Booklet on LSI Supervision

Prudential supervision of small and medium-sized banks

March 1 2019 Disclaimer No rights may be derived from this brochure. Moreover, this supervision brochure does not replace the applicable laws and regulations, nor is it considered to be DNB policy.

Prudential supervision of small and medium-sized banks 1 Introduction 4 1.1 DNB as the Dutch banking supervisory authority 4 1.2 Transparent about supervision 4 1.3 Chapter structure and reading guide 5 2 Banking supervision in a European context 6 2.1 The banking union 6 2.2 Single Supervisory Mechanism 7 2.2.1 Joint supervision of large banks 8 2.2.2 Supervision of small and medium-sized banks in a European context 8 3 Prudential supervision of small and medium-sized banks 12 3.1 Supervision of Less Significant Institutions by DNB 12 3.2 Supervisory principles 12 3.2.1 Risk-based supervision 12 3.2.2 Proportionality 13 3.3 Thematic supervision 14 3.4 On-sites: examinations on location 14 3.5 Submission of information and reports 15 4 Supervisory Review and Evaluation Process 16 4.1 Introduction to SREP 16 4.2 Main elements of the SREP process 18 4.3 Assessment of key SREP elements 20 4.3.1 Element 1: Business model 20 4.3.2 Element 2: Governance and risk management 21 4.3.3 Element 3: Capital risks 22 4.3.4 Element 4: Liquidity and funding risks 24 4.4 Final SREP assessment 26 Contents

4 This brochure will outline the supervisory approach of De Nederlandsche Bank (DNB) when it comes to the supervision of small and medium sized banks. It will also provide insight into the ‘Supervisory Review and Evaluation Process’ which determines an institution’s capital and liquidity requirements. This so-called micro prudential supervision is an important pillar in the supervision of the financial system. Solvent, stable and sustainable banks provide an important basis for maintaining financial stability and enhancing sustainable prosperity. 1.1 DNB as the Dutch banking supervisory authority The Netherlands has a large banking sector with a total balance sheet of approximately EUR 2,500 billion. The sector is roughly 3.5 times as big as the Dutch Gross Domestic Product (GDP).1 The sector is highly concentrated and dominated by a small number of large banks who undertake a wide range of activities. At the end of 2018, a total of 61 banks were based in the Netherlands, which includes, 6 large banks, 26 small and medium sized banks and 29 branches (see Box 4).2 Together, the 55 small and medium sized banks and branches account for roughly 15 percent of the entire banking sector (i.e. including ING, ABN Amro, Rabobank, etc.), with a total balance sheet of approximately EUR 360 billion. 1 Dutch GDP amounted to EUR 725 million in 2018. 2 The figures for the numbers and balance sheet size of the banks under supervision are based on data for the third quarter of 2018. DNB is committed to promoting a stable financial system: a system that is resilient and contributes to sustainable economic growth. DNB evaluates an institution's financially viability and ability to meet its financial obligations (even during an economic downturn). This is called prudential supervision. This brochure will solely focus on the prudential supervision of small and medium sized banks. It is important to note that DNB is also responsible for conducting integrity supervision. More information on integrity supervision can be found in Box 1 (below). From a statutory perspective, DNB’s supervisory task is part of its function as an independent administrative body, which has been deliberately placed at arm’s length of the Ministry of Finance. This forms an important foundation for the current supervisory model and is based on the principle that supervision requires independent expertise, without political interference. The Ministry of Finance has described the relationship between the Ministry and the financial supervisory authorities in a paper called ‘Toezicht op Afstand’, a Supervision Framework and

• in order to facilitate cooperation - a Memorandum of Understanding (MoU) for information exchange. 1.2 Transparent about supervision In accordance with the recommendations of the Netherlands Court of Audit (ARK), this brochure will give substance to DNB’s ambition to provide more open and transparent communication on 1 Introduction

5 Prudential supervision of small and medium-sized banks the prudential supervision of small and medium sized banks.3 In the coming years DNB will increase its transparency on the supervisory process by explaining more explicitly how an institution's requirements are determined, e.g. capital or liquidity requirements.4 Transparency increases our legitimacy as a supervisory authority, allowing for more accountability and predictability, which increases the likelihood that banks comply with laws and regulations. However there are limits to our transparency, specifically when it comes to investigations at an institution, or where it concerns proprietary business information. In such cases, the principle of transparency conflicts with our obligation to observe supervisory confidentiality. 3 Supervision of banks in the Netherlands, ARK. 4 Supervisory Strategy 2018-2022, DNB. 1.3 Chapter structure and reading guide The brochure starts with an overview of the European banking supervision framework (Chapter 2), followed by insight into DNB’s prudential supervision of small and medium sized banks (Chapter 3). The brochure will finish with insight into the 'Supervisory Review and Evaluation Process’ which is the methodology used to determine the capital and liquidity requirements of an institution (Chapter 4). Box 1 Integrity supervision Integrity and prudential supervision are closely intertwined within DNB. Integrity supervision involves tackling financial and economic crime to maintain a clean and ethical financial sector. Financial and economic crime comes in many forms, such as money laundering, corruption and conflicts of interest, terrorist financing, insider trading and non-compliance with sanctions regulations. Combating these crimes is one of our key priorities, as they harm confidence in the financial system. This is a focus area of DNB’s Supervision Strategy 2018 – 2022.

