ICAAP Internal Supervisory Guidelines

RESERVE BANK OF MALAWI GUIDELINES FOR INTERNAL SUPERVISORY REVIEW AND EVALUATION PROCESS March, 2013

1 Table of Contents 1.0 INTRODUCTION ............................................................................................ 2 2.0 MAIN FEATURES OF THE SREP ................................................................. 3 3.0 KEY FACTORS TO BE CONSIDERED IN THE SREP ............................... 3 3.1 Regulatory capital .......................................................................................... 4 3.2 Credit risk including concentration risk ........................................................ 5 3.3 Market risk..................................................................................................... 6 3.4 Operational risk ............................................................................................. 7 3.5 Interest rate risk in the banking book ............................................................ 7 3.6 Liquidity risk ................................................................................................. 8 3.7 Country risk ................................................................................................... 9 3.8 Earnings and profitability ............................................................................10 3.9 Corporate governance and internal control .................................................10 3.10 Other material risks .....................................................................................11 4.0 REVIEW OF THE ICAAP .............................................................................12 5.0 DIALOGUE WITH BANKS .........................................................................13 6.0 SUPERVISORY RESPONSE ........................................................................15

2 THE SUPERVISORY REVIEW AND EVALUATION PROCESS 1.0 INTRODUCTION The Reserve Bank of Malawi’s Supervisory Review Process (SRP) in the context of this document involves; an evaluation of banks’ Internal Capital Adequacy Assessment Processes (ICAAP) and their output; a dialogue with banks with regard to their ICAAP; and prudential measures that may be taken to address the identified weaknesses. This guideline therefore, supplements the existing guidelines set out in the Risk Based Supervision Manual of Examinations, the CAMEL Rating, and the Risk Assessment System (RAS). Although these guidelines are mainly directed at RBM supervision and examination personnel, banks may have an interest in knowing the approach the RBM intends to take in assessing capital adequacy. The basic components of the SREP are already embedded in the Registrar’s existing supervisory framework which rests on two elements - off-site monitoring, and on-site examination. The implementation of the SREP in the context of this guideline will be more of an elaboration and refinement process, rather than a radical change in existing practices. That said, proper execution of the SREP implies sound understanding of the core supervisory practices embedded in off site and on- site activities, thorough knowledge of all supervisory tools ranging from laws, regulations and international best practices. As this is assumed baseline knowledge, weaknesses should be

3 identified for remedy through appropriate initiatives. Needless to say, that banking system is very dynamic and the supervisory regime should be alert to this. Worth highlighting are refinement of the Basel II through what is popularly called Basel III. In summary, introduction of the Leverage ratio, Capital Conservation Buffer, Counter Cyclical Buffer, Liquidity Coverage Ratio and Net Stable Funding Ratio in ensuring sound capitalization, use of high quality capital as well as reliance on long term source of funding espoused in Basel III should be embraced. 2.0 MAIN FEATURES OF THE SREP The SREP will broadly involve the review of adequacy of risk assessment, assessment of capital adequacy, assessment of the control environment, and review of compliance with minimum standards; and will involve some combination of: a) On-site examinations; b) Off-site review; c) Discussions with bank management; d) Review of work done by external auditors (provided it is adequately focused on the necessary capital issues); e) Periodic reporting; and f) Risk assessment system. 3.0 KEY FACTORS TO BE CONSIDERED IN THE SREP

4 The Registrar will consider as a minimum the following key factors, which will enable it to apply a risk-based supervision framework to banks: a) Regulatory capital, b) Credit risk, including concentration risk, c) Market risk, d) Operational risk, e) Interest rate risk in the banking book, f) Liquidity risk, g) Country risk, h) Earnings and profitability, i) Corporate governance and internal control, j) Other material risks; k) Review of the ICAAP; and l) Correlation between risks1 . 3.1 Regulatory capital With respect to regulatory capital, the Registrar will assess and analyse: a) The structure of regulatory capital, the proportion and quality of Tier 1 capital, including the proportion of minority interests; b) The manner in which the bank monitors and manages its regulatory capital with particular attention to any event/circumstance that may

1 For example how liquidity risks transforms into solvency risk.

5 impact on the capital adequacy ratio, e.g. a large risk of provisioning, pursuit of a policy of expansion and peer group comparison; and c) The capacity of the bank to secure additional capital including parent or group support and accessibility to markets. 3.2 Credit risk including concentration risk The Registrar’s assessment of credit risk will consist of the following: a) A review of the broad composition of the bank’s credit portfolio, including its business lines and credit assessment procedures; b) A review of the bank’s level of doubtful loans, its policy for classifying doubtful loans as well as the appropriateness of the level of provisioning; c) The verification of the bank’s calculation of credit risk-weighted assets under the standardised approach; and d) A review of the bank’s credit risk mitigation policies and the credit risk mitigation instruments used by the bank, and their compliance on an ongoing basis with the minimum requirements to be recognised for regulatory capital purposes. This will ensure that other risks that the use of credit risk mitigation techniques give rise

