Circular NBB_2018_11 / Expectations regarding reporting on the Internal Capital Adequacy Assessment Process (ICAAP) and the Internal Liquidity Adequacy Assessment Process (ILAAP)

NBB_2018_11 – 23 March 2018 Circular – P. 1/10 boulevard de Berlaimont 14 – BE-1000 Brussels tel. +32 2 221 37 40 – fax + 32 2 221 31 04 company number: 0203.201.340 RPM Brussels www.bnb.be

Circular
Brussels, 23 March 2018
Reference: NBB_2018_11 your correspondent:
Thomas Bodequin tel. +32 2 221 53 65 – fax +32 2 221 31 04 Thomas.Bodequin@nbb.be

Expectations regarding reporting on the Internal Capital Adequacy Assessment Process (ICAAP) and the Internal Liquidity Adequacy Assessment Process (ILAAP)

Scope
This circular applies to less significant credit institutions under Belgian law as defined by Council Regulation No. 1024/2013. These recipients of this circular are hereinafter referred to as "the institutions".

Summary/Objective
This circular implements the guidelines of the European Banking Authority (EBA) on the collection of information relating to the ICAAP and the ILAAP within the framework of the Supervisory Review and Evaluation Process (SREP), and takes into account the minimum requirements arising from the SSM LSI SREP operational guide. This circular must be read in conjunction with section 4 of circular NBB_2017_05 entitled "Establishing an ICAAP and ILAAP report" and replaces circular PPB-2007-15-CPB-CPA of 18 December 2007 for the institutions concerned.

Annexes

1. Example of quantitative reporting referred to in part 2.B. of circular NBB_2018_11.
2. French version of the EBA guidelines of 3 November 2016 on the collection of information relating to the ICAAP and the ILAAP within the framework of the SREP

Circular – P. 2/10 NBB_2018_11 – 23 March 2018

Madam,
Sir,

Pursuant to Article 94 of the Law of 25 April 2014 (hereinafter the "Banking Law"), each institution is required to have sound, effective and comprehensive strategies and processes to be able to assess and ensure that it permanently maintains the amount, composition and distribution of internal capital and liquidity that it deems appropriate to cover the nature and level of risks to which it is or could be exposed. This process consists of two coordinated parts, namely the Internal Capital Adequacy Assessment Process (ICAAP) and the Internal Liquidity Adequacy Assessment Process (ILAAP). These processes reflect the practices of the institution itself.

To the extent that, pursuant to Article 142, the ICAAP and the ILAAP must be assessed by the NBB as the supervisory authority within the framework of its prudential supervision mission, and that they will be at the centre of the dialogue between the institution and the NBB, it is important that each institution can provide adequate documentation.

The guidelines of the European Banking Authority (hereinafter the "EBA") on the collection of information relating to the ICAAP and the ILAAP within the framework of the SREP specify what is meant by "adequate documentation". A French version of this text prepared by the EBA is attached to this circular and is also available on the website of the National Bank of Belgium. The NBB requires institutions to integrate these guidelines appropriately into their practices and intends to clarify, by means of this circular, the implementation by institutions of Articles 12 and 15 of these EBA guidelines.

1. Reporting to the NBB
2. The reporting consists, on the one hand, of a part that must be reported annually, and, on the other hand, of a part that must be reported only when the SREP must be carried out1. In the latter case, these two parts form a single report. For institutions subject to an annual SREP, there will therefore systematically be such a single report2.
3. Institutions use the end of the most recent financial year as the reference date for both parts of the reporting. In any event, the reference date must be clearly indicated, as well as any divergence on this subject.
4. The institution sends the reporting no later than three months after the reference date.
5. In addition to the part of the reporting with a fixed frequency, the supervisory authority may at any time request from institutions the entire ICAAP and ILAAP file, certain parts of this file or other relevant documents. Institutions are indeed asked to constantly update this documentation, particularly in the event of significant changes, and to have this documentation available at all times.
6. The ICAAP and ILAAP file includes a wide collection of documents concerning the institution's risk, risk management and risk appetite. Institutions may decide to structure their documentation in a modular way (in different documents), instead of treating the whole in a single document.

