Central Bank of Jordan Instructions on Stress Testing for Banks Operating in Jordan No. (2016/1)

15779/2/23 1438/03/06 AH 2016/12/06 AD Instructions on Stress Testing for Banks Operating in Jordan No. (2016/1) Issued by the Central Bank of Jordan pursuant to the provisions of Article 99(b) of the Banks Law No. 28 of 2000 and its amendments.

2 Table of Contents: Introduction 2....................................................................................................... First: Objectives of Stress Testing: 3..................................................................... Second: Governance of Stress Testing: 4................................................................... Third: Design of Stress Testing 6.................................................................... Fourth: Measures to be Taken by the Central Bank: 9................................................................ Fifth: Review of Stress Testing and its Frequency: 9................................................. Sixth: General Provisions ........................................................................................ 10

3 Introduction Stress testing is an important tool used by banks to measure their ability to withstand shocks and high risks that they may face. These tests aim to evaluate the bank's financial position under scenarios that are severe but possible. Stress testing has a future-oriented dimension in risk assessment, employing methods that go beyond statistical approaches based on historical information. Furthermore, these tests help the Board of Directors and Senior Executive Management understand the bank's conditions during crises. While stress testing is an essential part of the risk management process, it cannot alone cover all aspects of a bank's weakness; rather, it operates within an integrated risk management policy to enhance the safety and resilience of banks and strengthen the financial system as a whole.

The Central Bank of Jordan had previously issued Stress Testing Instructions No. (2009/46) dated 2009/9/30. This subject has witnessed significant developments since then, especially after the recent global financial crisis. The Basel Committee on Banking Supervision issued the Core Principles for Stress Testing and Supervision in 2009, and the Committee issued a paper in 2012 on the review of the application of these principles by supervisory authorities. Additionally, the International Monetary Fund developed comprehensive methodologies for conducting these tests. Consequently, supervisory authorities in countries worldwide and relevant international institutions have focused on the necessity of adhering to these principles. In light of these developments, the issuance of these instructions by the Central Bank aims to keep pace with the latest developments in this field and align with global best practices.

First: Objectives of Stress Testing Stress testing is used to achieve the following objectives:

1. Identifying and Controlling Key Risks: Stress testing is an essential part of the bank's risk management processes at all levels. Its purpose is to identify the risks facing the bank, focus on these risks, and assess their potential impacts. These tests serve as a key quantitative tool for understanding the bank's risk profile and its ability to face various types of shocks.

2. Assisting in Capital Planning: Stress testing forms an important part of the capital planning process through the Internal Capital Adequacy Assessment Process (ICAAP). These tests provide tools to evaluate the adequacy of the bank's internal capital to face all material risks and potential financial shocks. They also help the bank estimate the volume of future capital that must be available in the coming years.

3. Assisting in Liquidity Management: Stress testing is an important part of identifying, measuring, and controlling liquidity risks, specifically to evaluate the bank's liquidity and the adequacy of liquidity shock mitigants.

4. Stress testing is a complementary tool to other risk management instruments such as Value at Risk (VaR) and Economic Capital, which are based on historical data and statistical relationships, and do not replace them.

5. Providing detailed data on: the bank's risk exposure, the bank's business model, the bank's risk system, and providing a comprehensive analysis of the bank's weaknesses.

6. Enhancing Public Confidence in the Stability of the Banking Sector: This is achieved by publishing stress test results at the level of the entire banking sector, thereby reassuring citizens that the sector is capable of withstanding shocks and high risks.

Second: Governance of Stress Testing

1. Stress testing must form an essential part of risk governance and the bank's risk management culture. This aims to enhance the bank's ability to identify and control risks, including the use of these tests in managing credit risk, investment portfolio risk, and risks related to specific bank activities or the bank's overall strategy. Test results must be used in decision-making at the appropriate administrative levels, including strategic decisions by the Board of Directors and Senior Executive Management.

2. Role of the Board of Directors and Senior Executive Management:

1-2 Role of the Board of Directors:

• The Board must ensure the existence of an effective framework for stress testing to evaluate the bank's ability to withstand shocks and face high risks. The Board bears ultimate responsibility for the bank's stress testing program.
• The Board must ensure that the Risk Management Department conducts stress tests periodically. The Board plays a key role in approving the assumptions and scenarios used, analyzing test results, and approving measures to be taken based on these results.

2-2 Role of Senior Executive Management:

• Execute and monitor the stress testing program in accordance with the methodology approved by the Board of Directors.
• Ensure that the Risk Management Department has qualified staff to conduct stress tests and possesses the appropriate tools and means for this purpose.
• Ensure the availability of an appropriate number of potential scenarios related to the bank's business, ensuring these scenarios are understood and documented.
• Use stress test results in setting and determining the bank's risk appetite and in capital and liquidity planning processes.

