Amendments and Additions to the Regulation on Requirements for the Risk Management System of Banks and Banking Groups

Resolution of the Board of the Central Bank of the Republic of Uzbekistan, registered on January 21, 2025, registration number 3427-1

Date of Entry into Force

April 25, 2025

All

View

Russian

Uzbek

O’zb

Uzb|Russian

[OKOZ:

1.21.00.00.00 Comprehensive documents for amendments and additions / 21.04.00.00 Departmental normative legal documents]

[TSZ:

1. State and public structure / Legislative initiative. Norm-making activity]

Resolution of the Board of the Central Bank of the Republic of Uzbekistan

On Amendments and Additions to the Regulation on Requirements for the Risk Management System of Banks and Banking Groups

[Registered by the Ministry of Justice of the Republic of Uzbekistan on January 21, 2025, registration number 3427-1]

In accordance with the Laws of the Republic of Uzbekistan "On the Central Bank of the Republic of Uzbekistan" and "On Banks and Banking Activity", the Board of the Central Bank of the Republic of Uzbekistan resolves:

1. Amendments and additions shall be made to the [Regulation](/docs/6436466?ONDATE=19.07.2023 00#6436870) on Requirements for the Risk Management System of Banks and Banking Groups, approved by Resolution No. 4/11 of the Board of the Central Bank of the Republic of Uzbekistan dated March 7, 2023 (registration number 3427, April 18, 2023) (, 19.04.2023, No. 10/23/3427/0218), in accordance with the Appendix.

2. This resolution enters into force three months after the date of its official publication.

Chairman M. NURMURATOV

Tashkent city,

December 5, 2024,

No. 37/6

Resolution of the Board of the Central Bank of the Republic of Uzbekistan dated December 5, 2024, No. 37/6 Resolution

APPENDIX

Amendments and Additions to the Regulation on Requirements for the Risk Management System of Banks and Banking Groups

1. [Paragraph 1](/docs/6436466?ONDATE=19.07.2023 00#6436888):

The [fifth bullet point](/docs/6436466?ONDATE=19.07.2023 00#6436903) shall be stated in the following wording:

"compliance risk — the possibility of suffering losses (losses) and (or) not receiving planned income as a result of non-compliance with the legislative acts of the Republic of Uzbekistan, internal documents of the bank, as well as documents of foreign countries that may affect the bank's activities;";

It shall be supplemented with the seventh and eighth bullet points of the following content:

"interest rate risk arising in the bank portfolio — the possibility of suffering losses (losses) and (or) not receiving planned income as a result of the impact of changes in market interest rates on the bank's assets and liabilities in the portfolio;

country risk — the possibility of suffering losses (losses) and (or) not receiving planned income as a result of the political, economic, social situation or other changes in a foreign country;";

The [seventh to thirteenth bullet points](/docs/6436466?ONDATE=19.07.2023 00#6436915) shall be considered as the ninth to fifteenth bullet points, respectively;

The [fourteenth bullet point](/docs/6436466?ONDATE=19.07.2023 00#6436928) shall be stated in the following wording:

"significant risks — the bank's credit, liquidity, market, operational, compliance, country risks, and interest rate risk arising in the bank portfolio;";

It shall be supplemented with the following bullet points:

"trading portfolio — the sum of financial instruments purchased for subsequent sale and (or) for hedging risks with the aim of profiting from short-term price fluctuations in financial instruments by the bank;

bank portfolio — the sum of assets and liabilities held in the bank's balance sheet or off-balance sheet items until maturity, which are not included in the trading portfolio;

operational resilience — the ability of the bank to ensure the continuity of its important operations in emergency situations and unforeseen circumstances;

important operation — an operation carried out by the bank, the interruption (stoppage) of which in its implementation may significantly disrupt the stability of the bank's activities and (or) the stability of the banking system.".

2. It shall be supplemented with paragraph 41 of the following content:

"41. The bank's risk management system may include other risks in addition to significant risks, depending on the nature of the bank's activities.

In this regard, the bank must ensure that these risks are identified, assessed, monitored, reported on, controlled, and that measures are taken to reduce these risks.".

3. [Paragraph 7](/docs/6436466?ONDATE=19.07.2023 00#6436978) shall be supplemented with the following bullet point:

"The main bank must submit these calculations to the Central Bank within one month from the date of submission of the bank's annual financial report to the Central Bank.".

