Circular Letter No. 1/2006/DSB: Informal Application Process for Internal Ratings Systems (Credit Risk) and Standard/Advanced Measurement Approaches (Operational Risk)

Bank of Portugal
Circular Letter No. 1/2006/DSB, of 2006-01-03
SUBJECT: Commencement of the Informal Application Process for the Use of Internal Ratings Systems (credit risk) and Standard and Advanced Measurement Approaches (operational risk)

The proposed amendments to Directives 93/6/EEC and 2000/12/EC foresee the possibility for institutions/groups to have credit and operational risk quantification models recognised for regulatory purposes. Specifically, such recognition may occur from the beginning of 2007 – in the case of Internal Ratings Systems without own estimation of 'loss given default' (LGD) and 'conversion factors' (CF), for credit risk – and from 2008 – in the case of Internal Ratings Systems with own estimation of 'LGD' and 'CF' and the Advanced Measurement Approach (AMA). The same regulatory proposals also foresee minimum requirements for access to the Standard Approach, within the scope of operational risk, from 2007.

Considering the timeframe required for the transposition of those Directives and for meeting the conditions for their operationalisation, it becomes necessary to initiate an informal approval process, even before institutions/groups submit formal applications for the use of the aforementioned systems or approaches. Indeed, since the formal reception of applications will only be possible once the Directives have been transposed, compliance with the outlined deadlines implies anticipating the validation work, with its formalisation at a later stage.

In this regard, the Bank of Portugal, through this Circular Letter, expresses its availability to initiate the (informal) application process for the use of Internal Ratings Systems – without or with LGD and CF estimation – and the Standard and Advanced Measurement Approaches, these within the scope of operational risk.

The (informal) applications now initiated – to be formalised at a later stage – constitute the first step of the informal approval process for internal risk quantification approaches and the use of the Standard Approach (operational risk), which should successively include, as far as foreseeable, bilateral meetings and validation actions, as well as a preliminary assessment of their use for regulatory purposes.

For the efficient planning of resources to be allocated, institutions/groups must communicate the following information to the Bank of Portugal (Banking Supervision Department) within fifteen days from the date of publication of this Circular Letter:

• Systems and approaches covered, with the necessary detail per legal entity integrated into the same Group (if applicable) and per portfolio;
• Prudential regime to be used throughout the year 2007, in the case of institutions/groups intending to apply for Internal Ratings Systems with own estimation of LGD and CF and/or the Advanced Measurement Approach (operational risk);
• Date on which the elements that must accompany the (informal) application are expected to be available, as provided in the Annexes to this Circular Letter.

The (informal) application must be submitted by letter, accompanied by an Opinion from the supervisory body, specifying the following aspects:

• Approaches for which they are applying (per legal entity and per portfolio) and highlighting situations involving the participation of other supervisory authorities, when they include entities integrated into the same Group;
• Explanation of the reasons for the request;
• Person responsible for contacts with the Bank of Portugal.

Together with the letter, the elements identified in Annex 1 of this Circular Letter must be submitted, as well as the elements/documentation applicable to the approach(es) for which the institution/group is (informally) applying: Internal Ratings (Annex 2), Advanced Measurement (Annex 3), and Standard (Annex 4).

Finally, it is important to reiterate that the procedures established above, for the purpose of informal application, do not prejudice the formal process that will begin after the community directives have been transposed, which will be indispensable for the communication of the formal decision by this Bank.

__________________________________________________________________________________ Sent to:
Credit Institutions, Other Financial Companies, Financial Companies and Holding Companies.

Annex 1 – Elements to be Provided in the Informal Application Phase
(Common Component)
Response to the following questionnaire:

• Description of the institution/banking group, detailing the activity of each entity included in the consolidation, with a summary table (for example, in terms of contribution to assets or, if applicable, in terms of risk-weighted assets).
• Organizational structure describing the responsibilities and functions of the various areas involved in the management and control of various risks, as well as established/to be established structures.
• Units responsible for the development and validation of internal risk quantification systems and/or approaches.
• Human and material resources plan involved, with special emphasis on IT and internal audit resources.
• Self-assessment of the banking institution/group's ability to ensure compliance with the requirements (in the Directive amending Directive 2000/12/EC) for the use of methodologies for determining own funds requirements and/or the Standard Approach (operational risk).
• Currently published information and plans for compliance with the disclosure requirements provided in the Directive amending Directive 2000/12/EC, involved in the approach for which the institution/group is (informally) applying.

