Guideline on Stress Testing

BOM / BSD 45 / June 2022 BANK OF MAURITIUS Guideline on Stress Testing June 2022

This page is intentionally left blank.

i TABLE OF CONTENTS INTRODUCTION....................................................................................................................1 Purpose..................................................................................................................................1 Authority...............................................................................................................................1 Scope of application .............................................................................................................1 Effective date ........................................................................................................................1 Transitional provisions........................................................................................................1 Interpretation .......................................................................................................................2 Stress testing Taxonomy ......................................................................................................2 STRESS TESTING FRAMEWORK.....................................................................................5 Principle 1 .............................................................................................................................5 Principle 2 .............................................................................................................................5 Principle 3 .............................................................................................................................6 Principle 4 .............................................................................................................................6 Principle 5 .............................................................................................................................7 Principle 6 .............................................................................................................................8 Principle 7 .............................................................................................................................8 Principle 8 .............................................................................................................................9 DISCLOSURE..........................................................................................................................9 REPORTING REQUIREMENT............................................................................................9 Appendix I – Illustrative examples of factors and scenarios for stress-testing................10

This page is intentionally left blank.

1 INTRODUCTION This Guideline on Stress Testing (Guideline) draws on the stress testing principles of the Basel Committee on Banking Supervision (BCBS) contained in its publication ‘Stress testing principles’, October 2018. As underscored by the BCBS, stress testing is integral to banks’ risk management in that it alerts bank management and bank supervisors to the potential impact of unexpected but plausible adverse shocks and provides them an indication of the financial resources needed to absorb such losses. Stress testing can also be used as a key input for risk identification, monitoring and assessment. Purpose This Guideline sets out the high-level principles to be followed by banks for the implementation of a sound stress testing framework. Authority This Guideline is issued under the authority of section 50 of the Bank of Mauritius Act 2004 and section 100 of the Banking Act 2004. Scope of application This Guideline applies to all banks licensed by the Bank of Mauritius. The principles in this Guideline should be applied on a proportionate basis, depending on the size, complexity and risk profile of the bank. Branches and subsidiaries of foreign banks may use the stress testing framework of their parent banks as long as it meets the requirements of this Guideline. Effective date This Guideline shall come into effect on 23 June 2022. Transitional provisions Banks shall ensure full compliance with this Guideline by 30 November 2022.

2 Interpretation “board” means the board of directors of a bank except for branches of foreign banks where ‘board’ means the local advisory board/committee. For branches of foreign banks with no local advisory board, the responsibilities assigned to the board shall rest on the Chief Executive Officer of the branch. Stress testing Taxonomy “Adverse stress scenario” means a set of economic and financial conditions (significantly more negative than a baseline scenario) which is designed to stress the financial performance of a financial system, sector, institution, portfolio or product (reflecting severe but plausible conditions). The design of the adverse stress scenario depends on the purpose of the test, availability of data and the time horizon chosen; “Baseline scenario” means a set of economic and financial conditions that is generally consistent with the best (or average) estimate of future economic and financial conditions. The baseline scenario usually does not lead to a stressed result. It is, inter alia, used to draw comparison against other scenarios (e.g. moderate and severe); “Dynamic balance sheet” refers to the assumption that the size, composition and/or remaining maturity structure of a bank's balance sheet (e.g. assets and liabilities) are allowed to vary throughout the stress testing time horizon due to changes in, for instance, aggregate credit volumes, maturities, defaults or other scenario-imposed restrictions and/or management actions. Under this assumption, a bank’s management may react by taking actions that impact assets and liabilities, which could include, but are not limited to, changes in the credit portfolio mix, deleveraging, as well as changes in the composition of the trading book. However, actions that affect equity, such as issuance of new capital or restriction to the payment of dividends, may be treated separately within the capital planning process and might co-exist distinctly from the dynamic balance sheet assumption; “Liquidity stress test” refers to the process of assessing the impact of an adverse stress scenario on bank’s cash flow as well as on the availability of funding sources, and on market prices of liquid assets. Outcomes can be measured as liquidity ratios, e.g. liquidity coverage ratio (LCR) and net stable funding ratio (NSFR); “Moderate scenario” means a set of economic and financial conditions which is designed to stress the performance of the banking sector or of the bank. The scenario severity is significantly stronger than in a baseline scenario; “Multi-Factor Stress Test” refers to a stress test applying a combination of two or more economic and/or financial vulnerabilities simultaneously;