1 The SREP is based, in principle, on the end of the most recent financial year. This means concretely that, if an SREP must be carried out during year Y, the ICAAP and ILAAP file must be reported three months (cf. paragraph 3) after the end of financial year Y-1. 2 The supervisory authority informs the institution in good time of the date of the next SREP. The frequency is set in accordance with the EBA guidelines on common procedures and methodologies to be applied within the framework of the supervisory review and evaluation process (Supervisory Review and Evaluation Process, SREP).

NBB_2018_11 – 23 March 2018 Circular – P. 3/10
6. The institution ensures that the elements requested in this circular are easily accessible to any reader, particularly when the structure deviates significantly from the structure of this circular or when the possibility mentioned in the previous point is invoked multiple times.
7. The institution may decide not to incorporate certain documents into the reported file, when these are, for example, deemed too detailed. In this case, it is necessary to clearly indicate in the manual, as mentioned in point 33 below, which information has not been integrated and for what reason.
8. As for institutions that are part of a group subject to consolidated or sub-consolidated supervision by the NBB, the reporting may be included in the reporting on a consolidated or sub-consolidated basis of the group. However, the following conditions must be met:
a. the board of directors of the institution provides the same confirmations and guarantees as those referred to in point 31 below relating to the information on the institution at the head of which it is located; b. information relating to the parent institution and subsidiaries is clearly recognizable and separately identifiable in the reporting;
c. the integration into the (sub-)consolidated ICAAP and ILAAP has no impact on the accuracy and completeness of the information requested in this circular.

2. Information to be reported annually
   2.A. Content relevant to both the ICAAP and ILAAP file
3. A forecast of key financial strength indicators, including profitability and the cost base, for the next three years or more. The institution also describes the developments, assumptions and expectations on which this forecast is based, regarding both its own strategy and the (market) environment in which it operates. These must be consistent in both files.
4. The Risk Appetite Framework (RAF) dashboard, referred to in point 38 (f) below, which contains the risk appetite and risk indicators as well as the associated limits and the level of indicators at the reference date. In addition, changes at the level of risk appetite, limits or indicators are also explained, and the date of approval by the board of directors is mentioned.

2.B. Content of the ICAAP report
11. The result of the internal calculation of the capital requirement, which consists of the following elements:
a. the scope and coverage of each category and sub-category of risks treated in the ICAAP; b. the capital requirements for each individual category and sub-category of risks;
c. the impact of the aggregation of risk categories and sub-categories, and in particular the impact of diversification and concentration effects;
d. the total capital requirement.

Circular – P. 4/10 NBB_2018_11 – 23 March 2018
12. A description of any divergence within the group and group entities in the ICAAP process and in the key assumptions. This concerns in particular changes compared to the previous reporting that result in the reported figures having to be interpreted differently.
13. A clear argumentation of the risks listed in point 43 below, for which the institution has not calculated specific capital requirements. If applicable, the institution may adopt the following viewpoints:
a. the capital requirements for these risks have already been integrated into the capital requirements for other risks; b. qualitative measures have been taken to better cover this risk.
14. The level of available internal capital and the equity elements that compose it, its allocation to the different entities of the group, business lines and markets, as well as a comparison with the internal capital requirement and an assessment of the resulting surplus or deficit.
15. A forecast of future equity and future capital requirements for at least the next three years and the conclusions drawn by the institution, such as the adjustment of dividend policy, future strategy and balance sheet structure or the issuance of capital instruments.
16. The result of stress tests, expressed in terms of their impact on key indicators, including financial result, internal capital, regulatory equity and other relevant prudential indicators, and the actions taken as a result by the institution, including the holding of additional cushions, the strengthening of limits, the adaptation of reporting, models or risk appetite, or the adjustment of the business model or its strategy.

2.C. Content of the ILAAP report
17. A quantitative summary of significant risk factors identified in terms of liquidity and funding as well as a justification of their selection based on the criteria described in point 50 (c).
18. A quantitative summary of the institution's liquidity and funding profile, and an assessment of its stability over time, in all significant currencies.
19. The current funding plan.
20. A summary of recent funding cycles, accompanied by main characteristics such as volume, price and an assessment of investor and depositor appetite, as well as an assessment of the feasibility of the current funding plan given current market conditions.
21. An assessment of the (desired) evolution of the funding position over the next three years, in accordance with the EBA guidelines on harmonised models and definitions for credit institutions' funding plans pursuant to recommendation A4 of recommendation CERS/2012/2. Concretely, the funding position must be taken into account within a period of six months, as well as within a period of one, two and three years.
22. An assessment of the funding position and funding risk after the execution of the funding plan.

