Circular dated March 9, 2016 regarding instructions for the internal assessment of capital adequacy

Mr. / Chairman of the Board of Directors

Bank 0000

Greetings,

In the context of the Central Bank of Egypt's strategy to pursue best international practices in banking supervision, the implementation of Pillar 2 of the Basel Accords, also known as the Supervisory Review and Evaluation Process (SREP), is hereby enacted. This aims to link the Bank's overall risk profile, the efficiency of its risk management system, and its capital adequacy.

Previously, you were provided on November 29, 2015, with a discussion paper explaining the concept of the Internal Capital Adequacy Assessment Process (ICAAP) and the role of both the concerned Bank and the supervisory authority. The attached instructions were prepared following a study of the banks' comments on that paper. In this regard, and in accordance with supervisory review principles, the Board of Directors of the Central Bank of Egypt issued the following decision at its session held on March 2, 2016:

"Approval of the attached supervisory instructions regarding the Internal Capital Adequacy Assessment Process (ICAAP), with the obligation for banks to comply with the following:

• Submission of the Internal Capital Adequacy Assessment Process report for each financial year within 90 days from the end of that year, as a maximum limit.

• During the current financial year, all banks are obligated to submit the report for that year before the end of March 2017, as a maximum limit.

• Possibility of application on an individual basis instead of the group basis, provided there are strong justifications, subject to obtaining approval from the Board of Directors of the Central Bank of Egypt through a request submitted to the Supervision and Inspection Sector, to be considered on a case-by-case basis."

Please be kind enough to emphasize full compliance with the aforementioned instructions.

Accept our highest regards,

Gamal Naguib

Supervisory Instructions Regarding the Internal Assessment of Capital Adequacy (ICAAP)

Table of Contents

No.	Page	Description
1	2	Introduction
2	2	Concept of the Internal Assessment of Capital Adequacy Process (ICAAP)
3	3	Basic Principles of the Internal Assessment of Capital Adequacy Process
4	4	Scope of Application of the Internal Assessment of Capital Adequacy Process
4	4	Periodicity of the Internal Assessment of Capital Adequacy Process
5	5	Role of the Bank in accordance with Supervisory Review Principles
5	5	Responsibility for Preparing and Approving the Report
6	6	Responsibility of the Board of Directors and Senior Management
14	14	Components of the Report
16	16	Role of the Supervisory Authority in accordance with the Attached Instructions

Introduction

In the context of the Central Bank of Egypt's pursuit of best international practices in banking supervision, the implementation of Pillar 2 of the Basel II Accords, also known as the Supervisory Review Process (SRP), is enacted, completing the currently applied Pillar 1 of the Basel II Accords.

Pillar 1 of the Basel II Accords addressed the minimum capital requirements that banks must hold to cover credit, market, and operational risks. However, it did not address many other fundamental risks associated with all bank activities, including those related to the economic climate. From this perspective, and in accordance with Pillar 2 of the Basel II Accords, each bank must ensure that it has a capital base commensurate with the significant risks it faces, whether under normal or adverse conditions during the conduct of its activities.

The Supervisory Review Process (SRP) aims to link the Bank's overall risk profile, the efficiency of its risk management system, and the adequacy of its capital. Therefore, each bank must apply an effective risk management system that ensures the identification, measurement, monitoring, and control of risks. It must also have an appropriate assessment process for planning the capital required to cover these risks.

The Supervisory Review Process includes four principles, as follows:

In accordance with the Basel II Accords:

Principle 1: Internal Capital Adequacy Assessment Process (ICAAP), which is conducted by the Bank itself.

Each bank must have a mechanism for a comprehensive assessment of the adequacy of its capital, consistent with its overall risk framework and a strategy for maintaining sufficient capital levels.

Principle 2: Supervisory Review and Evaluation (SREP), which is conducted by the supervisory authority - Attachment No. (1).

The supervisory authority must review and evaluate the results of the internal capital adequacy assessment procedures conducted by banks, as well as their strategies, and ensure their ability to monitor and comply with supervisory capital adequacy standards. If the review process reveals any deficiencies, the supervisory authority must take appropriate measures.

Principle 3: Dialogue between the supervisory authority and the concerned Bank.

The supervisory authority must encourage banks to maintain capital ratios exceeding the minimum supervisory capital ratio. The supervisory authority must have the authority to compel banks to hold capital higher than the minimum required.

Principle 4: Supervisory Measures.

The supervisory authority must intervene at an early stage to prevent capital from falling below the minimum requirements to cover the overall risk framework for each bank individually. The supervisory authority has the right to demand any bank to take corrective measures quickly if the required capital is not met.

Note that Principles 1 and 3 relate to what the supervisory authority expects from banks, while Principles 2 and 4 address the role of supervisory authorities in the supervisory review process.