3 “Plausible scenarios” refer to scenarios which are associated with a probability, confidence interval, or frequency of occurrence in time, but this is not a necessary condition for a scenario to be plausible. The likelihood can also be based on expert judgement. The forecast horizon also plays a role in determining the plausibility of a scenario. For example, market risks usually materialise in a shorter time horizon than credit risks. The reconciliation of these differing time perspectives is also a necessary consideration for scenario consistency. Plausibility of a scenario is not only related to the likelihood of a certain scenario occurring. It is also related to the consistency of the scenario, which concerns the relationship or dependency of shocks to the risk factors and other components characterising the scenario. For stress testing, it is often desirable that a scenario is severe but plausible; “Reverse stress test” means the process of assessing a pre-defined adverse outcome for a bank, such as a breach of regulatory ratios, insolvency or illiquidity, and identifying possible scenarios that could lead to such adverse outcome. A reverse stress test helps to understand underlying risks and vulnerabilities in banks’ businesses and products that pose a threat to its viability and helps to identify scenarios that could threaten resilience; “Risk-specific stress test” means a process of assessing the impact of a stress scenario on a particular category of risk exposure of a bank, e.g. market, credit, liquidity, interest rate risk, amongst others; “Scenario analysis” means a process of applying historical and/or hypothetical circumstances to assess the impact of a possible future event on a financial system, sector, bank, portfolio or product. Scenarios are not necessarily forecasts; rather, they are coherent and credible narratives, describing potentially different paths to the current or expected conditions and their translation into calculating the scenario. Scenario analysis incorporates many economic and financial parameters in a consistent manner, in contrast to sensitivity analysis, which may focus on a subset of parameters; “Scenario severity” refers to the magnitude of the shocks affecting the risk factors or other components that characterise the scenario. The analysis of historical behaviour of risk factors often helps identifying worst case scenarios and the probability associated with those scenarios, which can also serve as a benchmark for comparing the severity among scenarios. A severe scenario may not necessarily translate into material stress losses; “Sensitivity analysis” means the process of assessing the impact of a change of a single or limited set of risk factors, variables, assumptions or other factors; “Severe but plausible scenario”, means a shock or combination of shocks that has a low but non-zero probability of materialising and has the potential of imposing severe losses to portfolios, banks or banking systems; “Single-factor stress test” means an analysis of the impact of economic and/or financial vulnerabilities in a single risk factor;

4 “Solvency stress test” refers to the process of assessing the impact of an adverse stress scenario on a bank’s capital (e.g. economic, regulatory, etc.). The outcomes of solvency stress tests are often measured in terms of capital adequacy ratios, which may entail a comparison to minimum regulatory requirements and/or pre-defined capital hurdle rates; “Static balance sheet assumption” refers to the assumption that the size, composition and remaining maturity of a bank’s balance sheet (e.g. assets and liabilities) are invariant throughout the stress testing time horizon. This assumption is often made in order to provide greater comparability across banks in a stress test, or to facilitate the quality assurance of banks’ stress test results in the case of (constrained) bottom-up supervisory stress test. Under this assumption, a bank’s management also does not change the balance sheet in response to the adverse stressscenario. Furthermore, actions that affect equity, such as issuance of new capital or restriction to payment of dividends, are treated separately within the capital planning process. Such issuances should only be allowed to occur during the stress test time horizon if decided and implemented before the start of the stress test; “Stress test” refers to a forward-looking risk management tool used to estimate the potential impact under adverse events or circumstances on a financial system, sector, bank, portfolio or product; and “Stress testing framework” describes the context in which stress tests are developed, evaluated and used within the decision-making process. A stress testing framework includes elements such as governance, resources, documentation, policies, processes, infrastructure and methodology that may be in place to guide and facilitate the use, implementation and oversight of stress testing activities. Source: The stress testing taxonomy is based on Basel Committee on Banking Supervision, “Supervisory and bank stress testing: range of practices” (Bank for International Settlements 2017)

5 STRESS TESTING FRAMEWORK Principle 1 Stress testing frameworks should have clearly articulated and formally adopted objectives.

1. The bank’s stress testing framework should have clear objectives and be documented and approved by the board.
2. The objectives should be consistent with the bank’s risk appetite, risk management framework and its overall governance structure.
3. The objectives should be used for setting out the framework’s requirements and expectations.
4. Staff, senior management and directors involved in the implementation of the framework should have a clear understanding of the framework and its objectives. Principle 2 Stress testing frameworks should include an effective governance structure that is clear, comprehensive and documented.
5. The board should have the ultimate responsibility for the overall stress testing framework, including the oversight of the framework.
6. The board or the appropriate sub-committee of the board may delegate development and implementation of the stress testing framework. However, the board or the appropriate sub-committee of the board, should understand the framework and be able to challenge the models including the modelling assumptions, the scenario selection and the assumptions underlying the stress tests.
7. The board and senior management should ensure that the framework remains up to date and relevant for the purpose, and review and approve the framework at least annually.
8. The stress testing framework should, inter alia: (a) specify the roles and responsibilities of board, senior management, assurance functions (risk management, compliance and internal audit) and other stakeholders responsible for the ongoing operation of the stress testing framework including scenario development and approval, model development and validation, reporting, data quality control, challenge of results and the use of stress test outputs; (b) include relevant policies and procedures taking into consideration the requirements of this Guideline; and (c) ensure appropriate engagement and collaboration with necessary stakeholders to facilitate credible challenge of the framework including the assumptions, methodologies, scenarios and results, the assessment of its ongoing performance and effectiveness and the remediation of identified gaps.

