Guidelines on Stress Testing of Licensed Commercial Banks and Licensed Specialised Banks

Guidelines on Stress Testing of Licensed Commercial Banks and Licensed Specialised Banks

Bank Supervision Department September 2014

Contents Page

1. Introduction 1
2. Objectives of Stress Testing 1
3. Principles Governing Stress Testing 2
4. Scope and Applicability 2
5. Stress Testing Framework (STF) 2 - 8 5.1 Developing and Implementing STF 2 5.2 The Board of Directors and Senior Management Oversight 3 5.3 Principal Risk Factors 4 5.4 Stress Testing Methodologies and Scenario Selection 5 5.5 Data and Appropriate Management Information System (MIS) 6 5.6 Reporting and Interpretation of Stress Test Results 7 5.7 Frequency of Stress Testing 7 5.8 Internal Controls and Independent Assessment 7 5.9 Remedial Actions 8 5.10 Disclosures 8 Annex 9 - 11 Frequently Asked Questions (FAQs) 12 - 13

1

1. Introduction 1.1. Stress testing has become an integral part of a bank’s risk management system and is used to evaluate its potential vulnerability to certain unlikely but plausible events or movements in financial variables. The vulnerability is usually measured with reference to the bank’s profitability, liquidity and/or capital adequacy. 1.2. Stress testing provides guidance to manage risks on the basis of normal business conditions and emphasises the importance of robust risk management systems which factor-in a forward looking element and recognise the need to manage risks over the economic cycle. 1.3. Improvement in risk management practices in the banking system in Sri Lanka has been in focus since the adoption of the Basle II capital adequacy framework beginning in
2. This process gained momentum with the issue of the Banking Act Direction No. 07 of 2011 on Integrated Risk Management (IRM) Framework in 2011 and the Banking Act Direction No. 5 of 2013 on Supervisory Review Process (SRP) for licensed commercial banks and licensed specialised banks (hereinafter referred to as “banks”) in 2013. 1.4. Building upon on previously issued supervisory guidance on stress testing under IRM framework and SRP, these guidelines provide broad principles a bank shall follow in developing and implementing its stress testing activities and integrating its stress testing results into the overall risk management and decision making process.
3. Objectives of Stress Testing Stress testing is intended to:  provide rigorous and forward-looking assessments of risk;  facilitate the development of risk mitigation or contingency plans across a range of stressed conditions;  facilitate capital and liquidity planning process;  guide in the process of undertaking new business activities, entering new markets or undertaking strategic initiatives;  provide information to set banks’ risk tolerance limits; and  link external environmental factors with internal risk management framework.

2 3. Principles Governing Stress Testing Banks shall follow the following key principles, that are designed based on the “Principles for sound stress testing practices and supervision” issued by the Basel Committee on Banking Supervision in May 2009 when developing and implementing their stress testing activities. 3.1. Stress testing shall form an integral part of the overall governance and risk management culture of the bank. 3.2. Stress testing of a bank shall promote risk identification, control and shall provide a complementary risk perspective to other risk management tools. 3.3. Stress testing shall take account of views, from across the bank in order to cover a range of perspectives, scenarios and techniques including forward-looking aspects. 3.4. Stress testing shall be actionable at the appropriate management level, including strategic business decisions of the board of directors and senior management. 3.5. Stress testing activities and the robustness of major individual components shall be assessed regularly and independently. 4. Scope and Applicability This Stress Testing Framework shall be applicable to banks on both standalone ("So1o") level as well as on the consolidated ("Group") level. 5. Stress Testing Framework (STF) 5.1. Developing and Implementing STF (a) Every bank shall develop and implement a rigorous and well documented STF proportional to its operations, risk profile and consistent with prudential requirements. (b) Stress testing of a bank shall include activities and exercises that are tailored to and sufficiently capture the exposures, strategies, activities, risks, their interactions and combined effects. (c) STF shall be adjusted according to the complexity of each bank’s business activities. Banks shall be able to justify their choice of stress tests and the choice of risk factors that are stressed.

