Bank of Albania Guideline 26/2017 on the Internal Capital Adequacy Assessment Process

REPUBLIC OF ALBANIA BANK OF ALBANIA SUPERVISORY COUNCIL DECISION No 26, dated 3.5.2017 APPROVAL OF THE GUIDELINE “ON THE INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS” In accordance with Article 12 “a”, Article 43 “c” of the Law No 8269, dated 23.12.1997 “On the Bank of Albania”, as amended; Article 57, paragraphs 1, 2, 4, 5; and Article 59, paragraph 4 of the Law No 9662, dated 18.12.2006, “On banks in the Republic of Albania”, as amended; the Supervisory Council of the Bank of Albania, upon proposal by the Supervision Department, DECIDED:

1. To approve the guideline “On the internal capital adequacy assessment process”, according to the text attached to this Decision.
2. The Supervision Department and the Financial Statistics Department shall be responsible for the implementation of this Decision.
3. Until the entry into force of this Decision, banks shall take measures and create the necessary conditions for the implementation of the requirements of the guideline, as well as for the submission of the internal capital adequacy assessment process report at the Bank of Albania (Supervision Department) as at the end of 2017 data and according to the defined deadline (30 April 2018).
4. The Governor's Office and the Research Department shall be responsible for the publication of this Regulation in the Official Journal of the Republic of Albania and in the Official Bulletin of the Bank of Albania. This decision shall enter into force on 31 December, 2017. SECRETARY CHAIRMAN Elvis ÇIBUKU Gent SEJKO

1 Content

1. General provisions .........................................................................................4 1.1. The purpose of the guideline........................................................................ 4 1.2. Scope of application..................................................................................... 4 1.3. Legal ground/basis....................................................................................... 4 1.4. Definitions.................................................................................................... 4
2. The Internal Capital Adequacy Assessment Process (ICAAP)......................5 2.1. The objective and basic principles of drafting the ICAAP .......................... 5 2.2. Administration of ICAAP documentation.................................................... 6
3. Internal capital requirement ...........................................................................7 3.1 General provisions ....................................................................................... 7 3.1.1 Risks in ICAAP............................................................................................ 7 3.1.2 Stress tests.................................................................................................... 8 3.1.3 The effect of diversification and correlation of risks................................. 10 3.2 The assessment of internal capital and the capital target ratio ................... 10
4. The implementation of the Bank of Albania Supervisory Review and Evaluation Process (SREP)..........................................................................11 4.1 General provisions..................................................................................... 11 4.2 Review and evaluation of the ICAAP........................................................ 11 4.2.1 The ICAAP report...................................................................................... 12 4.2.2 The dialogue between the Bank of Albania and the bank.......................... 12 4.3 Supervisory measures................................................................................. 12
5. Explanatory notes on filling out and submitting the ICAAP report at the Bank of Albania ...........................................................................................13 5.1 General provisions ..................................................................................... 13 5.2 Structure of the ICAAP report ................................................................... 14 5.2.1 SECTION 1: Basic data and executive summary. ..................................... 14 5.2.1.1 Basic data ................................................................................................... 14 5.2.1.2 Level of implementation of the ICAAP ..................................................... 14 5.2.1.3 Bank’s risk profile...................................................................................... 15 5.2.1.4 Bank management and the internal control system.................................... 15 5.2.1.5 The Capital Target Ratio for risk covering ................................................ 15 5.2.1.6 Capital planning ......................................................................................... 15 5.2.1.7 ICAAP improvement plan.......................................................................... 15 5.2.1.8 Miscellaneous............................................................................................. 16

2 5.2.2 SECTION 2: Bank management................................................................ 16 5.2.2.1 Organisational structure ............................................................................. 16 5.2.2.1.1 Description of the organisational structure of the bank ............................. 16 5.2.2.1.2 The role of the Steering Council of the bank in risk management, control environment and capital adequacy ............................................................. 16 5.2.2.1.3 Self-assessment of the organisational structure ......................................... 16 5.2.2.2 Risk management process.......................................................................... 17 5.2.2.2.1 Risk management principles ...................................................................... 17 5.2.2.2.2 Management of individual risks................................................................. 17 5.2.2.2.3 Self-assessment of the risk management process....................................... 18 5.2.2.3 System of internal control .......................................................................... 18 5.2.2.3.1 The tasks of the internal control unit in the risk management process ...... 18 5.2.2.3.2 Self-assessment of the functioning of the internal control unit.................. 18 5.2.3 SECTION 3: Risk assessment and internal capital requirements .............. 18 5.2.3.1 The measurement and assessment of risks that are subject to the minimum capital requirement..................................................................................... 18 5.2.3.1.1 Credit risk................................................................................................... 19 5.2.3.1.2 Market risks................................................................................................ 19 5.2.3.1.3 Operational risk.......................................................................................... 20 5.2.3.2 The measurement and assessment of risks that are not subject to the minimum capital requirement .................................................................... 21 5.2.3.2.1 Concentration risk ...................................................................................... 21 5.2.3.2.2 Interest rate risk in the banking book ......................................................... 23 5.2.3.2.3 Market liquidity risk................................................................................... 23 5.2.3.2.4 Other risks.................................................................................................. 24 5.2.3.2.5 External environment factors and stress tests ............................................ 25 5.2.3.2.6 Assessment of internal capital requirements based on the risk .................. 25 5.2.4 SECTION 4: Capital planning ................................................................... 25 5.2.5 SECTION 5: ICAAP improvement plan.................................................... 26 5.2.6 SECTION 6: Other aspects of the ICAAP ................................................. 26 ANNEX 1: ICAAP report and the calculation summary form ..................................... 27 ANNEX 2: Concentration risk ...................................................................................... 38 ANNEX 3: Interest rate risk in the banking book ......................................................... 39 ANNEX 4: List of banking and/or financial group subordinated institutions included in the ICAAP (level of implementation of the ICAAP)................................. 41 ANNEX 5: Organisational scheme of the bank, composition, position and respective responsibilities of the managing level (Steering Council and Executive Directors) and of the committees. .............................................................. 42 ANNEX 6: Principles of the ICAAP ............................................................................ 43

3 ANNEX 7: Example of a systematic categorisation of risks in the ICAAP and the used method of assessment...................................................................................46 ANNEX 8: Typical examples of risks that are not entirely covered by the minimal capital requirement.......................................................................................48

4

1. General provisions 1.1. The purpose of the guideline The purpose of this guideline is to set out the requirements for banks on drafting and implementing the Internal Capital Adequacy Assessment Process (ICAAP), as well as the expectations of the supervisor on the structure and content of the report of this process, which shall be submitted to the Bank of Albania. ICAAP, which is independently realised by the bank, shall ensure the assessment of the current and future levels of capital adequacy, based on its risk profile and strategies. The Bank of Albania (Supervision Department), shall implement the Supervisory Review and Evaluation Process (SREP), based on the ICAAP of the bank, in order to formulate an overall judgement on the risk profile and its needs for capital. 1.2. Scope of application This Regulation shall apply on banks licensed to conduct banking and financial activities in the Republic of Albania, in compliance with the licence granted by the Bank of Albania. 1.3. Legal ground/basis This guideline is issued in compliance with: a) Article 12 “a”; and Article 43, “c” of the Law No 8269, dated 23/12/1997, “On the Bank of Albania”, as amended”; b) Article 57, paragraphs 1, 2, 4, 5; and Article 59, paragraph 4 of the Law No 9662, dated 18.12.2006, “On banks in the Republic of Albania”, as amended; and c) Chapter IX of the Regulation No 48, dated 31/07/2013, “On Capital Adequacy Ratio”, as amended. 1.4. Definitions
2. The terms used in this guideline shall have the same meaning of the terms defined in the Law on banks and in the Regulation on the capital adequacy ratio and on the Regulation on the regulatory capital of the bank.
3. In addition to paragraph 1 of this Article, for the purposes of this guideline, the following terms/definitions shall apply: a) “internal capital requirement” - shall be the amount of internal capital that the bank assesses as necessary to cover/monitor losses that exceed an expected level of a particular/specific risk; b) “aggregate internal capital requirement” - shall be the amount of internal capital that the bank assesses as necessary to cover/monitor all material risks to which the bank is is exposed; c) “capital target ratio” - shall be the ratio set out in the capital planning process;

5 d) “Stress-testing” - shall be a risk management technique used to assess the impact of potential changes of one or more internal and external factors on the financial stability of the bank. 2. The Internal Capital Adequacy Assessment Process (ICAAP) 2.1. The objective and basic principles of drafting the ICAAP ICAAP’s main objective shall be the creation of a risk profile of the bank and the early identification of the internal and external factors that may deteriorate its performance. During the implementation of this process banks shall follow two steps: first step: determine the level of a specific risk they can undertake, in order to define their risk￾bearing capacity and ensure adequate capital to cover this risk, and second step: making a critical analysis of the risk level that is rational to undertake, taking into account all the possibilities and threats that correspond to this risk. ICAAP is a process fully based on the internal processes and systems of the banks that helps to manage and effectively control the risk profile and consequently to determine the necessary capital level. This process is oriented toward the quantitative elements of the risk management process - the assessment of internal capital requirements and of the capital for covering the risk, as well as its qualitative elements, created to strengthen the internal rules of management and control of the bank, which make possible the effective management and the mitigation of this risk. Banks shall ensure an adequate ratio between quantitative and qualitative elements1 , which implies that capital itself, may not replace or supplement in any case bank’s deficiencies in management and the internal control system. Banks, in drafting ICAAP, shall consider minimally the implementation of the following basic principles: a) Principle of responsibility. The implementation and development of ICAAP shall be the responsibility of the bank. The bank, in its dialogue with the supervisors, shall provide detailed arguments related to procedures, methodologies and systems used for this process; b) Principle of proportionality. Banks shall implement ICAAP, regardless of their size and complexity. In this context, the bank shall be responsible for assessing the adequacy of methods, processes and systems of ICAAP, depending on the nature, level of risk and complexity or volume of its activity. Smaller banks may meet the requirements of ICAAP by using simple methods. Banks that perform complex activities or high volume transactions may need to use complex systems in order to fulfil the requirements of ICAAP. Each bank shall use appropriate tools and processes in its ICAAP, while it shall prove/argument for the Bank of Albania that ICAAP is complete and appropriate for the risks arising from the activity and the environment in which this activity is conducted; c) Principle of materiality of risks. ICAAP must be focused on risks that may have a material impact on the current or future capital adequacy situation of the bank.