NBB_2018_11 – 23 March 2018 Circular – P. 5/10
23. The calculation of the liquidity requirement, expressed in terms of the minimum size of the liquidity cushion defined by the institution to comply with it.
24. The calculation of the current liquidity cushion, broken down by product, currency, counterparty, maturity and other relevant characteristics.
25. An assessment of the evolution of the liquidity requirement and the liquidity cushion, based on an expected scenario, on the one hand, and a stress scenario, on the other.
26. A summary of current and future levels of encumbered assets, particularly with regard to assets that could be used to generate liquidity.
27. A description of the scenarios (risk factors, time horizon, etc.) and assumptions (including the scope of application) used for the execution of stress tests, and the frequency of reporting to management.
28. A description of the criteria used to select and calibrate scenarios, including the use of historical scenarios, statistical methods and confidence intervals, reverse stress tests, etc.
29. The result of stress tests, expressed in terms of their impact on key indicators, including financial result, internal capital, regulatory equity and other relevant prudential indicators, and the actions subsequently taken by the institution, including the holding of additional cushions, the strengthening of limits, the adaptation of reporting, models or risk appetite, or the adjustment of the business model or its strategy.

2.D. Conclusions of the ICAAP and ILAAP and quality control
30. A description of the main conclusions of the ICAAP and ILAAP, including:
a. a general assessment of the current level of equity and liquidity necessary to meet current needs, as well as any planned measures to continue to meet capital and liquidity needs; b. significant (planned) changes to the risk management framework based on the results of the ICAAP and ILAAP;
c. significant (planned) changes to the business model, its strategy or risk appetite based on the results of the ICAAP and ILAAP;
d. significant (planned) changes to the ICAAP and ILAAP, in particular based on internal audit reports and discussions with the supervisory authority.
31. An ad hoc letter in which the board of directors confirms that the ICAAP and ILAAP file has been approved by it, meets the expectations specified in this circular and, in general, gives a true image of the institution's internal processes, the risks to which it is exposed and its risk appetite as well as its liquidity and capital needs, and the adequacy thereof.

3. Information that must be reported in the context of the SREP
   3.A. Content that is part of both the ICAAP and ILAAP file
4. A general summary document that presents the entire file in a synthetic form. All aspects requested below are addressed and the main objectives, assumptions, methods and conclusions of the ICAAP and ILAAP are clearly described. This document refers extensively to more detailed source documents.

Circular – P. 6/10 NBB_2018_11 – 23 March 2018
33. A "manual for the reader", which includes in particular the following elements:
a. a summary of all relevant documents mentioning the date of the last update indicated and whether they are attached as an annex or not; b. a description of all significant changes since the previous reporting;
c. a reference to all ICAAP and ILAAP information published by the institution.
34. A description of the institutions and entities included in the ICAAP and ILAAP, indicating their country of establishment and, if applicable, which supervision the entities fall under. Any difference from the supervision perimeter must be explained. Any differences between the ICAAP and ILAAP are commented on.
35. A clear description of the business model, which lists the main markets, activities and subsidiaries and also addresses the institution's prospective strategy, particularly with regard to changes to the business model or significant changes affecting the operation, structure or governance of the institution.
36. A description of the main revenues and cost factors allocated by business line, market and subsidiary. These are elements that directly or indirectly generate costs or revenues, for example the maintenance cost of IT systems. The approach adopted here is primarily economic, rather than accounting or prudential, and consists of an analytical decomposition3 into significant elements of the institution's performance.
37. A description of governance regarding the taking, management and control of risks and of governance regarding the ICAAP and ILAAP. It includes the following elements:
a. the sharing of responsibilities for the taking, management and control of risks (including the development of the ICAAP and ILAAP) at different levels, including the management committee; b. the lines and frequencies of reporting on risk management and control;
c. the link between the ICAAP and ILAAP and the institution's strategy;
d. the practical integration of the ICAAP and ILAAP into the institution's risk management (including the risk appetite framework).
38. The risk appetite framework. All less significant institutions are required to have a Risk Appetite Framework (RAF). This RAF is a generic term designating the policies and procedures that allow the institution to identify its risks, set and monitor its risk appetite. This RAF includes the following elements:
a. responsibilities regarding the RAF, including setting the level of risk appetite, developing and managing the dashboard, and monitoring indicators; b. the significant risks to which the institution is or may be exposed, including risks that are difficult or impossible to quantify, distributed by categories and sub-categories;

3 Institutions are therefore assumed to have the necessary knowledge and IT infrastructure to decompose their performance in a meaningful way and report on it in a structured manner: this is also called the management information system.