1. Concept of the Internal Assessment of Capital Adequacy Process ICAAP

The Internal Capital Adequacy Assessment Process aims to ensure the availability of capital consistent with the Bank's overall risk profile (Risk Profile), taking into account the effectiveness of risk management procedures, the adequacy of internal control systems, and the strength of strategic planning.

It is essential to note in this regard that the Internal Capital Adequacy Assessment Process must be an integral part of the Bank's management process, not merely a report prepared by the Bank. It is a process that includes an assessment of policies and procedures for all activities, ensuring the achievement of the following:

• Identification, measurement, monitoring, and control of risks.

• Availability of sufficient capital commensurate with the Bank's overall risk profile.

• Soundness and effectiveness of risk management and monitoring methods.

• The extent to which the accepted risk appetite aligns with the Bank's strategy, capital and liquidity planning, and stress test results.

2. Basic Principles of the Internal Assessment of Capital Adequacy Process

1/2 Proportionality

The principle of proportionality is one of the most important principles in the Internal Capital Adequacy Assessment Process. Each bank must perform this process according to the size of its various activities, the risks it faces, and the complexity of its banking operations. This principle must cover, at a minimum, the following aspects:

• The suitability of the organizational structure for effective risk management and control systems.

• The methodology used to measure and assess risks and determine the capital required to cover them.

• Determining the type and nature of stress tests.

• Considering the degree of linkage between the total volume of risks and the capital required for them.

2/2 Integration with the Management Process and Decision-Making Culture

The Internal Capital Adequacy Assessment Process must be an integral part of the Bank's management process, policies, and internal procedures. This allows senior management to continuously assess the fundamental risks associated with the Bank's activities and thereby determine the capital required to face them and assist in making important decisions.

3/2 Comprehensiveness and Future-Oriented Risk View

The Internal Capital Adequacy Assessment Process must align with the Bank's overall risk framework and operational procedures. It must also have a comprehensive future vision of all fundamental risks included in both Pillar 1 and Pillar 2 of the Basel II Accords, as well as any other external risks related to the economic environment and banking activities.

4/2 Periodic Review

The Internal Capital Adequacy Assessment Process must be reviewed periodically to ensure the adequacy of available capital to cover the Bank's overall risk framework under various conditions. The Bank must conduct this review at least once a year. Appropriate modifications must be made if the Bank's strategy, business plan, or the environment surrounding banking activities changes, or if there are any changes with a tangible impact on the assumptions and methodology used in the Internal Capital Adequacy Assessment Process. The emergence of any new risks related to one of the Bank's activities (e.g., those resulting from issuing new products) must also be taken into consideration.

5/2 Efficiency of the Risk Measurement and Assessment Process

The Bank must have approved and documented policies and procedures for the risk measurement and assessment process. The Bank must use the results of the Internal Capital Adequacy Assessment Process to evaluate its strategy and determine the accepted risk volume. Priority must be given to quantitative methods for estimating capital requirements to face risks, as well as qualitative factors related to governance, risk management planning, and internal systems and controls, considering the direct relationship between the Bank's capital, its strategic planning, and the soundness and effectiveness of its risk governance and monitoring systems and procedures.

3. Scope of Application of the Internal Assessment of Capital Adequacy Process

The application of the Internal Capital Adequacy Assessment Process covers all banks operating in Egypt as follows:

1. On a Group basis: For banking groups dominated by banking activity, considered as a single operating entity. The Central Bank of Egypt may require the Bank to send separate reports for its subsidiaries if necessary, with the possibility of application on an individual basis if strong justifications exist for any of the banks.

2. On an Individual basis: For banks that do not have subsidiaries, including all of the Bank's domestic and foreign branches.

3. Regarding branches of foreign banks operating in Egypt: Although they are exempt from the supervisory ratio for capital adequacy, they are required to prepare the report in both its quantitative and qualitative aspects. Special attention must be given to the qualitative aspects by the supervisory authority when reviewing the Internal Capital Adequacy Assessment Process.

4. Periodicity of the Internal Assessment of Capital Adequacy Process

The self-assessment of capital adequacy relies on the implementation of governance and risk management and monitoring principles within the Bank. Therefore, this process must be continuous and approved and reviewed annually by the Bank's Board of Directors.

The banking group includes the Bank and all its domestic and foreign branches, as well as all other financial companies (excluding insurance companies) in which the Bank (or the Bank and its related parties) owns more than 50% of shareholders' equity or any percentage that enables it to control that entity.

Banks must submit the report regarding the Internal Capital Adequacy Assessment Process annually to the Supervision and Inspection Sector - Office Supervision Management - of the Central Bank of Egypt within a maximum period of 90 days from the end of the financial year. The Central Bank of Egypt must be notified of any fundamental changes that may occur during the year in the content of that report. Banks may be required to submit this report for any other time period if necessary, to be submitted within 90 days from the date of the request, as a maximum limit. The aforementioned report must explain how the Internal Capital Adequacy Assessment Process is applied to all Bank activities, the accepted risk volume, and the amount of capital estimated to face those risks.