4. In the [second bullet point of paragraph 10](/docs/6436466?ONDATE=19.07.2023 00#6437027), the word "in paragraph 9" shall be replaced with "in paragraph 8".

5. The [third bullet point of paragraph 14](/docs/6436466?ONDATE=19.07.2023 00#6437085) shall be stated in the following wording:

"methodology and tools for stress-testing credit, liquidity, market, operational, country risks, and interest rate risk arising in the bank portfolio.".

6. In [paragraph 15](/docs/6436466?ONDATE=19.07.2023 00#6437093), the words "every quarter" shall be replaced with "once a year".

7. [Paragraph 29](/docs/6436466?ONDATE=19.07.2023 00#6437207) shall be supplemented with the following bullet point:

"Making decisions on entering into transactions related to significant risks. In this regard, significant risk is understood as risk for one borrower or a group of related borrowers with a total amount equal to or exceeding 10 percent of the bank's first-tier capital.".

8. [Paragraph 32](/docs/6436466?ONDATE=19.07.2023 00#6437290) shall be supplemented with the following bullet point:

"Submitting reports on significant risks and measures to reduce them to the Central Bank every quarter, and stress test results at least once a year.".

9. In [paragraph 34](/docs/6436466?ONDATE=19.07.2023 00#6437315):

The [third bullet point](/docs/6436466?ONDATE=19.07.2023 00#6437318) shall be stated in the following wording:

"developing or participating in the development of methods for assessing credit, market, operational, liquidity, country risks, and interest rate risk arising in the bank portfolio;";

The [thirteenth bullet point](/docs/6436466?ONDATE=19.07.2023 00#6437330) shall be stated in the following wording:

"submitting to the Supervisory Board and the Risk Management Committee (if established) reports on credit, liquidity, market, operational, country risks, and interest rate risk arising in the bank portfolio, including existing or anticipated risks in the bank and measures to reduce them, every quarter, and to the bank's management at least once a month;";

It shall be supplemented with the following bullet point:

"regularly assessing the reliability and effectiveness of the bank's internal models intended for identifying, measuring, monitoring, and controlling risks, as well as for conducting stress tests.".

10. It shall be supplemented with paragraph 351 of the following content:

"351. If the employment contract with the head of the risk department is terminated, the bank must provide information to the Central Bank within 5 days from the date the decision to terminate the employment contract is made, indicating the grounds and reasons for termination.".

11. [Paragraph 36](/docs/6436466?ONDATE=19.07.2023 00#6437416) shall be supplemented after the words "Legislative acts" with the words ", documents of foreign countries that may affect the bank's activities".

12. In [paragraph 49](/docs/6436466?ONDATE=19.07.2023 00#6437493):

It shall be supplemented with the third bullet point of the following content:

"description of the process of reviewing (ordering) credit applications, approving, and making decisions on granting or refusing credit;";

The [third to ninth bullet points](/docs/6436466?ONDATE=19.07.2023 00#6437496) shall be considered as the fourth to tenth bullet points, respectively;

It shall be supplemented with the fifth bullet point of the following content:

"description of credit limits taking into account the results of the analysis of borrowers' repayment capacity;";

The [fifth to tenth bullet points](/docs/6436466?ONDATE=19.07.2023 00#6437500) shall be considered as the sixth to eleventh bullet points, respectively;

The [ninth bullet point](/docs/6436466?ONDATE=19.07.2023 00#6437510) shall be stated in the following wording:

"clear boundaries of responsibility among the bank's management bodies, committees, and structural subdivisions, including branches, in making decisions on credit allocation.".

13. It shall be supplemented with paragraphs 511–513 of the following content:

"511. The Supervisory Board must monitor the following in credit risk management:

1. that credits are allocated within the bank's risk appetite, including within the framework of the risk management strategy and business plan;

2. that the credit allocation process is reflected in the bank's credit policy and relevant documents;

3. that it has an information system that includes:

a database formed reflecting information on whether the credit portfolio by credit types is within the bank's risk appetite;

the opportunity to receive periodic reports;

the accumulation of necessary information for assessing the level of risk by credit types.

512. To effectively manage credit risk, the bank must take into account:

the diversification of the credit portfolio;

the debt burden level of borrowers;

the ratio of the credit to the value of collateral (if the credit is secured);

the share of insured credits in total credits and the level of accumulation (concentration) with respect to insurance organizations;

the financial condition of guarantors (sureties), including insurers;

the expected maximum losses in the credit portfolio, the share of problematic credits, and the level of written-off credits.