6 2 Banking supervision in a European context 2.1 The banking union The recent financial crisis has shown how quickly problems within the financial sector can spread across borders, especially within a monetary union, and the direct impact these problems can have on its citizens. The need for a European solution, i.e. an intensive cross-border cooperation in the field of prudential banking supervision, became ever more evident. A joint European perspective on banking supervision allows for greater harmonisation with the ambition of increasing the quality of supervision among member states. Therefore, the European Council decided in 2012 to set up the banking union with the aim of ensuring a secure, safe and robust European banking system. The banking union should also foster further financial integration and stability across Europe. The banking union rests on three pillars: Figure 1 European banking union European banking union The main components of the banking union are:

1. A supranational supervisory authority, the European Central Bank (ECB), which has the power to supervise large banks – (SIs) together with the national supervisory authorities in the Single Supervisory Mechanism (SSM).
2. A European resolution mechanism, the Single Resolution Mechanism (SRM). When a bank is on the brink of failing or bankruptcy is imminent, the resolution mechanism will allow for the controlled wind down of the institution, so as to ensure that its critical functions are continued and that its customers retain access to payment services and their savings. Moreover, this mechanism aims to prevent other institutions from collapsing. Resolution aims to ensure that it is no longer the government who has to bail out a bank with taxpayers' money, but instead the shareholders and investors who are responsible for bearing the cost of a failing bank.
3. A (yet to be established) European deposit guarantee scheme (European Deposit Insurance Scheme – EDIS) that guarantees citizens’ deposits in the event of a bank’s failure. The scheme will be run at a European level and subject to a maximum payout value.

7 Prudential supervision of small and medium-sized banks 2.2 Single Supervisory Mechanism Within the banking union, the SSM is the system that exercises the prudential supervision of banks within the European Union. In this new supervisory system, the ECB cooperates with the national supervisory authorities of the member states, the National Competent Authorities (NCAs). The purpose of the SSM is to exercise effective and consistent banking supervision that contributes to a sound and solvent banking system and thus to the stability and resilience of the financial system. Independent, forward-looking and risk-based supervision are the principles that the SSM adheres to when performing its duties. The legal framework for the SSM is laid down in the SSM Regulation, which is further elaborated in the SSM Framework Regulation. DNB ECB Central bank Banking supervision Single Supervisory Mechanism Indirect supervision or oversight on banks < €30 billion Methods, analyses, regulations, authorisations Information supply, decisions, resolution Central bank Joint Supervisory Teams Direct supervision of large banks Scope of the brochure Dutch Small and medium￾sized banks Single Supervisory Mechanism Single Supervisory Mechanism Figure 2 National and European prudential banking supervision

8 DNB has been carrying out its banking supervision tasks within this European system since 4 November 2014. The SSM supervision system works in two ways: supervision (direct supervision) and oversight (indirect supervision). The difference is that direct SSM supervision is carried out for large banks (Significant Institutions, SIs), whereas indirect SSM supervision is carried out for small and medium￾sized banks (Less Significant Institutions, LSIs). The ECB is directly responsible for supervising large banks, whereas NCAs carry out the day-to-day supervision of small and medium-sized banks with the ECB presiding over the final responsibility (see Figure 2). 2.2.1 Joint supervision of large banks Approximately 119 banks in the euro area have been classified as significant. The rationale behind this classification is that these large banks operate across borders, are systemically important at member state level, and are therefore of great importance to the stability of the financial system throughout the euro area. It is important to note that this European supervision of large banks only concerns prudential supervision, not conduct or integrity supervision for which the NCAs remain responsible. In principle, banks qualify as a Significant Institution if they meet at least one of the following three criteria: 1. a balance sheet total above EUR 30 billion 2. the relative size of the bank compared to the GDP is considerable (>20%) 3. other reasons such as the complexity and interconnectedness of the bank with the real economy, significant cross-border activities or number of institutions per Member State (at least three significant banks per EU Member State). Finally, a bank is considered significant if it receives direct state aid or once it has requested or has already received financial support from the European Stability Mechanism (ESM) or the European Financial Stability Facility (EFSF). There are six significant banks in the Netherlands: ING Bank, ABN AMRO, Rabobank, Volksbank, Nederlandse Waterschapsbank (NWB) and Bank Nederlandse Gemeenten (BNG). These banks represent a total balance sheet size of approximately EUR 2,200 billion. Joint Supervisory Teams The responsibility for the prudential supervision of the aforementioned 119 significant banks lies with the Joint Supervisory Teams (JSTs). JSTs are comprised of supervisors from both the ECB and NCAs. They work in close collaboration on day-to￾day supervisory tasks. Although the management and responsibility for decision making lies with the Joint Supervisory Team Coordinator (Head of the JST at the ECB).

9 Prudential supervision of small and medium-sized banks 2.2.2 Supervision of small and medium-sized banks in a European context ▪ Small and medium-sized banks in the euro area are only indirectly supervised by the ECB. As indicated, the NCAs are responsible for the day￾to-day supervision of these banks. The ECB does, however, ‘supervise supervision’ or conducts oversight. This indirect supervision is carried out by the Directorate General Microprudential Supervision III (DGMS III) of the ECB. DGMS III has the ultimate authority in a number of areas: ▪ granting and withdrawing of authorisations/ permits, issuing declarations of no-objection for the acquisition and disposal of qualifying holdings ▪ conducting risk analyses and sectoral analyses ▪ promoting harmonisation of supervisory practices among member states ▪ taking over the supervisory tasks from the NCA, as a last resort. DNB is obligated to report on the supervision of small and medium-sized banks to the ECB on a regular basis. The ECB monitors DNB's application of the SSM’s supervisory standards, processes and procedures. Furthermore, there are regular bilateral visits and consultations between DNB’s senior management and the ECB in order to discuss DNB’s supervisory activities and the status of the Dutch banking sector. DNB’s banking supervision divisions are keen on contributing to developing methodologies and promoting common supervisory standards. To this end, DNB staff members take part in various SSM decision-making bodies, working groups, drafting teams and on-site missions (consisting of a combination of ECB and NCA supervisors). Box 2 DNB has aligned its organisational structure with that of the SSM In organisational terms, DNB has aligned its banking supervision divisions with those of the ECB. In the past, DNB had one large banking supervision department. With the establishment of the SSM in 2014, DNB organised the supervision of banks into three divisions: European Banks, National Institutions, and On-site Supervision and Banking Expertise.

