Circular Letter No. 3.695

The Deputy Head of the Department of Banking Supervision (Desup), using the attribution conferred by art. 22, item I, subitem "a", of the Internal Regulations of the Central Bank of Brazil, annexed to Administrative Rule No. 29.971, of 4 March 2005, RESOLVES: Art. 1 The document "Information on the Internal Market Risk Model" referred to in item III of the Sole Paragraph of art. 30 of Circular 3.646, of 4 March 2013, is available in the Annex to this Circular Letter. Art. 2 This Circular Letter enters into force on the date of its publication. Art. 3 Circular Letter No. 3.688, of 29 December 2014, is revoked.

Carlos José Braz Gomes de Lemos ANNEX Information on the Internal Market Risk Model I – INSTRUCTIONS The following information must compose a report to be provided by financial institutions that apply for authorization to use internal market risk models to calculate the daily amount referring to the RWAMINT portion of risk-weighted assets (RWA), referred to in Resolution No. 4.193, of 1 March 2013. 1- The concepts used refer to those in Circular No. 3.646, of 4 March 2013. The institution must describe, clearly and succinctly, the practices and procedures that demonstrate compliance with the minimum requirements set forth in the aforementioned circular. 2- If different internal market risk models coexist within the scope of application, for example, for different business units or for different types of risk, a set of information must be provided for each model. 3- For each item, sufficient information must be provided for proper understanding, and references to external documents, whether annexed or not, are prohibited, except in cases explicitly requested or absolutely necessary. 4- The report and all requested annexes must be provided, on password-protected digital media, to the headquarters of the Department of Banking Supervision – Desup, located at Avenida Paulista 1.804, 15th floor, São Paulo - SP. A printed copy of the report must also be delivered, without the annexed documents cited in Section IV. 5- Although the application may be made by a prudential conglomerate, the generic nomenclature of "institution" was adopted in this document for simplicity. 6- In this document the word risk refers to market risk. 7- Additional information on processes, procedures and calculation methodologies, as well as reports and other evidence related to market risk management, may be requested at any time by the Central Bank. 8- This report must be accompanied by the other documents mentioned in article 30 of Circular No. 3.646. 9- Questions regarding the preparation of the report may be addressed with the supervisor responsible for the financial institution.