1 The ratio between internal capital requirements and effectiveness and transparency of the risk management processes.

6 The bank’s internal capital requirements must consider its risk profile and the impact of the external factors in the environment in which it operates; d) Principle of looking forward. ICAAP shall focus on ensuring the bank’s capital adequacy, taking into account future developments and its activity’s performance. ICAAP shall consider in particular the impact of the business cycle, external factors that may have a negative impact on bank’s capital adequacy, as well as strategic plans and their relation to macroeconomic factors, for which banks draft and test adequate scenarios in extraordinary situations (stress-testing). The bank shall reflect the quantitative results of the ICAAP or the assessment of exposure to material risks, in the internal capital requirement and in the internal capital assessments. In the event of deficiencies in the risk management system or the internal control system being identified, the bank may raise the internal capital requirement as appropriate, as well as undertake the necessary measures to improve the risk management system, or strengthen the internal control system. 2.2. Administration of ICAAP documentation Banks shall draft ICAAP in a transparent and comprehensive manner that would assist employees to understand and implement the defined procedures, as well as make it easier for the Bank of Albania to review and assess the adequacy of processes, methods and systems of the bank for this process. Banks shall draft a written document on all the elements of ICAAP, which may be based on existing documentation and definitions that comply with the regulatory requirements of the Bank of Albania. Banks, in creating the required documentation, shall ensure that the details and purpose of its explanations are realized according to the needs of the target groups. Banks shall use different level of details in the actual implementation of documentation requirements for strategies, policies, manuals and rules or internal procedures, respectively. Banks shall ensure that the documentation is complete and up-to-date and this shall be an important responsibility in the process of its creation and maintenance. Banks shall also ensure that the documents shall be written and stored systematically on paper, or another durable medium (e-mail, floppy disk, CD-ROM, DVD) and in a manner that is comprehensible to third parties. Banks shall not be obliged to rewrite their entire documentation in order to implement the requirements of ICAAP, since the documentation may be based on the existing guidelines and regulations. However, banks shall update the documentation with any adaptation or enlargement of the internal risk management process that shall result from the implementation of ICAAP, and when necessary, shall reorganise systematically this documentation. The scope and level of details of documentation shall be proportionate to the size, complexity and risk levels of the bank.

7 A well-structured documentation would contribute to transparency of the bank’s ICAAP process, enabling the Steering Council to assess more effectively its drafting (ICAAP’s). The complete documentation of all the important processes and rules is important to prove the bank’s ICAAP adequacy to the Bank of Albania. 3. Internal capital requirement 3.1 General provisions The bank shall ensure through the ICAAP an effective relationship between its risk profile and the level of the components of necessary capital, both on an individual basis and on a consolidated basis. ICAAP shall provide to the bank an optimal balance between the capital and the exposure to material risks within ICAAP framework, through more effective risk management systems (i.e. the process of identifying, measuring/assessing, monitoring and controlling/mitigating of risks). The careful planning of the internal capital requirement, for current and future periods, shall ensure to the bank a long-term stability of its risk-bearing capacity. When calculating its capital requirements, the bank shall consider all materially significant risks and the other internal and external factors that determine its risk profile. The bank shall compare its capital requirements with the assessment of the capital elements, in order to determine the additional capital necessary to hedge/cover/monitor risks. The internal capital requirements, calculated for the purpose of the ICAAP, may be higher or lower than the minimum capital requirement. Some of the reasons might be as follows: a) The inclusion of risks and factors that are not subject to minimum capital requirement. In this case the internal capital requirements are higher than the minimum capital requirements; b) The use of advanced risk measurement techniques, such as internal models for bank’s capital calculation. In this case, the internal capital requirement may be lower than the minimum capital requirements, but in any case the bank shall ensure the adequate level of minimum capital required by the Bank of Albania; c) Consideration of the effects of risk diversification and correlation. In this case too, the internal capital requirement may be lower than the minimum capital requirement, but in any case the bank shall ensure the adequate level of minimum capital required by the Bank of Albania. 3.1.1 Risks in ICAAP When calculating the internal capital requirements, the bank shall consider the following risks and factors: a) Risks that are subject to minimum capital requirements. The bank, in calculating the internal capital requirement for credit risk, market risk and operational risk, shall use the methods laid down in the Regulation of the Bank of Albania ”On capital adequacy ratio”.

8 b) Risks not entirely covered by minimum capital requirements. The bank, in calculating the internal capital requirements, shall also consider risks that are not entirely covered by the minimum capital, calculated according the standard methods defined by the Bank of Albania (standard methods for credit risk, market risk or the simple indicator method and the operational risk standard one), which overall do not consider some particular factors in capital calculation to fully cover a certain risk. E.g., in the case of credit risk, the bank shall consider the residual risk as result of the use of credit risk mitigation techniques or securitization positions, or in the case of operational risk, it shall consider the risk derived from the planned strategy of activity and the risks derived from the scope and complexity of its activity, when these risks are included in the definition of operational risk (typical examples of these risks are presented in Annex 8 of this guideline). c) Risks that are not subject to minimum capital requirements. The bank, in calculating the internal capital requirements, in addition to the risks that are subject to minimum capital requirements, shall also consider the calculation of the internal needs for capital for the interest rate risk in the banking books, the concentration risk, the reputational risk, the profitability risk, the strategic risk, etc. The bank, depending on the complexity and particularity of its activity, may consider also other risks of this category and uses its internal qualitative and quantitative methods for their assessment. d) External environment factors. The bank, in calculating the internal capital requirements, shall also consider the risks that may become materialised in extreme but not impossible situations, having also a considerable impact on bank’s capital adequacy. These risks may derive from the macroeconomic environment or market factors, or from the regulatory framework. In the assessment of the risks deriving from these factors, the bank must also conduct stress tests. 3.1.2 Stress tests For the purposes of the implementation of the ICAAP, the bank shall conduct stress tests to obtain a clearer understanding and vision of its exposures to various risks, and the assessment of the impact of extreme situations in a certain period, or in several consecutive periods on revenues and planned capital. Stress tests allows the bank to assess all the material risks in a comprehensive, integrated and forward-looking way and to realise the comparison of the impact of the stress tests results with its business plan and the undertaking of appropriate measures in timely manner. Banks, whose business is smaller in scope and complexity, and of no systemic importance, may improve the risk assessment by using simple stress tests in order to implement the ICAAP. The simple stress tests, or sensitivity analysis, are not complex techniques to implement, since they consider the assessment of the impact of a change in a single risk factor (a shock event) on the financial position of the banks, without defining the cause of the materialisation of the unfavourable situation (the shock). Simple stress tests, or sensitivity analysis, may include for example the assessment of the impact of the decline of the interest rates in certain days on bank’s profitability, or an assessment of the impact of the deterioration of the quality of the credit portfolio on the increase of bank’s credit risk exposure, without defining the cause of the situation.

9 The main advantage of sensitivity analyses is that, the size of risks/losses for a particular factor is easily determined (e.g. the effect that the exchange rate and the slowdown of GDP growth has on the probability of bankruptcy of households and businesses, etc.), while their disadvantage is that often they fail to present the real situation of the bank’s exposure. This is explained with the fact that really (de facto), the used risk factor does not act in an isolated manner, but in combination with other factors. Large banks, with more complex activities and systemic importance, may use sensitivity analysis, but as a rule they are encouraged to use more complex techniques also known as stress-testing scenarios, which give to the bank the possibility to improve the projections in accordance with internal statistical models. Stress-testing based in scenarios consider the assessment of the impact of a shock event in a certain risk factor, or a combination of risk factors, where as basis for the determination of the change in the risk factor may serve, amongst other things, extreme and unfavourable historical events. These analyses assume a simultaneous change of several risk factors and measure the combined impact on the position of the bank, also taking into account secondary and overdue effects. These analyses may also be based on hypothetical and historical scenarios. The advantage of this analysis is that it takes into consideration the interaction between risk factors, allowing the treatment of bank’s risks in an integrated manner. In drafting the scenario analyses, the bank shall use scenarios that are consistent with its risk profile and complexity, as well as it shall consider the interaction and the reaction of the parameters. The bank shall interpret and understand the results of its stress tests, in order to use it as a basis for a clear definition of risk mitigation measures. The senior management of the bank shall be informed and shall take an active role in drafting and supervising the stress tests’ programme and in the assessment of its results. Stress tests shall be defined taking into account the characteristics of the bank’s portfolio and the assumed risks, in relation to the current external environment. The bank, in the cases when there is any change of these factors, reviews the applied tests, and even if there is no change in the above mentioned factors, it shall review them once a year. Larger banks are encouraged to use a combination of sensitivity analysis and scenario analysis techniques, when the latter method includes a larger interval of hedging product/s lines and geographical zones. Banks shall integrate the stress tests in an organic manner, in risk management practices, and they shall use their results for: a) the assessment of the results of capital calculation and their assessment in the capital planning (budgeting) process; b) high-level decision-making (e.g. elaboration of emergency scenarios, setting of limits, etc.);