10 Box 3 Relevant laws and regulations Banks under prudential supervision are subject to rules and regulations at the European and national level. Below is a general overview of some of the relevant categories of laws and regulations. International regulations and guidelines for banking supervision Single Rulebook The European Union has a harmonised framework of substantive supervision rules in place. As regards regular prudential supervision, these rules are mainly found in the Capital Requirements Regulation (CRR) and the Capital Requirements Directive IV (CRD IV), and as regards the recovery and resolution of banks in the Bank Recovery and Resolution Directive (BRRD). The CRD IV and BRRD are European directives that become applicable when member states have implemented them into binding national laws and regulations. In the Netherlands, this is the Financial Supervision Act (Wet op het financieel toezicht – Wft). Based on proposals and advice from the European Banking Authority (EBA), the European Commission has adopted various implementing regulations under the CRR/CRD IV and the BRRD. These are also known as Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS). These RTSs and ITSs further detail provisions in the CRR/CRD IV and BRRD. The EBA also draws up various Guidelines. In these guidelines, the provisions of the CRR/CRD IV and BRRD are elaborated in more detail. The guidelines are not to be considered as laws or regulations, but are applied on the basis of the 'comply or explain' principle. The purpose of these Guidelines is to ensure consistent and uniform application of standards in European legislation in all EU member states. These Guidelines and the entire package of EU regulations are also referred to as the 'Single Rulebook'. Basel frameworks In addition to European laws and regulations, there are also worldwide standards. The Basel frameworks (I, II, III) constitute a global set of standards drawn up by the Bank for International Settlements (BIS). These frameworks impose capital and other requirements on banks. The latest set of standards, Basel 3.5, describes bottom-up (see Chapter 4) and risk-based supervision for banks. The BIS also makes clear that banking supervision is not an exact science and that the supervisory process therefore inevitably contains discretionary elements. The Basel frameworks are not only intended to ensure that banks hold enough capital for their risks, but also to encourage banks to develop better risk management techniques and to use them to monitor and manage their risks. The Basel 3.5 standards are expected to take effect from 2022 onwards.

11 Prudential supervision of small and medium-sized banks National laws and regulations The aforementioned European directives for banking supervision and other relevant European directives must be transposed into national laws and regulations. In the Netherlands they have been included in the Financial Supervision Act (Wet op het financieel toezicht – Wft) and other secondary legislation. The Dutch Decree on Prudential Rules for Financial Undertakings (Besluit prudentiële regels Wft – Bpr) and the Decree on Market Access for Financial Undertakings (Besluit markttoegang financiële ondernemingen – BMfo) are examples of such further regulations. As part of its mandate DNB can also adopt binding regulations regarding technical implementation rules for specific subjects, such as the Regulation on sound remuneration policies under the Wft. Finally, it is important to note that DNB can draw up policy rules that guide the definition of specific legal standards and powers in the performance of supervision. An example of this is the common Policy Rule on suitability of DNB and the Dutch Authority for the Financial Markets (AFM). Open Book on Supervision With the web-based Open Book on Supervision, DNB provides access to all applicable laws and regulations regarding supervision. Here, the laws and regulations and the related explanatory notes are accessible and presented coherently. Open Book is intended for professionals who work at supervised institutions and for external advisers.

12 3 Prudential supervision of small and medium-sized banks 3.1 Supervision of Less Significant Institutions by DNB In order to be able to operate effectively and efficiently within European regulations, and to harmonise supervision, DNB make use of the ECB’s practices and methodologies as much as possible, when carrying out its supervisory activities. Important elements of DNB’s supervision of small and medium-sized banks are therefore largely comparable with the supervision of large banks. DNB (in cooperation with the ECB), is the gatekeeper and licensing authority for the banking system in the Netherlands. As a result, it carries out the following tasks: ▪ draft decisions on licensing and declarations of no-objection - (DNOs) – (ECB has the ultimate authority) ▪ fit and proper assessments of executive directors and members of supervisory boards ▪ other forms of giving consent such as granting exemptions For banks that are already under DNB supervision, the banking supervision division is responsible for carrying out, among other things, the following tasks: ▪ the Supervisory Review and Evaluation Process (SREP) and the standardised risk analyses that results in the determination of the capital and liquidity requirements of the banks. This is the standardised process for assessing the four main risk elements: business model, governance and risk management, capital risk, liquidity and financing risk. Chapter 4 looks in more detail at the process in which the capital and liquidity requirements are determined ▪ monitoring the capital and liquidity position of the banks ▪ thematic reviews and deep-dives ▪ on-site inspections ▪ drafting and implementing risk mitigation plans 3.2 Supervisory principles 3.2.1 Risk-based supervision Risk-based supervision is a core principle within DNB’s supervisory approach. Risk-based supervision ensures that the level of supervision is commensurate to the level of risk. For example, business models of small institutions, in theory, do not automatically involve low risks and may in fact demand a great deal of prudential attention. And the reverse also applies: there can be relatively large institutions that adopt rather simple low￾risk business models and may therefore be of less prudential concern. Risk prioritisation Not only is the banking system itself subject to many changes, but the risks to which banks are exposed are also in flux. For this reason, DNB has decided to use the outside in principle for prioritisation purposes. In order to identify priorities, the risks of the LSIs are determined first. This is for example done by taking into account the SSM risk analyses and the business model of the banks. A link is also established with macro-prudential developments and risks that could have an impact on the banking sector, the so-called micro-macro link.