3. Internal Policies, Procedures, and Documentation: Stress testing must be governed by internal policies and procedures approved by the Board of Directors and documented appropriately. Documentation must include the following: a. The type and details of stress tests and scenarios used, and the main objective of each type of test. b. Reasons for selecting tests and the role and opinion of bank experts in this selection. c. Annual evaluation (at least) or evaluation based on changing external circumstances of the basic assumptions underlying the tests, and documentation of the evaluation results. d. The frequency of conducting stress tests within the bank, which may vary depending on the type of test and its objective. e. Details of the methodologies used to determine scenarios and the calculation processes used to derive results. f. Corrective measures to be taken based on the objective, type, and results of the tests, and an evaluation of the feasibility of these measures in the event of stress conditions.

1 For branches of foreign banks operating in the Kingdom, internal policies and procedures are approved by the Regional Manager.

4. Appropriate Infrastructure:

1-4 The bank must have appropriate infrastructure to conduct stress tests accurately and comprehensively, including at a minimum: qualified staff, a sufficient database in terms of accuracy and comprehensiveness, and appropriate management information systems (MIS). The bank must dedicate sufficient resources to maintain and develop this infrastructure to enable periodic updates of methodologies to apply new scenarios when needed. The infrastructure must be flexible enough to allow stress testing at the level of a specific bank activity or the bank as a whole.

2-4 The information systems used by the bank must be commensurate with the size, nature, and complexity of the bank's business and its risk structure.

3-4 The bank must have an appropriate mechanism to provide periodic reports on tests and their results to Senior Executive Management and the Board of Directors in a timely manner.

4-4 Although the design and implementation of stress testing is an internal process, the bank may decide to outsource certain processes, such as program design, methodology review, and validation. In such cases, the bank must clearly define and document the activities to be performed, be able to understand and evaluate the results of external sources, and ensure that all work completed by external sources falls within the overall risk management framework of the bank. Additionally, the bank must take measures to maintain banking confidentiality in accordance with prevailing laws and regulations.

Third: Design of Stress Testing

1. Designing a stress testing program and using models and methodologies to test their impact on the bank and utilize the results requires collaboration among various experts and stakeholders in the bank. The Risk Management Department must organize appropriate dialogue among relevant parties to consider their views on potential shocks and stress scenarios. This aims to identify assumptions and scenarios suitable for internal and external risks the bank may face. All relevant parties in the bank should participate in this dialogue, such as: risk management officials, economists, heads of research and studies departments, heads of facilities, treasury, and finance departments, etc.

2. The stress testing program must include quantitative and qualitative methods to improve the comprehensiveness of these tests and make them supportive and complementary to the models and risk management methods used in the bank. Tests should range from simple sensitivity tests based on changes in a single risk factor to scenarios based on statistical methods that consider relationships between systemic risk drivers during crises.

3. Banks must consider two types of tests within their stress testing program: Sensitivity Analysis tests and Scenario Analysis tests.

1-3 Sensitivity Analysis Tests:

1-1-3 Sensitivity analysis tests are used to measure the impact of movements in risk factors - individually - on the bank's financial position, such as: an increase in non-performing loans, changes in interest rates, changes in exchange rates, changes in stock prices, etc. The source of the shock (the source generating this type of risk) is usually not specified in these tests, nor are relationships and interdependencies between different risk factors considered. These tests aim to determine the sensitivity of the bank's financial position to a single risk factor and evaluate the bank's ability to face it.

2-1-3 The bank must identify relevant risk drivers that could affect the bank, particularly risks related to macroeconomic variables such as: interest rates and exchange rates; credit risks such as: an increase in non-performing loans or an increase in the probability of customer default (PD); financial risk factors such as: increased volatility in financial markets; operational risk factors such as: internal bank fraud, natural disasters, bank robbery, communication system failure, etc.

3-1-3 The bank must conduct stress tests on the identified risk factors using different degrees of severity, determined based on historical data and previous experiences at the bank or the economy in general, supported by reasonable assumptions.

4-1-3 The bank must conduct sensitivity analysis tests at several levels within the bank, including tests at the level of individual exposures, portfolio level, business line level, or the bank as a whole.

5-1-3 Sensitivity analysis tests that banks must perform include: credit risk, concentration risk, market risk, operational risk, and liquidity risk.

The Central Bank will annually provide banks with the sensitivity analysis tests to be performed, taking into account risk developments at the local, regional, and international levels. New tests may include different levels of severity compared to previous tests, and tests may be changed partially or completely if there are significant economic or financial developments.

2-3 Scenario Tests: These tests evaluate the impact of scenarios that may have a low probability of occurrence but a significant impact on the bank's financial position if they occur. Generally, scenario tests must include two types of tests: First - Tests based on historical events that occurred either in Jordan or in other countries (e.g., the 1988-1989 currency crisis, the global financial crisis, etc.). Second - Hypothetical tests that could occur (e.g., a sharp decline in GDP growth rate, an increase in unemployment rate, an increase/decrease in interest rates, etc.).