10 c) the calculation of additional regulatory capital after the dialogue with the Bank of Albania, and if necessary, shall take sufficient measures for risk mitigation (capital increase, strategy, use of more prudent limits, etc.); d) the elaboration of risk strategy; e) the assessment of liquidity reserves. 3.1.3 The effect of diversification and correlation of risks The bank, in order to calculate the internal capital requirement for all risks, may also take into consideration the effects of diversification and correlation of risks. The Bank of Albania, taking into consideration the technical nature and complexity of the effects of diversification between risks and within the group of individual risks, as well as in the conditions when the development of internal capital economic models is done in an earlier phase, and in different directions, shall not recognise these effects (either on an individual or on a consolidated basis) for a lower internal capital requirement. 3.1.4. The methodology for calculating the internal capital requirements The bank, in calculating the internal capital requirement for credit risk, market risk and operational risk and for other risks (e.g. concentration risk, etc.), which are not subject to minimum capital requirements, shall use the methods set out in the regulatory framework of the Bank of Albania2 and/or its internal methods or models. Banks are encouraged to develop their internal models for the assessment of certain risks, or for a part of a certain risk. In these cases, all the necessary information required and the relevant arguments for their adequacy shall be presented at the Bank of Albania. 3.2 The assessment of internal capital and the capital target ratio The bank shall define the internal capital elements that will be considered for ICAAP implementation purposes. The Bank of Albania, for the purposes of this guideline, shall recognise as an assessment of internal capital the capital calculated according the the Bank of Albania’s Regulation on The Regulatory Capital, including the capital indicators and the limits of its components. The bank, in the analyses and risk-bearing capacity assessment, shall ensure that the aggregate capital for covering risk is always adequate to cover the risks undertaken (internal aggregate capital requirement). The capital target ratio aims to consider a necessary level of capital that must be held in the present as well as in the future periods, according to its policies and business strategy. The capital target ratio is not only the amount of internal capital requirements to cover the risks to which the bank is exposed, but it must consider also the environment factors in which it exercises its activity. The higher is the evidenced need for additional capital in the ICAAP, or the higher are the deficiencies in management or administration and

2 The regulation on capital adequacy ratio and this guideline.

11 control of particular risks, the higher shall be the reserve against the regulatory requirement of the Bank of Albania for capital. The bank shall consider if there is the need for a higher capital reserve, also because of the activity exercised in a limited geographic area, or in a field of its activity. This ratio shall be decided by the bank itself, within a reasonable limit of fluctuation, based on its expectations for the future. The bank shall ensure medium-term sustainability and the consistency of this target, despite temporary disequilibriums that may derive as a consequence of negative impacts, or particular circumstances. The capital target ratio shall also allow to the bank the fulfillment of the capital requirements, for the purposes of the implementation of the regulatory requirements of the Bank of Albania, in the case of a significant economic decline as well, or in non favourable activity circumstances, by using appropriate stress-testing scenarios. 4. The implementation of the Bank of Albania Supervisory Review and Evaluation Process (SREP) 4.1 General provisions The SREP is an integral part of the supervision process of the Bank of Albania, which consists in reviewing and evaluating ICAAP, bank’s risk exposure and compliance with the requirements defined in the Law on banks and in the supervision regulatory framework. In the framework of this process, the Bank of Albania shall encourage an active dialogue with the banks, with the aim of promptly identifying any deficiencies in the ICAAP and risk mitigation, as well as of ensuring adequate capital levels. The Bank of Albania shall ensure that the SREP is consistent and based on rules and procedures, which shall define the requirements for the implementation of this process, based on various criteria for the assessment of the adequacy of methodologies, procedures, systems and calculations realised in the ICAAP, which shall consider the dialogue with the bank during its realisation, the comparison of the results of SREP between similar banks and the comparison of the risk profile of an individual bank during different periods, as well as the analysis of every SREP result. The Bank of Albania (Supervision Department), during the overall analysis process of a bank’s risk profile, according to the risk assessment system, shall analyse every SREP result and its report (Bank of Albania’s) for the implementation of ICAAP and any other information that derives from the dialogue with the bank. The Bank of Albania shall analyse in a critical manner the ICAAP adequacy for individual banks and, in the cases when it is necessary, shall decide and order the undertaking of supervisory measures. 4.2 Review and evaluation of the ICAAP The Bank of Albania, as part of its supervision process, shall review and evaluate the ICAAP, with the aim of ensuring adequate capital levels, to monitor risks undertaken by the bank and to use, develop and improve the risk management methods. The Bank

12 of Albania shall review and evaluate the ICAAP, overall, on the basis of the ICAAP report and the dialogue with the bank regarding the capital adequacy. 4.2.1 The ICAAP report The ICAAP report shall present the quantitative and qualitative aspects of bank’s ICAAP process. This document allows the familiarisation with the bank’s risk profile and the results of the methodologies used for the internal capital requirements, based on the risk undertaken by the bank and it is a basis for establishing the dialogue between the bank and the Bank of Albania. 4.2.2 The dialogue between the Bank of Albania and the bank The Bank of Albania, during the dialogue process with the bank, shall learn about the bank’s strategy in the undertaking and management of risks and the bank’s methodologies used for assessing/measuring risks, creating its risk profile and calculating the internal capital requirements (the aggregate assessment of risks). This dialogue shall be structured in such manner as to focus on elements of responsible and effective management of the bank, its strategies and its organisational structure, as well as the method used for calculating and fulfilling the internal capital requirements for covering the undertaken risks. The intensity of this dialogue shall depend on the nature, scope and complexity of the business of the bank, as well as on the nature of the risks to which it is exposed. The bank, in the process of the dialogue about ICAAP, shall provide the arguments related to the adequacy of this process to the Bank of Albania. The Bank of Albania and the bank shall coordinate their positions related to the adequacy of the bank’s ICAAP within the framework of the dialogue process. In case of any deficiencies in the ICAAP, the Bank of Albania and the bank shall assess the best solutions for their correction. The bank shall explain the nature of these deficiencies and their cause, as well as shall set out the deadlines for their solution or improvement. Any finding in the ICAAP elements shall be considered completed only after the Bank of Albania accepts the arguments of the bank on the solution, or improvement of the deficiencies identified in ICAAP. 4.3 Supervisory measures

1. The Bank of Albania, in the cases when the solution or the improvement of the deficiencies of ICAAP in the dialogue process with the bank shall not be ensured, in accordance with of the dispositions of the Law on banks and the regulatory framework into force, shall undertake the necessary supervisory measures. The supervisory measures may include, among others, the decisions of the Bank of Albania, respectively on: a) the reduction of the bank’s exposures to specific risks (downsizing or ceasing of certain business activities), ensuring their monitoring with the necessary capital, and the improvement of its risk profile; and b) requirements for additional capital, in order to ensure adequate levels of capital for specific risks covering, the creation of adequate systems for risk management, etc. The requirement of the Bank of Albania for additional capital

13 shall represent the difference between the amount of capital calculated by the bank, within the framework of the ICAAP, and the amount of capital calculated by the Bank of Albania, within the framework of the SREP. 2. The Bank of Albania, in case of failure to comply with the obligations laid down in this guideline, shall implement the supervisory and/or punishing measures stipulated in the Law on banks. 4.4 Bank of Albania’s assessment of the adequacy of the bank’s ICCAP The Bank of Albania shall assess the adequacy of bank’s ICAAP, based on: a) Qualitative assessment of the ICAAP, according to the basic principles used in the drafting of this process. The Bank of Albania, in reviewing and evaluating the ICAAP, shall assess if the bank realises the ICAAP process in accordance with its 10 principles, which guide the bank during the implementation of this process (Annex 6); b) Quantitative evaluation of the ICAAP. The Bank of Albania shall assess the adequacy of the internal capital requirements capital and the adequacy of bank’s internal capital assessment, on the basis of a comparison between the internal capital requirements from the ICAAP report and the assessment of bank’s risk profile, according to the risk assessment system. The Bank of Albania shall assess whether the internal capital requirements have to be revised (upwards). The Bank of Albania, during the quantitative evaluation of ICAAP, shall assess the quality of the risk management systems, which is part of the overall risk assessment according to the assessment methodology of risks in the field of organisation, management and internal control and shall allow the definition of additional capital requirements for particular risks. A low/weak assessment of the risk management systems quality, shall not be accompanied in every case with an increase of the internal additional capital requirement, but it is an important factor in the assessment of the Bank of Albania, in defining or undertaking of any supervisory measure, in accordance with the dispositions of the Law on banks. The Bank of Albania shall perform the quantitative evaluation of ICAAP every year, after the presentation by the bank of the ICAAP report and its elaboration by the Supervision Department. The Bank of Albania shall notify in writing the bank about the findings during the ICAAP report assessment process and shall provide recommendations and define the terms for their fulfillment, related to the deficiencies identified during the ICAAP assessment process. 5. Explanatory notes on filling out and submitting the ICAAP report at the Bank of Albania 5.1 General provisions The bank shall prepare the ICAAP report with the respective quantitative and qualitative data, once a year and in any case when there are significant changes in risk

14 exposure, in order for the Bank of Albania to realise the SREP. This report is reviewed and approved by the Steering Council and is submitted every year at the Bank of Albania (Supervision Department) by April 30, with the data from December 31 of the previous period. The bank shall draft the ICAAP report in accordance with the proportionality principle. Thus, the detailing of the explanations and argumentation of the particular fields or issues in this report shall depend on their importance (of issues or fields). The ICAAP report shall ensure that the users shall have a clear understanding of all its elements. The ICAAP report and the summary of its calculations are presented in Annex 1 of this guideline, and include the following main elements: SECTION 1: Basic data and executive summary; SECTION 2: Bank management; SECTION 3: Risks assessment and internal capital requirements; SECTION 4: Capital planning; SECTION 5: ICAAP improvement plan; SECTION 6: Other aspects/issues. 5.2 Structure of the ICAAP report 5.2.1 SECTION 1: Basic data and executive summary. In this section the bank shall present basic information about the ICAAP and briefly summarises the main elements. The bank shall explain this information in greater detail in the other sections of the ICAAP report. 5.2.1.1 Basic data The bank shall provide the following data in the ICAAP report: a) The full name, organisational unit and position of the person responsible for compiling the ICAAP report or the person responsible for submitting the information to the Bank of Albania in relation with the ICAAP report; b) contact numbers (telephone, fax, etc.), e-mail address; c) various data related with the ICAAP report (the reporting period, the date of the report, the date of the last update, the date of the review and approval by the Steering Council); d) the signature of the person responsible for compiling the ICAAP report. 5.2.1.2 Level of implementation of the ICAAP The bank shall draft the ICAAP report on an individual basis and/or on a consolidated basis, at the banking group level. The bank, in the cases of ICAAP implementation on a consolidated basis, shall submit a list of the banking group’s subordinated institutions included in the bank’s ICAAP report, as defined in Annex 4 of this guideline.

