Bank of Albania Guideline 60/2019 on Banks’ Stress Testing

R E P U B L I C O F A L B A N I A BANK OF ALBANIA SUPERVISORY COUNCIL DECISION No. 60, dated 4.9.2019 ON THE APPROVAL OF THE GUIDELINE “ON BANKS’ STRESS TESTING” In accordance with Article 12, letter “a” and Article 43, letter “c” of the Law No. 8269, dated 23.12.1997 “On the Bank of Albania”, as amended; and Article 58, paragraph 1, letter “c” of the Law No. 9662, dated 18.12.2006, “On banks in the Republic of Albania”, as amended; the Supervisory Council of Bank of Albania having regard to the proposal from the Supervision Department, DECIDED:

1. To approve the Guideline “On banks’ stress testing” as provided in the text thereto.
2. The Bank of Albania's Supervision Department shall monitor the implementation of this Decision.
3. The Governor's Office and the Research Department shall be responsible for the publication of this Decision in the Official Journal of the Republic of Albania and in the Official Bulletin of the Bank of Albania, respectively.
4. This Decision shall enter into force on 1 March 2020. SECRETARY CHAIR Elvis ÇIBUKU Gent SEJKO

2 CHAPTER I GENERAL PROVISIONS Article 1 Purpose This guideline aims to lay down the requirements and methodologies for the performance of stress testing by banks, as part of their risk management process. Article 2 Subjects This guideline applies on banks and branches of foreign banks, licensed by the Bank of Albania to carry out banking and/or financial activity in the Republic of Albania, which for simplicity, hereinafter in this guideline shall be referred as “banks”. Article 3 Legal basis This guideline is issued in compliance with Article 12, letter “a” and Article 43, letter “c” of the Law No. 8269, dated 23.12.1997 “On the Bank of Albania”, as amended; and Article 58, paragraph 1, letter “c” of the Law No. 9662, dated 18.12.2006 “On banks in the Republic of Albania”, as amended; Article 4 Definitions

1. The terms used in this guideline have the same meaning with the terms defined in the Law “On banks in the Republic of Albania (hereinafter as “Law on banks”); the Law “On the recovery and resolution of banks in the Republic of Albania” (hereinafter the Law “On the recovery and resolution”; and in the other by-laws issued by the Bank of Albania.
2. In addition to paragraph 1 of this Article, for the purposes of this guideline, the following definitions apply: a) “capital (solvency) stress test” - means the assessment of the impact of certain macro- or microeconomic scenarios, on the overall capital position of the bank, including the impact on minimum or additional capital requirements, by designing the bank’s resources and capital requirements, highlighting the bank’s vulnerabilities and assessing its capacity to absorb losses and the impact on its capital position (capital adequacy); b) “liquidity stress test” - means the assessment of the impact of certain macroeconomic or microeconomic scenarios, from a funding and liquidity

3 perspective and shocks on the overall liquidity position of an bank, including on its minimum regulatory requirements or additional liquidity requirements; c) “static balance sheet assumption” - means a methodological assumption according to which the impact of the stress test scenarios is to be measured on the assumption of a “constant balance sheet” and of an “unchanged or stable business model” throughout the projection/forecast period. Static balance sheet assumption: i. for the calculation of the impact of the scenarios, does not allow to take into account, changes in the assets and liabilities of the bank that derive, indicatively, from:

• actions/measures of the management of the bank;
• increases of credit portfolio or increase of non-performing loans recovery;
• differences in maturities or other characteristics of these assets or liabilities. Despite the above provisions, the application of the stress test methodology, might lead to changes in the size and the composition of the balance sheet, and particularly the capital base, over the projection/forecast period, due to, for example, new defaults, impairments, increases of stock or value adjustments of financial assets; ii. permits the inclusion of new assets and liabilities as far as these new items bear the same main characteristics (maturities, risk profiles, etc.) with the existing ones; d) “dynamic balance sheet assumption” - means a methodological assumption according to which the impact of the stress test scenarios is to be measured on the assumption of a “non-constant balance sheet” and of an “evolving business model” throughout the projection/forecast period. Under the dynamic balance sheet assumption, the outcome of the stress test reflects a combination of the scenario imposed and the responsive actions taken by the management of the bank. The responsive actions taken by the management of the bank may be constrained or unconstrained (e.g. interventions planned from the start and independent from the scenario and/or conditional on the stress test scenario); e) “portfolio level stress test” - means a stress test of individual or several portfolios of the bank, with the focus on the implications of the shocks from a single risk factor or multiple risk factors; f) “sensitivity analysis” - means a stress test that measures the potential impact of a specific single risk factor or simple multi-risk factors, affecting capital or liquidity of the bank, to a particular portfolio or to the bank as a whole; g) “scenario analysis” - means the assessment of the resilience of the bank or of a portfolio to a given scenario that comprises a set of risk factors, which should have all of the following characteristics: i. they are aligned in an internally consistent way;

4 ii. the risk factors forming the relevant set presuppose the simultaneous occurrence of forward-looking events covering a range of risks and business areas; and iii. the set of risk factors also aim to reveal the nature of linked risks across portfolios and across time, system-wide interactions and second-round effects; h) “reverse stress test” - means a bank stress test that starts from the identification of the pre-defined outcome (e.g. points at which a bank business model becomes unviable/unstable or at which the bank can be considered as likely to fail in the meaning of the Law “On Recovery and Resolution”) and then explores/assesses scenarios and circumstances that might cause this outcome. Reverse stress testing should have one or more of the following characteristics: i. it is used as a risk management tool aimed at increasing the bank’s awareness of its vulnerabilities, where the bank explicitly identifies and assesses the scenarios (or a combination of scenarios) that result in a pre￾defined outcome; the bank decides on the kind and timing (triggering events) of management or other actions, necessary for both rectifying business failures or other problems; and aligning its risk appetite with the actual risks revealed by the reverse stress testing; ii. specific reverse stress testing can be also applied in the context of recovery planning (e.g. reverse stress tests applied in a wider context can be used to inform a recovery plan stress test by identifying the conditions under which the recovery might need to be planned). i) “backtesting” - means the process of comparing the losses projected by the model (technique employed by the bank) with those actually occurred during the testing period. It serves as a crucial tool to validate the stress testing model (the employed technique), which is a process to validate if the model (the employed technique) is appropriate. The main goal of backtesting is to assure, at a certain confidence level, that the actual losses do not exceed the expected losses. j) “second-round effects ” - means the spillover effects (which may be not limited to macroeconomic effects) caused by the responses of individual banks to an external original shock, which – in aggregate – generally amplify such an original shock, thereby causing an additional negative feedback effect; k) “severity of scenario” - means the degree of severity of the assumptions or the deterioration of the scenario (from baseline to an adverse scenario) expressed in terms of the underlying macroeconomic and financial variables (or any other assumptions). The greater the severity of the scenario, in general, the larger the level of losses of the bank. l) “plausibility of scenario” - means the degree to which a scenario can be regarded as likely to materialise in respect of the consistency of the relationship of that scenario with the current macroeconomic and financial variables, the support of the scenario by a coherent narrative and the backing of the scenario by probability