13 Prudential supervision of small and medium-sized banks In dialogue with supervisors and with the input from SSM analyses, the risks are then converted bottom￾up to priorities for the relevant year, also resulting in the work plans (e.g. on-sites and deep dives). 3.2.2 Proportionality DNB uses proportionality as an important principle when exercising its supervisory tasks. Regulation and supervision should be tailored to the scale and complexity and, most of all, to the risks to which financial institutions are exposed. Obviously, there is a certain minimum level of supervisory requirements that all institutions must always be able to meet. Proportionality is also important for the supervisor when deciding the effective allocation of scarce resources to supervisory activities. This means, among other things, that supervision will be more intensive when the scale and complexity of an institution increases or the specific risks identified by the supervisor increase. Hence, there are differences between the supervisory approach of small and medium-sized banks. For example, the balance sheet size of small and medium-sized banks varies from several tens of millions of euro to EUR 28 billion. In line with the ECB policy, DNB has prioritized banks by low, medium and higher priority. On the basis of this priority, supervisory activities are scaled up when institutions are larger or more complex. Furthermore, the proportional approach impacts the level of supervisory activity, the frequency of on-site inspections (targeted risk inspections at the bank premises), the frequency of reporting and level of resources assigned to the bank. In a European context, the Joint Supervisory Teams for large banks vary in size from 6 to as many as 50 supervisors. Proportionality is also applied within the supervisory methodology for small and medium-sized banks, the aforementioned SREP. This may result in differences in terms of frequency, scope and depth of supervision (see also Chapter 4). Box 4 Supervision of branch offices In addition to the regular banks, there are 26 branches of foreign banks (registered office within the EEA) in the Netherlands. Primary prudential supervision is conducted by the supervisory authority of their home country, (i.e. the country where the parent company has its registered office). DNB's supervision of these branch offices is limited to Dutch integrity legislation, whereas the 'parent supervisory authority' remains responsible for the prudential supervision. There are also three 'third-country branch offices', with a registered office outside the EEA. These banks are subject to the DNB's prudential supervision.

14 3.3 Thematic supervision In addition to the structural and ongoing supervisory processes to determine the capital and liquidity requirements, the supervisory divisions also carry out tasks that are more ad-hoc by nature. For example, supervisors conduct examinations, also known as deep dives, in response to changes to the banks operating environment (e.g. the low interest rate environment or a change in accounting standards) or because of the need to get a better insight into the management of certain risks. Examples of such supervision are: ▪ impact analysis and the monitoring of implementation of accounting standard IFRS 9 in the financial reporting of banks ▪ benchmark analysis of outsourcing activities ▪ research into credit portfolios of banks with business models focused on emerging markets ▪ research into financial products and capital structuring ▪ research on non-performing loans ▪ research into climate risks ▪ preparation for Brexit In some cases, the analyses may lead to binding requirements, rules or recommendations for the banking sector as a whole, for certain peers, or for individual banks. When this is the case, DNB publishes these rules, examples or regulations on Open Book Supervision. 3.4 On-sites: examinations on location An on-site inspection is an in-depth examination into one or more different risk types (business model risk, IT risk, financial risk, operational risk or governance risk) at the institution’s premises. On-site inspections are carried out by a separate examination team, in order to guarantee independence from regular supervision. This ensures that the inspection team conducting the inspection can provide an objective perspective into a bank's risk profile. The objective, scope and duration of the inspection are determined in advance. The team consists of a Head of Mission and a number of risk experts, depending on the type of examination. Once the examination is completed, the findings are shared with the institution and the report is submitted to the supervisory team. The supervisory team is responsible for providing the follow-up expectations and recommendations to the institution.

15 Prudential supervision of small and medium-sized banks 3.5 Submission of information and reports In order to perform its supervisory activities, DNB relies on information provided by banks under its supervision. A bank itself makes a proposal for its capital and liquidity requirements by supplying the Internal Capital Adequacy Assessment Process (ICAAP), the Internal Liquidity Adequacy Assessment Process (ILAAP), prudential reporting, reports and dialogues. These documents (including the underlying data, assumptions and models) are then analysed and challenged by DNB. ICAAP/ILAAP The ICAAP outlines the banks strategy, policy, systems and processes that the institution uses to determine its own capital level. The ILAAP describes the institution’s strategy, policies, processes and systems for managing and monitoring liquidity risks and funding positions. The ICAAP and ILAAP outline the necessary level of capital and liquidity required to survive a stressed scenario such as deteriorating economic conditions. Prudential reporting In addition, DNB uses all prudential reports submit￾ted by the bank in its analysis. Banks share their financial data (including the balance sheet and profit-and-loss accounts) with DNB via Common Reporting (COREP) and Financial Reporting (FINREP). FINREP contains all information relating to the viability of the bank (balance sheet, profit￾and-loss account). COREP contains all information relating to the banks risk profile and capital levels. Reports and dialogues Quantitative and qualitative reports submitted by the bank are also used in the supervision of the bank. These reports range from internal and external audit reports, minutes and strategic plans. In addition, various dialogues are held between DNB and the banks under its supervision.