15 When the subordinated institutions shall be assessed not to apply the appropriate ICAAP, or present deficiencies in the data for the calculation on a consolidated basis of the internal capital requirement, the bank shall summarise the measures and the deadlines for the fulfillment of the deficiencies. 5.2.1.3 Bank’s risk profile The bank shall submit a list of materially significant risks and the internal capital requirements for each risk, as well as the bank shall summarise the analysis of risk profile and the main findings. 5.2.1.4 Bank management and the internal control system The bank shall summarise its self-assessment on the suitability of the bank’s management and the internal control system in relation to the risk profile, reflecting the evidenced deficiencies as well. 5.2.1.5 The Capital Target Ratio for risk covering The bank shall define the Capital Target Ratio to cover the risk completely, in value as well as in structure. This target may be defined in absolute or in relative (percentage) value, against the internal capital requirement. The bank shall compare the Capital Target Ratio for aggregate risk covering, with the aggregate capital ratio to bank’s risks at the reporting date. The bank, in case it is the superordinate bank of a banking group, shall submit the internal capital allocation policy at group level related to material individual risks, toward which the subordinated institutions of the group are currently or may be exposed, as well as the Capital Target Ratio. The superordinate bank, in drafting the capital allocation policy at the group level, shall consider the possibilities that exist within the group for this purpose (through dividends or capital increase). The bank shall explain if it has taken into account any external assessment of credit quality, in defining the Capital Target Ratio, for the overall risk covering, the assessment of which external credit assessment institution has been used, as well as the targets to get credit quality assessment in the future. 5.2.1.6 Capital planning The bank shall summarise the capital planning process for the next three years, including its policy for dividend distribution, or increases/additions (new injections) of capital. 5.2.1.7 ICAAP improvement plan The bank, in the cases when it is necessary, shall summarise any weaknesses or deficiencies in the ICAAP, and shall present the main measures and plan for their timely correction.

16 5.2.1.8 Miscellaneous The bank shall summarise other significant findings not included in the previous sections, giving the relevant conclusions. 5.2.2 SECTION 2: Bank management In this section the bank shall provide a detailed explanation of the internal organisational structure, the risk management process and the system of internal control. The bank, in case it is the superordinate bank of a banking group, shall also submit the most significant changes/differences evidenced in the ICAAP, as a result of the position of the more relevant subordinated institutions of the group. 5.2.2.1 Organisational structure 5.2.2.1.1 Description of the organisational structure of the bank The bank shall submit its organisational scheme, including the composition, position and respective responsibilities of the Steering Council, committees and Executive Directors, in Annex 5 of the ICAAP report. In the organisational scheme shall be presented also the reporting lines in the risk management process. 5.2.2.1.2 The role of the Steering Council of the bank in risk management, control environment and capital adequacy In this part, the bank shall explain the responsibilities undertaken by the Steering Council of the bank related with: a) the nature and size of the risks undertaken; and b) the internal capital adequacy ratio for monitoring these risks. The bank shall explain how the Steering Council creates a risk management culture at the bank, which ensures that: a) the sophistication of the risk management processes is proportionate to the nature, scope and complexity of the business that the bank pursues; b) the system of the internal control secures the adequate management and mitigation of the risks; c) the internal capital of the bank for risk covering is adequate with regard to its risk profile and to the macroeconomic environment in which it operates. The bank shall also include a list of the most important activities of the Steering Council, in the area of risk management, during the previous year (reporting period). 5.2.2.1.3 Self-assessment of the organisational structure The bank shall submit a self-assessment of the adequacy of its organisational structure, disclosing any deficiencies of this structure (when these occur).

17 The bank, during this self-assessment process shall consider, among others, also the level of compliance with the regulatory framework of the Bank of Albania, on the basic principles of management and the requirements for the internal control system, as well as qualify any weaknesses or deficiencies evidenced. The bank shall submit in this part of the report the results of the self-assessment. 5.2.2.2 Risk management process 5.2.2.2.1 Risk management principles The bank shall summarise the most important principles of risk management, shall determine the managerial level that adopts the principles, and shall submit a list of documents (policies) that adopt/consider these principles. The bank shall describe which structure/organisational unit (or person/s) shall ensure that the organisational units are informed on the policies for undertaking and managing risks, the manner in which these policies are communicated to the different levels, ensuring that the employees understand correctly the objectives of risk management and how this process is carried out. This part shall include the description of the functions and responsibilities in the risk management process, as well as their integration in the organisational chart of the bank. 5.2.2.2.2 Management of individual risks The bank shall submit, in this part of the report, a list of the materially significant risks that are included in the ICAAP, and shall also explain for each risk: a) The risk management policy from the point of view of the specific corresponding limits and/or other techniques used to mitigate risk. The bank shall assess how the decision-making policies are currently taken into consideration, in the area of risk management. b) The organisational function of risk management from the point of view of risk assessment and measurement, monitoring and management. The bank shall explain the division of responsibilities in the area of risk management, as well as in the cases there is a department for the management of a specific risk, shall explain its organisational structure. c) Individual risk management processes (identification, assessment/measurement, monitoring and management) from the point of view of Information and Technology (IT) methodologies, procedures and backup systems. If the bank has put in place a database serving to risk management, it shall describe its use and functioning. The bank shall submit a list of standard and specific reports for the risk managerial personnel. In Annex 7 of this guideline are presented a systematic categorisation of the risks in view of their inclusion or non-inclusion in the ICAAP, as well as the assessment method used, according to the regulatory framework of the Bank of Albania or the internal method, while the bank shall formalise or formally document the decision-making for this purpose (the choice of the used method).

18 5.2.2.2.3 Self-assessment of the risk management process The bank, for each of the risks addressed in the ICAAP, shall submit a self-assessment on the adequacy of policies, management (e.g. organisational structure, delegation of functions, activities of risk committees), methods of assessment/measurement and the corresponding internal control procedures and systems. 5.2.2.3 System of internal control 5.2.2.3.1 The tasks of the internal control unit in the risk management process The bank shall submit a list of the areas of regular review, by the internal control unit in relation to risk management in the previous year (the reporting period). Where appropriate, the bank shall summarise the most important conclusions of these reviews, such as: a) compliance with internal rules (e.g. the control of the implementation of limits and procedures); b) the effective use of the results of the ICAAP in daily decisions of bank management; c) the effective and satisfactory functioning of the internal control system; d) the adequacy of the support of Information and Technology (IT) systems for the risk management processes; e) the quality and integrity of risk management data; f) the assessment of the adequacy of risk assessment/measurement method. Where appropriate, the bank shall submit a list of measures that must be undertaken to address the identified deficiencies, as well as define the positions/structures responsible for their implementation. 5.2.2.3.2 Self-assessment of the functioning of the internal control unit The bank shall submit a self-assessment of the internal control unit on the adequacy of the control processes and the risk management systems, as well as on the adequacy of its resources. 5.2.3 SECTION 3: Risk assessment and internal capital requirements In this section the bank shall explain the quantitative aspect of the ICAAP, shall assess its exposure to individual materially significant risks and assess the internal aggregate capital requirement. 5.2.3.1 The measurement and assessment of risks that are subject to the minimum capital requirement The bank, in the process of measuring and assessing the exposure to risks that are subject to the calculation of minimum capital requirement for credit, market and