3 (d) Banks which have global operations, and/or are active in derivatives markets, and/or are operating an active trading portfolio shall use stress tests that suit to stress such activities. (e) The STF of a bank shall satisfy the following essential requirements. (i) The board of directors and senior management oversight; (ii) principal risk factors; (iii) stress testing methodologies and scenario selection; (iv) data and appropriate Management Information Systems (MIS); (v) reporting and interpretation of stress test results; (vi) frequency of stress testing; (vii) internal controls and independent assessment; (viii) remedial actions; and (ix) disclosures. 5.2. The Board of Directors and Senior Management Oversight (a) The Board shall ensure that the bank has put in place a Board approved STF which suits to its individual requirements and integrate into its risk management systems. (b) The Board shall exercise effective oversight over the bank’s stress testing activities. (c) The Board shall establish appropriate stress tolerance limits and shall ensure that the appropriate remedial actions that banks may consider necessary to address the alarms of stress testing are put in place at required point of time. (d) The Board shall establish formal lines of authority and the appropriate segregation of duties to maintain an effective check and balance within the stress testing process. (e) The Board shall ensure that the senior management performs their duties effectively and adequately in order to develop and implement its STF successfully. (f) The Board shall review the effectiveness and robustness of STF periodically, at least annually. Areas for review include: (i) effectiveness of STF in meeting its intended purposes; (ii) effectiveness of stress testing policies, procedures and process;

4 (iii) scope of coverage of the framework, risk factors, stress scenarios and the levels of stress applied; (iv) integrity of MIS, data, assumptions and judgments feeding into stress tests; (v) adequacy of the documentation for various elements; (vi) integration of STF in the day-to-day risk management processes; and (vii) adequacy of the remedial actions and the efficiency of the systems for their activation. (g) The Senior Management shall ensure effective implementation of STF, including: (i) identification of principal risk factors; (ii) designing and implementation of appropriate single/multi factor stress tests; (iii) designing of an appropriate MIS to support the stress tests to be conducted; (iv) ensuring an appropriate and effective internal control mechanism is in place to implement and validate stress tests and their findings; (v) reviewing of stress test results and monitor for loss limits; (vi) activation of appropriate remedial actions; (vii) reporting periodically the stress test results and the actions taken, if any, to the Board; and (viii) ensuring the staff involved will have adequate training and qualifications. 5.3. Principal Risk Factors (a) A bank shall identify its material risks that shall be subject to stress tests, their exposures and the correlation between these risks. (b) Suggested list of risks that banks in general are exposed to are; credit risk, credit concentration risk, interest rate risk, market risk, foreign currency risk, liquidity risk, operational risk, reputational risk, model risk, strategic risk, macro-economic and country risk. These are only a probable list and banks shall identify the risks to which they are exposed to with regard to their bank specific circumstances and portfolios.

5 (c) Suggested list of items that a bank shall consider when designing its STF: (i) on and off-balance sheet activities; (ii) business strategy; (iii) portfolio composition; (iv) asset quality; (v) bank-specific events; (vi) reputational events; (vii) operating environment; (viii) macro-economic factors (interest rate, foreign exchange rate, inflation, GDP growth, unemployment rate, asset prices, property price index); (ix) geographical and political factors (health of other economies, vulnerabilities to external events, contagion effects); (x) historical events; and (xi) latest development in the economic, political, geographical and global conditions and perspectives. 5.4. Stress Testing Methodologies and Scenario Selection (a) The stress events and scenarios identified and developed by a bank shall be plausible and relevant to its portfolio. It shall cover a range of scenarios, including forward-looking, quantitative and qualitative that take into account system-wide interactions and feedback effects. (b) Stress tests that can be applied to a bank are broadly in two categories: sensitivity tests and scenario tests. These may be used either separately or in conjunction with each other. (c) Sensitivity tests are normally used to assess the impact of change in one variable or the change in closely linked variables on the bank’s financial position (examples for sensitivity tests – Annex). (d) Scenario tests include simultaneous moves in a number of variables based on a single event experienced in the past or a plausible market event that has not yet happened and the assessment of their impact on the bank’s financial position. A bank shall determine the various risks that shall be included in a scenario, take into account the linkages among the various risks without looking at each of them