6 Principle 3 Stress testing should be used as a risk management tool and for making business decisions. 9. Stress testing results may, inter alia, be used: (a) in formulating and pursuing strategic and policy objectives; (b) in the calibration of risk appetite and limits, financial and capital planning, liquidity, capital adequacy and funding risk assessment, contingency planning and recovery and resolution planning; (c) as an input to risk identification, monitoring and assessment; and (d) to support portfolio management and new trade/product approval processes, and to inform other corporate decision-making processes such as the evaluation of strategic options. 10. Stress tests should be undertaken at least once every six months. However, the relevance of the sensitivity and scenarios should be reviewed on a quarterly basis. Banks should conduct stress testing exercises more frequently in times of stress and, subsequent to or in anticipation of material events. 11. Stress test results should be reported to the board and senior management on a half-yearly basis. The reports should also cover the main modelling and scenario assumptions as well as any limitations of the models. Principle 4 Stress testing frameworks should capture material and relevant risks, as determined by a sound risk identification process and apply stresses that are sufficiently severe. 12. The risk identification process should be comprehensive and should cover risks derived from: (a) both on- and off-balance sheet exposures; (b) earnings vulnerabilities; (c) credit risks; (d) operational risks; (e) market risks; (f) climate-related and environmental risks; and (g) other factors that could affect the solvency or liquidity position of the bank.

7 13. The risk identification process should also consider potential areas of risk concentrations such as concentrations by facility type, customer category, industry sector or country. 14. Stress test scenarios should capture material and relevant risks. The scenarios should be sufficiently severe, varied and plausible. Key variables within each scenario should be internally consistent. The stress testing framework should have at least 3 scenarios based on different levels of stress, that is, a baseline scenario, a moderate scenario and a severe scenario. 15. Banks should, inter alia, consider single-factor stress tests, multi-factor stress tests, risk￾specific stress tests, sensitivity analysis as well as scenario analysis. Examples of factors which may be considered for stress testing scenarios are illustrated in Appendix I. 16. The risk identification process, the resulting scenarios, the rationale for including/excluding the identified risks as well as the limitation of the model and methodology used to assess the impact must be duly explained and documented. 17. The scenarios should address bank-specific vulnerabilities and take into consideration the bank’s strategic orientation, risk appetite and the current/emerging macroeconomic environment as well as relevant historical events and hypothetical future events. New and emerging risks and vulnerabilities should also be taken into account. 18. Stress tests should be conducted at relevant levels of the organisation (e.g. at a portfolio level, business unit level, etc.) depending on the objectives. 19. Banks having recourse to services supplied by third parties or by their respective parent bank for the conduct of stress testing, should ensure that the framework takes into account the specificities of the local context. Reverse stress testing 20. Banks should also conduct reverse stress tests to ascertain scenarios that could potentially cause them to fail, thus identifying their core vulnerabilities. As a minimum, reverse stress tests should consider the decrease in income and profitability that would cause concerns on the liquidity and capital positions of the bank, and the possible causes of such events. Principle 5 Resources and organisational structures should be adequate to meet the objectives of the stress testing framework. 21. The stress testing framework should ensure that there are adequate resources including staff with relevant skill set and appropriate systems/ IT infrastructure. 22. In case banks are having recourse to services supplied by third parties or by their respective parent bank to supplement internal resources, the framework should ensure that they have adequate oversight and control over the stress testing exercises, and adequate knowledge transfer over the services.

