Chapter Five: Pillar Two Requirements of Basel Decisions

Part One: Regarding the Internal Capital Adequacy Assessment Process (ICAAP)

Introduction

In the framework of striving by the Central Bank of Egypt to add value to its efforts in the financial sector by implementing the principles of Basel II Accord, it is considered that the Supervisory Review Process (SRP) is one of the three pillars of Basel II.

This pillar imposes on banks the obligation to maintain sufficient capital to cover their internal risks, whether credit risks, market risks, operational risks, or other risks faced by the bank. Therefore, the approach of this chapter is that the pillars of Basel II are complementary and interdependent, reflecting the risks facing banks in light of the prevailing conditions and the environment in which they operate.

The SRP is based on the bank's risk profile and aims to ensure that banks have adequate capital relative to their risk profile. It also ensures the application of sound risk management practices by assessing the quality of risk measurement systems and ensuring that banks plan for capital adequacy given these risks. The SRP under Basel II consists of two main components:

1. The Internal Capital Adequacy Assessment Process (ICAAP).
2. The Supervisory Review and Evaluation Process (SREP).

Principle One: Internal Capital Adequacy Assessment Process (ICAAP), conducted by the bank itself.

The bank must ensure that its capital is commensurate with its risk profile and consistent with its strategic plan to maintain adequate capital levels.

Principle Two: Supervisory Review and Evaluation Process (SREP), conducted by the regulatory authority - Annex No. (1)

The regulatory authority reviews the reports submitted by banks regarding the SREP process, along with the strategies adopted by banks to assess and manage their risks, as well as their capital adequacy plans. Based on this review, the regulatory authority takes necessary decisions to address any deficiencies identified.

The regulatory authority and banks must ensure that capital levels are sufficient to cover the bank's risk exposure. The regulatory authority must ensure that banks maintain capital above the minimum required level.

Principle Four: Regulatory Actions.

The regulatory authority may take corrective actions if a bank fails to meet the minimum capital requirements or if there are deficiencies in the bank's risk profile or capital adequacy plans. The regulatory authority has the right to impose additional capital buffers or other measures to ensure compliance.

Any violations by the regulatory authority or banks will be subject to penalties stipulated in the relevant laws and regulations.

1. Concept of the Internal Capital Adequacy Assessment Process (ICAAP)

The components of the SREP process indicate that capital adequacy must be consistent with the bank's risk profile (Risk Profile). This implies that the bank must adopt a comprehensive risk management system that aligns with its strategic planning.

The objectives of the SREP process include:

• Measuring and quantifying risks.
• Ensuring that capital levels are commensurate with the bank's risk profile.
• Establishing effective risk management policies and procedures.
• Ensuring that all risks are aligned with the bank's risk appetite and strategic planning.

1/2 Proportionality

The scope and depth of the SREP process should be proportional to the different risks faced by the bank. The proportionality principle applies to:

• The complexity of the bank's risk management system.
• The methods used to measure capital adequacy.
• The selection of appropriate indicators.
• The frequency of reporting on capital adequacy.

2/2 Integration with Management Processes and Decision-Making Culture

The responsibilities of management must be integrated into the SREP process. The board of directors and senior management must ensure that risk management processes are embedded in the bank's daily operations and decision-making culture. They must also ensure that capital adequacy assessments are linked to strategic planning and performance evaluation.

3/2 Comprehensiveness and Forward-Looking Risk-Based Perspective

The SREP process must be comprehensive and forward-looking, considering all current and potential risks facing the bank, including those related to Basel II requirements. It should also account for external risks such as economic conditions and regulatory changes.

4/2 Periodic Review

The SREP process must be reviewed periodically to ensure that capital adequacy remains sufficient in light of changing conditions. This review should be conducted at least annually, taking into account the bank's risk profile, strategic plan, and business environment. Any significant changes in risk factors or business activities should trigger an immediate review.

Banks must establish policies and procedures for updating their risk assessments and capital adequacy plans. These updates should reflect changes in risk profiles, business strategies, and external environments. The board of directors and senior management must approve these updates.

3. Scope of Application of the Internal Capital Adequacy Assessment Process

The ICAAP applies to all banks, including:

• On a consolidated basis: For banking groups operating internationally, where the parent bank consolidates the results of its subsidiaries. If a subsidiary is not a bank, the group must still apply the ICAAP to the entire group.
• On an individual basis: For standalone banks without foreign subsidiaries.
• Foreign branches operating in Egypt: Must comply with the ICAAP requirements set by the Egyptian regulatory authority, unless exempted by specific agreements.