5 distribution and historical data. The definition of plausibility is not restricted to historical data, and hence expert judgements that take into account changing risk environments (e.g. observed structural breaks) and stress events that were observed in similar risk environments outside the bank’s own direct historical experience should play a key role. The bank may also use simulative methods (e.g. Monte Carlo simulations). m)“point in time estimation” - means the process where the internal rating/scoring of the bank reflects an estimation of the current situation of the borrower and/or its future situation, over a definite time horizon. In this way, the internal rating/scoring changes along with the change of the borrower’s situation during the credit/business cycle. A point in time estimation measures the default risk, during a short time horizon, maximally covering one year. n) “through the cycle estimation” - means the estimation process of borrower’s risk, upon the the worst-case scenario that would show his situation under a stressing situation. In this case, the rating/scoring of the borrower will continue to be the same during the credit/business cycle. Through the cycle estimation should include a sufficiently long time horizon, in order the business cycle effects are diminished. As a rule, there could be considered a period of five or more years. o) “country risk” - means the risk of exposures against losses, originating from the events occurring in a foreign country. This risk relates to all forms of investment or lending of the bank to households, corporates, banks or governments of foreign countries; p) “funding risk” - means the risk the bank lacks stable funding sources in both medium and long-term period, that would result into the current or future risk the bank fails to meet the financial obligation that mature in either medium or long-term period, or without increasing the funding costs; q) “model risk” - means the probability of bank's losses due to the decisions taken by the bank, mainly based on the results of internal models, caused from errors in developing, implementing or using of these models; r) “migration risk” - means the risk related to the worsening of solvency or the worsening of the estimation of borrower’s credit quality, if such an estimation exists, that is materialised into the increase of default risk; s) “probability of default (PD)” - means the probability the borrowers default, for every degree of estimation, which shows the average percentage of borrowers that fail in this estimation degree over one year; t) “exposure at default (EAD)” - means the estimation of the outstanding exposure (the exposure’s withdrawn amount plus the expected amount to be withdrawn in the

6 future, from the unused part) at the moment the borrower defaults on the payment of liabilities; u) “loss given default (LGD)” - is the value of exposure that a bank might lose definitely on a borrower’s default. Usually these losses are stated as a percentage of exposure at default and depend on among other, the type and value of guarantee/collateral, type of borrower ad the expected revenues from the execution of assets; v) “expected loss” - is estimated based on the probability of default, exposure at default and loss given default; x) “recovery rate” - is computed based on the historical payments by borrowers, where the expected values and the confidence intervals determine the range of possible recovery rates; y) “time period of survival” - means the period over which the bank conducts its business under stressed conditions and continue to fulfil its obligations; z) “risk data aggregation” - means defining, gathering and processing risk data according to the bank’s risk reporting requirements to enable the bank to measure its performance against its risk tolerance/appetite. This process includes also sorting, merging or breaking down sets of data. aa) “data infrastructure” - means physical and organisational structures to build and maintain data and information technology (IT) systems to support the bank’s risk data aggregation and internal policy on risk reporting; bb) “systemically important banks” - are the banks being granted a license by the Bank of Albania and which conduct their activity in Republic of Albania, being defined as such according to the decision making of the Bank of Albania. Article 5 Frequency of stress testing

1. The bank shall perform stress testing in accordance with the stipulations laid down in this guideline, with an appropriate frequency as a meaningful part of the bank’s risk management framework.
2. The frequency that the bank performs stress tests and the reporting of their results should be determined having regard to the scope and type of the stress test, size and complexity of the bank’s activities according to proportionality principle, as well as the changes in both macro-economic environment or bank’s activities.
3. The frequency of performing stress tests should be at least 2 (twice) a year for systemically important banks and at least 1 (once) a year for non-systemically

7 important banks, except for cases when it is differently stipulated the other by-laws issued by the Bank of Albania. 4. The Bank of Albania may require, in any case, the bank to perform stress tests at more frequent periods and/or according to scenarios with defned assumptions. CHAPTER II STRESS TESTING CONTENT Article 6 Stress testing programme

1. The banks should have in place a stress testing programme that should cover at least the following: a) the types of stress testing and their main objectives and applications; b) the frequency of the different stress testing exercises; c) the internal governance arrangements including well-defined lines of responsibility and procedures; d) in the case of a banking group, the group’s entities subject to consolidation, and the coverage of the stress tests by risk types and portfolios; e) the relevant data infrastructure; f) the methodological details, including models used and possible links between liquidity stress tests and solvency stress tests, namely the magnitude of such dynamic interactions and the capture of second-round effects; g) the range of assumptions, including business and managerial actions, and remedial actions envisaged for each stress test; and h) periodicity of models review, the conducted changes and the relevant reasons.
2. The superordinate bank in a banking group shall develop a group stress testing programme. The programme should be approved by the steering council of the superordinate bank and should be monitored by the directorate/executive directors in the context of their centralised risk management policy. A group stress testing programme should include and address, to the extent appropriate, all the entities of the group subject to consolidation.
3. In case a bank is part of a foreign bank group, it shall develop an individual stress testing programme, taking into account the specific risks it is exposed. If the bank participates in a group stress tests and the results of these tests show additional weaknesses, then the bank should consider these results in solvency and liquidity planning and in its risk management.
4. The bank should include reverse stress testing and reverse stress testing scenarios in its stress testing programme.

8 5. The bank should regularly assess its stress testing programme, and should update it as appropriate. The assessment should be made on at least an annual basis and on the basis of both quantitative and qualitative analysis, and should fully reflect the changing external and internal conditions. When assessing the stress testing programme, the bank shall consider at least the following: a) the effectiveness of the programme in meeting its intended purposes; b) the need for improvements; c) the identified risk factors, definitions and reasoning for relevant scenarios, model assumptions (the technique used by the bank) and the sensitivity of results to these assumptions, as well as the role of expert judgement to ensure that it is accompanied by sound analysis; d) the model performance (the technique used by the bank); e) the way and adequacy of possible interlinkages between solvency stress tests and liquidity stress tests; f) instructions/assessments received from the Bank of Albania in the context of stress tests; g) the adequacy of the data infrastructure (systems implementation and data quality); h) the level of involvement of the bank’s management bodies; i) all assumptions including business and/or managerial assumptions, and management actions envisaged, based on the purpose, type and result of the stress testing, including an assessment of the feasibility of management actions in stress situations and a changing business environment; and j) the adequacy of the relevant documentation. 6. The bank should ensure that its quantitative analysis in accordance with paragraph 5 of this Article includes adequate elements as backtesting tools to validate the assumptions, parameters and results of stress testing models (e.g. credit risk models, market risk models). The bank should ensure that its qualitative analysis in accordance with paragraph 5 of this Article is based on expert judgements or benchmarking assessments. 7. The bank should properly document the stress testing programs and their outcomes, for all types of stress tests carried out at the single risk type and/or portfolio level as well as at bank level. 8. The stress testing programme should be made known across the bank, particularly to be assessed by the risk committee (if exists) and the internal audit unit. Business units not responsible for the design and application of the programme and/or non-involved external experts should play a key role in the assessment of the designing and application of the programme process, taking into account the relevant expertise for specific issues. 9. The bank should ensure, both for the initial design and for the assessment of the stress testing programme, that an effective dialogue has taken place with the involvement of experts from all business lines of the bank and that the programme and its updates

9 have been properly reviewed by the management bodies of the bank, who are also responsible for monitoring and overseeing its execution. Article 7 Role and responsibilities of the bank’s management

1. The Steering Council should approve the stress testing programme and the Directorate (executive directors) oversees its implementation.
2. The Steering Council and the Directorate (executive directors) must have sufficient knowledge on the impact of stress events on the overall risk profile of the bank, and must understand the most important aspects of the stress testing programme, to be able to: a) actively engage while taking measures and in discussions for bank’s stress testing; b) challenge key modelling assumptions, the scenario selection and the assumptions underlying the stress tests in general; and c) decide on the necessary management actions/measures, and whenever the stress tests’ results identify material deficiencies, they should discuss these actions/measures with the Bank of Albania.
3. The bank should execute the stress testing programme in accordance with its relevant internal policies and procedures. The Directorate (executive directors) should ensure that clear responsibilities and sufficient resources (e.g. skilled human resources and information technology systems) are assigned and allocated for the execution of the stress testing programmes.
4. The stress testing programme should be an integral part of the bank’s risk management framework and should support different decisions and processes related to bank’s business as well as strategic planning, including capital and liquidity planning.
5. The bank should estimate the outcomes of stress tests and considers them during its strategic planning, during the process of setting the bank’s risk appetite and limits, and when it takes all the decisions affecting capital, liquidity, recovery and resolution planning. Article 8 Data infrastructure and aggregation
6. The stress testing programme should be supported by an adequate data infrastructure, which: a) allows for both flexibility and appropriate levels of quality and control; b) is in line with the proportionality principle; c) requires the commitment of sufficient human, financial and material resources at each management level to guarantee the effective development and maintenance of this infrastructure, including information technology systems.