8 Principle 6 Stress tests should be supported by accurate and sufficiently granular data and by robust IT systems. 23. Banks should have an adequate data infrastructure which: (a) can collect, retrieve, process and report information used in stress tests to ensure that same can meet the objectives of the stress testing framework; (b) can support targeted or ad hoc stress tests; (c) ensures that the data is accurate, adequately quality assured and available at a sufficiently granular level and in a timely manner; (d) ensures that there is consistency of data sources, processing, and aggregation across stress tests; and (e) ensures that the data is coherent with their overall risk management framework. Principle 7 Models and methodologies to assess the impacts of scenarios and sensitivities should be fit for purpose and intended use of the stress tests. 24. Banks should ensure that: (a) the degree of sophistication of the models is commensurate for objectives of the exercise and the type and materiality of the risk; (b) the coverage, segmentation and granularity of the data and types of risk are in line with the objectives of the stress test framework; (c) models used for stress testing are justified and duly documented and that model overlays or expert judgements, if used, are justified, documented and subject to credible challenge, validation and/or independent review, as relevant; (d) there is an adequate model inventory and model management process as well as a robust model validation/ performance testing function; (e) linkages among models (for example, between solvency and liquidity stress tests) are considered; (f) there is appropriate collaboration and engagement among different experts and stakeholders to ensure that all stakeholders duly understand the risks being modelled, the business objectives, business drivers, risk factors, scenario severity and other information relevant for the stress testing; and (g) point-in-time static balance sheet approaches and more sophisticated dynamic balance sheet simulations are considered where appropriate.

9 Principle 8 Stress testing models, results and frameworks should be subject to challenge and regular review. 25. Regular independent review and challenge should be conducted to, inter alia, improve the reliability of stress test results, facilitate understanding of their limitations, identify areas for improvement and ensure that the results meet the objectives of the framework. 26. Banks should ensure that such reviews include: (a) a validation/ independent review of the key components of the stress testing process, such as the methodologies, the scenario assumptions and estimations of the stressed losses, revenues and liquidity forecasts, and whether the stress testing framework is maintained and regularly updated; (b) an assessment of the overall adequacy and effectiveness of the exercise, amongst others; and (c) backtesting where relevant. 27. Banks should ensure that there is adequate challenge at multiple points and at multiple levels including from the board and senior management of the bank. This should as a minimum cover, the plausibility of outcomes relative to market experience, the processes, assumptions (e.g. scenarios and sensitivities), the outcomes of the stress tests, the process in place for independent review and validation of the framework.

28. The internal audit function should regularly and comprehensively review the bank’s stress testing framework. DISCLOSURE
29. Banks may, at their discretion, publicly disclose results of stress testing. Such disclosures should include adequate and relevant details on, inter alia, the objectives, the framework, the limitations and the assumptions to ensure that market participants understand the information. REPORTING REQUIREMENT
30. Banks shall report on their stress testing exercise in such form and manner as may be prescribed by the Bank of Mauritius. Bank of Mauritius 23 June 2022

10 Appendix I – Illustrative examples of factors and scenarios for stress-testing Credit Risk Higher Non-Performing Assets (NPA) and provisioning • Overall increase in NPA by X% (baseline), Y% (moderate), and Z%(severe) for single customers as well as for groups of connected counterparties • X% increase in provisioning for stage 1, stage 2 and stage 3 exposures • X% increase in NPA in specific sectors/Top Sectors • Unwinding of COVID-19 measures and moratoriums of restructured exposures turning NPA o X% of Stage 1 migration to Stage 2 o X% of Stage 2 migration to Stage 3 o Reduction in collateral value by X% Liquidity Risk • Withdrawal of Top XX largest single customers • Withdrawal of Top XX largest Global Business Company customers • Withdrawal of Top XX largest Non-Resident customers • X% increase in run off rates in computation of Liquidity Coverage Ratio • X% increase of withdrawal in foreign currency deposits • X% increase of withdrawal in Global Business Company deposits • X% drop in value of liquid assets, including High Quality Liquidity Assets • X% increase in drawdown on off-balance sheet commitments Concentration Risk • Default by Top largest single counterparty • Default by Top largest groups of connected counterparties • X% increase in NPA/Default by Top sectors • Default by Top counterparty/ groups of connected counterparties by country • X notches downgrade in external/internal ratings of counterparties Interest Rate Risk • Change (increase/decrease) in interest rate Foreign Exchange Risk • X% depreciation/appreciation of MUR • Disruptions in Foreign Exchange Markets Operational Risk • Operational losses due to internal/external frauds, IT security breaches and cyber incidents including impact on Reputational risk Market Risk • Losses from adverse movements in market price of commodity, credit, equity, foreign exchange and interest rate risk factors

11 • Default of large counterparts/market participants Reverse Stress Testing Banks may conduct reverse stress testing to identify adverse movements in risk factors which would result in breach of minimum capital requirement and other regulatory requirements. Scenario Analysis In consideration of the COVID-19 pandemic and measures taken to support those impacted, the scenario designs should at least consider: (a) withdrawal of support measures, including moratoriums; and (b) potential increase in default rates, specifically with respect to moratoriums and other concessions which were granted in account of the COVID-19 pandemic. Banks may also simulate scenarios including an institution-specific crisis or general macro￾economic market crisis such as a delayed global/local recovery or prolonged lockdowns.