Generally, hypothetical tests involve fundamental changes in macroeconomic variables that may have negative effects on the bank's conditions, such as an increase in non-performing loan ratios, thereby reducing bank profitability and affecting its solvency. Additionally, hypothetical tests may include factors that sharply affect the bank's liquidity.

Among the most important macroeconomic variables that can be taken into account in building hypothetical tests are the following: a. A decrease in the GDP growth rate (economic growth rate). b. An increase in unemployment levels. c. An increase/decrease in inflation rates. d. An increase/decrease in interest rates. e. A decrease in stock prices. f. An increase/decrease in oil prices in global markets.

The Central Bank will annually provide banks with the scenario tests to be performed, taking into account risk developments at the local, regional, and international levels. New tests may include different levels of severity compared to previous tests, and tests may be changed partially or completely if there are significant economic or financial developments.

Fourth: Measures to be Taken by the Central Bank

1. If test results indicate a weakness in the bank's capital or liquidity, the Central Bank will request the bank to provide information on the measures it will take to enhance its capital or liquidity.

2. The measures the bank will take based on stress test results must be commensurate with the severity of the test impacts and the overall risk management framework and risk hedging policy.

3. If the Central Bank is not satisfied with the adequacy of the measures to be taken by the bank, the Central Bank may take any measure to reinforce the bank's capital or liquidity, including imposing restrictions on the bank's dividend distribution.

Fifth: Review of Stress Testing and its Frequency

The Internal Audit Department is responsible for reviewing and evaluating the stress testing framework at least annually and submitting the evaluation and review results to the Board of Directors. The evaluation and review process must include the following:

1. The operational framework for stress testing at the bank to determine the efficiency and effectiveness of this framework and the need to modify any part of it. The review must cover the following matters: a. The extent to which the program achieves its objectives. b. The assumptions used in building stress tests. c. The realism of the tests applied. d. The application of systems used in preparing tests. e. Management supervision. f. The quality of data and management information systems. g. Documentation.

2. Ensuring that stress testing methodology update procedures are clearly documented and implemented as specified.

3. Evaluating the accuracy of calculations in stress tests and the accuracy of data used in models.

Sixth: General Provisions

The bank must observe the following:

1. Stress tests must include scenarios ranging from the least impactful to the most impactful, including scenarios that may determine the bank's solvency and ability to continue operations. This aims to identify latent uncovered risks and consider the level of impact of potential scenarios on the bank's financial position, either through the volume of expected loss and/or through the impact on the bank's reputation.

2. Use stress test results to develop emergency plans to deal with various risks and activate the use of risk mitigation tools such as hedging, netting of balance sheet items, and accepted guarantees. At the same time, evaluate the effectiveness of using these tools during difficult financial and economic conditions.

3. Develop methodologies to measure the impact of reputation risk expressed through other risks such as credit, market, and liquidity risks by including stress tests for some scenarios related to reputation risk.

4. Use stress test results to identify, monitor, and control concentration risks. To do this correctly, selected scenarios must be at the level of the bank as a whole and at the level of certain business lines, covering on-balance sheet and off-balance sheet assets. These tests must consider potential changes in market conditions that may negatively affect the bank's exposure to concentration risks.

5. Stress tests must cover all complex financial products as needed. Banks must avoid the mistake made in the recent financial crisis, where banks estimated the risks of financial products relying solely on external credit ratings or historical data of similar financial products. These methods are insufficient and do not cover all risks associated with complex financial products in severe crisis conditions.

6. Stress tests must include scenarios to evaluate the volume and impact of off-balance sheet assets on other types of risks, especially credit, market, and liquidity risks, and their impact on the bank's solvency and liquidity.

7. The Central Bank will regularly and comprehensively evaluate the stress testing framework conducted by banks to ensure banks' compliance with the standards contained in these instructions, particularly regarding the role of the Board of Directors and Senior Executive Management in these tests, the bank's ability to integrate these tests into its risk governance and risk management processes, and the use of results in decision-making at various administrative levels in the bank, including strategic decisions. This aims to enhance and activate risk management in banks.

8. The Central Bank will evaluate banks' compliance with best practices in stress testing, including instructions issued by external regulatory authorities regarding banks with external presence.

9. Tests used must be commensurate with the risk appetite defined by the bank itself. Selected scenarios by the bank must be commensurate with the size, nature, and complexity of the bank's business and associated risks.

10. The Central Bank may request banks from time to time to conduct stress tests for specific financial products or apply tests to evaluate weaknesses at the level of the entire financial system.

11. Results of stress tests must be taken into account in developing the bank's recovery plans, which are part of the business continuity plan. These plans are used to manage any bank's risks, whether internal or external. Their importance lies in being a tool that helps the bank continue after severe events and reduces the impact of negative events on it.

12. These instructions shall enter into force from their date, and anything inconsistent with them is repealed.

Dr. Ziad Faris