513. When assessing credit risk for a counterparty with rating scores provided by rating companies, the bank must not be limited to using these rating scores but must take measures to independently and objectively comprehensively assess the financial condition of such a counterparty.".

514. It shall be supplemented with paragraphs 531 and 532 of the following content:

"531. The assessment and re-assessment of the market value of the collateral subject to credit shall be carried out within the deadlines established by the bank's internal documents in accordance with the Law of the Republic of Uzbekistan "On Valuation Activity" and other legislative acts.

532. The procedure and principles for assessing and re-assessing the market value of the collateral subject to credit must be approved by the bank's management.".

533. It shall be supplemented with paragraph 621 of the following content:

"621. The bank's management must periodically (at least once a year) evaluate the effectiveness of its policy on working with problematic assets and submit the evaluation results to the Supervisory Board within 5 days from the date the results are ready and to the Central Bank within 15 days.".

16. In [paragraph 89](/docs/6436466?ONDATE=19.07.2023 00#6438195):

The [second bullet point](/docs/6436466?ONDATE=19.07.2023 00#6438197) shall be stated in the following wording:

"interest rate risk arising in the bank's trading portfolio due to unexpected changes in market interest rates affecting the value of securities, other financial instruments with fixed income, and derivatives of securities;";

In the [fifth bullet point](/docs/6436466?ONDATE=19.07.2023 00#6438205), the words "securities" shall be replaced with "shares and derivatives of securities whose underlying asset is shares".

17. In the [first bullet point of paragraph 90](/docs/6436466?ONDATE=19.07.2023 00#6438209), the word "investment" shall be replaced with the word "trading".

18. It shall be supplemented with paragraph 911 of the following content:

"911. The risk appetite for market risk must include the following quantitative indicators:

the maximum amount of risk-weighted value covering a 10-day period with a high confidence level (at least 99 percent) for market risks (in absolute value and as a percentage of the bank's regulatory capital);

the maximum amount of the sum of market risks in the capital adequacy calculation (in absolute value and as a percentage of the bank's regulatory capital);

the maximum amount of currency positions by the bank's main currencies.".

19. [Paragraph 105](/docs/6436466?ONDATE=19.07.2023 00#6438450) shall be supplemented with the sixth bullet point of the following content:

"the procedure for ensuring operational resilience;";

The [sixth bullet point](/docs/6436466?ONDATE=19.07.2023 00#6438465) shall be considered the seventh bullet point.

20. It shall be supplemented with paragraphs 1091–1099 of the following content:

"1091. The Supervisory Board must approve the bank's procedure for ensuring operational resilience, taking into account the bank's risk appetite.

1092. The bank's management must implement the procedure for ensuring operational resilience by correctly distributing the bank's financial, technical, and other resources.

1093. The procedure for ensuring operational resilience includes:

the plan for restoring the bank's activities and ensuring its continuity (hereinafter referred to as the recovery plan);

the procedure for testing the recovery plan.

1094. The recovery plan is a set of measures aimed at ensuring the continuity of the bank's important operations in emergency situations and unforeseen circumstances.

The recovery plan includes:

a list of the bank's important operations;

a list of employees, tools, processes, information, and third parties necessary for the bank to carry out important operations in emergency situations and unforeseen circumstances;

a description of the sequence of actions to ensure the continuity of the bank's important operations and restore them;

the procedure for carrying out the bank's internal and external communications in emergency situations and unforeseen circumstances;

a description of the time required to restore the bank's important operations;

the minimum amount of resources necessary to ensure the continuity of the bank's important operations and restore them.

1095. The recovery plan must be tested at least once a year or in the event of significant changes in the bank's activities.

In this regard, the following are checked:

the protection of the bank's important operations regardless of the level of interruption in the bank's activities;

the bank's ability to operate effectively in emergency situations and unforeseen circumstances and the assurance of its return to normal operations.

1096. During the preparation for testing the recovery plan, the bank must take into account:

the testing of this system in general and in separate parts to assess the reliability of the system ensuring the continuity of the bank's activities;

the limitation of the impact of emergency situations arising during the test on the bank's activities;

the clear definition of the goals and objectives of the test;

the formation of a list of employees responsible for the test.

1097. Recovery plan tests must be carried out based on scenarios that include emergency situations and unforeseen circumstances that may have serious consequences for the bank but have a possibility of occurring.