10 2. The bank shall also consider stress testing data infrastructure as part of its overall information technology infrastructure. 3. The bank should maintain and keep up-to-date accurate and reliable risk data to conduct reliable stress tests. 4. The bank shall ensure that its aggregation of risk data is characterised by: a) accuracy and integrity of risk data, which is guaranteed by the data aggregation through a largely automated basis so as to minimise the probability of error; b) the completeness, which is guaranteed by the fact that risk data also fully capture off-balance-sheet risks and are easily attainable at any level of the bank. 5. The bank shall be able to produce aggregated risk information on a timely basis to meet all reporting requirements, throughout the process of stress testing, arising both from internal needs of the bank or from supervisory requirements. The bank shall develop an efficient structure that ensures timeliness. Article 9 Reporting process within the bank

1. The bank shall ensure that the reporting process for stress testing purposes within the bank: a) is completely supported by data aggregation capabilities; b) accurately conveys aggregated risk data and reflects risk in an exact manner; c) covers all material risks and, in particular, allows the identification of emerging vulnerabilities that could potentially be further assessed even in the same stress testing exercise; d) offers or is able to offer additional information regarding main assumptions, tolerance levels or caveats; and e) communicates information in a clear and concise manner including meaningful information tailored to the needs of the recipients. CHAPTER III STRESS TESTING SCOPE AND COVERAGE Article 10 General requirements
2. Stress tests should take into account all types of material risks having regard to both the on- and off-balance-sheet assets and liabilities of the bank.

11 2. Stress tests should capture risks at various levels in a bank. In this regard, according to the proportionality principle, the scope of stress testing may vary from simple portfolio level sensitivity analysis or individual risk level analysis, to a comprehensive bank and group-wide scenario stress testing. 3. Stress tests, whenever possible, should take into account the fact that correlations between risk types and risk factors, tend to increase during times of economic or financial distress. 4. The bank shall determine the stress tests’ impact of every material risk, in quantitative terms, whenever appropriate on: a) capital stress tests: on bank’s income and overall capital position, including also the impact on both capital minimum requirements or capital-add ons; b) liquidity stress tests: on overall liquidity position of the bank, from the financing and market liquidity position, including the impact on minimum regulatory requirements or additional requirements. Article 11 Portfolio and individual risk level stress testing

1. The bank shall perform stress tests on an individual portfolio basis, covering all risk types that affect these portfolios, using both sensitivity and scenario analyses. The bank shall also identify risk factors and their adequate level of stress, wherever possible, at the level of an individual portfolio.
2. The bank shall perform stress test for portfolios and business lines or units to identify intra- and inter-risk concentrations – i.e. concentrations of common risk factors within and across risk types.
3. The bank, when considering inter-risk concentrations, shall aggregate across risk types notably market and credit risk, to gain a better understanding of their potential risk concentrations in a stress situation. The bank shall identify potential links between exposures that could be risky during periods of economic or financial distress, as well as assumptions about dependencies and correlations between risk types in a stress situation. Article 12 Stress testing at bank and group-wide level
4. The bank, when performing stress tests at bank and group-wide level, shall take into account that: a) risks at the bank-wide level may not be entirely reflected by a simple aggregation of stress tests on portfolio levels, individual risk levels or business units of the bank’s/group’s levels;

12 b) correlations, offsetting of individual exposures and concentrations may lead to either the double counting of risks or to an underestimation of the impact of stressed risk factors; and c) specific group-wide risks may arise at the bank level. Article 13 Proportionality principle

1. In accordance with the principle of proportionality, a bank’s stress testing programme should be consistent with its individual risk profile and business model.
2. The bank shall take into account its size, internal organisation, nature and complexity of its activities when developing and implementing a stress testing programme. Systemically important banks are encouraged to have more sophisticated/advanced stress testing programmes, while non-systemically important banks may implement simpler stress testing programmes. CHAPTER IV STRESS TESTING TYPES Article 14 General requirements
3. The specific design, complexity and level of detail of the stress testing methodologies should be appropriate to the proportionality principle, and should consider the strategy and business model, as well as the portfolio characteristics of the bank.
4. Stress tests performed for the purposes of internal capital adequacy assessment should be consistent with the risk appetite/tolerance and overall strategy of the bank (including its business model).
5. The scenarios or assumptions described for Bank of Albania’s stress tests purposes, do not substitute the stress tests that banks should perform for the purposes of the internal capital adequacy assessment.
6. The bank should identify appropriate, meaningful and robust mechanisms for translating risk factors into relevant internal risk parameters (probability of default (PD), loss given default (LGD), write-offs, fair value haircuts, etc.) that provide a bank’s and a group’s complete view of risks.
7. The link between stressed risk factors and the risk parameters not only should be based on bank historical experience and analysis, but should be supplemented, where available and appropriate, with benchmarks from external sources and, when possible, from supervisory guidance.

13 6. Because of the complexity involved in modelling hypothetical and macroeconomic￾based risk factors/scenarios, the bank should be aware of the model risk involved and ensure that the following have been performed when setting those factors/scenarios: a) a regular and sufficiently conservative expert review of the model’s assumptions and mechanics has been performed and a conservative modelling approach to account for model risk has been followed; b) a sufficient degree of conservatism as appropriate has been applied when making assumptions that are difficult to measure in a quantitative way (e.g. diversification, exponential growth projected, fees projected, forward-looking management views) but may have an impact on the model’s outputs (e.g. the outputs of pre-provision net revenue models should be based on sufficient statistical support as well as business considerations); and c) the dependencies and sensitivities of the results on the assumptions have been acknowledged and their impact is assessed on a regular basis. 7. The bank should ensure that shortcomings of models and mechanisms that link risk factors with losses or increased risk parameters should be understood, communicated clearly and taken into account when interpreting results. Models (techniques applied by the bank) should take into account the interactions between solvency and funding liquidity and funding costs in order to not systemically and significantly underestimate the impact of a shock. Where possible, results for different modelling approaches should be compared. These links should be based on robust statistical models. However, if data availability or quality or structural breaks in historical data do not allow for meaningful estimates, then quantitative analyses should be supported with qualitative expert judgements. Even where the underlying modelling process is robust, expert judgement should play a role in challenging model outputs. 8. If the bank is part of a foreign banking group, it should have a thoroughly understanding of the stress tests models built up by the parent bank. If the bank uses the models of the parent bank, it should ensure that the models used are appropriated to the types of risks against which the bank is exposed, and do considerate both the domestic macro-economic factors and the detailing level of data. Article 15 Sensitivity analysis

1. The bank shall conduct sensitivity analyses at the level of: individual exposures, portfolios or business units, the bank; and of specific risk types, proportionate to its complexity. The bank shall assess at which aggregation level sensitivity analyses are meaningful or even feasible. The use of expert judgements should be clarified in detail whenever applicable.
2. The bank shall identify relevant risk factors at various levels of application of prudential requirements and across different portfolios, business units and geographical locations. The bank shall ensure that all relevant types of risk factors are covered, including macroeconomic and macrofinancial variables, statistical aspects of

14 risk parameters (such as the volatility of PD parameters and idiosyncratic factors (such as operational risks)). 3. The bank shall maintain a list of the risk factors identified. 4. The bank shall supplement the single-risk factor analyses by simple multi-risk factor analyses, where a combined occurrence is assumed, without necessarily defining a scenario. Article 16 Scenario analysis