16 4 Supervisory Review and Evaluation Process 4.1 Introduction to SREP Banks must have sufficient capital and liquidity to cover their current risk levels. In addition, they must have a sound capital and liquidity plan in order to ensure sufficient capital and liquidity reserves in case of unforeseen circumstances. Capital and liquidity requirements are the requirements pertaining to the bank’s own funds and cash reserves. This chapter describes how DNB determines the capital and liquidity requirements for small and medium-sized banks. The total capital requirement for an institution consists of several building blocks (see Box 6). The minimum amount of capital that an institution must hold is determined by law and is the same for all institutions (the Pillar 1 requirements). Furthermore, Pillar 2 sets additional requirements for institutions to cover the risks that are not or insufficiently covered by the Pillar 1. They are tailored to the risk profile of the institution in question and may therefore vary per institution. SREP-methodology at a glance: four key elements SREP Decision Overall SREP assessment - holistic approach → Score + rationale/main conclusions Quantative liquidity measures Quantative capital measures Viability and sustainability of business model Adequacy of governance and risk management Categories: e.g. credit, market, operational risk and IRRBB Categories: e.g. short-term liquidity risk, funding sustainability

1. Business model assessment
2. Governance and risk management assessment
3. Assessment of risks to capital
4. Assessment of risks to liquidity and funding Other supervisory measures Figuur 3 SREP methodology at a glance

17 Prudential supervision of small and medium-sized banks In order to determine the additional capital requirements, DNB uses the aforementioned Supervisory Review and Evaluation Process (SREP). This methodology was established within the SSM (entered into force as of January 2018). All SSM members use the same methodology to ensure a harmonised and consistent supervisory approach. The main objective of the SREP is to perform sound risk assessments, pursue a level playing field and ensure high supervisory standards. As the same methodology is used for all banks, it also allows for making comparisons between institutions and conducting horizontal analyses. As shown in Figure 3, the SREP methodology has four key elements for assessing an institution’s risk profile: ▪ assessment of the business model ▪ assessment of internal governance and risk management ▪ assessment of risks to capital ▪ assessment of risks to liquidity and funding These four key elements are inputs into the overall SREP assessment. They are explained in more detail under subsection 4.3. The SREP assessment results in the final quantitative capital and liquidity requirement and if necessary other qualitative supervisory measures (risk mitigation plans). SREP legal framework Article 97 of the CRD IV outlines the legal framework for the SREP. This framework defines the powers of the central bank to assess the arrangements, strategies, processes and mechanisms of an institution. The EBA published guidelines on common procedures and methods for the SREP in 2014. A revision was published in 2018. Disclaimer: The SSM methodology states a minimum level of harmonized SREP procedures and criteria. NCAs have the flexibility to conduct additional SREP activities on a national level. Risk level Phase 1 Date gathering Phase 2 Automated score Phase 3 RL assessment RL final score Risk control Phase 1 Information gathering Phase 2 Formal compliance checking Phase 3 RC main assessment RC final score Figure 4 SREP assessment phases

18 4.2 Main elements of the SREP process The assessment of the four SREP key elements is a formulised process and consists of two assessments, each containing three phases. The assessments focus on the risk level (assessment of the inherent risk) and the risk control (assessment of the control framework). Each phase of the assessment is explained in greater detail below. Phase 1: Information Gathering The information needed to assess the SREP key elements is collected in the first phase. The required information varies from financial data to internal documents of the institution such as the ICAAP, ILAAP, prudential reports, audit reports and information from on-site inspections. For a more detailed explanation of these information sources, see also 3.5. Phase 2: Risk Assessment System In the second phase, the Risk Assessment System (RAS) is a key element. With the help of the RAS, DNB evaluates the risk levels and how they are managed by supervised institutions. The RAS generates scores for the risk areas on the basis of quantitative data from FINREP and COREP. The indicators per risk area are assessed on the basis of a rating scale ranging from 1 (low risk) to 4 (high risk). This means that a loss-making institution may receive a score of 4 on the profitability indicators. The RAS is supported by an ECB information system in which financial and qualitative data from institutions are documented. The indicators are calculated in a systematic and comparable way for all institutions and used by supervisors in the review process. For example, in order to assess the SREP element ‘business model’, profitability indicators such as the Return on Assets (RoA) or Cost-Income Ratio (CIR) of an institution are calculated. In the context of risk management, a compliance check is carried out on the basis of qualitative data. This is also done in the second phase. This check verifies, for example, if the institution complies with the laws and regulations or EBA guidelines. The supervisor examines this check on the basis of a questionnaire. The relevance of the questions may differ from one institution to another and is therefore applied proportionately by the supervisor. The compliance check also results in a risk management assessment, with a score ranging from 1 (low risk) to 4 (high risk). Finally, the risk level score and risk control score are put together in a combined score for a specific risk area. Phase 3: Assessment and constrained judgement In this phase, the supervisory authority makes a final assessment of the institution’s risk level and the control of these risks. The final assessment consists of a final score with explanatory notes from the supervisor, where relevant. The explanation will mainly relate to deviations in the automated scoring. For example, if a bank has a very specific business model or if less data is available, as a result the specific risks of the institution may be insufficiently addressed in the automated risk scoring.