19 operational risks, respectively, shall use the standard methods provided in the regulatory framework of the Bank of Albania. 5.2.3.1.1 Credit risk The bank, in assessing the capital requirement for credit risk, shall submit in the ICAAP report a detailed analysis related to the credit risk, and in particular if it (the bank) is exposed to materially significant risks, which are not entirely covered by the minimal capital requirement. According to the standard method for credit risk, the bank may use a considerable number of techniques for financed or non-financed credit hedging, such as financial collaterals, netting, guarantees or even credit derivatives. The use of mitigation techniques is subject to the fulfillment of several qualitative requirements, the disregard of which may expose the bank to the residual risk. Likewise, the potential increase of exposure as a result of securitization positions, caused mainly by the considerable and effective transfer of this risk to third parties and the lack of a clear implicit support in various securitization programmes implemented by the bank itself, may be another risk, which is not covered by the minimal capital requirement. The bank shall describe and explain the internal framework of the stress-testing used and in the cases in which it results that the required capital should be regulated (corrected) with the results of the stress test for this risk, it shall explain the applied stress tests, as well as the results and internal documents that correspond to this process (stress-testing). 5.2.3.1.2 Market risks The bank, while assessing the capital requirements for market risks, shall submit in the ICAAP report, a detailed analysis of all the important exposures to market risks that are not covered by the minimum capital requirement for market risks. The banks that do not calculate the capital requirement for market risks shall compile this part of the ICAAP report only if they assess that market risks to which they are exposed are materially significant. Thus, the cases to be taken into account by the bank may be the following situations: a) whether the size of the tradable portfolio, even if it’s not subject to the capital requirement (does not meet the regulatory limit), may be assessed by the bank as having a significant potential impact on the capital, as a consequence of the high volatility of interest rates for an instrument or a group of financial instruments of debt in the tradable portfolio, due to market expectations of considerable decline of the price and their factoring, even if the issuer rating has not changed, as assessed by external credit assessment institutions, or a considerable decline of price due to the fast change of the issuer ranking; b) whether the size of the tradable portfolio, even if it’s not subject to the capital requirement (does not meet the regulatory limit), but the bank holds a considerable settlement portfolio, which is assessed at market value, despite the fact if it has or has not a direct impact on capital, the unrealized losses may convert in realised losses, in the case a part or the entirety of the

20 portfolio shall be classified in the tradable portfolio or sold potentially in the market. The bank shall describe and explain the internal framework of the stress-testing used, and in the cases in which it results that the required capital for market risks should be regulated (corrected) with the results of the stress-testing for these risks, it shall explain the applied stress testing, as well as the results and internal documents that correspond to this process (stress-testing). 5.2.3.1.3 Operational risk The bank, while assessing the capital requirements for operational risk, shall submit in the ICAAP report, a detailed analysis of all the important exposures to operational risk that are not covered by the minimum capital requirement for operational risk. The bank, in the quantitative assessment of the exposure to the operational risk, shall use the simple indicator method, the standard method and/or the alternative indicator method for certain business lines. The simple indicator method constitutes the simplest alternative for this assessment and is recommended for smaller banks mainly, which do not have sufficient human resources, adequate technological infrastructure to develop and implement the methodology for the net income allocation from banking activity according to the business lines. The standard method and the alternative indicator method for certain business lines are recommended mainly for larger banks, which are mainly part of foreign banking and/or financial groups, and as such may have the support of their parent banks with the necessary expertise, to build a more structured process for operational risk assessment, or that aim to implement higher standards due to operational risk monitoring and assessment in an unified manner at group level. However, due to certain circumstances it may happen that the banks, which are recommended to implement the standard method, choose to assess the operational risk according to the simple indicator method and vice versa. In the conditions when it is not verified a significant relation between operational risk exposure and the net income from banking activity, as in the case of the simple indicator method and the standard method, as well as aiming the better assessment of risk profile, the bank shall build and rely in more systematic processes, which shall ensure the collection and the organisation of a database (historical) with losses from operational risk. The bank, when assessing that the operational risk exposure is not covered entirely by standard methods (e.g., in the case when unforeseen factual losses from operational risk are higher than the capital calculated for this purpose), may make a review of the capital requirement for operational risk. The bank shall describe and explain the internal framework of the stress-testing used and in the cases in which it results that the required capital for the operational risk should be regulated (corrected) with the results of the stress-testing for this risk, it shall explain the applied stress-testing, as well as the results and internal documents that correspond to this process (stress testing).

21 5.2.3.2 The measurement and assessment of risks that are not subject to the minimum capital requirement 5.2.3.2.1 Concentration risk The bank, when assessing the internal capital requirements for credit concentration risk, shall submit in the ICAAP report a credit concentration risk analysis, as a risk that may generate losses, which may seriously damage the stability and continuity of the business of the bank. Some of the most important forms of credit concentration risk may be presented as follows: a) concentration on clients or related client groups; b) concentration on non-performing clients (the bank, for the purposes of ICAAP, shall define the maximal risk that can undertake for this category of exposures); c) concentration on a particular country (in the case of country risk, the risk exposure does not come directly from the counterparty’s inability to settle the obligation, but from economic and political developments in a country, which may have an impact on the financial position of the client of the bank and as a consequence, the increase of exposure to a certain country may cause considerable losses for the bank, if the country risk is materialized); d) concentration on an industry/economic sector, which derives from exposure to clients whose financial position depends upon similar products or services; e) concentration on foreign currency exposure and/or indexed in foreign currency, which is also known as indirect risk from the negative effect of the exchange rate, which derives from loans disbursed in foreign currency and/or indexed in foreign currency, particularly when the borrower income is generated in a currency different from the disbursement currency (mainly in the domestic currency); f) concentration on credit risk mitigation techniques, which derives from concentration on the considerable use of a type of collateral or on a single guarantor for a considerable number of loans. The bank, in assessing the internal capital requirement for this risk, referred to the concentration by economic sectors and by clients/related group of clients, may use the method defined by the Bank of Albania or its internal method, if it has one. I) The method of the Bank of Albania a) The calculation of the sectoral concentration according to this method is based on the Herfindahl-Hirschman Index (HHI), as defined in Annex 2 of this guideline. The bank, in this calculation shall consider the projected curtailments and exemptions for calculating large exposures in the regulatory framework of the Bank of Albania for risk management from large exposures. The bank, when HHI exceeds 10, shall rise the assessment of the internal capital requirement for sectoral concentration risk, by multiplying the capital requirement for credit risk with the relevant risk value, according to the escalation presented in the following table:

22 Sectoral concentration index Mark-up 0 < HHIs ≤ 10 0% 10 < HHIs ≤ 15 2% 15 < HHIs ≤ 20 4% 20 < HHIs ≤ 25 6% 25 < HHIs ≤ 100 8% b) The calculation of the concentration by clients/related groups of clients is based on the Herfindahl-Hirschman Index (HHI), as defined in Annex 2 of this guideline. The bank, in this calculation shall consider the projected curtailments and exemptions for calculating large exposures in the regulatory framework of the Bank of Albania for the risk management from large exposures. The bank, when HHI exceeds 1, shall rise the assessment of the internal capital requirement for concentration risk by clients/related groups of clients, by multiplying the capital requirement for credit risk with the relevant risk value according to the escalation presented in the following table: Concentration index of clients/related group of clients Mark-up 0 < HHIi ≤ 1 0% 1 < HHIi ≤ 2 2% 2 < HHIi ≤ 4 4% 4 < HHIi ≤ 10 6% 10 < HHIi ≤ 100 8% II) Internal method The bank may use its internal method for calculating the internal capital requirement for concentration risk (by sectors and by clients/related groups of clients) and shall argument for the Bank of Albania that this method better suits to the nature and management risk needs in the bank. Internal methods for this purpose are recommended for banks that have functional models to calculate the internal capital requirement for credit risk for internal purposes. The bank, in calculating the capital requirement for concentration risk, in the framework of preparing the ICAAP report for the Bank of Albania, shall: a) complete Annex 2 of this guideline, in the event it uses the Bank of Albania method; b) explain the internal method from the point of view of the assumptions and arguments used, in the event it uses the internal method; c) argue, in the event that the bank does not calculate the internal capital requirement for concentration risk; d) describe and explain the internal framework of the stress test used, and in the the event it results that the required capital for concentration risk should be regulated (corrected) with the results of the stress tests for this risk, it shall explain the applied stress tests, as well as the results and internal documents that correspond to this process (stress-testing).

23 5.2.3.2.2 Interest rate risk in the banking book The bank, in assessing the internal capital requirements for the interest rate risk in the banking book, shall submit in the ICAAP report an analysis of the exposure of the bank to the volatility risk of the interest rate in the banking book, which is, overall, the most important risk in the market risk category for banks that have no exposure in the tradable portfolio. The bank, in assessing the internal capital requirement for this risk, may use the method defined in the regulatory framework of the Bank of Albania for the risk management of the interest rate risk in the banking book or its internal method, if it has one. The bank, in case it uses its internal method, shall argument for the Bank of Albania that this method is better suited to the nature and the management needs of this risk in the bank, and it may use a non-uniform shock over the return rate curve and/or a maximum limit on loss or exposure to internal capital. The bank shall calculate the internal capital requirement for the interest rate risk in the banking book, if the loss or the exposure calculated by the method of the Bank of Albania or the internal method, exceeds the limit of 20% of internal capital. Capital requirement is calculated by multiplying the value in excess of 20%, with the internal capital. The bank, in calculating the capital requirement for interest rate risk in the banking book, in the framework of preparing the ICAAP report for the Bank of Albania, shall: a) complete Annex 3 of this guideline, in the event it uses the Bank of Albania method; b) explain the internal method from the point of view of the assumptions and arguments used, in the event it uses the internal method; c) describe and explain the internal framework of the stress-testing used, and in the event it results that the required capital for interest rate risk in the banking books should be regulated (corrected) with the results of the stress-testing for this risk, it shall explain the applied stress-testing, as well as the results and internal documents that correspond to this process (stress-testing). 5.2.3.2.3 Market liquidity risk The bank, in the framework of implementing the ICAAP, shall assess the internal capital requirement for market liquidity risk, which derives from the impossibility of sale or replacement of the positions of an instrument in short-term periods with a non￾considerable impact on market prices, due either to insufficient market depth, or to market imbalances. The bank, in order to ensure the fulfillment of capital requirements for market liquidity risk, shall create an adequate control environment for this risk, which includes the proper development and implementation of policies and internal regulations, beyond the regulatory framework of the Bank of Albania.