5. Role of the Bank in accordance with Supervisory Review Principles

It is the Bank's responsibility to develop the Internal Capital Adequacy Assessment Process procedures. It is also the Bank's responsibility to demonstrate the comprehensiveness of this process and its suitability to the nature of risks associated with its activities and the conditions in which it operates, through dialogue with the supervisory authority.

The overall framework for the Internal Capital Adequacy Assessment Process must be designed to be commensurate with the size and nature of risks and capital planning. Therefore, Bank management must pay attention to qualitative aspects regarding risk management, as well as the effects of economic cycles, the degree of risk sensitivity, and any other external or internal factors.

The most important characteristics that must be present in the Internal Capital Adequacy Assessment Process are:

• It must be an integral part of the Bank's management process and decision-making culture.
• It must be reviewed periodically.
• It must be risk-based.
• It must be comprehensive.
• It must have a future vision.
• It must take into account the efficiency of the risk measurement and assessment process.

6. Responsibility for Preparing and Approving the Report

The primary responsibility for approving the overall framework for the Internal Capital Adequacy Assessment Process lies with the Bank's Board of Directors. In the case of branches of foreign banks operating in Egypt, it must be approved by the Regional Manager.

The responsibility for implementing and updating the Internal Capital Adequacy Assessment Process lies with the Chief Executive Officer to ensure its continuous alignment with all Bank activities and with the conditions in which it operates. Since this report is prepared using multiple inputs from various departments and responsible persons, the departments and individuals responsible for its preparation must be clearly identified in the report submitted to the Central Bank of Egypt for reference if necessary.

In this regard, it is emphasized that the report must be approved by the Bank's external auditors after its preparation, similar to the financial statements.

7. Responsibility of the Board of Directors and Senior Management

1/7 Responsibility of the Board of Directors

The Board of Directors must ensure the following:

• The alignment of risk management policies and procedures with the Bank's overall risk framework and strategic plans, and ensuring that Bank policies cover all activities and products.

• The Bank's strategic plan must clearly include the current required capital volume and the target capital level, in addition to expected capital expenditures and external capital sources, consistent with strategic goals, taking into account the dividend distribution policy and targeted growth rates.

• Senior Bank Management performing the tasks assigned to them within the responsibilities and authorities delegated by the Board of Directors, consistent with the overall risk management framework, policies, and standards approved by the Board of Directors in this regard.

The Board of Directors must disclose how it ensures the following:

• The suitability of risk measurement and management methods with the degree of complexity of the Bank's activities and the risks it faces.

• The adequacy and effectiveness of internal control systems to ensure the quality of managing the Bank's activities, products, and risks arising therefrom.

• The alignment of the target capital base level with the Bank's overall risk framework and the economic environment in which it operates.

• The application of suitable and credible policies and procedures to identify, measure, monitor, and report all fundamental risks.

2/7 Responsibility of Senior Management

Senior Bank Management is responsible for monitoring and managing all the Bank's activities and operations on a daily basis, and for establishing risk management procedures consistent with the accepted overall framework approved by the Board of Directors.

8. Components of the Report

The format and contents of the Internal Capital Adequacy Assessment Process report may vary depending on the size of the Bank and the complexity of its operations. However, the report must include, at a minimum, the following information:

1/8 Report Summary

This section contains a general overview of the Internal Capital Adequacy Assessment Process and the main results discussed in detail in the following sections of the report.

2/8 Comprehensive View of Business Strategy and Future Expectations for the Balance Sheet and Income Statement for a Period

ranging between 3-5 years.

This section begins with a summary of the Bank's current performance, including a comprehensive analysis of profits and losses, return on equity, and the general structure of financial positions and their development over a previous period ranging between 3-5 years. It must also include a summary of strategic priorities for the next 3-5 years regarding planned growth areas, geographical expansion, activities and products, and targeted business sectors, distinguishing between local and international operations.

A strategic work plan must be presented, including the income and balance sheet statements and the expected dividend distribution plan for the next 3-5 years, supported by the assumptions used in preparing that plan.

3/8 Governance and Overall Risk Management Framework

This section contains the qualitative aspects of the Internal Capital Adequacy Assessment Process, regarding governance and risk management and monitoring, in accordance with the governance instructions and internal control instructions issued by the Central Bank of Egypt.

1/3/8 Governance

This section specifically summarizes the Bank's organizational structure and the governance policy followed, including:

a- The Board of Directors:

• Composition of the Board of Directors.
• Sub-committees of the Board.
• Authorities of the Board of Directors.
• Policy for determining authorities and responsibilities for executive management.
• Reports and information provided to the Board and its sub-committees.

b- The Organizational Structure:

• Organizational structure of senior management (starting from executive directors).
• Responsibilities of senior management.
• Committees formed in the Bank (membership, role, authorities).