NBB_2018_11 – 23 March 2018 Circular – P. 7/10
c. a series of indicators for these risks to measure risk and/or set risk appetite and its limits, both for individual exposures and on an aggregated basis;
d. an allocation of limits for each risk and each entity in the group or for each business line or market, if applicable – this decision, taken by the governing body at the highest level of the institution, is called the risk appetite statement; e. a description of how this framework is integrated into daily risk management and general management of the institution, including strategy and planning; f. a dashboard to monitor indicators and risk appetite. This RAF must be reported in full as part of the ICAAP and ILAAP file. Regarding item (c), institutions should use relevant and preferably quantitative indicators. These include both prudential indicators – for example, capital and liquidity ratios – and institution-specific indicators, such as the level of non-performing loans or the share of short-term funding. This item may also include other non-financial indicators, such as the number of complaints or the number of minutes of IT system unavailability, or the result of stress tests. The institution defines different risk levels4 based on its risk appetite and follows its risk profile based on these indicators, preferably using a synthetic dashboard showing the thresholds of the different risk categories and reflecting the current and previous levels of indicators. It is expected that institutions will practically use the ICAAP and ILAAP in general, and this dashboard in particular, for daily management and that they adjust the aforementioned thresholds to the thresholds used in the recovery plan, and that these are consistent with each other.
39. A description of the general stress testing framework and the frequency of implementation and use of stress tests within the institution. In this regard, the institution takes into consideration the methodologies, models, assumptions and data used, as well as the sharing of responsibilities for the development and implementation of stress tests.
40. A description of the interaction or integration of stress tests in the ICAAP and ILAAP.
41. The (sub-)consolidated ICAAP and ILAAP explain how ICAAP and ILAAP information, including capital requirements and liquidity requirements, are aggregated and included in the (sub-)consolidated ICAAP and ILAAP.

3.B. Specific content of the ICAAP
42. A description of the main objectives and assumptions of the ICAAP, including:
a. the objectives and their priority link; b. the method of risk identification;

4 If we take the example of the CET1 capital ratio, risk appetite could imply that the institution intends to maintain its CET1 capital ratio at all times (+NL) above 12%, but targets a CET1 capital ratio greater than 15%. These internal thresholds are then used to indicate a "critical", "moderate" and "low" risk level. The thresholds can be coordinated with the warning threshold provided for in the recovery plan.

---

Circular – P. 8/10 NBB_2018_11 – 23 March 2018

c. the method for assessing the materiality of risks;
d. the impact taken into consideration, for example the accounting impact or the impact on economic value; e. the time horizon.

Regarding the foregoing, the institution also explains how these elements vary from one to another depending on the entities and the risks.

43. A list of the "risk categories and sub-categories"5 treated in the ICAAP, which includes their definition and scope. In this context, it is also described how these risks, their definition, or their scope differ from those listed in the RAF.

44. A description of the methodology used to measure, assess, and aggregate risk, including, at a minimum for each risk category, a description:
    a. of the main characteristics of quantification and measurement methods, such as the criteria, models, assumptions, and parameters used (including confidence intervals); b. of the data used, including the entities concerned and the characteristics of historical data;
    c. of the main differences between the model used for the ICAAP and the internal model used for the calculation of the Pillar 1 requirement, where applicable;
    d. of the method for aggregating capital requirements calculated for different risk categories and, in the case of a group, for different institutions; e. how diversification and/or concentration effects are taken into account.

45. The definition of all elements comprising internal capital. In this regard, attention is paid to the permanent nature of capital instruments and any embedded options.

46. A description of the difference between the internal capital described in the previous point and regulatory own funds.

47. A description of the methodology and assumptions used to allocate capital to different markets, group entities, and business lines.

48. A summary of the capital planning procedure followed by the institution, including a presentation of the main characteristics and assumptions.