24 Minimally, the bank shall define and monitor limits on market liquidity risk management, materialised in the spread between the acquisition and sale prices of liquid financial instruments or the volume realised in the market. The bank, in the framework of preparing the ICAAP report for this risk, shall submit: a) explanations on the policy and the engagement in market liquidity risk management, internal controls and the plans for crisis management; and b) describe and explain the internal framework of the used stress-testing, and the internal results and documents that correspond to this process (stress-testing). 5.2.3.2.4 Other risks The bank, in assessing the internal capital requirements for other risks, shall consider minimally the following types of risks, assessing also their materiality, respectively: a) Strategic risk, as the risk that derives from financial losses as a result of inadequate or not well studied strategic decision-making/s in banking activity; b) Reputation risk, as the risk that derives from financial losses as a result of the decline in the reputation of the subject/s activity, due to the negative opinion of the public toward the bank; a) Capital risk, as the risk that derives from the inadequate internal structure of the capital in relation with the nature and the size of the risks, or from the difficulties of the bank to generate additional capital timely, if necessary; b) Income risk, as the risk that derives from the inadequate diversification of the income structure of the banks, or the inability to ensure a sufficient level of continuous profitability. The bank, if it does not calculate the internal capital requirement for other risks, shall submit the relevant arguments in this part of the ICAAP report. The banks, due to the lack of quantitative methods of other risks assessment, may assess this risks’ category in a qualitative manner. In this case, the bank shall argument the qualitative assessment for these risks and document in an appropriate manner, as well as analyse the reasons of the losses except those forecasted from this category of risks (if there is such), so as to take the adequate measures for their monitoring in the future. This shall be done based on a framework of internal regulations of the bank itself, which shall include the methods and the processes that ensure the prevention or reduction of the materialisation of the other risks. The bank, when it shall calculate the internal capital requirement for other risks, may correct this demand with the qualitative assessment of these risks. The bank may use the method of the Bank of Albania or its internal method for the calculation of the internal capital requirement for the other risks. I) The method of the Bank of Albania The bank that uses the method of the Bank of Albania may increase the internal capital requirement from 5% up to 15% of minimal capital requirements. The bank shall

25 argument and submit sufficient explanations, in this part of the ICAAP report for the level (%) used based on the current and future exposure. II) Internal method The bank may use its internal method for calculating the internal capital requirement for other risks and shall argument for the Bank of Albania that this method is better suited to the nature and management needs of this risk category in the bank. The bank, in calculating the capital requirement for other risks, in the framework of preparing the ICAAP report for the Bank of Albania, shall: a) explain and specify the applied percentage for additional capital, in case it uses the method of the Bank of Albania; b) explain the internal method from the point of view of the assupmptions and arguments used, in case it uses the internal method; c) argue, in case the bank does not calculate the internal capital requirement for the concentration risk; d) describe and explain the internal framework of the stress-test used and in the cases in which it results that the required capital for these risks should be regulated (corrected) with the results of the stress-testing for this risk, it shall explain the applied stress tests, as well as the results and internal documents that correspond to this process (stress-testing). 5.2.3.2.5 External environment factors and stress tests The bank, in assessing the internal capital requirement, during the ICAAP process, shall also consider the risks that derive from external environment factors based in various stress tests. The bank may define elements (reserves) of its internal capital for covering these risks, in order to use them in crisis situations. The bank, when it uses stress-testing for risks assessment, that may derive from macroeconomic environment or market or regulatory framework factors, shall explain in this part of the ICAAP report the applied stress-testing, as well as the internal results and documents that correspond to this process (stress-testing). 5.2.3.2.6 Assessment of internal capital requirements based on the risk The bank shall calculate the internal aggregate capital requirement, based on individual assessments of the needs for capital for various risks, as defined in the sections of this guideline, as the sum of capital requirements calculated for individual risks. The bank shall submit the aggregate capital requirement in the ICAAP report at the Bank of Albania, according to Annex 1 of this guideline. 5.2.4 SECTION 4: Capital planning The bank, in this section of the ICAAP report, shall submit the projections and the analyses in the area of capital planning. The bank, in planning the internal capital target ratio, shall take into consideration the strategic plan of business growth, its dividend policy, the projected changes in its risk profile, the results of the ICAAP, etc.

26 The bank, in the ICAAP report for the Bank of Albania, shall: a) reflect the capital planning period, which shall not be shorter than three years; b) analyse the differences between the planned capital for the period in question and the calculated capital in the previous period; c) explain the capital planning methodology, by submitting its results; d) explain the stress tests and their results, referring to the internal corresponding documents; and e) describe and explain the internal framework of the used stress tests, and the internal results and documents that correspond to this process (stress-testing), as well as in the cases when it is applicable: i. refer to alternative sources of capital to fulfil the need for capital in the future; and ii. explain the contingency plan in case the projected internal capital requirement is higher than the projected capital to be ensured through various alternative sources. 5.2.5 SECTION 5: ICAAP improvement plan The bank, in this section of the ICAAP report, shall submit the measures and actions it has undertaken to correct the deficiencies in the ICAAP process, or to improve it. The bank, based on the self-assessments of the individual elements of its management and on significant risk exposure, shall explain the largest deficiencies and weaknesses in the ICAAP process, and shall decide a plan of actions to correct or improve them. The plan of actions may set out measures to: a) improve the risk profile of the bank, like: the downsizing of certain activities, the use of a new protection to credit risk etc. b) improve the governance and the internal organisation of the bank, like: improvement of the risk management processes, the strengthening of the internal control systems etc. The bank shall also submit any other planned changes in relation with the capital management policy or the risk management policy. Examples of these changes shall include improvements in: a) the methods to calculating minimal capital requirements; b) the methodology for the assessing of the internal capital requirements ; c) techniques for managing individual risk; d) the internal control system for managing/mitigating risks. 5.2.6 SECTION 6: Other aspects of the ICAAP The bank, in this section of the ICAAP report, shall submit any other findings and results of the ICAAP, not covered in the previous sections.

27 ANNEX 1: ICAAP report and the calculation summary form REPORT TO THE BANK OF ALBANIA ON THE IMPLEMENTATION OF THE ICAAP [Bank name]

1. BASIC DATA AND EXECUTIVE SUMMARY 1.1 Basic data Validity period: d d m m y - d d m m y (period to which the ICAAP report relates) Full name: Date of the ICAAP report d d m m y (person responsible for communicating with the Bank of Albania) (date of most recent reporting to the Bank of Albania) Position: Last update: d d m m y (date of last update in the ICAAP report)

Organisation al unit: Indication of changes: (indication of sections of the report that have been changed/updated) Steering Council Reviewed/approved m m y (date of the last review of ICAAP report by the Steering Council) Name and code of the document: (reference to the document that confirms the review and the approval of the ICAAP report by the Steering Council) Signature of the person responsible for compiling the ICAAP report:

---

28 1.2 Level of implementation of the ICAAP [Note: A superordinate bank that implements ICAAP on a consolidated basis shall submit a list of subordinated institutions included in the ICAAP in Annex 4 of the ICAAP report] 1.3 The bank’s risk profile 1.4 Bank management and the internal control system 1.5 The bank’s Capital Target Ratio 1.6 Capital planning 1.7 ICAAP improvement plan 1.8 Miscellanious 2. BANK MANAGEMENT 2.1 Organisational structure [Scheme of the bank’s organisational structure] (Note: Shall be submitted in Annex 5 of the ICAAP report) [The role of the bank’s Steering Council in risk management, the control environment and capital adequacy] [Self-assessment of the organisational structure]

29 2.2 Risk management process [Risk management principles] [Management of individual risks] (Note: Clarifications shall be given in order, risk by risk) [Self-assessment of management of individual risks ] (Note: Clarifications shall be provided in the same order of risks)

2.3 System of internal control [Risk-related tasks of the internal control unit in the risk management process] [Self-assessment of the functioning of the internal control unit] 3. RISK ASSESSMENT AND INTERNAL CAPITAL REQUIREMENTS 3.1 Measurement and assessment of credit risk Method used: [1] [2] (select) Assessment of internal capital requirements [enter here] For banks using the method of the Bank of Albania: [The analysis of exposure to individual risks that are not sufficiently covered by the capital requirement for credit risk (i.e. adequacy of the use of credit protection and the corresponding residual risk, analysis of risks deriving from securitisation programmes)]. [Where appropriate, the assessment of internal capital requirements for each risk (quantitative evaluation)]. [Where appropriate, explain any stress tests, citing the corresponding results and referencing the corresponding internal documents]. For banks using the internal method:

30 [Clarification and argumentation on the used methodology and on its assumptions.] [Analysis of any differences between the capital requirements for credit risk and the assessment of internal capital requirements for credit risk.] [Reference/s to internal documents, on which the methodology used is based]. [Where appropriate, explain the stress tests, citing the corresponding results and referencing the corresponding internal documents]. 3.2 Measurement and assessment of market risks Method used: [1] [2] (select) Assessment of internal capital requirements [enter here] For banks using the method of the Bank of Albania: [Analysis of all significant exposures to market risk not covered by the capital requirement for market risks] [Where appropriate, explain any stress tests, citing the corresponding results and referencing the corresponding internal documents]. For banks using the internal method: [Explanation and argumentation for the methodology used and its assumptions.] [Analysis of any differences between the capital requirements for market risks and the assessment of internal capital requirements for market risks.] [Reference/s to internal documents, on which the methodology used is based]. [Where appropriate, explain any stress tests, citing the corresponding results and referencing the corresponding internal documents].