6 to (e.g. legal risk, documentation risk and liquidity risk), are adequately controlled. With respect to credit concentration risk, the Registrar will assess: a) The bank’s policies and limits with respect to exposure sizes and concentrations, including sectoral and geographical concentration, b) The actual structure of its credit portfolio; and c) Whether the Pillar 1 standardised credit risk capital figure is adequate. 3.3 Market risk The Registrar’s assessment of market risk will consist of the following: a) Review the nature of the trading activities of a bank to ascertain whether there is no variation in market parameters that would warrant a change in the Registrar’s policy; b) Review the bank’s policy with respect to interest rate risk, equity risk, foreign exchange risk, and commodity risk;

7 c) Evaluate how the bank combines its risk measurement approaches to arrive at the overall internal capital for interest rate risk, equity risk, foreign exchange risk and commodity risk; and d) Assess the adequacy of the capital. 3.4 Operational risk The analysis of operational risk will cover: a) The review of the structure and complexity of the bank’s business model and operations; b) The systems for identifying and cataloguing material incidents along with any losses recorded; c) The operational risk monitoring system and its scope of application; and d) The assessment of the bank’s calculation of operational risk capital under the standardised approach and the adequacy of capital. 3.5 Interest rate risk in the banking book Banks should conduct simple stress tests to provide standardised measures of interest rate risk in the banking book (IRRBB), involving an across-the board interest rate shock of 200 basis points up or

8 down. Banks for which this standard test results in a reduction in economic value of more than 20 per cent of the capital base are identified as ‘outliers’, and will be given extra supervisory attention. They may be required to maintain additional capital. The analysis of the IRRBB will involve: a) An assessment of the bank’s tools and methodologies which include both quantitative and qualitative factors, used for the measurement of the overall interest rate risk; and b) An assessment of whether the standardised measure accurately reflects the true IRRBB of the bank and if not, what alternative measures the bank believes would be more appropriate and what results they would produce. 3.6 Liquidity risk In the analysis of the bank’s liquidity and transformation structure, the Registrar will review: a) The bank’s liquidity risk management policies, procedures and limits, and its actual liquidity risk profile. Factors to be considered will include the level, trend and volatility of the bank’s liquidity ratio, its maturity profile, the stability and concentration of its funding sources and other qualitative factors such as the bank’s

9 borrowing capability and access to money markets, and results of stress tests; and b) Whether the total Pillar 1 capital figure provides sufficient coverage of liquidity risk given the bank’s liquidity risk profile and the liquidity of the market in which it operates.2 3.7 Country risk With respect to country risk, the Registrar will: a) Review the bank’s policies and processes relating to the identification, measurement, monitoring and control of country risk and transfer risk; b) Assess whether the bank monitors and evaluates developments in country risk and in transfer risk and applies appropriate countermeasures; c) Assess whether the bank has information systems, risk management systems and internal control systems that accurately monitor and control exposures on an individual country basis and whether country exposure limits, if any, are adhered to.

2 The RBM will nonetheless endeavour to embrace the Liquidity Coverage Ratio and the Net Stable Funding Ratio as packaged in the Basel III.

10 3.8 Earnings and profitability The quality of the profits earned by a bank is critical to ensuring the maintenance of its financial strength. For this reason, the registrar will analyse: a) The composition of income and profits; and b) The level, structure and trends in a number of ratios and indicators e.g. the return on assets, net banking income and cost-to-income ratio. The Registrar will complement the analysis with an accounting review of the composition of earnings and will assess all the above elements in relation to the overall strategy of the bank. 3.9 Corporate governance and internal control The review of the bank’s general organisation will include: a) The control systems put in place by the bank including the bank's management information systems, and the methods used to monitor each of the risks borne by the bank; b) The evaluation of the board’s responsibility in ensuring that management establishes a system for assessing the various risks that relates them to the bank’s capital level; and

11 c) A review of the work of internal audit and external audit reports. 3.10 Other material risks AML/CFT measures Money laundering and terrorist financing may represent significant risks for a bank. In this respect, the Registrar issued Guidance Notes on AML/CFT in which it has recommended a panoply of anti-money laundering and anti￾terrorist financing measures. The Registrar will verify: a) Whether the bank has implemented internal procedures to detect money laundering and terrorist financing; b) Whether the bank has procedures that allow the application of legal and regulatory provisions; c) Whether the collection of relevant information on large, unusual and complex transactions is effected; and d) The effectiveness of the tools, computerised or other, that are used to detect suspicious transactions.