1. The bank shall ensure that scenario analyses are a core part of their stress testing programmes.
2. The bank shall take into account that the design of the stress test scenarios should not only be based on historical events, but should also consider hypothetical scenarios based on non-historical events. The bank shall ensure that scenario designs are forward-looking and take into account (overall) systematic and bank-specific changes in the present and foreseeable future. For that purpose, the bank shall endeavour to have recourse to external data from similar risk environments relevant for banks with similar business models.
3. The bank shall use data that are relevant and available. Relevant data may be internal and/or external and, whenever possible, incorporate benchmarking and supervisory guidance.
4. The bank shall consider a range of scenarios to encompass different events and degrees of severity.
5. The bank shall ensure that the stress test scenarios meet at least the following requirements: a) address the main risk factors that the bank may be exposed to. In this regard, the results obtained from single risk factor analyses, which aim to provide information about the sensitivity towards single risk factors, should be used to identify scenarios that include a stress of a combined set of highly plausible risk factors. No material risk factor should be left unstressed or unconsidered; b) address major bank-specific vulnerabilities, deriving from the regional and sectorial characteristics of the bank, as well as its specific product or business line exposures and funding policies; concentration and correlation risks, both of an intra- and of an inter–risk type, should be identified a priori; c) include a coherent narrative for the scenario, covering all main risk factors as well as their (forward-looking) development on the basis of multiple trigger events (i.e. monetary policy, financial sector developments, commodity prices, political events and natural disasters). The bank shall ensure that the scenario narrative is plausible and non-contradictory when assuming the co-movement of

15 risk factors and the corresponding reaction of market participants. Where certain risk factors are excluded from the scenario narrative, the bank should ensure that this exclusion is fully justified and documented; d) are internally coherent, so as to ensure that the identified risk factors behave consistently with other risk factors in a stress event and that they contain explicit estimates and assumptions on the dependence structure among the main underlying risk factors. The co-movements in risk factors that may appear contradictory should be explored to identify new sensitivities; e) take into account innovation and more specifically technological developments or sophisticated financial products, as well as their interaction with more traditional products; and f) ensure that stressed risk factors translate into internally consistent risk parameters in line with risk appetite/tolerance. 6. The bank shall determine the time horizon of stress testing in accordance with the aim of the exercise, the characteristics of the portfolio of the bank such as its maturity and liquidity of the stressed positions, where applicable, as well as the risk profile. Solvency stress testing and liquidity stress testing consider different time horizons and scenarios. 7. The bank shall ensure that: a) stress tests explicitly take into account dynamic interdependences, e.g. among economic regions and among economic sectors, including the financial sector; b) the overall scenario takes into account system-wide dynamics, e.g. closure of certain markets, and risk concentrations in a whole asset class (e.g. mortgages). 8. The bank shall make qualitative assessments of second-round effects against shocks, where appropriate and in particular if no robust quantitative estimates can be established. Article 17 Severity of scenarios

1. The bank shall ensure that stress testing is based on severe but plausible scenarios and the degree of severity should reflect the purpose of the stress test. For this purpose, stress tests should be: a) meaningful in terms of addressing relevant risks to the bank with a view to promoting the stability of the bank under adverse conditions and, in the case of systemically important banks, also of the financial system at all points in the economic cycle and over market fluctuations including funding markets; and b) consistently applied across the bank, recognising that the impact of identical scenarios is not necessarily severe for all business lines.

16 2. The bank shall ensure that various degrees of severity are considered for both sensitivity analysis and scenario stress testing covering at least one severe economic downturn for the assessment of capital adequacy and capital planning purposes. 3. The bank shall ensure that severity is set taking into account its specific vulnerabilities to a given scenario on the basis of its business model (e.g. the bank is exposed to international markets). The bank shall develop its own scenarios and shall not be dependent on scenarios defined by the Bank of Albania. When assessing the severity of a scenario, the bank shall be aware of the dynamics of risk environments and, where possible, of experiences of banks with similar business models. 4. The bank shall ensure that its scenarios assess absolute and relative changes of risk factors. In an absolute scenario, the degree of severity should be a direct change of the risk factor and not depend on the current level. In a relative scenario, the degree of severity should depend on the current level and economic situation (e.g. GDP growth decreases by 2%, i.e. a relative change to the absolute level). The bank shall ensure that the selected scenario is sufficiently severe in both relative and absolute terms. Both the choice and its impact on the degree of severity should be justified and documented. 5. For assessing the appropriate degree of severity of scenarios, the bank shall compare them with the scenarios outlined in their reverse stress testing, considering specific implications of the reverse stress test design for the scenario’s plausibility. Article 18 Reverse stress testing requirements

1. The bank, in compliance with the principle of proportionality, shall perform reverse stress tests as part of its stress testing programme, sharing the same governance and quality standards, and an effective infrastructure, and to complement other types of stress testing.
2. The systemically important banks should use more sophisticated reverse stress testing techniques, while non-systemically important banks may focus more on the qualitative aspects of reverse stress testing.
3. The reverse stress testing should be clearly defined in terms of responsibilities and resources allocated and should be supported by an infrastructure that is suitable and flexible and by written policies and procedures.
4. Reverse stress testing should be carried out regularly by all banks and at the same level of application as the Internal Capital Adequacy Assessment Process (e.g. at bank/group wide level and covering all relevant risk types).
5. Bank shall include scenarios identified through the reverse stress testing to complement the range of stress test scenarios it undertakes and, for comparison

17 purposes, in order to assess the overall severity, allowing the identification of severe but still plausible scenarios. Reverse stress testing should be useful for assessing the severity of scenarios for ICAAP stress tests. The severity of reverse stress testing scenarios can also be assessed by comparing it to, inter alia, historical or other Bank of Albania's and publicly available scenarios. 6. In carrying out reverse stress tests, the bank should also consider whether failure of one or more of its major counterparties or a significant market disruption arising from the failure of a major market participant (in a separate or combined manner) would cause the pre-defined outcome. Article 19 Use of reverse stress testing

1. The bank shall use reverse stress testing as a regular risk management tool in order to improve its awareness of current and potential vulnerabilities, providing added value to the bank’ risk management. The principle of proportionality applies to all aspects of the use of reverse stress testing. Nevertheless, the bank shall also consider that the pre-defined outcome of reverse stress testing can be produced by circumstances other than the circumstance analysed in the stress test.
2. As part of its business planning and risk management, the bank shall use reverse stress testing to understand the viability and sustainability of its business models and strategies, as well as to identify circumstances where it might be failing or likely to fail. The bank should identify indicators that provide alerts when a scenario turns into reality. For this purpose, the bank shall: a) identify the pre-defined outcome to be tested (e.g. of a business model becoming unviable); b) identify possible adverse circumstances that would expose them to severe vulnerabilities and cause the pre-defined outcome; c) assess the likelihood that the events included in the scenarios, lead to the pre￾defined outcome, depending on the bank’s size, nature, scale, complexity and riskiness of its business activities; and d) adopt effective arrangements, processes, systems or other measures to prevent or mitigate identified risks and vulnerabilities.
3. The bank shall use reverse stress testing in planning and decision-making and to challenge its business models and strategies, in order to identify and analyse what could possibly cause their business models to become unviable, such as the assessment of both the ability to generate returns over the following months and the sustainability of the strategy to generate returns over a longer period based on strategic plans and financial forecasts.
4. Where reverse stress testing reveals that the bank’s risk of business model failure is unacceptably high and inconsistent with its risk appetite, the bank should plan