1098. Employees responsible for testing the recovery plan must:

monitor and evaluate the test results;

prepare a protocol containing a description of the test process and results, as well as measures to be taken by the bank to improve operational resilience;

coordinate the protocol with the structural subdivisions of the bank participating in the recovery plan test;

submit the protocol for approval to the bank's management.

1099. Within 15 days from the date the recovery plan is approved or amendments and additions are made to it, as well as from the date the protocol on recovery plan tests is approved, these documents must be submitted to the Central Bank.".

1100. The [sixth bullet point of paragraph 112](/docs/6436466?ONDATE=19.07.2023 00#6438567) shall be stated in the following wording:

"losses (losses) arising as a result of operational risk incidents.".

22. It shall be supplemented with paragraphs 1121 and 1122 of the following content:

"1121. Information in the bank's database on internal operational risk incidents shall be grouped by banking group participants, structural subdivisions of the bank, and bank operations (transactions).

1122. When maintaining the bank's database on internal operational risk incidents, the bank must take into account:

the classification of the operational risk incident;

the identification and recording of losses (losses) associated with the operational risk incident;

the registration of the operational risk incident;

the updating of information on operational risk incidents;

the updating of information sources on operational risk incidents.".

23. It shall be supplemented with paragraph 1221 of the following content:

"1221. To ensure the financial stability of the bank and the continuity of cross-border operations:

the bank must identify and assess risks related to compliance with the requirements of legislative acts of foreign countries that may affect banking activity;

risks related to the disruption of correspondent relationships with foreign banks.".

24. It shall be supplemented with Chapters 111 and 112 of the following content:

"Chapter 111. Requirements for Country Risk Management

§ 1. Country Risk Management System

1241. The Supervisory Board and the bank's management must implement a country risk management system that serves to identify, assess, monitor, control, and reduce country risk.

1242. Country risk arising in the bank includes:

risks related to payments arising from the borrower's inability to fulfill its obligations due to the introduction of restrictions in a foreign country, including restrictions on currency operations;

sovereign risk arising from the inability or refusal of the foreign country's government to fulfill contractual obligations;

chain reaction risk arising from adverse events in one country leading to the inability of debtors in another country to fulfill their obligations.

1243. The country risk management system includes:

country risk management policy and procedures;

the procedure for submitting reports on country risk.

§ 2. Requirements for Country Risk Management Policy and Procedures

1244. The country risk management policy must include at least:

the organizational structure of the country risk management system, including the distribution of functions, powers, and responsibilities of structural subdivisions (hereinafter referred to as the relevant structural subdivision) (employees) responsible for country risk management, as well as the procedure for their interaction;

requirements for identifying, assessing, monitoring, controlling, reducing, and reporting on country risk;

report forms, the procedure for their submission, and periodicity;

criteria for identifying and analyzing country risk;

limits for country risk, including the bank's total limit for cross-border operations, as well as individual limits by countries and (or) regions;

description of cross-border financial operations carried out by the bank.

1245. To effectively implement the country risk management policy, the bank's management must develop internal procedures.

These procedures must be developed taking into account the nature and complexity of the bank's activities related to foreign countries and must comply with the requirements established by the Central Bank and legislative acts.

These procedures must include:

the procedure for identifying, assessing, monitoring, controlling, and reducing country risk;

the procedure for ensuring the compliance of the bank's activities with country risk limits;

the procedure for information exchange between participants in the country risk management process;

reports on country risk.

1246. In managing country risk, the bank must:

continuously analyze the situation (political, economic, social, and other) in foreign countries;

evaluate the requirements of documents of foreign countries that may affect the bank's activities;

evaluate the impact of country risk on the bank's financial condition;

ensure the official documentation of analysis and evaluation results;

ensure the timely submission of reports on country risk to the Supervisory Board and management.

1247. When analyzing country risk, the bank may take into account the following factors related to the foreign country:

economic growth rates;

volume and structure of external debt;

volume of international reserves;

government budget balance;

dynamics of the national currency exchange rate;

trade balance;

access to international financial markets;

level of development of the financial system;

social, legal, and political situation.

1248. The country risk policy and limits must be approved by the Supervisory Board and communicated to all relevant structural subdivisions and employees.

The country risk policy and limits must be reviewed at least once a year or regularly in the event of risks of an increase in country risk with respect to a specific country.

