and rigorous program of stress testing in place as a supplement to the CCR analysis based on the day-to-day output of the firm’s risk measurement model. The results of this stress testing must be reviewed periodically by senior management and must be reflected in the CCR policies and limits set by management and the board of directors. Where stress tests reveal particular vulnerability to a given set of circumstances,

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-21 ONLY THE HEBREW VERSION IS BINDING management should explicitly consider appropriate risk management strategies (e.g. by hedging against that outcome, or reducing the size of the firm’s exposures). 777(ix). The banking corporation must have a routine in place for ensuring compliance with a documented set of internal policies, controls and procedures concerning the operation of the CCR management system. The firm’s CCR management system must be well documented, for example, through a risk management manual that describes the basic principles of the risk management system and that provides an explanation of the empirical techniques used to measure CCR. 777(x). The banking corporation must conduct an independent review of the CCR management system regularly through its own internal auditing process. This review must include both the activities of the business credit and trading units and of the independent CCR control unit. A review of the overall CCR management process must take place at regular intervals (ideally not less than once a year) and must specifically address, at a minimum:  the adequacy of the documentation of the CCR management system and process;  the organization of the CCR control unit;  the integration of CCR measures into daily risk management;  the approval process for risk pricing models and valuation systems used by front- and back-office personnel;  the validation of any significant change in the CCR measurement process;  the scope of counterparty credit risks captured by the risk measurement model;  the integrity of the management information system;  the accuracy and completeness of CCR data;

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-22 ONLY THE HEBREW VERSION IS BINDING  the verification of the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources;  the accuracy and appropriateness of volatility and correlation assumptions;  the accuracy of valuation and risk transformation calculations;  the verification of the model’s accuracy through frequent backtesting. 777(xi). A banking corporation that receives approval to use an internal model to estimate its exposure amount or EAD for CCR exposures must monitor the appropriate risks and have processes to adjust its estimation of EPE when those risks become significant. This includes the following:  Banking corporations must identify and manage their exposures to specific wrong-way risk.  For exposures with a rising risk profile after one year, banking corporations must compare on a regular basis the estimate of EPE over one year with the EPE over the life of the exposure.  For exposures with a short-term maturity (below one year), banking corporations must compare on a regular basis the replacement cost (current exposure) and the realized exposure profile, and/or store data that allow such comparisons. 777(xii). Repealed. 777(xiii). Repealed. 777(xiv). Repealed. C. Operational risk 778. Gross income, used in the Basic Indicator and Standardized Approaches for operational risk, is only a proxy for the scale of operational risk exposure of a

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-23 ONLY THE HEBREW VERSION IS BINDING banking corporation and can in some cases (e.g. for banking corporations with low margins or profitability) underestimate the need for capital for operational risk. With reference to the Committee document on Sound Practices for the Management and Supervision of Operational Risk (February 2003), the Supervisor will consider whether the capital requirement generated by the calculation in Proper Conduct of Banking Business Directive number 206 gives a consistent picture of the individual banking corporation’s operational risk exposure, for example in comparison with other banking corporations of similar size and with similar operations. D. Market risk

1. Policies and procedures for trading book eligibility 778(i). Clear policies and procedures used to determine the exposures that may be included in, and those that should be excluded from, the trading book for purposes of calculating regulatory capital are critical to ensure the consistency and integrity of firms’ trading book. Such policies must conform to paragraph 687(i) of Proper Conduct of Banking Business Directive number 208.
2. Valuation 778(ii). Prudent valuation policies and procedures form the foundation on which any robust assessment of market risk capital adequacy should be built. For a well diversified portfolio consisting of highly liquid cash instruments, and without market concentration, the valuation of the portfolio, combined with the minimum quantitative standards set out in paragraph 718(Lxxvi) of Proper Conduct of Banking Business Directive number 208, as revised in this section, is expected to deliver sufficient capital to enable a banking corporation, in adverse market conditions, to close out or hedge its positions within 10 days in an orderly fashion. However, for less well diversified portfolios, for portfolios containing less liquid instruments, for portfolios with concentrations in relation to market turnover, and/or for portfolios which contain large numbers of positions that are marked-to-model, this is less likely to be the case. In such circumstances, the Supervisor will consider