19 Prudential supervision of small and medium-sized banks The supervisor has some degree of flexibility and discretion in adjusting the RAS scores. However, this has been restricted through the principle of ‘constrained judgement’. Based on the supervisors expert judgement, the methodology permits a rating change of -1 (positive) and +2 (negative) based upon a rating scale of 1 to 4. Constrained judgement provides the right balance between a supervisors knowledge of the bank's specific characteristics and complexity and ensuring harmonisation and consistency in the supervision of SSM banks. If a supervisor makes use of constrained judgement functionality, rationale and documentation must be provided to substantiate the change in scoring. The scores used to analyse the four key SREP elements are visualised in Figure 5. Figure 5 Scores for analysis of the four key SREP elements5 5 The four underlying capital risks – credit risk, market risk, operational risk and interest rate risk in the banking book – receive a risk level and risk control score. • Risk Level score and • Risk Control score • Risk Level score and • Risk Control score • Risk Level score • Risk Control score Element 1: Business Model Element 2: Internal Governance and Risk Management Element 3: Capital Risk Element 4: Liquidity and Funding Risk Information from thematic and on-site examinations

20 4.3 Assessment of key SREP elements 4.3.1 Element 1: Business model The first key SREP element concerns the assessment of an institution’s business model. In the assessment, the supervisor assesses the viability and sustainability of the business model in the short, medium and long term, taking into account both external (macroeconomic) and internal (company￾specific) factors that may pose a risk to the institution’s profitability. The assessment includes the following elements: ▪ determining the principal activities ▪ assessing the business environment ▪ analysing the future-oriented strategy and financial plans ▪ evaluating the business model on the basis of: – viability (within 1 year) – sustainability (within 3 years) – sustainability through the cycle (more than 3 years) ▪ assessing the main vulnerabilities Small and medium sized banks in the Dutch banking sector have different business models. Certain business models may result in specific risks, for example in terms of profitability, credit and market risk or liquidity management. Institutions 6 Dutch Financial Conglomerate (FICO) banks are banks that are part of an insurance group and primarily serve retail customers, chiefly with mortgage and savings products. FICO banks are characterised by the holding company, which is usually an insurance company. An overview of the risks to FICO banks is included in the newsletter for banks of March 2016: https://www.dnb.nl/nieuws/dnb-nieuwsbrieven/nieuwsbrief-banken/nieuwsbrief-banken￾maart-2016/dnb339261.jsp. with a similar business model are equally susceptible to (international) macroeconomic shocks or changes in laws and regulations. DNB considers these varying business models in its assessment of the key risk element. For example, the population of small and medium￾sized banks in the Netherlands include a number of so-called monoliners: banks with a highly specialised business and revenue model. Other banks are still in the start-up phase with uncertain sources of funding or rely heavily on an IT-driven business model; this may cause higher risks and possible uncertainty about future profitability. Greater risks associated with a specific business model may lead to increased capital needs. In its dialogue with the institution, DNB quantifies this need. Below are two examples in which a specific business model may lead to increased capital needs. Example 1: Dependency risk Some banks may be part of a group or financial conglomerate and depend on the parent company for their economic viability. Banks that are heavily dependent on an insurance firm as its parent company are therefore exposed to dependency risk.6 The supervisory principle in these cases is that when a bank is dependent on the group, the bank

21 Prudential supervision of small and medium-sized banks will have to meet all supervisory requirements on a stand-alone basis. Example 2: Policy rule on the treatment of con￾centration risk in emerging countries (BRCOL)7 Banks with a business model that is strongly focused on one or more emerging countries are exposed to country risk, due to the economic volatility in such countries. Such banks are required to hold additional capital in order to cover any potential risk that a borrower is unable to meet its credit obligations given foreign exchange risk. This risk may arise due to significant currency fluctuations or restrictions on the convertibility of specific currencies. This poses a risk of losses as a result of developments in a specific country, on which the respective government may have some influence. Private companies, however, have hardly any or no influence at all. DNB has established a policy ruling to further define concentration risk related to emerging countries. The policy rule is applied to concentrations (>5% of the balance sheet total and the total of off-balance sheet items) in emerging countries with a high probability of a country risk event and indicates what additional measures are required by DNB to manage such country risk. The outcome of the risk assessment of business model may, for instance, result in an add-on for credit risk or interest rate risk. If for example a bank is strongly focused on one country, this may increase the credit risk of this bank. Should this be the case, a one-time capitalisation is applied to this 7 http://www.toezicht.dnb.nl/4/4/2/50-204054.jsp, in Dutch only. risk in order to avoid double counting in the capital requirements. 4.3.2 Element 2: Governance and risk management The second key SREP element concerns the assessment of the internal governance and risk management of the bank. This analysis tests the overall control and risk management framework of the institution. In the assessment, the following elements are analysed: ▪ the internal governance framework of the institution, including essential control functions such as internal audit and compliance ▪ the risk management framework and the risk culture of the institution ▪ the risk infrastructure, internal data and reporting of the institution ▪ the remuneration policy and practices of the institution Part of this assessment includes an analyses of the organisational structure of the management bodies and any subcommittees. When analysing the organisational structure, supervisors assess the internal reporting lines and the responsibilities of the management body. It is important that they function properly and in accordance with the laws and regulations. This includes the essential control functions such as internal audit and compliance. The supervisor checks if the institution has these control