1249. When country risk increases significantly, the relevant structural subdivision (employee) responsible for managing this risk must notify the Supervisory Board and the bank's management without delay and propose appropriate corrective measures within five business days.

A significant increase in country risk must be established in the bank's internal documents.

§ 3. Requirements for Reports on Country Risk

12410. In managing country risk, the relevant structural subdivision must submit reports on country risk to the Supervisory Board and the Risk Management Committee (if established) every quarter, and to the bank's management at least once a month.

Chapter 112. Requirements for Managing Interest Rate Risk Arising in the Bank Portfolio

§ 1. Interest Rate Risk Management System in the Bank Portfolio

12411. A system for managing interest rate risk arising in the bank portfolio must be implemented in the bank to identify, assess, monitor, control, and reduce such risk.

12412. An effective system for managing interest rate risk arising in the bank portfolio must include:

the risk appetite for interest rate risk arising in the bank portfolio;

the policy and procedures for managing interest rate risk arising in the bank portfolio;

tools for assessing and monitoring interest rate risk arising in the bank's portfolio;

the procedure for conducting stress tests on interest rate risk arising in the bank's portfolio;

reports on interest rate risk arising in the bank's portfolio.

12413. Interest rate risk arising in the bank's portfolio includes at least the following:

repricing risk arising from changes in interest rates over different periods for bank assets and liabilities, including off-balance sheet items;

basis risk arising from changes in market interest rates (indices) on which bank assets or liabilities, including off-balance sheet items, are based, if the interest rates (indices) differ from each other;

option risk arising from customers' right to change the amount or timing of payments for bank assets or liabilities, including off-balance sheet items, and their use of this right.

Section 2. Requirements for the Interest Rate Risk Management Policy and Procedures in the Bank's Portfolio

12414. Interest rate risk arising in the bank's portfolio is managed in accordance with the bank's interest rate risk management policy and other internal documents.

12415. The interest rate risk management policy in the bank's portfolio must include:

the organizational structure of the interest rate risk management system in the bank's portfolio, including the distribution of duties, powers, obligations, and interaction procedures among participants in the risk management system;

the procedure for setting limits on interest rate risk arising in the bank's portfolio;

the identification, assessment, monitoring, control, reduction, and reporting of interest rate risk arising in the bank's portfolio;

the procedure for stress testing interest rate risk arising in the bank's portfolio;

the report forms prepared for the Supervisory Board and the bank's management on interest rate risk, the procedure for submitting them, and their frequency.

12416. To ensure the effective implementation of the interest rate risk management policy in the bank's portfolio, the bank's management may develop internal procedures for the bank. These procedures must take into account the nature and complexity of the bank's activities.

These procedures must include:

the procedure for identifying, assessing, monitoring, controlling, hedging, and reporting on interest rate risk arising in the bank's portfolio;

the tools, indicators, methods, and techniques necessary for identifying interest rate risk arising in the bank's portfolio;

the procedure for information exchange among participants in the interest rate risk management process;

the procedure for preparing reports to the Central Bank on interest rate risk and verifying their accuracy.

12417. At a minimum, the following indicators must be evaluated for the purpose of managing interest rate risk arising in the bank's portfolio:

the impact on the bank's capital of changes in the current net present value of assets and liabilities in the bank's portfolio resulting from changes in market interest rates;

the impact of changes in market interest rates on the bank's net interest income for the bank's portfolio.

12418. When conducting stress tests on interest rate risk arising in the bank's portfolio, the bank uses the following scenarios related to market interest rates:

an increase in all interest rates;

a decrease in all interest rates;

a decrease in short-term interest rates and an increase in long-term interest rates;

an increase in short-term interest rates and a decrease in long-term interest rates;

a sharp increase in short-term interest rates;

a sharp decrease in short-term interest rates.

Section 3. Requirements for Reports on Interest Rate Risk in the Bank's Portfolio

12419. The form, frequency, and volume of reports on interest rate risk arising in the bank's portfolio are determined by the Supervisory Board or the bank's management.

12420. Reports on interest rate risk arising in the bank's portfolio must include the following information:

data on the volume and description of each type of interest rate risk arising in the bank's portfolio;

information on the breach of established limits for interest rate risk arising in the bank's portfolio;

the results of stress tests conducted on interest rate risk arising in the bank's portfolio.".

(, 24.01.2025, No. 10/25/3427-1/0066)