18 measures to prevent or mitigate such risk, taking into account the time that the bank should have to react to these events and implement those measures. As part of these measures, the bank shall consider if changes to its business model are required. These measures derived from reverse stress testing, including any changes to the bank’s business plan, should be documented in detail in the bank’s Internal Capital Adequacy Assessment Process documentation. 5. The bank shall perform qualitative analyses in developing a well-defined narrative of the reverse stress testing and a clear understanding of both the second-round effects and non-linear effects, taking into account the dynamics of risk, and combinations of and interactions between and across risk types. When developing a well-defined narrative, the bank shall consider external events such as economic events, an industry crash, political events, litigation cases and natural events, as well as risk factors such as operational risks, concentration and correlations, reputational risks and loss of confidence, and combinations of these events and factors. 6. The proper engagement of the management bodies of the bank in the discussions of the narrative is fundamental, taking into account possible specific vulnerabilities and the impact on the whole bank. 7. The bank, in line with the principle of proportionality, shall perform quantitative and more sophisticated analyses, in setting out specific loss levels or other negative impacts on its capital, liquidity (e.g. the access to funding, in particular to increases in funding costs) or overall financial position. The bank shall work backwards in a quantitative manner to identify the risk factors, and the required amplitude of changes, that could cause such a loss or negative impact (e.g. defining the appropriate loss level or other important indicators on the balance sheet of the bank such as capital ratios or funding resources). 8. The bank shall understand and document in detail the risk drivers, the key business lines and a clear and consistent narrative around weaknesses and the corresponding scenarios (e.g. about the underlying assumptions and sensitivity of the results to those assumptions over time) that cause the pre-defined outcomes and the events chain and the likely flow through (e.g. the most important factors may be mapped to macroeconomic variables according to the combinations for a given target loss/capital in a portfolio), identifying hidden vulnerabilities and overlapping effects. 9. The bank shall, where appropriate, use sensitivity analyses as a starting point for reverse stress testing (e.g. shifting one or more relevant parameters to some extreme to reach pre-defined outcomes). The bank shall consider various reverse sensitivity analyses for credit risk (e.g. how many large customers would have to go into default before the loss absorbing capital is lost), market risk, liquidity risk (e.g. stress on deposits in the retail sector and circumstances that would empty the bank’s liquidity reserves) and operational risk, among other risks, and a combination analysis where all risks are covered simultaneously.

19 10. The bank, without prejudice to the requirements laid down in paragraph 9 of this Article, shall not only be based on the sensitivity analysis to identify the scenario relevant for the reverse stress test. Qualitative analyses and assessments, combined with expert judgements from different business areas, should guide the identification of relevant scenarios. 11. The bank shall use reverse stress testing as a tool to gather insights into scenarios that involve combinations of solvency and liquidity stresses, where traditional modelling may fail to capture complex aspects from real situations. The bank shall use reverse stress testing to challenge its capital and liquidity plans. Where appropriate, the bank shall identify and analyse situations that could aggravate a liquidity stress event and transform it into a solvency stress event, and vice versa, and eventually to a business failure. The bank shall apply reverse stress testing in an integrated manner for risks to capital or liquidity with a view to improving the understanding and the management of related risks in extreme situations. Article 20 Recovery actions and recovery planning

1. The bank shall develop scenarios of severe macroeconomic and financial distress, varying in their severity (including system-wide events, bank’s specific events and group-wide events), to be used in recovery plans under the requirements laid down in the Regulation “On the recovery plans of banks”.
2. The bank shall use specific reverse stress testing to develop “near-default” scenarios, (the bank close to failure, and as an input to inform and test the efficiency and effectiveness of its recovery actions and its recovery planning, and analyse sensitivities around corresponding assumptions.
3. Such “near-default” scenarios should identify and describe the point that would lead a bank’s or a group’s business model to become non-viable, unless the recovery actions were successfully implemented.
4. The scenarios used by the bank should allow the estimation of results and the suitability of all the available recovery options.
5. The description of recovery scenarios should help to determine which recovery options were tested under particular stress scenarios. The description should have a sufficient level of detail, through both a set of quantitative assumptions and a qualitative narrative, in order to determine whether or not the scenario is relevant for the bank and how severe it is. The events should be described in a logical sequence and the assumptions underlying the main drivers (e.g. net income, risk-weighted assets (RWAs), capital) should be laid down very clearly.
6. The scenarios should also take into account a possible estimation of the cross-effects of executing different recovery plan options in the same stress scenario. The scenarios

20 should also allow an understanding of how the events unfold by providing an appropriate timeline that makes it clear at which point in time certain actions will be developed. The purpose of this exercise is to test the effectiveness of the bank’s recovery options in restoring financial strength and viability when the bank comes under such severe stress. 7. Because of the different objectives, the stress tests for ICAAP purposes and for recovery planning purposes, should not be interlinked, but comparable to each other. 8. The bank shall use reverse stress testing to identify the risk factors and further understand and describe the scenarios that would result in “near default”, assessing effective recovery actions that can be credibly implemented, either in advance or as the risk factors or scenarios develop. 9. Reverse stress testing should contribute to the recovery plan scenarios by using a dynamic and quantitative scenario narrative, which should cover: a) the recovery triggers (i.e. at which point the bank would enact recovery actions in the hypothetical scenario); b) the recovery actions required and their expected effectiveness, including the method of assessing that effectiveness (i.e. indicators that should be monitored to conclude that no further action is required); c) the appropriate timing and process required for those recovery actions; and d) in the case of further stress, the potential additional recovery actions required to address residual risks CHAPTER V INDIVIDUAL RISKS STRESS TESTS Article 21 Individual risk areas

1. The bank shall ensure that the stress testing of individual risks is performed in line with the principle of proportionality.
2. The bank, whenever possible, shall take into account the impact of second-round effects at the individual level, when performing individual risks stress testing.

21 SUBCHAPTER I CREDIT RISK Article 22 Credit and counterparty credit risks, including both migration and default risk

1. The bank shall identify and assess specific risk-related factors and shall determine in advance how such factors may affect both its revenues and capital requirements. The bank shall identify and assess specific risk-related factors by exposure classes (e.g. factors relevant to mortgage loans may be different from those relevant to corporate exposures class).
2. The bank, while performing stress tests for its credit risk exposures, whenever possible, shall analyse at least: a) the borrowers’ ability to repay their obligations, e.g. the probability of default (PD); b) the recovery rate in the event of a borrower’s default, including the deterioration of the collateral values or credit worthiness of the guarantor, e.g. the loss given default (LGD); c) the size and dynamics of credit exposure, including the effect of undrawn commitments from borrowers, e.g. the exposure at default (EAD).
3. The bank shall ensure that the credit risk stress tests at bank/group-wide level include all its positions in the banking and trading book, including hedging positions and exposures to central counterparties.
4. The bank shall assess the credit risk at various levels of shock scenarios (base scenario, severe scenario, etc.), from simple sensitivity analysis to bank-wide stress tests, or to group-wide stress tests, for the following scenarios: a) market-wide shock scenarios (e.g. a sharp slowdown of the economy that affects portfolio quality for all creditors); b) counterparty-specific and idiosyncratic shock scenarios (e.g. bankruptcy of the bank’s largest creditor); c) sector-specific and geographic areas-specific shock scenarios; and d) a combination of the above.
5. The bank shall consider risk factors for sensitivity analysis, which in turn should provide quantitative information for the design of scenarios.
6. The bank shall determine different time horizons when applying the stress scenarios, which may fluctuate from short-term periods to longer-term periods.
7. When stress testing financial collateral values, including the value of assets acquired by the court proceedings for the execution of non-performing loans collateral, the bank