31 3.3 Measurement and assessment of operational risk Method used: [1] [2] (select) Assessment of internal capital requirements [enter here] For banks using the method of the Bank of Albania: [Analysis of all significant exposures to operational risk not covered by the capital requirement for operational risk] [Where appropriate, explain any stress tests, citing the corresponding results and referencing the corresponding internal documents]. For banks using the internal method: [Explanation and argumentation for the methodology used and its assumptions.] [Analysis of any differences between the capital requirements for operational risk and the assessment of internal capital requirements for operational risk.] [Reference/s to internal documents, on which the used methodology is based]. [Where appropriate, explain the stress tests, citing the corresponding results and referencing the corresponding internal documents]. 3.4 Measurement and assessment of concentration risk The method of the Bank of Albania: [YES] [NO] Assessment of internal capital requirements [enter here] Internal method: [YES] [NO] (select) Assessment of internal capital requirements [enter here] For banks using the method of the Bank of Albania:

32 [Complete Annex 2] or [Provide argumentation that there is no need for the bank to conduct an assessment of internal capital requirements] [Where appropriate, explain the stress tests, citing the corresponding results and referencing the corresponding internal documents]. For banks using the internal method: [Explanation and argumentation for the methodology used and its assumptions.] [Reference/s to internal documents, on which the methodology used, is based]. [Where appropriate, explain any stress tests, citing the corresponding results and referencing the corresponding internal documents]. 3.5 Measurement and assessment of interest rate risk in the banking book The method of the Bank of Albania: [YES] [NO] Assessment of internal capital requirements [enter here] Internal method: [YES] [NO] (select) Assessment of internal capital requirements [enter here] For banks usingthe method of the Bank of Albania: [Where appropriate, explain the stress tests, citing the corresponding results and referencing the corresponding internal documents]. For banks usingthe internal method: [Explanation and argumentation for the methodology used and its assumptionsions.] [Reference/s for internal documents, on which the used methodology is based].

33 [Where appropriate, explain the stress tests, citing the corresponding results and referencing the corresponding internal documents]. 3.6 Measurement and assessment of market liquidity risk Assessment of internal capital requirements

[enter here]

For all banks: [Explanation and argumentation for the policies of undertaking and managing market liquidity risk, internal control systems and crisis plan] [Reference/s to the corresponding internal documents] [Where appropriate, explain the stress tests, citing the corresponding results and referencing the corresponding internal documents]. 3.7 Measurement and assessment of other significant risks The method of the Bank of Albania: [YES] Internal method: [YES] [NO] Assessment of internal capital requirements [enter here] For banks using the method of the Bank of Albania: [Increase of the assessment of internal capital requirements by a percentage of the minimum capital requirement (enter the percentage)]: [5% – 15%] [Explanation and argumentation for the percentage used] For banks using the internal method: [Explanation and argumentation on the methodologies used to assess other significant risks (in order)] [Reference/s to internal documents, on which the methodology used, is based].

34 [Where appropriate, explain the stress tests, citing the corresponding results and referencing the corresponding internal documents]. 3.8 External environment factors and stress tests Assessment of internal capital requirements [enter here] For all banks: [Explanation of stress tests and citation of corresponding results] [Where appropriate, provide an assessment of the regulatory risk that derives from the inability of the bank to ensure the fulfillment of the regulatory framework requirements into force] [Reference/s to the corresponding internal documents related to the stress tests] 3.9 Assessment of internal capital requirements based on risk Method used: Assessment of internal capital requirements: Diversification effects (evidenced only for internal purposes): Total assessment of internal capital requirements: [enter here] (a) [enter here] (b) [enter here, if any] (a) + (b) [enter here] For all banks: [Completion of the ICAAP report calculation summary form in this annex] 4. Capital planning Period of capital planning: [enter here] For all banks: [Analysis of the differences between Capital Target Ratio in the period in question, and the internal capital in the previous period] [Explanation of the capital planning methodology and results, and references to the corresponding internal documents] [Where appropriate, explain stress tests and results, referencing the corresponding internal documents. Where appropriate, cite alternative sources of internal capital.]

35 5. Improvement plan to the ICAAP [Explanation of the major weaknesses and deficiencies identified by the bank through the ICAAP] [Where appropriate, reference the internal documents covering the plan of the activities to correct or improve the ICAAP in the future] [List of planned or projected changes in risk management strategy] 6. Other aspects/issues. (51) [Where appropriate, explain other elements of the ICAAP, which are not covered by the ICAAP report.]

36 ICAAP REPORT CALCULATION SUMMARY FORM Name of Date the bank: I. BANK'S CAPITAL RATIO AND TARGET Capital Adequancy Ratio (in %) Common Equity Tier 1 Capital/Risk-weighted exposures (in %) Tier 1 capital/Risk-weighted exposures (in %) II. BANK’S REGULATORY CAPITAL AND INTERNAL CAPITAL ESTIMATES Bank’s regulatory capital: Common Equity Tier 1 Capital: Additional Tier 1 capital: Tier 2 capital: Items included in the internal capital estimates (+ or -) All items: …… …… ….. ….. Total internal capital estimates: III. MINIMUM CAPITAL REQUIREMENTS AND ASSESSMENT OF INTERNAL CAPITAL REQUIREMENTS A) Element 1: Risks subject to minimum capital requirements Credit risk Market risks Operational risk B) Element 2: Risks not entirely covered by minimum capital requirements Residual risk (from credit risk) Market risks Operational risk C) Element 3: Risks not subject to minimum capital requirements Concentration risk Interest rate risk in the banking book Market liquidity risk Other risks a) Strategic risk of which: b) Reputation risk c) Capital risk d) Profitability risk e) etc. (entered by the bank, where appropriate) D) Element 4: External environmental factors Stress tests Total internal capital requirement E) Diversification effects (-) (only for internal purposes) a) For the same risk of which: b) For different risks F) Total assessment of internal capital requirements and diversification effects (only for internal needs) PILLAR 1 PILLAR 2 (ICAAP) Approach to calculating the minimum capital requirement Minimum capital requirements (ALL million) Methodology of assessment of internal capital requirements Assessment of internal capital requirements (ALL million)

37 IV. CAPITAL PLANNING Current Current year (t) Year t+1 Year t+2 Year t+3 "A" "B" "C" "B"/"A" "D" "E" = "C" + "D" %E %E Additional capital requirement "F" = "E" - "B" Sources/adequacy of additional capital requirement funding Regulatory capital Minimal capital requirement (Pillar 1) Capital Adequacy Ratio Capital requirement (Pillar II) Total capital requirement (including strategy and the change of business conditions) (ALL millions) Projection Risk-weighted Exposures Business strategy (materialized in the budget) and risks that derives from it Change of business conditions, materialized according to stress test scenarios

38 ANNEX 2: Concentration risk A) Sectoral concentration The bank calculates the overall exposure of one sector by the following table. The sectoral concentration index (HHIs) shall be calculated based on the following formula: HHIs = ∑ x2 / (∑x) 2

• (∑x) / y, where x is referred to the exposure value of a specific sector and y is referred to aggregate exposure. The bank shall classify its exposures by sectors in accordance with the available data. Individual concentration The bank estimates the overall exposure to the 100 largest borrowers despite their status. The individual concentration index (HHII) shall be calculated based on the following formula: HHII = ∑ xi 2 / (∑xi) 2
• ∑ xi / ∑y * 100; where “xi” is referred to the value of “i” clients in the bank’s portfolio (by aggregate exposure), “y” is referred to the aggregate value of the bank’s portfolio, and “i” is referred to the number of clients considered for the calculation of HHI (i = 100). Total Exposure ∑y 100 100 largest borrowers ∑x Individual concentration index HHII % EXPOSURE TOTAL EXPOSURE AMOUNT Economic Sectors

11. Real estate, renting etc.
12. Public administration
13. Education
14. Healthcare and social work activities
15. Monetary and financial intermediation SECTOR (according to the SCEA*)
16. Agriculture, hunting, forestry
17. Fishing
18. Mining and quarrying
19. Manufacturing
20. Production and distribution of electricity, gas and water
21. Construction
22. Trade, maintenance and repair of motor vehicles and household items
23. Hotels and restaurants
24. Transport, storage and telecommunication TOTAL EXPOSURE TO SECTOR %
25. Collective activities, social and individual

• (Nomenclature of activity classification economy) (national version of the NACE)

16. Others

39 ANNEX 3: Interest rate risk in the banking book

1. The banks, in order to calculate by the assessment method of exposure change of the banking book, shall allocate the sensitive position against interest rate, in 14 time bands, as defined in the Table of this Annex.
2. The banks shall allocate positions with fixed interest rate into time bands, by residual maturity, also the positions with variable interest rate in the time bands, by time, until the next change of the interest rate.
3. The banks shall use the weighting factors defined in the table of this Annex, which are calculated as output of 200 basis points (or 2%) interest rate shock with the estimated modified duration for each time band.
4. Banks, whether they use the assessment method of exposure change of the banking book, shall follow the steps below: a. collect for each major currency on an individual basis and for the other currencies on aggregate basis, the positions of assets and liabilities and the derivative financial instruments (or the off-balance sheet items assets and liabilities), for each time band, in order to calculate the net position for each band; b. multiply the aggregate net position calculated according to letter “a” of this paragraph, for each time band, with the weights defined in the table of this Annex, for each major currency on an individual basis and for all the other currencies in aggregate basis; c. collect all weighted positions, calculated for each time interval, in order to calculate the long or short net position for each major currency on individual bases and for all the other currencies in aggregate basis; d. Collect long and short net positions for all currencies, in order to calculate the weighted aggregate net position in the banking book.
5. Weighted aggregate net position in the banking book, as defined in letter “d” of point 4 of this Annex, is expressed as a value/absolute amount and will represent the change of banking book exposure, as the result of the application of interest rate standard shock.
6. Banks shall calculate the change exposure ratio in the banking book against the regulatory capital, in percentage.