2/3/8 Overall Risk Management Framework

A comprehensive description of the overall risk management framework must be included, which must include, at a minimum, the method prescribed for managing each type of fundamental risk in detail, in terms of identification, measurement, monitoring, and control of those risks, as well as how tasks and responsibilities related thereto are delegated through the following:

a- Separation of Functions Related to Risks

Separation of functions/tasks related to different risk management authorities is a fundamental requirement to ensure sound management of the Bank's risks, as follows:

First: Business Lines: The responsibility for risk management lies primarily with the business lines. Decision-makers regarding risks in the context of ongoing activities must be clear. Therefore, the nature of those activities and associated risks must be clarified, as well as the person responsible for managing those risks, and whether there are supporting functions in this regard.

Second: Risk Management: This department is responsible for proposing and developing risk policies. These policies must be approved by the competent authority, in addition to ensuring that staff in various Bank departments (business lines) comply with those risk policies and procedures. The mechanisms specialized in managing and monitoring risks aim to address the risks faced by the Bank through appropriate assessment.

Third: Compliance Management: The role of the compliance function should not be limited to assessing the impact of changes in the surrounding environment on the Bank's activities, but should also extend to verifying that new products and procedures align with the currently applicable legal environment. It is also among the main tasks of the compliance function to create a suitable internal environment that supports a culture of compliance, and to provide adequate training to employees to keep them informed of current and new instructions continuously, with the aim of reducing compliance risks.

Fourth: Internal Audit (Inspection): This department is specialized in reviewing the work and activities of all Bank departments, including risk management, compliance management, and assessing the adequacy of current policies, procedures, and controls. This section must also ensure the adequacy and efficiency of internal audit staff in performing their assigned tasks in this field.

It should be noted that the details of subjects examined by internal audit regarding risk management may include, for example:

• The extent of compliance with internal risk management rules (limits, procedures).
• The effective and appropriate use of risk management tools by the Bank as a whole.
• Review of supervisory functions for managing and monitoring risks, and evaluating their efficiency.
• The suitability of information technology systems used in managing and monitoring risks.
• Evaluation of risk measurement methods.

The results extracted from internal audit reports regarding various risks and proposed corrective measures (if any) must also be clarified, along with identifying the entities within the Bank to which this report is submitted.

b- Statement of Risk Level

The risk level in the Bank is presented within the Internal Capital Adequacy Assessment Process report in the following framework:

• Maximum Risk Tolerance: Which represents the maximum quantitative amount of risk the Bank can bear given its available capital resources without threatening the Bank entity.

• Accepted Risk Appetite: Which includes a complete description of the type of risk the Bank is willing to take in order to achieve its strategic goals and reach targeted profits.

The methodology for approving risk policies followed within the Bank must be clarified, which distinguishes between policies falling within the authorities of the Board of Directors and those delegated to senior management or committees to make the appropriate decision regarding them.

It is also necessary to determine how those policies are applied practically, especially regarding how the total risk limits set by the Board of Directors are distributed across different activities to align with the Bank's total maximum and accepted risk volume, whether under normal or adverse conditions.

A summary of each type of fundamental risk must be presented, with a clear specification of tools and risk assessment methods, root causes, required reliance level, risk monitoring and control systems (such as risk matrices), accountability, and supporting information technology systems for decision-making.

d- Risk Monitoring and Reporting

The availability of a strong information management system is a fundamental requirement for monitoring and reporting risks and assessing the Bank's capital needs. The information management system applied in the Bank must include early warning indicators showing deviations from the target capital. It must also include a governance mechanism that ensures the periodic application of stress tests and the taking of corrective measures when necessary.

The periodicity of reports provided to both the Board of Directors and Senior Management depends on the type and level of risks and their degree of impact on the Bank's activities. These reports must enable both the Board of Directors and Senior Management to do the following:

• Evaluate the level and direction of fundamental risks and their impact on capital levels.
• Evaluate the main assumptions used in the capital assessment/measurement system.
• Determine if the capital held by the Bank is sufficient to face different risks and aligns with the applied capital adequacy ratios.
• Evaluate future capital requirements based on the Bank's risk structure and make adjustments to the Bank's strategy accordingly.

3/3/8 Overall Assessment

The Board of Directors must assess the adequacy of the governance framework, risk management system, and its supervision in light of the Bank's overall risk framework, consistent with supervisory requirements. In case of any deficiencies or weaknesses, they must be focused on and the measures taken by the Bank to address them must be stated.

Explanation of the Risk Matrix

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 120,338-character original (20% of the document). The remainder was not translated. The complete original-language text is stored with this document.]