6 in isolation and assess the extent to which the stress would impact their financial position (examples for stress test scenarios – Annex). (e) Stress testing shall be conducted over various relevant time horizons to adequately capture risk characteristics of exposures, conditions that may materialize in the near term and adverse situations that take longer to develop. (f) Banks shall stress the relevant parameters at least at three levels of increasing adversity, i.e. minor, medium and major, with reference to the normal situation and estimate the resources needed under each of the circumstances to: (i) meet the risk as it arises and for mitigating the impact of manifestation of that risk; (ii) meet the liabilities as they fall due; and (iii) meet the minimum capital and liquidity requirements. (g) Assumptions for stress testing: (i) banks are free to choose the various assumptions underlying the stress tests and the basis for their assumptions. (ii) these assumptions shall be well documented and available for verification by the supervisor/auditors. (iii) assumptions underlying the stress tests shall be reviewed periodically for assessing their validity and changes, if any, shall be supported with relevant reasons. Banks shall undertake fresh stress tests when there are significant modifications in the underlying assumptions. (h) When designing stress testing methodologies and scenarios, the second round or spillover effects that might arise from the original shock must be taken into account. 5.5. Data and Appropriate MIS (a) A bank shall use appropriate, accurate and complete data when performing stress tests. (b) A bank shall have a suitably robust infrastructure in place, which is sufficiently flexible to accommodate different and possibly changing stress tests at an appropriate level of granularity. (c) IT resources shall be commensurate with the suitability of the techniques and the coverage of the stress tests.

7 5.6. Reporting and Interpretation of Stress Test Results (a) The results of stress testing shall be reviewed by the senior management and reported to the Board. (b) The results shall be an essential ingredient of bank’s risk management systems. (c) Banks shall be conscious of the fact that the stress tests only indicate the likely impact and do not indicate the likelihood of the occurrence of the stress events. (d) Since stress testing is influenced by the judgments and experiences, the effectiveness of the stress tests will depend upon whether banks have identified their major risks, whether they have chosen the right level of stress/stress scenarios, whether they have understood and interpreted the stress test results appropriately and whether they have initiated the necessary steps to address the situation presented by the stress test results. 5.7. Frequency of Stress Testing (a) A bank may apply stress tests at varying frequencies necessitated by their respective business requirements, relevance and cost. (b) Some stress tests may be conducted daily or weekly and some others may be conducted at monthly or quarterly intervals. (c) Under specific circumstances, ad-hoc stress tests may be required to assess the impact of observed deterioration, which banks had not taken into account. 5.8. Internal Controls and Independent Assessment (a) An appropriate and effective internal control mechanism is essential to implement and validate stress tests and their findings. (b) As part of the bank’s internal control process, regular and independent assessment of stress testing policies, procedures and processes shall be carried out to ensure the quality and effectiveness of STF. (c) The independent assessment may be carried-out by internal audit or those who are not involved in model development nor makes decision based on the model output.

8 5.9. Remedial Actions The remedial actions, that banks may consider necessary to activate when the various stress tolerance levels are breached may include and not limited to: (a) reduction of risk limits; (b) reduction of risks by enhancing collateral requirements, seeking higher level of risk mitigants; (c) reduction of exposures to specific sectors, portfolios, countries or regions; (d) revision of pricing and other policies to reflect enhanced risks or previously unidentified risks; (e) augmentation of capital levels to enhance the buffer to absorb shocks; (f) implementation of contingency plans; (g) enhance sources of funds through credit lines, managing the liability structure, altering the liquid asset profile, etc. 5.10. Disclosures The Board of Directors/senior management shall ensure that disclosures are made in the bank's Annual Report or in the Audited Financial Statements on stress testing as appropriately.

9 Annex Examples for Sensitivity Tests Category Description Interest Rates (i) Parallel yield curve shift (ii) Change of yield curve slope (iii) Shift of curve and changing slope Equities (i) Shocks to levels and volatilities (ii) Shocks to levels/volatilities only Exchange Rates (i) Shocks to levels only (ii) Shocks to levels and volatilities Credit Shocks to credit spreads Others Shocks to various volatilities Examples for Stress Test Scenarios Category Stress Test Scenarios Credit Risk (i) Movement in Non-Performing Assets(NPAs) (a) Increase in NPAs (b) Migration among NPA categories (c) Default of large borrower/s (d) Default in a specific sector/industry/region (ii) Change in impairment (a) Probability of defaults (PD) for individual counterparty, portfolio or sector (b) Loss given defaults(LGD) for specific facility types (c) Change in expected cash flows (iii) Credit concentration to a: (a) Single borrower/ group of borrowers (b) Sector (c) Industry (d) Region (iv) Collaterals (a) Factors affecting on unencumbered position of