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-24 ONLY THE HEBREW VERSION IS BINDING whether a banking corporation has sufficient capital. To the extent there is a shortfall the Supervisor will react appropriately. This will usually require the banking corporation to reduce its risks and/or hold an additional amount of capital. 3. Stress testing under the internal models approach 778(iii). Not yet adopted. 4. Specific risk modeling under the internal models approach 778(iv). Not yet adopted. IV. Other aspects 779-783. Repealed. V. Capital adequacy assessment process for securitization transactions 784-785. Repealed. A. Significance of risk transfer 786. Securitization transactions may be carried out for purposes other than credit risk transfer (e.g. funding). Where this is the case, there might still be a limited transfer of credit risk. However, for an originating banking corporation to achieve reductions in capital requirements, the risk transfer arising from a securitization has to be deemed significant. Therefore, the capital relief that can be achieved will correspond to the amount of credit risk that is effectively transferred. The following includes a set of examples in which there may be a concern about the degree of risk transfer, such as retaining or repurchasing significant amounts of risk or “cherry picking” the exposures to be transferred via a securitization. 787. Retaining or repurchasing significant securitization exposures, depending on the proportion of risk held by the originator, might undermine the intent of a securitization to transfer credit risk. Specifically, the Banking Supervision

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-25 ONLY THE HEBREW VERSION IS BINDING Department expects that a significant portion of the credit risk and of the nominal value of the pool be transferred to at least one independent third party at inception and on an ongoing basis. Where banking corporations repurchase risk for market making purposes, the Banking Supervision Department will find it appropriate for an originator to buy part of a transaction but not, for example, to repurchase a whole tranche. The Banking Supervision Department expects that where positions have been bought for market making purposes, these positions should be resold within an appropriate period, thereby remaining true to the initial intention to transfer risk. 788. Another implication of realizing only a non-significant risk transfer, especially if related to good quality unrated exposures, is that both the poorer quality unrated assets and most of the credit risk embedded in the exposures underlying the securitized transaction are likely to remain with the originator. Accordingly, and depending on the outcome of the Banking Supervision Department’s review process, the Supervisor may increase the capital requirement for particular exposures or even increase the overall level of capital the banking corporation is required to hold. B. Market innovations 789. As the minimum capital requirements for securitization may not be able to address all potential issues, the Banking Supervision Department expects the banking corporations to consider new features of securitization transactions as they arise. Such assessments would include reviewing the impact new features may have on credit risk transfer and, where appropriate, the Banking Supervision Department will take appropriate action under this directive. A response may be formulated in accordance with the minimum capital requirements in order to take account of market innovations. Such a response may take the form of a set of operational requirements and/or a specific capital treatment.

C. Provision of implicit support

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-26 ONLY THE HEBREW VERSION IS BINDING 790. Support to a transaction, whether contractual (i.e. credit enhancements provided at the inception of a securitized transaction) or non-contractual (implicit support) can take numerous forms. For instance, contractual support can include over collateralization, credit derivatives, spread accounts, contractual recourse obligations, subordinated notes, credit risk mitigants provided to a specific tranche, the subordination of fee or interest income or the deferral of margin income, and clean-up calls that exceed 10 percent of the initial issuance. Examples of implicit support include the purchase of deteriorating credit risk exposures from the underlying pool, the sale of discounted credit risk exposures into the pool of securitized credit risk exposures, the purchase of underlying exposures at above market price or an increase in the first loss position according to the deterioration of the underlying exposures. 791. The provision of implicit (or non-contractual) support, as opposed to contractual credit support (i.e. credit enhancements), raises significant concerns. For traditional securitization structures the provision of implicit support undermines the clean break criteria which, when satisfied, would allow banking corporations to exclude the securitized assets from regulatory capital calculations. For synthetic securitization structures, it negates the significance of risk transference. By providing implicit support, banking corporations signal to the market that the risk is still with the banking corporation and has not in effect been transferred. The institution’s capital calculation therefore understates the true risk. Accordingly, the Banking Supervision Department will take appropriate action when a banking corporation provides implicit support. 792. When a banking corporation has been found to provide implicit support to a securitization, it will be required to hold capital against all of the underlying exposures associated with the structure as if they had not been securitized. It will also be required to disclose publicly that it was found to have provided non￾contractual support, as well as the resulting increase in the capital charge (as noted