22 shall identify conditions that would adversely affect the realisable value of the collateral, including deterioration in the credit quality of collateral issuers or market illiquidity (market liquidity risk). 8. In the design of scenarios, the bank shall consider the impact of stress events on other risk types, e.g. liquidity risk and market risk and the possibility of spillovers at other banks. 9. The bank shall consider, wherever possible, the following relevant parameters: probability of default (PD), loss given default (LGD), exposure at default (EAD,) expected loss (EL) and risk exposure amount, and the impact on credit losses and capital requirements. 10. For the estimation of future losses according to stress tests, the bank shall, where appropriate, rely on credit risk parameters different from the ones applied in the calculation of capital requirements, which are usually through-the-cycle or hybrid parameters (a combination of through-the-cycle and point-in-time parameters) for the probability of default (PD) and under downturn conditions for loss given default (LGD). In particular, where relevant, for the purpose of estimating credit losses, the bank shall apply estimates based on point-in-time parameters in accordance with the severity of the scenario. 11. For the computation of the exposure at default (EAD), a bank shall also consider the percentages (CCF) for off-balance sheet items, laid down in Article 9 of the Regulation “On capital adequacy ratio”, and in particular, the effect of the bank’s legal capacity to unilaterally cancel undrawn amounts of committed credit facilities, especially in stressed situations. 12. When assessing their risk to counterparties with material exposures, the bank shall take into account risk concentrations and they should not presume the existence of collateral or continuous re-margining agreements, which may not be available in case of severe market shocks. The bank shall identify such correlated risks adequately. 13. The bank shall reflect the stress tests’ outcomes of credit risk and counterparty credit risk, as an increase in risk-weighted assets, increase in non-performing loans and decrease in bank’s revenues. The increase in risk-weighted assets shall be driven as a result of exposure migration to a lower category of credit classification. The increase in non-performing loans shall reflect the increase of default risk. The decrease in revenues is driven by the increase of reserve funds for special-mention loans and non￾performing loans. The bank, based on the methodology of the estimation of expected credit losses for the creation of reserve funds in accordance with International Financial Reporting Standards, in stress tests analyses, shall include in the calculation of the reserve fund increase, the increase of probability of default (PD), loss given default (LGD) and the exposure at default (EAD). If possible, these parameters should also be included in the calculation of the risk-weighted assets in stressed conditions. The final result of the increase of risk-weighted assets and the increase of reserve funds

23 should be considered in computing capital ratios in stressed situations (common equity tier 1 ratio, tier 1 ratio and capital adequacy ratio)1 . 14. Systemically important banks shall establish internal credit ratings, to ensure the performing of effective stress tests for credit portfolios. Article 23 Securitisation

1. The bank shall take into account securitisation risks that arise from structured credit products, usually created by the cash flow transfer from a pool of assets, to various risk segments (tranches) or asset-backed securities.
2. The bank shall ensure that the stress testing of securitised assets addresses the credit risk of the underlying pool of assets, including the default risk, and the change in collateral values. The bank shall take into account all relevant information with regard to the specific structure of each securitisation, such as the seniority of the risk segment (tranche), the quality of the segment, credit enhancements and granularity, expressed in terms of the effective number of exposures.
3. Scenarios should also consider the default of one or more of the contractual counterparties involved in the securitisation structure, especially of those acting as guarantors of certain risk segments. Article 24 Country risk
4. The bank shall perform stress testing analyses for its exposures to country risk, for the purposes of monitoring the current and future risks that arise from important exposures of the bank abroad, or from the exercise of the business abroad, through its subsidiaries/branches.
5. Stress tests should include the assessment of the various events’ impact of the country risk, on the assets and liabilities of the bank, as well as on the off balance-sheet items.
6. The bank shall consider in stress testing scenarios, at least the following events: a) the government of the foreign country does not have the capacity or will to repay its direct or indirect liabilities (guarantees provided) in foreign currency; b) the borrower is unable to exchange the domestic currency into a foreign currency, due to the restrictions set forth by the foreign government on the exchange of the currency or the free transfer of capital, thus leading to arrears of paying his liabilities in foreign currency;

1 The bank shall calculate the impact on the capital adequacy ratio, only once for all risks together, by considering the impact on the risk-weighted assets and on revenues, from shocks against individual risk￾related factors.

24 c) unfavourable development in a country, may drive to worsening of credit quality of that country and of other countries of the region; d) the solvency of a domestic borrower is negatively related to the developments in a foreign country, where the borrower has business interests; e) the borrower may be affected by the economic policies of the foreign country’s government, e.g. higher tax or interest rates, which may cause the deterioration of his solvency; f) the level of concentration by all types of exposures to country risk, as a ratio to the bank's credit portfolio. 4. The bank shall reflect the outcomes of country risk’s stress tests, as an increase in risk weights for the relevant exposures and an increase in the reserve funds for the country risk, accordingly to the bank’s internal rules for the calculation of reserve funds. Article 25 Unhedged exposures against exchange rate risk

1. The bank, when performing stress tests, shall also take into account the additional risk arising from the exposures of unhedged borrowers against exchange rate risk.
2. The bank shall take into account that lending risk in foreign currency: a) may arise from the inability of the borrowers exposed to exchange rate risk (i.e. retail borrowers and small and medium-sized enterprises (SME)) to service debt denominated in currencies other than the currency in which they generate income; b) is related to credit risk and market risk, related to the exchange rate; c) is characterised by a non-linear relationship of credit and market risk components; and d) is influenced by the general exchange rate risk.
3. In the stress testing programmes, the bank should take into account also the level of exposures unhedged against exchange rate risk, the impact of volatilities in the exchange rate, the borrower's ability to withstand exchange rate shocks and the increase in the probability of these borrower’s insolvency arising from these shocks.
4. In the stress testing programmes, the bank should take into account the risk of lending in foreign currency, affecting credit facilities in the asset side of their balance sheet and its multiple sources of risk, taking into account that the debtor’s inability to repay its debt may originate from: a) risks related to the debtor’s internal source of income; b) risks related to the economic situation of the country in which the currency is denominated; and c) foreign exchange risk.

25 5. The bank should consider, when designing or implementing the stress test scenarios, that impacts of lending in foreign currency risk may arise from the increase in both the outstanding value of debt and the flow of payments to service such debt, as well as from an increase in the outstanding value of debt compared with the value of collaterals denominated in the domestic currency. 6. The bank should develop stress scenarios by changing different parameters to allow them to forecast the performance of credit portfolio in foreign currency, in different cases, such as: a) assuming the exchange rate appreciation of the foreign currency, by a predetermined percentage; b) assuming a shift in the interest rate foreign currency loans, by a predetermined percentage point; or c) combining both of the above scenarios. 7. In order to assess potential vulnerabilities, the bank should be able to demonstrate additional credit risk losses stemming from foreign exchange lending risk separate from the credit risk losses and risk exposure amounts resulting from the impact of the scenario on credit risk factors. 8. When stress testing the risk of lending in foreign currency, the bank should take into account at least: a) the exchange rate regime and how this could impact on the evolution of the foreign exchange rate between domestic currency and foreign currencies; b) the sensitivity impact of exchange rate movements on a borrower’s credit rating/score; c) the potential concentration of lending activity in a single foreign currency or in a limited number of highly correlated foreign currencies; d) the potential concentration of lending activity in some specific sectors of the economy, in the currency of the country, that have a core business in foreign countries or markets and the corresponding evolution of such sectors highly related to foreign currencies. 9. The bank should reflect the stress tests’ outcomes as an increase in risk weights of credit portfolios dominated in foreign currency, increase of probability of shifting these portfolios into non-performing loans portfolios and hence, higher reserve funds requirements.