II - IDENTIFICATION OF THE INSTITUTION Name of the institution or conglomerate; Name and telephone of the director responsible for market risk management, as established in article 10 of Resolution No. 3.464, of 26 June 2007; Name, position and telephone of the contact person for questions related to this application. III – INFORMATION 1. Scope of application 1.1 Coverage Companies of the conglomerate with relevant exposure to market risk, justifying the relevance. 1.2 Exclusions Justification for the exclusion of institutions, business portfolios or risk factors, if the scope of the application does not include all exposures of the conglomerate or institution. 1.3 Risk segmentation VaR of each financial and non-financial institution included in the internal model. Use a position from a recent day that represents a typical portfolio. If VaR by institution is not available, present values following the segmentation used for risk management. Present values without considering correlation effects between institutions or segments. 2. Administrative structure, policies and strategies 2.1 Senior management 2.1.1 Main committees involved in risk management, indicating composition, meeting frequency and attributions; 2.1.2 Inventory of the main reports or presentations used to communicate matters related to risk management to senior management, indicating purpose, brief description of content, recipients and frequency. 2.2 Units involved in risk management With regard to the units involved in risk management, such as treasury, market risk, audit, back office, validation and others, inform: 2.2.1 Attributions of each unit; 2.2.2 Number of people working in it; 2.2.3 Main managers, respective positions and telephone numbers for contact; 2.2.4 Human resources policy for these areas, such as job profiles, turnover, retention, training, remuneration and development of managers; 2.3 Risk management policies 2.3.1 Summary description of the main documents that establish guidelines, policies and procedures for market risk management; 2.3.2 Procedures for approving changes in processes and policies related to market risk management and measurement models. 2.4 Treasury 2.4.1 Treasury activities a. Policies, strategies and objectives of the treasury area, indicating the main instruments for their implementation and monitoring; b. Segmentation of portfolios and trading desks. 2.4.2 Classification of operations a. Policy for classifying operations in the trading portfolio provided for in article 5 of Resolution No. 3.464, of 26/06/2007; b. Procedures adopted to verify compliance with this policy; c. Situations in which reclassification is permitted. 2.4.3 Use of derivatives and hedge policy a. Policy for hedge operations; b. Policy for the use of derivative instruments, especially non-standardized ones; c. Strategies used for trading with Greeks, if applicable; d. In the case of conglomerates: information on mitigation and transfer of risk exposures among the various
institutions. 2.4.4 New products a. Process for development and approval of new products; b. Post-approval monitoring procedures. 3. VaR Models Note: for the following items, if the institution trades non-linear instruments, detail the treatment given. 3.1 Methodology 3.1.1 Type of approach a. VaR approach used for VaR and for stressed VaR; b. In the case of using Monte Carlo Simulation: i. Models adopted for simulating the behavior of risk factors. c. For stressed VaR: i. Description of the method used to determine the historical stress period; ii. Frequency of revision of the historical period; iii. Frequency of calculation of stressed VaR. 3.1.2 Risk factors a. Risk factors used; b. Discussion of their sufficiency in relation to the institution's risk profile. 3.1.3 Other risk measurement tools used by the institution, if any. 3.2 Parameters and data 3.2.1 Internal parameters a. Time horizon i. Methodology for estimating market risk in the regulatory horizon (minimum holding period of 10 business days); ii. Treatment given to less liquid exposures and how they impact VaR. b. Historical data period i. Justification for the selection of the historical observation period of the data and the frequency of its updating; ii. Data weighting techniques for calculating volatilities and correlations, if applicable. c. Confidence levels for which VaR is estimated and brief report on the application of each of them. 3.2.2 Market data a. Briefly cite the market variables captured, indicating the sources of information; b. Describe the calculations and methodologies used for pricing instruments, such as: obtaining curves, treatment of instruments with low liquidity, spread of private securities, volatility smile, non-standardized derivative instruments, etc. 3.2.3 Position data a. Procedures for mapping the cash flows of instruments; b. Methodology for decomposition or mapping into risk factors, with specification of calculations by type of product; c. Treatment given to options in the calculation of VaR, if applicable. 3.3 Limitations of the risk measurement process 3.3.1 Limitations of the methodology and assumptions of the model with respect to the characteristics of the products traded; 3.3.2 Other limitations related to the market risk measurement process; 3.3.3 Impact of these limitations on the calculation of VaR. 4. Stress tests 4.1 Description of the process 4.1.1 Definition and approval of stress scenarios (including those responsible for the tasks and revision deadlines); 4.1.2 Assumptions of the current stress scenarios; 4.1.3 Frequency of conducting the tests. 4.2 Use of results 4.2.1 Use of results in establishing policies, risk-taking limits and contingency plans; 4.2.2 Examples, if any, of stress analyses conducted in the last 24 months with significant implications for taking market risks, establishing limits, maintaining capital, among others. 5. Backtesting 5.1 Description of the process 5.1.1 Frequency of execution; 5.1.2 Observation
periods; 5.1.3 Confidence intervals; 5.1.4 Level of disaggregation (business units, treasury desks, risk factors, products, or others); 5.1.5 Unit responsible for execution; 5.1.6 Detailed procedure for obtaining actual and hypothetical results. 5.2 Analysis procedures 5.2.1 Analyses performed in addition to counting the number of exceptions; 5.2.2 Examples, if any, of situations in which backtesting was used to improve the model, in the last 24 months. 6. Limits 6.1 Structure and authorities 6.1.1 Limits for market risk management and current values; 6.1.2 Procedures for determining limits and decision-making authorities (include revision frequency). 6.2 Communication and procedures in case of exceedance 6.2.1 Form of communication to trading desks of changes in their positions throughout the day and of their situation in relation to limits; 6.2.2 Procedure adopted in case of limit exceedance. In case of convening a high-level committee, mention the list of essential participants, deadline for the meeting and for decision-making. 6.2.3 Indication of the five most recent exceedances and measures adopted. 7. Reports from the risk area Inventory of the main reports used by the market risk area, indicating purpose, brief description of content, recipients and frequency. 8. Technological environment and information integrity control 8.1 Description of the technological environment inherent to the model 8.1.1 Explanatory diagram and brief description of the systems and other sources of information involved in the calculation of treasury results, in the calculation of prices of traded financial instruments, in obtaining the model's input data and in the measurement and control of market risk. 8.1.2 Information flow among the aforementioned systems, specifying automatic and manual interfaces. For the latter, describe the existing compensating controls and the forecast for automation of the processes. 8.2 Controls Note: in all items below, those responsible for executing the control must be indicated. 8.2.1 Routine analysis and validation procedures, both automatic and manual, which seek to identify errors in capturing position data, market data or internal calculations (such as volatilities and correlations). 8.2.2 Operational routines (back office): a. Procedures for confirmation, documentation, recording and settlement of treasury operations, with comments regarding the processes that assess the quality of execution of these routines; b. Description of automatic locks inserted in the treasury systems, if any, specifying at what level they are implemented (by operator, by portfolio, etc.). 8.2.3 Integrity of information a. Procedures and technological infrastructure designed to ensure the availability and integrity of information, even in contingency situations; b. Reconciliation process between the positions of operations (front office), the accounting system and the input data of the risk management system. Application systems used and existing
controls, including access controls. 9. Business continuity plans 9.1 Description of plans 9.1.1 Business continuity plans for treasury and for the areas involved in market risk management; 9.1.2 Procedures for approval and updating of said plans. 9.2 Tests and examples of application 9.2.1 Procedures and periodicity established for testing the continuity plans; 9.2.2 Situations in which the plans were activated in the last 24 months, if applicable. 10. Validation and internal audit 10.1 Validation 10.1.1 Persons responsible for validation of the internal model; 10.1.2 Steps of the internal model validation process; 10.1.3 Policy defining the periodicity and circumstances under which validations must be performed. 10.2 Internal audit Procedures adopted for the evaluation of the validation process and market risk management. IV. ATTACHED DOCUMENTS Include the documents listed in the following table, numbering them according to the first column. The second column describes the required document. The last column indicates the topic of the report to which the requested document refers, when it is related to one of the items. State which area is responsible for preparing each of the documents.