10 collaterals/guarantees (b) Limits on the degree of reliance, e.g.; illiquid nature of collaterals (c) concentration (v) Ratings Impact on internal/external rating migrations (vi) Economic movements Changes in macro-economic variables, e.g., rise in oil prices, global/country specific slowdowns, international/market risk events, extreme liquidity conditions, war situation etc. Interest Rate Risk (Rate of Return Risk in the banking book and Benchmark Rate Risk in the trading book for Islamic operations) (i) Banking Book (Investment Portfolio) (a) Parallel shifts in the yield curve/yield curve twists (b) Basis changes (c) Option and prepayment (ii) Trading Book (Trading Portfolio) (a) Market moves  Decline in market value of financial instruments due to adverse changes in market prices  Volatility changes and twists in the term structure of volatility  Changing credit spreads of bonds and securities  Contagion effect due to adverse market direction; eg.; global tightening (focusing on increasing of short-term and long-term interest rate) (b) Model assumptions  Historical volatilities  Correlations, i.e. positive, negative, perfect or un￾correlated (c) Product complexity  Derivative instruments when market is illiquid  Structured products with embedded multiple risks

11 Foreign Exchange Risk Adverse movement in exchange rates; e.g.; impact of net open position on major currencies, impact of major customers with substantial foreign exchange position. Equity Risk (i) General risk: Relating to major change in the overall stock market index (ii) Specific risk: Relating to the individual issuer Liquidity Risk (i) Liquidity crisis (ii) Credit tightening (bank specific, market specific or combination of both) (iii) Speed and time period to act (Refer Explanatory Note 1/2014 on Guidelines on Stress Testing of Licensed Commercial Banks and Licensed Specialised Banks / FAQs)

12 Explanatory Note 1/2014 Guidelines on Stress Testing of Licensed Commercial Banks and Licensed Specialised Banks Frequently Asked Questions (FAQs) These Frequently Asked Questions (FAQs) have been developed to assist banks in carrying-out stress testing activities in accordance with the Guidelines on Stress Testing of LCBs and LSBs and to clarify the possible queries relating to these Guidelines. Q1 – What is the overall purpose of issuing stress testing guidelines to banks? (a) The key objective of issuing these guidelines is to provide guidance to banks on the critical areas pertaining to stress testing and to provide broad principles that banks could follow in carrying-out stress testing activities. (b) In addition, to reinforce the importance of stress testing as a risk management tool to evaluate the potential effects on bank’s financial position arising from certain unlikely but plausible events or movements in financial variables. Q2 – Does a bank have the flexibility to determine suitable models, appropriate methodologies and frequency of stress testing, depending on the approaches that they have adopted? Yes. (a) The principle advocated in these guidelines is that banks have the flexibility with regard to the design and methodology adopted, so long as the management is satisfied with the robustness of the process and assumptions. (b) The models used for stress testing shall be appropriate in the context of risk exposures and size and complexity of operations. (c) The frequency of stress testing shall be commensurate with the nature of risks to which banks are exposed to. In case where the approach adopted limits the frequency of the stress test conducted, the management should re-consider the appropriateness of the approach used vis-à-vis the risk profile of the portfolio.

13 Q3 – Why these guidelines does not provide common risk factors and magnitudes of shocks to assist banks in developing appropriate scenarios? (a) It is not the intention of these guidelines to specify standard scenarios for comparability across banking industry. (b) Given the objective and the scope of these guidelines, the prescribed scenarios may not be broad enough to cover all the detailed information and experiences of specific bank or may be irrelevant to others. (c) Hence, banks should identify their own vulnerabilities as they have the best understanding of their own business exposure and inherent vulnerabilities. Q4 - Why these guidelines does not specify any examples for operational risk events or scenarios? (a) By nature, operational risk events or scenarios are specific to a particular bank. Therefore, these guidelines are not specified any common scenarios for operational risk. (b) Based on business models, risk management systems, risk exposure, internal control policies and procedures banks are free to generate operational risk scenarios, which suits to their size and complexity of business operations. Q5 - What is the acceptance level of second round or spillover effects? Is there a specific approach/common methodology to link the second layer risk elements to the first layer risk factors? (a) While acknowledging the challenge in incorporating second round effects and understanding the complexity of the links between the scenarios, these guidelines do not specify any common methodology to conduct such an exercise. (b) Banks are expected to capture the second round effect based on the reasonable expectation of the impact at least for the portfolio of material risk. Q6 – What are the possible measures available to handle non-availability of adequate data in carrying-out stress testing? (a) Lack of complete data does not preclude stress testing. However, the quality of data will improve stress testing results and usefulness. (b) Banks may make additional assumptions or use proxy data as appropriately. (c) However, this shall not be considered as a long-term solution to the non-availability of adequate data and banks are required to build and maintain necessary and appropriate date for this purpose.