26 Article 26 Unhedged exposures against interest rate risk

1. The bank shall include in the stress testing programme also the risk arising from unhedged exposures to interest rate risk, by assessing the impact of interest rate increase on the deterioration of the counterparty’s solvency.
2. The bank, when performing stress tests for unhedged exposures against interest rate risk, in particular exposures within the country, whenever possible, shall take into account the impact of the increase of the interest rate in the domestic economy, particularly in the economy sector where the counterparty is exposed to, with the purpose to re-assess the counterparty's position in the market, and consequently, its financial position.
3. The bank shall take into account that indirect credit risk arising from interest rates, may become materialised against exposures which have a variable interest rate and are unhedged through a derivative product (instrument), mainly in credit segment or other financial instruments, with medium and long-term residual maturity.
4. When designing stress tests scenarios, the bank shall take into account, that indirect credit risk arising from interest rate, may arise from both the increase in both payment cash flows and from the increase in outstanding credit compared to the guarantee value.
5. The bank shall develop stress testing scenarios for indirect credit risk arising from interest rates, by reflecting the impact of the possible change of interest rates in various financial parameters of the counterpaties, at individual level, group of clients or portfolio level, such as the ratio of instalment value to income, to forecast the negative impact on credit portfolio quality or other financial instruments, subject to this risk. Article 27 Credit concentration risk
6. Stress testing should be a key tool in the identification of concentration risk, as allow the bank to identify interdependencies between exposures, which may only become apparent in stressed conditions as well as hidden concentrations.
7. In assessing this risk in the stress testing programmes, the bank shall take into account the credit risk of each exposure but also consider the additional sources of risks arising from the similar behaviour of certain exposures (with higher correlation). These additional sources of risk under analysis, include the following: a) concentrations to a person or group of connected persons as defined in the regulation “On risk management from large exposures of banks”; b) concentrations against non-performing clients; c) the geographical concentrations; d) the sectorial concentrations; e) concentrations against exposures in foreign currency; f) concentrations by products;

27 g) concentrations by collaterals/guarantees. h) etc. 3. In stress testing, especially at bank level and group level, the bank shall assess concentration risk considering on- and off-balance-sheet exposures, as well as banking book posirions and hedging positions. 4. Stress tests should take into account changes in the business environment that may occur and that would lead to the materialisation of concentration risk. In particular, stress tests should consider unusual but plausible changes in correlations between various types of risk factors as well as extreme and unusual changes in risk parameters, going beyond single risk factors, to look at scenarios that take account of interrelated risk factors and that feature not only first-round but also the second-round effects. 5. The bank, when appropriate, shall include in stress testing the way in which concentrated exposures perform in response to the same risk factors, including the risk of large short-term losses as a result of concentrated exposures across the retail and corporate credit portfolios or across different entities of a group. 6. In order to assess the ex-ante level of concentration risk and/or impact of the scenario on the concentration level, the bank shall, where appropriate, consider more or less complex indicators (for instance the Herfindahl-Hirschman Index (HHI) and Gini coefficients). 7. The bank shall consider the potential existence of overlaps between different concentration sources. 8. Credit risk concentration stress testing should include: a) measuring of concentration credit risk increase, for a diversified portfolio in another way; or b) the increase of default risk or recovery risk in a concentrated portfolio, under a stressed situation. 9. For the purposes of paragraph 8, letter “a” of this Article, some of the adequate scenarios to measure the increase of concentration credit risk, for a diversified credit portfolio in another way, may be: a) simultaneous defaults of some large borrowers; b) increase in the correlated defaults among some sectors, which under normal times (not in stressed situations) appear diversified/uncorrelated; c) the default of all large borrowers, positioned at the lowest class of credit classification (internal or external) of the bank; d) simultaneous default of some large exposures in a certain country. 10. The bank, for the purpose of measuring concentration risk according to scenarios set forth in paragraph 9 of this Article, in case of using Herfindahl Hirschman index (HHI),

28 shall re-calculate the index, by addressing the exposures assumed to default, either as a single exposure or as an exposure to a sector. The new value of HHI (or of other measures of concentration) may be used to assess additional capital requirements under stressed situations. The calculation of the new values of the index should reflect also the increase of correlations in stressed situations. 11. For the purposes of paragraph 8, letter “b” of this Article, some of the appropriate scenarios to measure the increase of default risk or recovery risk in a concentrated portfolio, under stressed situation, may be: a) increase in default rate in a specific sector, due to a macroeconomic shock; b) increase in the ratio between the value of the exposure guaranteed by residential or commercial real estate, against the value of the real estate, as a result of the decrease in the value of real estates (collaterals); 12. The bank shall take into account the effect of scenarios defined in paragraph 11 of this Article, which may be translated into additional capital requirements, by increasing the risk weights to reflect the probability of default and higher losses given default of special concentrated portfolios in stressed situations. Furthermore, the impact of stress situation on bank’s revenues is assessed by calculating the increase of reserve funds that derive from the increase in non-performing loans, according to the relevant scenarios. The bank shall take into account that capital level will be affected by the increase of risk weights and by the decrease in revenues, and the stress testing outcomes should reflect both cases. SUBCHAPTER II OTHER RISKS Article 28 Market risk

1. The bank should take into account market risk, notably risks derived from losses resulting from adverse changes in the value of positions arising from movements in market prices of on- and off-balance sheet exposures.
2. The bank should conduct stress tests for its positions in financial instruments in trading portfolio and placements portfolios, including securitisation instruments/positions and covered bonds. These stress tests should be undertaken as part of bank-wide stress testing as well as for market risk management and calculation purposes.
3. The bank should apply a range of severe but plausible scenarios for all positions referred to in paragraph 2 of this Article (e.g. shortages of liquidity in the markets and the default of large market participants). Dependencies and correlations between different markets and, consequently, adverse changes in such correlations, where appropriate, also should be taken into account by the bank.

29 4. When calibrating these stress tests, the bank should take into account at least the nature and characteristics of relevant portfolios and financial instruments, volume of markets where these instruments are traded, their trading strategies, and the possibility of, associated cost of and potential time involved in hedging out or managing risks under severe market conditions. 5. The bank should ensure that the stress tests are reviewed on on-going basis, to accommodate the changes set forth in paragraph 4 of this Article. 6. The bank, when assessing that the method being used, underestimates the measured risk (e.g. the bank uses a method aiming to explain price behaviour by normal distribution), should be based on a more appropriate method (e.g. historical distribution), to identify the size of the underestimated risk, or apply severe hypothetical scenarios, which assume events beyond the theoretical confidence levels (as suggested by the model). 7. The bank should design a plan of measures containing limits and other possible actions taken to reduce risks and preserve the required capital level. In particular, where appropriate, the bank should take into account the limits set by the bank on exchange rate, interest rate, equity price and commodity prices, related the results of the stress testing calculations. 8. In stress testing, especially at bank level and including group-wide level stress testing, the bank shall assess concentration risk considering on- and off-balance-sheet exposures. 9. The bank should consider the impact of the exposure towards various risk factors, on the trading book. 10. The bank should calculate the outcomes of stress tests in terms of unexpected losses accumulated in portfolio or deepening of unrealised gains, if any, present in various asset classes or as a combination of both. These losses should be considered while forecasting/projecting capital ratios under stressed situations. Article 29 Interest rate risk in the banking book

1. Stress tests should support and be an integral part of the interest rate risk in the banking book (IRRBB) internal management system.
2. The interest rate scenarios used for stress testing purposes of the interest rate risk in the banking book should be adequate to identify all material interest rate risks, such as repricing risk, yield risk, basis risk and option risk.
3. The bank should ensure that the stress tests referred to in paragraph 2 of this Article are not only based on a simple parallel shift, but that in their scenario analysis they consider

30 movements and changes in the shape of the yield curves, the mismatch between reference rates (basis risk), and early termination risks included in contracts with an embedded option, in order to identify all risk sources. 4. The bank shall measure the outcomes of stress tests in terms of decrease in both the internal capital value and net interest income. The bank, in the event of the decrease in internal capital value or net interest income, whatever is higher, shall reflect the effect in the projected capital ratios under stressed situations. Article 30 Operational risk