22 functions in place and if they operate independently of the business operations. Another aspect DNB looks at is the institution’s risk management framework and risk culture. For example, it is important that new risk strategies correspond to the bank’s established risk appetite and capital and liquidity plans. Supervisors also look at specific issues that may vary per institution, due to differences in the size, complexity and riskiness of portfolios. Smaller institutions may, for instance, outsource certain horizontal functions because they do not have the in-house expertise. Naturally, the institution itself remains responsible for the processes it outsources and for the correct checks and balances. Operational choices and economies of scale Controlling and mitigating certain risks may be an operational or strategic choice for a bank. A good example is the interest rate risk that arises as a result of differences in the maturities of assets and liabilities. Banks may choose to actively reduce this risk. This requires, however, that the bank builds internal expertise and embeds that expertise in processes. Some banks, usually the larger ones, choose to set up divisions to hedge and mitigate the interest rate risk on their liabilities and assets (Asset Liability Management). In the case of smaller banks, this picture is more mixed, because for smaller banks these activities are not profitable enough, for example, or it may be a strategic choice to accept this risk. This may result in ‘open’, unhedged interest 8 For more information see: www.dnb.nl/toezichtprofessioneel/055_Gedragencultuur/index.jsp. rate positions. In the SREP process, the supervisor may impose a higher capital requirement in such a case. This risk is also taken into account in the assessment of the capital risks (see also 4.3.3). Behaviour and culture The crisis has shown that behaviour and culture have a major impact on a bank’s financial results. Perhaps not in the short term, but certainly in the longer term. Therefore DNB has given priority to its supervision on behaviour and culture in recent years. Through its supervision of behaviour and culture8 , DNB identifies behavioural and cultural aspects that (may) have a positive or negative impact on the business operations and therefore on their performance. If it turns out that behavioural and cultural aspects lead to undesirable risks, they will be addressed. Compared to financial and organisationally oriented supervision, behaviour and culture is more difficult to quantify in a capital requirement (imposed requirement to hold additional capital). This usually results in qualitative measures. 4.3.3 Element 3: Capital risks The third key SREP element concerns the assessment of an institution’s risks to capital. The assessment is completed on the basis of both RAS and the risk-by-risk approach (see below), supplemented with the analysis of the institution’s stress tests.

23 Prudential supervision of small and medium-sized banks In the RAS assessment, the following four risk areas are analysed: ▪ credit risk ▪ market risk ▪ operational risk ▪ interest rate risk for the banking book DNB provides risk level and risk control scores for these risk areas, see also 4.2. Automated scores are given for the risk level scores, based on quantitative aspects such as quality (e.g. non-performing loans) and hedging (e.g. provisioning) of financial assets. The qualitative analysis leading to the risk control score for the underlying risk areas consists of a questionnaire that ensures a formal compliance check in accordance with the CRR and CRD IV. This compliance check contains questions regarding internal governance, risk appetite, risk management and the internal control of credit risks. The results of the questionnaire provide guidance for the supervisor when assessing the risk management score. The combination of the risk level and risk control score of the four risk areas is assessed together and combined into a final score. The score serves as input for the final capital risk assessment, together with the risk-by-risk approach, ICAAP analysis and stress test assessment. Risk-by-Risk approach This section focuses on the risk-by-risk approach. The underlying idea of this approach is that banks that have more specialised or concentrated activities run more specific risks that need to be capitalised. In the more automated RAS assessment, these specific risks may not be adequately addressed. In the risk-by-risk approach, the level of the capital requirement is calculated by determining the required capital for each risk area. If an institution is exposed to a relatively higher market risk, additional capital requirements may be imposed for this specific risk. The required capital requirements are expressed as a percentage, which indicates the amount of capital that the institution must hold in relation to its risk-weighted assets (Total Risk Exposure Amount – TREA). In the risk-by-risk approach, the qualitative and quantitative aspects of the ICAAP are taken as a starting point. The bank itself draws up the ICAAP in which it describes the strategies, policies, systems and processes that are used to assess and maintain the internal capital level. The quality and the level of capital that the bank deems necessary to keep the capital level at an adequate level, are described in the ICAAP. Since the bank provides its own ICAAP, it is important for supervisory purposes to ensure its quality through a reliability analysis. The supervisor also checks for example whether the ICAAP is in line with the structure described in the EBA guidelines. The qualitative analysis of the ICAAP looks at the i) governance ii) capital planning iii) designing and drafting of scenarios iv) internal control measures, independent evaluations and documentation and v) data, infrastructure, and recording, measuring and aggregating risks. These elements are assessed on the level of detail, comprehensibility, comparability and credibility.

24 The quantitative analysis focuses primarily on the risk definition and ICAAP estimates according to the banks’ own risk assessment. The supervisor assesses the institution’s ICAAP estimates on inter alia concentration risk, market risk, credit risk and interest rate risk in the banking book (IRRBB). In addition, proxies are used to compare institutions and to test the reliability of the estimates made by the institution. The results of this analysis generate a combined score that reflects the quality of the ICAAP. Finally, the risk assessment is supplemented with the analysis of the internal stress test carried out by the institution. The stress test shows the results of the institution’s capital position during a ‘bad weather scenario’. Testing the capital adequacy on the basis of a stress test gives an indication of whether the institution can still meet its capital requirements under continuously deteriorating market conditions, both at a fixed time in the future and during a certain time horizon. 9 Some small and medium-sized banks are concentrated in certain sectors. For banks that rely on one sector, for example agriculture or solar panel manufacturers, a negative macroeconomic or policy shock may lead to bigger losses for a large part of their customers. 10 DNB has its own manual for the assessment of the ILAAP, available in the Open Book on Supervision on www.dnb.nl 4.3.4 Element 4: Liquidity and funding risks The fourth key SREP element concerns the assessment of the institution’s liquidity and funding risks. The liquidity position of a bank is understood to mean the extent to which it can meet its payment obligations. An analysis is made of the bank’s short-term liquidity and the sustainability of the funding in its portfolio in the medium and long term. This assessment for example examines whether the outflow of funds in the short term is greater than the inflow, and, as a result, there are insufficient liquid assets to compensate this deficit within a period of one year. Long-term liquidity risks relate to a sustainable financing profile in the future. In the liquidity assessment, qualitative and quantitative aspects of ILAAP are taken as the starting point. In the ILAAP, the bank itself describes the strategy, policies, processes and systems for managing and monitoring liquidity risks and funding positions. Supervisors also look into prudential reports and in-depth analyses, and the ILAAP stress test that is supplied by the institution itself.10 Box 5 Concentration risk Some banks focus on one target group for funding and lending.9 If, at a small bank, a limited number of customers from one single sector leave, or their loans are loss-making, this will have a relatively greater impact on the bank's solvency than if it were a large diversified bank. As a result of less diversification and risk-spreading, these banks run a higher risk and therefore need to hold more capital to cover this risk.