12 The analysis of risks detailed above is not exhaustive. The Registrar will enquire from the bank whether it believes there are any other risks to which it is materially exposed and the impact they may have on overall capital adequacy. The Registrar will consider the extent to which the bank has provided for unexpected events in setting its capital levels. 4.0 REVIEW OF THE ICAAP 4.1A bank shall submit its ICAAP and the results of its stress tests to the Registrar along with its audited financial statements. It is expected that this will be at least an annual requirement or as and when there are major changes to the assessed position. The objective of the Registrar’s review of the ICAAP is to determine whether the level and composition of capital are appropriate for the nature and scale of the bank’s business. The Registrar will evaluate whether the target levels of capital established by the bank are: a) Based on a rigorous process that is comprehensive and encompasses all material risks to which the bank is exposed; b) Relevant to the current operating environment; c) Based on testing for unexpected events (scenario analysis);

13 d) Commensurate with the bank’s risk profile, the adequacy of its risk management and internal control environment; and e) Properly monitored by senior management and reviewed by the Board. 4.2 A bank must be able to explain and demonstrate to the satisfaction of the Registrar: a) How its ICAAP meets supervisory requirements; b) How it defines, categorises and measures its material risks; c) How the internal capital targets are chosen and how they relate to the overall risk profile and current operating environment of the bank; and d) How these targets are consistent with the present and future business needs of the bank. 4.3 The bank must be able to explain the similarities and differences between the level of capital calculated under its ICAAP and its regulatory capital requirements. 5.0 DIALOGUE WITH BANKS

14 5.1 The SREP will generate an active dialogue with the bank, the purpose of which is: a) To obtain a deeper understanding of the bank’s overall risk profile and its risk control system; b) To understand the approach of the bank towards the risks not captured by Pillar 1 and the amount of capital allocated to them; c) To exchange information on the key findings of the SREP; and d) To ensure follow-up on the implementation of any prudential measures that may be decided by the Registrar. 5.2 For the SRP to be effective, RBM will need to develop a sufficiently thorough understanding of how the ICAAP is determined and the differences between it and the minimum regulatory capital requirement under the Framework. This would help in evaluating the ICAAP outcome. The SRP emphasizes the importance of analyzing the main elements, and understanding the differences between ICAAP assumptions and minimum regulatory capital requirement assumptions. Once the process has begun, the dialogue will provide the opportunity for iteration between the ICAAP and SREP, with each informing the other, i.e., banks may make changes to the ICAAP in the course of the

15 dialogue, in response to challenge and feedback from RBM, and vice versa. 5.3 This dialogue will take place with management, the officers in charge of risk measuring and monitoring or any person at an appropriate level designated by the bank. 6.0 SUPERVISORY RESPONSE 6.1 After completion of the SREP, the Registrar will consider whether the minimum capital requirements remains appropriate for the bank or whether they need to be changed in the light of the results and findings of the SREP. 6.2 The Registrar will discuss with the bank the results of its assessment, including any areas of concern, which may lead to an increase in its minimum capital adequacy ratio (CAR). The Registrar will explain the factors that have led to this assessment and recommend actions which the bank should take to address the concerns. . 6.3 If there is a proposed increase in the minimum CAR, the bank will be consulted (with the opportunity to make representations) before a final decision is taken. 6.4 In case the Registrar requires the bank to maintain a higher CAR, the bank shall take the appropriate disclosure under Pillar 3 of the Basel II framework.

16 6.5 Other supervisory actions include but are not limited to; a) intensifying the monitoring of the bank, b) limiting or prohibiting the distribution of net profits and requiring that part or all of the net profits be used to increase the capital accounts of the bank; and c) requiring the bank to improve its internal control and risk management frameworks; d) requiring the bank to reduce the risk inherent in its activities, products and systems; e) restricting or limiting the expansion of business, operations or network of the bank; f) requiring the bank to raise additional capital immediately 6.6 The requirement to increase capital may also be set where the RBM judges the existing capital held by a bank to be inherently inadequate for its overall risk profile. It must be acknowledged that there is no ‘scientific’ method for determining the amount, and that capital is not a long-run substitute for remedying deficiencies in systems and controls. In practice, the process relies heavily on subjective judgment and peer-group consistency to ensure a level playing field and a defense to possible challenge that may be posed by banks. 6.7 The Registrar will monitor the progress made by the bank in implementing the corrective actions.

17 Feedback For further enquiries please contact: The Director Bank Supervision Reserve Bank of Malawi P. O. Box 565 Blantyre Tel: +265 (0) 1 820 299/444 Fax: 265 (0) 1 822 118 Email: basu@rbm.mw