Item

Description of documents

Reference topic

1

Organizational chart of the conglomerate or institution, indicating director positions and names of the occupants of the positions

2.1

2

Last three minutes of each meeting of the mentioned committees

2.1

3

Reports or presentations used for communication of matters related to market risk management to senior management (last copy of each type)

2.1

4

Organizational charts of all units involved in market risk management

2.2

5

Summary curriculum vitae of the main managers involved with internal models

2.2

6

Documents establishing guidelines, policies and procedures for risk management

2.3

7

History of relevant changes made to the internal model, as well as its validations, occurring in the last 12 months

2.3

8

Manuals related to trading, hedge, products, classification of operations and development of new treasury products

2.4

9

Main reports used by treasury for risk control and monitoring of results, traded volumes and positions (last copy of each type)

2.4

10

Documentation regarding the development and approval of the last three products traded by treasury

2.4

11

Manuals related to the methodologies used for risk measurement and control (including their theoretical foundation) and to the procedures for analysis complementary to VaR

3.1 and 3.2

12

Manuals for pricing of financial instruments

3.2.2

13

Manuals for mapping positions

3.2.3

14

Stress testing manual

4.1

15

Most recent stress testing report

4.2

16

Backtesting manual

5.1

17

Most recent set of backtesting reports, with indication and explanatory analysis of the exceptions that occurred at the available disaggregation levels

5.2

18

Manual or policy for defining and reviewing limits

6.1

19

Manual addressing the treatment given to limit extrapolations or minutes in which it was formalized.

6.2

20

Main reports used by the market risk area (most recent copy of each type)

7

21

Documentation of the systems involved in risk management (including operating manuals)

8.1

22

Procedure manuals and operational control routines, including the position reconciliation process

8.2

23

Reports evaluating the technological risk management environment produced by internal audit and by external agents (independent auditors and/or consultants)

8.2

24

Documentation on business continuity plans for treasury and for the areas involved in risk management

9.1

25

Reports of the most recent tests of the business continuity plans

9.2

26

Validation manual

10.1

27

Reports of the most recent validation process

10.1

28

Internal audit manuals referring to the evaluation of the validation process and of market risk management

10.2

29

Internal audit reports referring to the evaluation of the validation process and of market risk management

10.2

30

Other internal audit reports, prepared in the last 12 months, referring to the market risk and treasury areas, if any

10.2

31

Reports produced by external agents (independent auditors and/or consultants), in the last 12 months, referring to the market risk and treasury areas, if any