40 Weighting factors by time bands Time band Centre of time band Modified duration Projected change in yield curve Weighting factors (1) (2) (3) (4) (5) = (3)*(4) immediately (at sight) 0 0 200 bp 0.00% up to 1 month 0.5 month 0.04 year 200 bp 0.08% 1 to 3 months 2 months 0.16 year 200 bp 0.32% 3 to 6 months 4.5 months 0.36 year 200 bp 0.72% 6 to 12 months 9 months 0.71 year 200 bp 1.43% 1 to 2 years 1.5 years 1.38 years 200 bp 2.77% 2 to 3 years 2.5 years 2.25 years 200 bp 4.49% 3 to 4 years 3.5 years 3.07 years 200 bp 6.14% 4 to 5 years 4.5 years 3.85 years 200 bp 7.71% 5 to 7 years 6 years 5.08 years 200 bp 10.15% 7 to 10 years 8.5 years 6.63 years 200 bp 13.26% 10 to 15 years 12.5 years 8.92 years 200 bp 17.84% 15 to 20 years 17.5 years 11.21 years 200 bp 22.43% Over 20 years 22.5 years 13.01 years 200 bp 26.03%

41 ANNEX 4: List of banking and/or financial group subordinated institutions included in the ICAAP (level of implementation of the ICAAP) In this Annex shall be submitted the list of subordinated institutions, part of the banking group, which are included in the ICAAP of the (superordinate) bank, where applicable.

42 ANNEX 5: Organisational scheme of the bank, composition, position and respective responsibilities of the managing level (Steering Council and Executive Directors) and of the committees. In this Annex shall be submitted the organisational scheme of the bank, as well as the composition, position and respective responsibilities of the managing level (Steering Council and Executive Directors) and of the committees.

43 ANNEX 6: Principles of the ICAAP In this Annex shall be submitted the overall principles of ICAAP defined in accordance with the recommendations of EBA. The principles shall serve as a guideline for all the banks in drafting their ICAAP. ICAAP 1: Each bank must have in place a process for assessing the capital adequacy relative to its risk profile. Each bank shall have an effective management and adequate risk management procedures, including a strategy and processes that aim at achieving and maintaining an adequate capital level for the nature of the activities and the risks of the bank. The fulfillment of this principle may be examined at a group level and at an individual level (see below). ICAAP 2: The ICAAP is the responsibility of the bank.  Each bank is responsible for its ICAAP, and for setting internal capital targets that are in accordance with the bank’s risk profile and the environment in which it exercises its activity;  ICAAP shall be drafted according to the needs and the circumstances of the bank and shall use inputs and definitions that the bank uses normally for internal purposes;  ICAAP shall fulfill the supervisory requirements and the bank shall be able to prove that; ICAAP 3: The drafting of ICAAP shall be completely specified, the bank’s management policy and capital planning of the bank fully documented and the managing bodies shall take full responsibility for ICAAP.  The responsibility for starting and designing ICAAP remains at the Steering Council, who approves in principle the overall purpose, methodology and objectives of the ICAAP, while technical details and concepts are responsibility of the Executive Directors;  The Steering Council is also responsible for the integration of capital planning and its management, in the culture and approach to bank’s risk management;  The ICAAP of the bank (e.g. Methodologies, suppositions and procedures) and the capital policy shall be documented formally, and shall be reviewed and approved by the Steering Council of the bank;  The bank shall report the results of the ICAAP to the Steering Council; ICAAP 4: The ICAAP shall be an integral part of the management process and of the decision-making culture of the bank. ICAAP shall be an integral part of the management processes of the bank in order to allow the Steering Council to assess continuously the risks that derive from the activities and that are material to the bank. ICAAP 5: Since the ICAAP is based on processes and procedures, the adequacy of its implementation shall be reviewed regularly, at least once a year.  An ICAAP shall be reviewed by the bank any time it is necessary (but at least once a year) to ensure that risks are sufficiently covered and that the covering with capital reflects the current profile of the bank’s risk;  The ICAAP and its reviewing process shall be subject to an independent internal review;  Any change in the bank’s strategic focus, business plan, operating environment or other factors that impact materially the suppositions or the methodologies used in the ICAAP, shall drive the necessary corrections. New risks that

44 accompany the activity of the bank shall be identified and included in the ICAAP. ICAAP 6: The ICAAP shall be risk-based. Capital adequacy of a bank is a function of its risk profile. Banks shall set out capital targets that are in accordance with the risk profile and the environment in which they exercise their activity. Banks may also consider other factors in their decision on how much capital they shall require, like external credit risk assessments, market reputation and strategic targets. The bank shall clearly decide for which risks a quantitative assessment is necessary, and for which risks the qualitative factors are important; in the latter case emphasis shall be put in risk management and the use of mitigating risk instruments. Even banks that apply simpler methods for the assessment of credit, market and operational risks, are obliged to ensure their ICAAP is based on current risks addressing. ICAAP 7: The ICAAP should be comprehensive.  In the ICAAP, the bank shall address all the materially significant risks to which the bank is exposed, irrespective of whether it does not exist a standard categorisation of the types of risk and a definition on materiality;  The bank is free to use its own terminology and definitions. The Bank of Albania shall require that the bank is able to submit in details the approaches, terminology and definitions that it applies in ICAAP (together with the differences with the regulatory capital calculation methods) during the dialogue between the bank and the Bank of Albania;  The ICAAP shall be comprehensive and shall take into account all the materially significant risks. ICAAP 8: The ICAAP shall be forward-looking.  The ICAAP shall take into account the strategic plans of the bank and how they relate to the economic factors. The bank shall develop an internal strategy for maintaining capital levels, which may incorporate factors such as expected loan growth, , possible sources of capital increase in the future, dividend policy, as well as every pro-cyclical effect;  The bank shall have a plan of needs for approved capital, which shall declare the bank’s targets and the time period for achieving these targets, and in general terms, the capital planning process and the specification of the persons responsible for this process. The plan shall show how the bank will treat the situations that require immediate action (e.g. additional capital increase, activity limitation or the use of risk mitigation techniques). ICAAP 9: The ICAAP shall be based on adequate assessment and measurement processes.  The ICAAP shall be based on adequate risk measurement and assessment, but a single ICAAP correcting method does not exist. Since banks are free to choose the method they wish to apply, the supervisory authority shall consider some approaches acceptable and that shall not necessarily require the use of complex capital calculation models. Despite this, based on the proportionality principle, the supervisor shall require that the banks that exercise complex and various activities shall apply advanced quantitative techniques in line with their specific system;

45  Some risk elements, as well as the relevant capital requirements may be difficult to calculate, but the supervisory authority shall require that the capital values for these risks shall be determined by the assessment of experts;  It is important that banks shall not rely only on quantitative methods in the ICAAP process, but that they consider qualitative and prudent assessments of risk management related with the inputs and outputs of the model. ICAAP 10: The ICAAP shall produce a reasonable outcome. The ICAAP, after identifying the capital requirements for specific types of risks, shall evidence the aggregate internal capital requirement of the bank. This figure shall be reasonable, e.g. it shall be in proportion with the current risks of the bank and shall be coordinated with the regulatory capital level. The ICAAP shall result in a figure of aggregate internal capital requirement and an assessment that supports it. The internal assessment procedure of capital adequacy shall produce a reasonable general result. The bank shall be able to explain the similarities and the differences between the ICAAP results that cover all the material risks and the regulatory capital requirement. If during the supervisory examination process it is found a significant difference between the bank expectations and the calculation of the bank itself for the capital requirement, the bank shall be able to justify the adequacy and the comprehensive nature of the applied method.

46 ANNEX 7: Example of a systematic categorisation of risks in the ICAAP and the used method of assessment. Risk type Risk subtype Risk level Argument (if it is not material) The method used for risk assessment ... Credit risk Counterparty credit risk Very high The method of the Bank of Albania Equity risk non￾material Share investment in relation to total assets indicator It is not taken into consideration Country risk average Strict limitation (structural limit) Securitization risk non￾material No inclusion in any securitization programme (as issuer or investor) It is not taken into consideration Credit concentration risk high Strict limitation (structural limit) and added monitoring Residual risk after credit risk mitigation techniques average Qualitative assessment, risk contraction based on processes (use of standard contracts, “four eyes” principle, regular collateral reassessment, etc.) Market risk Market risks in the trading book low The method of the Bank of Albania exchange rate risk in the balance sheet of the bank average The method of the Bank of Albania Interest rate risk in the banking book high VAR (Value At Risk) model

47 Operational risk average The method of the Bank of Albania Market liquidity risk low Qualitative measure Other risks Strategic risk low Reputational risk low Capital risk average The method of the Bank of Albania Income risk low

48 ANNEX 8: Typical examples of risks that are not entirely covered by the minimal capital requirement. Some examples of risks that banks should consider in risk assessment that are not entirely covered by the minimal capital requirement are as follows:

1. Not effective use of credit risk mitigation techniques, which generates additional risks related with legal risk (documentation) and liquidity (efficient execution) of the tool used for mitigation position purposes;
2. Credit risk under-assessment as a consequence of the use of credit risk assessment from external credit assessment institutions, particularly in the category “Investment Grade”3 ;
3. Credit risk exposure under-assessment in the case of the mortgage portfolio, by regulatory definition, particularly in the conditions of decline of the real estate market and the existence of a non-liquid domestic market.
4. Operational risk under-assessment in the case of a low net income from the banking activity, which does not fulfill properly an adequate assessment of bank’s operational risk exposure, or compensation of income positions by business lines and consequently the final generation of a negligible positive result from the business lines, even though the bank remains equally exposed to the operational risk.

3 The experience of the recent years has shown bankruptcies of even companies/institutions assessed with ratings from A to AAA etc.