1. The bank should be aware that relevant risk parameters related to operational risk may derive from inadequate or failed internal processes, people and systems, including legal risks, or from external events, and may affect all products and activities within the bank.
2. In order to stress relevant risk parameters, the bank shall use events of operational risk nature, registered according to its internal policies, notwithstanding if they have or not a materialised impact on the profit and loss statement.
3. As operational losses may induce second-round effects (i.e. reputational risk), in order to account for such effects, the bank should thoroughly integrate the operational risk stress testing programme into the bank-wide stress test and should include interconnections with liquidity and own funds requirements.
4. The bank, for the purposes of performing stress tests for operational risk, shall analyse all the events related to this risk.
5. The bank shall analyse the possible interaction of operational risk losses with credit risk and market risks.
6. The analysis of the stress test events should involve expert judgement, to include at least low-frequency high-severity events.
7. The bank shall design severe but plausible stress events. Assumptions may differ from assumptions used in credit and market risk stress scenarios. When the bank expands its business in the local or in the international markets through mergers and acquisitions, the design of new products or a new business line, the severe but plausible stress test scenarios should be based on expert judgement to overcome the possible lack of historical information.
8. The bank shall build its stress testing programme based on both internal and whenever possible, on external data, while analysing:

31 a) the use of scaling factors (e.g. in a situation where external data were scaled down, the scaling may be reduced) and the possible need for additional impacts stemming from changing scaling factors in a stress situation; and b) the criteria for determining the relevance of data. 9. The bank, when designing stress tests, should also consider legal risk as part of operational risk. Where appropriate, the bank should assess whether or not future profits will be sufficient to cover expected losses/costs of legal risk and incorporate this information into capital planning. 10.The bank should measure stress tests’ outcomes in terms of increase in losses from operational risk and their impact on the profit and losses statement of the bank. These losses should be considered while forecasting/projecting capital ratios under stressed situations. Article 31 Liquidity risk

1. The bank, when designing the stress testing programme, shall take into account that liquidity risk encompass: a) short- to medium-term liquidity risk; and b) funding (long-term) risk.
2. The bank shall perform a self-assessment of risk factors for assets, liabilities and off￾balance- sheet items.
3. The bank analyzes the risk factors related to assets and liabilities, as well as to off￾balance-sheet commitments that include, but should not be limited to: a) the impact of macroeconomic conditions (e.g. the impact of interest rate shocks on contingent cash flows); b) the impact of the exchange rate and possible disruptions in the access to foreign exchange markets; c) liquidity sources within the group and the risk of constraints for the transfer of funds between jurisdictions or group entities; d) obligations required to be accomplished any time, notwithstanding the maturity term, to reduce the reputational risk; e) the vulnerabilities within the funding term structure due to external, internal or contractual events; f) realistic run-off rates under normal conditions that accelerate in stressed times; g) concentration in funding; h) estimates of future balance-sheet growth.

32 4. The bank shall perform sensitivity analyses to risk factors, which in turn should provide the appropriate quantitative information for the design of stress testing scenarios. 5. The banks shall design the following three types of stress scenarios: a) an idiosyncratic scenario which assumes bank-specific events (e.g. a rating downgrade of the bank, the default of the largest funding counterparty or of the counterparty providing the largest inflows, a loss of market access, a loss of currency convertibility, clients’ behaviour, including depositors, other providers of funds and other counterparties, for each different scenario and for each time horizon); b) market stress scenario should assume an impact on a group of banks or on the financial sector as a whole (e.g. a deterioration in funding market conditions, the macroeconomic environment, or rating downgrades of countries in which the bank operates); and c) a combination of both above scenarios. 6. The bank shall design different time horizons in its stress testing, ranging from overnight up to at least 12 months. The bank shall also perform separate stress tests relating to intraday liquidity risks. The time horizon should display, for example, a short acute phase of stress (up to 30 days in order to cover such periods without having to change the business model), followed by a longer period (between 3 and 12 months). 7. The bank shall combine the stress of the short- to medium-term liquidity risk with a stress of funding risk, considering a time horizon of at least 12 months. 8. In the design of scenarios, the bank might consider the impact of stress events for other risk types (e.g. credit risk losses and reputational risk events) on its liquidity position, and the possibility of spillovers from other banks as well, or the impact from its own liquidity buffer on the market-to-market value of other assets the bank holds. 9. The bank shall extend the analysis, if appropriate, to other metrics, such as a) liquidity ratios and other metrics used in the framework, which should include, but may not be limited to, supervisory liquidity ratios laid down by the Bank of Albania, e.g. liquid assets to short-term liabilities ratio and the liquidity coverage ratio; b) liquidity buffer (liquid assets) above the ratios for the indicators referred in letter “a” of this paragraph. The stress testing of this metric should be accompanied by an assessment of the impact on the increase of encumbered assets; c) the survival horizon of the bank as derived from its counterbalancing capacity, i.e. the bank’s ability to hold, or have access to, excess liquidity over short-term, medium-term and long-term time horizons in response to stress scenarios; d) solvency and profitability.

33 10. When applying the different stress scenarios, the bank shall assess and highlight counterbalancing effects provided by central banks (monetary policy) and adopt a conservative approach. 11. Liquidity stress test metrics should include, if appropriate, a granularity per currency and in particular for at least all significant currencies, to allow the analysis of currency￾specific assumptions in scenarios (e.g. volatility in exchange rates or currency mismatches). 12. The bank shall, where appropriate, integrate liquidity stress test in its bank-wide stress tests, and take into account differences in the time periods covered in liquidity stress tests from those covered in bank-wide solvency stress tests. At a minimum, banks should assess the impact of increasing funding costs on profit and loss statement. CHAPTER VI ACTIONS/MEASURES APPLIED BY THE BANK BASED ON OUTCOMES OF STRESS TESTS Article 32 Actions/measures of the management bodies of the bank

1. The Directorate (executive directors) should inform the steering council, the audit committee and other committees at steering council level on the results of each stress test. The information, under this paragraph, should contain: a) outcomes of stress tests; b) actions/measures proposed to be undertaken, due to the stress test outcomes.
2. The management bodies of the bank should take the appropriate measures addressing the outcomes of stress tests and aimed at ensuring their on-going capital adequacy, to withstand the stressed scenario.
3. The bank should consider a broad range of management actions (including within the liquidity contingency plans) against a range of plausible stressed conditions with a focus on at least one severe but plausible scenario.
4. To assess possible responses to a stressed situation, the bank should identify the most relevant actions and when it would have to take them. The bank should take into account that some management actions are required immediately and others are contingent on specific events happening, in which case clearly defined triggers for action should be identified beforehand.
5. Management actions should be consistent with stated strategies and policies (for example in the context of stated dividend policies). The bank should be conservative

34 about its ability to take mitigating management actions, recognising the possible impact of the stressed scenarios on other markets. 6. The bank should explain the qualitative and quantitative impacts of the stress before and after mitigating management actions. The impact before management actions should include assumptions about strategy, growth and associated revenue, but exclude management actions that would not be available in a stress event such as winding down a business line or raising capital. 7. For the purposes of this Article, the bank might consider as acceptable management measures/actions the following: a) the review of internal risk appetite/tolerance and risk limits; b) the review of the use of risk mitigation techniques; c) the revision of policies, such as those that relate to liquidity and funding or capital adequacy; d) the reduction of dividend distributions; e) the changes in the overall strategy and business plan and risk appetite/tolerance; f) the raising of capital or funding; g) etc. CHAPTER VII REPORTING AND SUPERVISION Article 33 Reporting requirements

1. The bank shall report to the Bank of Albania, at least once a year, within September, the outcomes of stress tests, as per the data of June of each year.
2. The bank, as part of the report submitted to the Bank of Albania, shall include also the actions/measures undertaken by its management bodies, as a result of the stress tests’ outcomes.
3. The Bank of Albania shall assess the results of the stress tests and the actions/measures of the management bodies, after their reporting by the bank. Article 34 Supervisory and penalising measures The Bank of Albania, in case of failure of banks to meet the obligations set forth in this guideline, shall apply the supervisory measures laid down in Article 74, paragraph 2, letter

35 “c”, Article 76, paragraph 1, letter “ë” of the Law on banks and/or the corrective measures set forth in Article 89, paragraph 1, letter “b” of the Law on banks. CHAIRMAN OF THE SUPERVISORY COUNCIL Gent SEJKO