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-27 ONLY THE HEBREW VERSION IS BINDING above). The aim is to require banking corporations to hold capital against exposures for which they assume the credit risk, and to discourage them from providing non￾contractual support. 793. If a banking corporation is found to have provided implicit support on more than one occasion, the banking corporation is required to disclose its transgression publicly and the Banking Supervision Department will take appropriate action. 794. Repealed. D. Residual risks 795. As with credit risk mitigation techniques more generally, the banking corporation will review the appropriateness of its approaches to the recognition of credit protection. In particular, with regard to securitizations, the banking corporation will review the appropriateness of protection recognized against first loss credit enhancements. On these positions, expected loss is less likely to be a significant element of the risk and is likely to be retained by the protection buyer through the pricing. Therefore, the Banking Supervision Department will expect banking corporations' policies to take account of this in determining their economic capital. Where the Supervisor does not consider the approach to protection recognized to be adequate, he will take appropriate action. Such action may include increasing the capital requirement against a particular transaction or class of transactions. E. Call provisions 796. A banking corporation will not make use of clauses that entitle it to call the securitization transaction or the coverage of credit protection prematurely if this would increase the banking corporation’s exposure to losses or deterioration in the credit quality of the underlying exposures.

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-28 ONLY THE HEBREW VERSION IS BINDING 797. Besides the general principle stated above, banking corporations will only execute clean-up calls for economic business purposes, such as when the cost of servicing the outstanding credit exposures exceeds the benefits of servicing the underlying credit exposures. 798-800. Repealed. F. Early amortization 801. Banking corporations will internally measure, monitor, and manage risks associated with securitizations of revolving credit facilities, including an assessment of the risk and likelihood of early amortization of such transactions. Banking corporations will implement reasonable methods for allocating economic capital against the economic substance of the credit risk arising from revolving securitizations and will have adequate capital and liquidity contingency plans that evaluate the probability of an early amortization occurring and address the implications of both scheduled and early amortization. In addition, the capital contingency plan should address the possibility that the banking corporation will face higher levels of required capital under the early amortization minimum capital requirements. 802. Because most early amortization triggers are tied to excess spread levels, the factors affecting these levels should be well understood, monitored, and managed, to the extent possible (see paragraphs 790 to 794 on implicit support), by the originating banking corporation. For example, the following factors affecting excess spread should generally be considered:  Interest payments made by borrowers on the underlying receivable balances;  Other fees and charges to be paid by the underlying obligors (e.g. late￾payment fees, cash advance fees, over-limit fees);  Gross charge-offs;  Principal payments;  Recoveries on charged-off loans;

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-29 ONLY THE HEBREW VERSION IS BINDING  Interchange income;  Interest paid on investors’ certificates;  Macroeconomic factors such as bankruptcy rates, interest rate movements, unemployment rates; etc. 803. Banking corporations should consider the effects that changes in portfolio management or business strategies may have on the levels of excess spread and on the likelihood of an early amortization event. For example, marketing strategies or underwriting changes that result in lower finance charges or higher charge-offs, might also lower excess spread levels and increase the likelihood of an early amortization event. 804. Banking corporations should use techniques such as static pool cash collections analyses and stress tests to better understand pool performance. These techniques can highlight adverse trends or potential adverse impacts. Banking corporations should have policies in place to respond promptly to adverse or unanticipated changes. 805. While the early amortization capital charge described in the minimum capital requirements is meant to address potential supervisory concerns associated with an early amortization event, such as the inability of excess spread to cover potential losses, the policies and monitoring described in this section recognize that a given level of excess spread is not, by itself, a perfect proxy for credit performance of the underlying pool of exposures. In some circumstances, for example, excess spread levels may decline so rapidly as to not provide a timely indicator of underlying credit deterioration. Further, excess spread levels may reside far above trigger levels, but still exhibit a high degree of volatility which could warrant supervisory attention. In addition, excess spread levels can fluctuate for reasons unrelated to underlying credit risk, such as a mismatch in the rate at which finance charges reprice relative to investor certificate rates. Routine fluctuations of excess spread

Supervisor of Banks: Proper Conduct of Banking Business [2] (5/13) Measurement and Capital Adequacy— Capital Adequacy Assessment page 211-30 ONLY THE HEBREW VERSION IS BINDING might not generate supervisory concerns, even when they result in different capital requirements. This is particularly the case as a banking corporation moves in or out of the first step of the early amortization credit conversion factors. On the other hand, existing excess spread levels may be maintained by adding (or designating) an increasing number of new accounts to the master trust, an action that would tend to mask potential deterioration in a portfolio. For all of these reasons, the Banking Supervision Department will place particular emphasis on internal management, controls, and risk monitoring activities with respect to securitizations with early amortization features. 806. The sophistication of a banking corporation’s system in monitoring the likelihood and risks of an early amortization event will be commensurate with the size and complexity of the banking corporation’s securitization activities that involve early amortization provisions. 807. Repealed.