49. A description of the stress tests performed as part of the ICAAP, including a description of the scenarios, parameters used, and calibration of the stress tests (including, for example, the use of reverse stress tests), as well as an explanation of the relevance of the scenarios to the institution.

3.C. Specific Content of the ILAAP

50. A description of the general configuration of the ILAAP, including:
    a. the scope of application of the ILAAP and deviations from the scope of liquidity requirements; b. the different elements of the ILAAP and their interaction;

5 Concentration risk may, for example, consist of one of the sub-categories of credit risk.

NBB_2018_11 – 23 March 2018 Circular – P. 9/10

c. the criteria applied to select significant risk factors regarding liquidity and funding risk, as well as significant currencies;
d. the criteria applied to select appropriate measurement and assessment tools.

51. An assessment of intra-group liquidity and funding flows, mentioning all restrictions to which these flows are subject.

52. Documentation attesting that the institution monitors its compliance with prudential requirements related to liquidity risk and will continue to do so.

53. A description of the institution's funding strategy, including:
    a. the main elements of the funding plan, including funding sources, different maturities, markets, products used, etc.; b. the policy implemented by the institution to maintain access to certain markets for its funding;
    c. the policy focused on funding concentration risk, including the criteria used to measure the correlation between funding sources. This occurs, for example, when depositors also hold other funding products, such as shares or subordinated loans;
    d. the policy focused on foreign currency funding, including an assessment of the convertibility of these currencies.

54. Information relating to the management of the liquidity buffer, including:
    a. the general liquidity buffer management policy and applicable limits, including, for example, limits on concentration and asset quality; b. the methodology used to determine the minimum internal size of the liquidity buffer;
    c. the methodology used to measure and monitor concentration within the liquidity buffer;
    d. how the liquidity value of assets is determined; e. how the liquidity value of assets is verified, including the time frame within which assets can be converted into liquidity; f. the policy regarding encumbered assets.

A description of the differences between, on the one hand, the liquidity buffer used in the ILAAP, and on the other hand, the "rebalancing capacity" and "high-quality liquid assets" referred to in Delegated Regulation (EU) No 2015/61, as well as the risks not covered by Regulation (EU) No 515/2013 that are covered by the ILAAP.

55. An assessment of the time required to convert the different elements of the liquidity buffer into available liquidity.

56. The configuration and results of the ex-post control of the conversion time of the liquidity buffer into available liquidity.

57. The results of the ex-post controls of the funding plan. This is an assessment of the previously established funding plan based in particular on actual funding needs and actually available funding. An important finding may be to note that the institution was unable to raise the planned quantity of funding means. Of course, this must be taken into account in the current funding plan.

Circular – P. 10/10 NBB_2018_11 – 23 March 2018

58. A description of the cost-benefit trade-off mechanism regarding liquidity. This is the correlation established by the institution between, on the one hand, its funding and liquidity costs, and on the other hand, its business lines, activities, and products. This mechanism allows the institution to set the prices of its products and assess their profitability. Its current calibration, including the interest rate curves used, is also mentioned.

59. A description of the methods, assumptions, and criteria used to measure and manage intraday liquidity risk, as well as escalation procedures to avoid intraday liquidity crises, where applicable.

60. A historical summary of intraday liquidity risk, covering at least the past year, and the number of missed and/or late payments, as well as a supplementary explanation for all significant missed and/or late payments.

61. A description of the stress tests performed as part of the ILAAP, accompanied by a description of the scenarios, parameters used, and calibration of the stress tests, as well as insights into the relevance of the scenarios to the institution.

3.D. Conclusions of the ICAAP and ILAAP and Quality Control

62. The report of the self-assessment carried out by the institution on the collection, storage, and aggregation of data, as well as on the validations performed as part of the ICAAP and ILAAP. In this regard, particular attention is paid to the accuracy, integrity, completeness, and speed of the institution's access to data and its ability to aggregate it, as well as to the (structural) flexibility of the data to answer different questions.

63. Internal audit reports regarding the ICAAP and ILAAP file, including reports on ICAAP governance, risk quantification, and compliance with this circular.

A copy of this is sent to the auditor(s), approved reviewer(s) of your institution.

Please accept, Madam, Sir, our distinguished salutations.

Jan Smets
Governor

Annexes: 2