25 Prudential supervision of small and medium-sized banks In principle, LSIs in the Netherlands have to comply with at least three liquidity requirements: 1. Liquidity Coverage Ratio First, a Liquidity Coverage Ratio (LCR) of at least 100%. This is a legal requirement that relates to the institution’s short-term liquidity. The ratio measures if the institution has sufficient liquidity reserves to absorb an outflow of liquidity during one month of stress. Such an increase in money outflows may occur, for example, when a large number of people withdraw money all at once in the event of a crisis. The LCR is reported and monitored on a monthly basis. 2. Net stable funding ratio Secondly, DNB expects all institutions to comply with a Net Stable Funding Ratio (NSFR) of at least 100% in anticipation of European legislation. This requirement has been drawn up because the LCR only relates to an institution’s short￾term liquidity. Long-term liquidity risks are taken into account to a limited degree only. The NSFR ensures that banks fund their assets with more stable long-term funds and thus reduces the long-term liquidity and funding risks. 3. Survival Period Third, institutions must be able to meet the requirement of a Survival Period of at least six months. This is determined by means of the stress tests that the institutions themselves develop as part of the ILAAP. These stress tests are then assessed by DNB. If it complies to the Survival Period of at least six months, the institution proves that they can meet their pay￾ment obligations in periods of stress. In contrast to the LCR and NSFR, the Survival Period contains institution-specific elements. This requirement is institution-specific because the institution itself provides the stress tests, in which the biggest institution-specific risks are taken into account. The stress test could, for example, contain management actions that may influence the institution’s liquidity.

26 4.4 Final SREP assessment The four key SREP elements are merged into an overall SREP assessment, possibly supplemented by a specific add-on based on the risk-by-risk approach. On the basis of this overall assessment, the supervisory authority takes a capital decision and a liquidity decision. In order to formally establish the capital and liquidity needs of small and medium-sized banks, the banking supervision department follows the decision-making process within DNB, which also applies to the supervision of pension funds and insurance companies. The management of the banking supervision department ultimately decides on the level of capital and liquidity requirements for individual banks. Finally, the highest decision￾making body in the framework is DNB’s Prudential Supervision Council. If there are significant problems at an institution, there would be an enhanced exchange of information and dialogue with the ECB, in addition to the involvement of the Prudential Supervision Council. Finally, in specific cases, the Dutch resolution authority may also be involved in prudential supervision issues. In principle, every year all banks receive the official SREP decisions and risk scores in a decision letter. In 2019, in the context of proportional and risk￾based supervision, DNB will examine whether the annual frequency of the SREP decision may be reduced for institutions that meet certain conditions. The decision letter explains the findings and sets out the final capital and liquidity requirements to be met by the institution. The structure of the capital requirements (see Box 6) and the accompanying explanatory notes are also described in the decision letter. The new capital and liquidity requirements will apply upon receipt of the decision letter. Finally, DNB will have a concluding meeting with the Executive Board and Supervisory Board of the institution.

27 Prudential supervision of small and medium-sized banks Box 6 Capital requirements structure The total capital requirement is made up of four components: the Pillar 1 requirement, the Pillar 2 requirement, the regulatory buffers and the Pillar 2 guidance. All four key SREP elements serve as input for determining the capital requirements. The Pillar 1 requirement is the capital and liquidity requirements that apply equally to all banks. In concrete terms this means that banks are legally obliged to hold at least 8% of capital vis-à-vis their risk-weighted assets. This requirement is laid down in the CRR and therefore applies equally to all banks in the EU. Risks that need to be capitalised are credit risk, market risk and operational risk. Pillar 2 requirements are additional requirements for risks that are not or insufficiently covered in the legal minimum framework of Pillar 1. Just like the Pillar 1 requirements, these are statutory requirements, i.e. hard capital requirements. Examples include interest rate risk, credit concentration risk, or specific operational risks. DNB defines these additional Pillar 2 capital requirements on the basis of all the information that it has at its disposal. During the SREP, this information is analysed, and new requirements are set based on this analysis. Because all banks are subject to specific risks that are not covered by the Pillar 1 requirements, DNB always sets higher requirements than the statutory minimum. The SREP determines the level of the requirements for each bank. Furthermore, the CRR stipulates that three types of regulatory buffers may be imposed on top of the capital requirements. The aim is to reduce the pro-cyclicality in the financial system. The three buffers are the capital conservation buffer, countercyclical buffer and the systemic buffer. If a bank fails to adhere to these buffers, this is not a breach of the law, but restrictions will apply with regard to dividend and bonus payments for example. Finally, DNB may impose additional requirements, the Pillar 2 guidance, which the institution need not comply with legally. However, DNB suggests that the institution does adhere to it. The Pillar 2 recommendation applies to capital needs that are deemed necessary under unforeseen circumstances. Stress tests are often used to analyse the capital needs. Here is an example of a possible capital requirement structure: Total capital requirement 14,2% Pillar 2 - recommendations Buffers Pillar 2 - requirements Pillar 1 - requirements (minimum) 1% 1% 4,2% 8%

De Nederlandsche Bank N.V. PO Box 98, 1000 AB Amsterdam +31 20 524 91 11 dnb.nl