Annex 2 – Informal Applications for the Use of the Internal Ratings Approach
(Minimum Content of Elements/Documentation to be Submitted)

1. Response to the following questionnaire:

• Approach (expected to be) applied in the institution/group or in each entity of the Group for different asset classes, regarding credit risk, on the (expected) effective date of the new regulatory provisions.
• If applicable, for subclasses where the application of an approach different from that foreseen for the (expected) effective date of the new regulatory provisions is anticipated in the future, specification of the foreseen deadlines (roll-out) and work plans.
• Percentage of coverage of risk exposures included in the Internal Ratings System for which the institution/group is informally applying, with respect to the Group total, referring both to the present and to the (expected) effective date of the new regulatory provisions.
• Definition of the models to be applied to different classes, specifying the current percentage of risk exposures covered by each model in relation to the total and the forecast timing for achieving total coverage. For each model, specify:
• Implementation date of the internal rating system.
• Use of the rating system – use test – (granting, limit setting, pricing,).
• Regarding the data used to estimate risk parameters, specification of the historical depth of internal databases and the eventual use of external data.
• Methodology used in portfolios with a reduced or zero number of defaults.
• Description of the methodologies used in the validation of internal rating systems, as well as the main results obtained and any measures implemented to correct any detected deficiencies.
• Internal assessment of the technological context and applications that enable the effective "functioning" of internal models and systems and procedures to ensure the integrity and consistency of the databases used.
• Indicate whether the need to use the transitional provisions established in the Directive on the use of internal systems and on the temporal depth of databases is foreseen, with respective detail by classes.
• Approach adopted for the treatment of risk mitigation techniques.
• Approach adopted for the treatment of securitisation positions.
• Definition of default used, with detail of the qualitative criteria considered.

2. Documentation on internal rating systems in use or planned for use:

• List of all internal documents that the institution/group considers relevant for the application, including a brief description of their contents.
• Map of models (identification of the type of risk exposure and legal entities covered or to be covered by each rating system) that the institution/group will use in each of its portfolios.
• Generic description of each model, namely, types of data used, definitions, classifications, and methodologies employed, as well as quantitative and qualitative assessments.
• Additional information on:
• Definitions of default and loss.
• Main characteristics of the risk rating process.
• Models provided by third parties.
• Differences between the calculation of requirements for internal and regulatory purposes.
• Model validation processes – namely, "back-testing" and "benchmarking".

3. Description of implementation and control procedures, as well as technological infrastructures, including:

• Use of different models for management purposes.
• Organisation of the rating assignment process.
• General information on the technological structure.
• Internal audit reports (if applicable).

4. Implementation plan and details on permanent partial use:

• The Implementation Plan, which includes «roll-out» (if applicable), must be detailed, at least, by classes of risk exposure and by parameter(s) to be estimated. Emphasis should be placed on timings and adopted rules, in addition to the identification of portfolios permanently exempt from the Internal Ratings approach.

Annex 3 – Informal Applications for the Use of the Advanced Measurement Approach
(Minimum Content of Elements/Documentation to be Submitted)

1. Response to the following questionnaire:

• Approach (expected to be) applied in the institution/group or in each entity of the Group regarding operational risk, on the (expected) effective date of the new regulatory provisions.
• If applicable, identification of the main operational risk mitigants to be used.
• Characterisation of any contingency plans outlined/implemented.

2. Documentation on operational risk quantification and management systems in use or planned for use:

• List of all internal documents that the institution/group considers relevant for the application, including a brief description of their contents.
• Map of models (identification of the type of activities and/or operational risks covered or to be covered by each model) that the institution will use.
• Generic description of the model(s), namely, types of data used, definitions, classifications, and methodologies employed, as well as quantitative and qualitative assessments.
• Allocation of own funds requirements for operational risk among Group entities.
• In the event that the institution/group uses risk mitigation instruments, information on coverage and quantification of expected loss, on insurance policy, or on other risk transfer mechanisms.

3. Description of implementation and control procedures, as well as technological infrastructures, including:

• Internal use of the operational risk quantification and management system.
• Classification of the type of events covered.
• Organisation of the modelling process.
• General information on the technological structure.
• Internal audit reports (if applicable).

4. Implementation Plan:

• The Implementation Plan, which includes «roll-out» (if applicable), must be detailed, at least, by lines of activity, highlighting the timings and adopted rules.

Annex 4 – Informal Applications for the Use of the Standard Approach – operational risk
(Minimum Content of Elements/Documentation to be Submitted)

1. Response to the following questionnaire:

• For segments where the application of an approach different from that foreseen for the effective date of the new regulatory provisions is anticipated in the future, specification of the foreseen deadlines (roll-out) and work plans.
• Documentation on the policies and specific criteria for assigning indicators related to various segments and activity sectors.
• Information related to compliance with eligibility requirements, namely, operational risk assessment and management system, assigned responsibilities, significant loss data, and integration into the institution/group's risk management processes.

2. Documentation on operational risk management systems planned for use:

• List of all internal documents that the institution/group considers relevant for the (informal) application, including a brief description of their contents.
• Allocation of own funds requirements for operational risk among Group entities.

3. Regarding the operational risk assessment and management system, identification of control and implementation procedures, as well as technological infrastructures, including:

• Responsibilities of the parties involved.
• General information on the technological structure.
• Internal audit reports (if applicable).