4. Frequency of the Internal Capital Adequacy Assessment Process

The ICAAP must be updated regularly, especially when significant changes occur in the bank's risk profile or business activities. Updates must be submitted to the Central Bank of Egypt within 90 days of the end of the fiscal year or within 90 days of any significant event affecting capital adequacy.

Banks operating in the financial sector, including investment banks and non-bank financial institutions, must adhere to these timelines. Failure to submit timely reports may result in regulatory sanctions.

5. Role of the Bank According to Supervisory Review Principles

The bank must ensure that its ICAAP reflects its risk profile and strategic goals. The bank must provide accurate and complete information to the regulatory authority regarding its risk management practices and capital adequacy plans.

The bank must ensure that its ICAAP covers all material risks, including those not fully captured by regulatory capital requirements. The bank must also demonstrate how it manages these risks and maintains adequate capital levels.

Key Characteristics Required in the Internal Capital Adequacy Assessment Process:

• Comprehensive coverage of all risks.
• Regular updates and reviews.
• Alignment with strategic planning.
• Integration with risk management processes.
• Transparency and accountability.
• Forward-looking perspective.
• Proportionality to the bank's size and complexity.

6. Responsibility for Preparing and Approving the Report

The board of directors and senior management are responsible for preparing and approving the ICAAP report. The report must be reviewed and approved by the board of directors before submission to the regulatory authority.

The CEO and Chief Risk Officer are responsible for ensuring the accuracy and completeness of the report. The report must be signed by authorized representatives of the bank.

7. Responsibilities of the Board of Directors and Senior Management

7/1 Responsibilities of the Board of Directors

The board of directors is responsible for:

• Overseeing the implementation of risk management policies and strategies.
• Ensuring that capital adequacy plans are aligned with the bank's strategic objectives.
• Approving risk appetite statements and limits.
• Monitoring the effectiveness of risk management processes.
• Ensuring that the bank maintains adequate capital levels to cover all material risks.

The board must disclose how it ensures:

• The adequacy of risk management systems.
• The alignment of capital levels with risk profiles.
• The effectiveness of risk mitigation strategies.
• The compliance with regulatory requirements.

8. Components of the Report

The ICAAP report must include, at a minimum, the following sections:

1/8 Executive Summary

A summary of the key findings and recommendations of the ICAAP.

2/8 Strategic Overview and Future Expectations for the Balance Sheet and Income Statement

The report must cover a period of 3-5 years. It should include projections for assets, liabilities, income, and expenses, taking into account the bank's strategic plan and market conditions. The report must also outline the bank's strategy for maintaining capital adequacy over this period.

3/8 Governance and General Risk Management Framework

This section describes the governance structure and risk management framework of the bank. It includes:

• A. Board of Directors: Roles and responsibilities, composition, and oversight functions.
• B. Organizational Structure: Risk management units, reporting lines, and independence of risk functions.
• C. Risk Appetite and Limits: Policies and procedures for setting and monitoring risk limits.
• D. Risk Reporting and Escalation: Mechanisms for reporting risks and escalating issues to senior management and the board.

3/3/8 Overall Assessment

An overall assessment of the bank's risk management framework and capital adequacy. This section should highlight strengths, weaknesses, and areas for improvement.

4/8 Risk Measurement and Determination of Appropriate Capital

This section details the methods used to measure risks and determine capital requirements. It includes:

• 1/4/8 Types of Material Risks: Credit risk, market risk, operational risk, liquidity risk, strategic risk, reputational risk, and other risks.
• A. Pillar One Risks: Risks covered by Basel II capital requirements.
• B. Pillar Two Risks: Risks not fully covered by Pillar One, including concentration risks, interest rate risk in the banking book, and other emerging risks.

The bank must use appropriate models and methodologies to measure these risks. The choice of models should be justified and validated.

6/8 Stress Testing

Stress testing is a critical component of the ICAAP. Banks must conduct stress tests to assess the impact of adverse scenarios on their capital adequacy. Stress tests should cover a range of scenarios, including macroeconomic shocks, market disruptions, and idiosyncratic events.

Stress testing plays a vital role in identifying vulnerabilities and informing capital planning decisions. Banks must document their stress testing methodologies, assumptions, and results.

(Note: The provided text ends abruptly during the discussion of stress testing.)

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 100,824-character original (24% of the document). The remainder was not translated. The complete original-language text is stored with this document.]