Circular No. 9/2022: Internal Capital Adequacy Assessment Process (ICAAP) Reporting Guide

Central Bank of Libya Banking and Currency Control Departments P.O. Box 1103 Telegraphic Address: Libya Bank - Tripoli - Libya Reference Number / A.R.M / N ( ) Circular No. (2022/9) Date: 10 Rabi' al-Awwal 1444 AH Corresponding Date: 06 October 2022

To: General Managers of Banks Mr. / General Manager of the Libyan External Bank

Subject: Internal Capital Adequacy Assessment Process (ICAAP) Reporting Guide

---

Greetings...

Based on the provisions of Law No. (1) of 2005 concerning Banks and its amendments, and within the framework of the Central Bank of Libya's strategy to apply international best practices in banking supervision, and implementing Pillar 2 of the Basel proposals (Supervisory Review), with the aim of ensuring banks hold sufficient capital to cover various risks and encouraging banks to develop and use the best risk management methods in managing and measuring risks they may be exposed to.

In order to enable banks to comply with the instructions contained in the Internal Capital Adequacy Assessment Process (ICAAP) Guide, banks are granted a period of three months to complete the requirements set out in the Guide and to take all necessary measures to adhere to the provisions of this Guide.

The Banking and Currency Control Department will take the necessary measures to monitor banks' compliance with the provisions contained therein, and we must be informed immediately of the steps taken in this regard at each bank to ensure the correctness of implementation.

We refer you to the Guide mentioned above, requesting your full compliance and presenting the matter to the Board of Directors of your banks to issue the necessary executive decisions regarding this matter.

Peace, mercy, and blessings of God be upon you...

Naji Muhammad Issa Director of Banking and Currency Control Department

Copies to:

• Mr. / The Governor
• Mr. / Deputy Director of Banking and Currency Control Department
• Mr. / Deputy Director of Banking and Currency Control Department for Office Supervision and Compliance Monitoring Affairs
• Mr. / Deputy Director of Banking and Currency Control Department for Operations Affairs
• Mr. / Deputy Director of Banking and Currency Control Department for Islamic Banking Affairs
• Messrs. / Chairmen of Boards of Directors of Banks
• Messrs. / Heads of Risk Management Departments in Banks

Basel Instructions Banking and Currency Control Department

Internal Capital Adequacy Assessment Process (ICAAP) Reporting Guide, which includes the following:

1. The objective of the Internal Capital Adequacy Assessment Process.
2. The steps that must be followed to prepare the Internal Capital Adequacy Assessment Process report.
3. Types of risks that must be covered in the Internal Capital Adequacy Assessment Process report.
4. Structure of the Internal Capital Adequacy Assessment Process report.

The Internal Capital Adequacy Assessment Process is one of the most important outputs of Basel II. Subsequent issuances following the global financial crisis emphasized the importance of Pillar 2 of capital requirements. A number of improvements were made to the general framework as part of a set of reforms aimed at monitoring bank capital and improving its quality to align with the size of risks. The Internal Capital Adequacy Assessment Process, also known as ICAAP, is considered a main component of Pillar 2, whereby this mechanism produces the appropriate level of capital that matches the nature and characteristics of the bank's risks.

When preparing the report, banks must take into account all risks the bank currently faces or may face in the future, in addition to capital adequacy risks. Since Pillar 2 of capital requirements includes another aspect, which is the Supervisory Review and Evaluation Process (SREP), the Internal Capital Adequacy Assessment Process report submitted by banks is reviewed and evaluated by the regulatory authority (Central Bank of Libya). The regulatory authority may request amendments to the report (for example, requesting an increase in the bank's capital).

1. Objective of the Internal Capital Adequacy Assessment Process: It is the process through which the bank ensures that it operates at an appropriate level of capital. The report includes a large part of what can be sought in the comprehensive framework for managing the bank's risks. The report combines risk management and capital activities in a form that can be used to support business decisions.

2. Steps that must be followed to prepare the Internal Capital Adequacy Assessment Process report: Since the report includes all risks the bank faces and the way it deals with those risks, the report must include a quantitative and qualitative analysis, covering all details related to risks so that the required capital to face risks can be assessed.

The report must cover the following aspects:

• Comprehensive identification and assessment of risks.
• Supervision by senior management and the Board of Directors.
• Determination of Risk Appetite and Risk Taking Capacity.
• Risk monitoring and mitigation.
• Internal control review.
• Capital adequacy and hedging plans.
• Stress testing.

The following figure illustrates the steps followed to prepare the report:

Entity	Steps
Government	• Disseminate a risk culture in the bank.<br>• Link risks to business strategy.<br>• The Board of Directors must determine the acceptable level of risk and approve risk policies.
Hedging	• Hedge all business lines (operational risks - information risks).<br>• Review the Internal Capital Adequacy Assessment Process report and update it continuously.<br>• Update risk systems.
Risk Mitigation	• Describe controls to reduce exposure to each type of risk.<br>• List hedges and insurance guarantees.<br>• Assign responsibility for risk control.
Capital Adequacy	• Internal Capital Adequacy Assessment Process.<br>• Compare the Internal Capital Adequacy Assessment Process with the minimum capital adequacy adjusted by the regulatory authority (Pillar 1).<br>• Increase internal capital over regulatory capital. This is discussed with the Central Bank.
Stress Tests	• Subject all main assumptions to stress testing.<br>• Use scenarios appropriate to business models.<br>• Determine the impact on capital.
Information Disclosure	• Results of stress tests.<br>• Summary of reports submitted to the Central Bank of Libya.<br>• Submit periodic reports to senior management and the Board of Directors.
Reports	• Each bank has the right to adopt a specific mechanism for the format of the ICAAP report after discussing it with the Central Bank of Libya.
Review	• Independent review to confirm the correctness of the ICAAP report preparation process.<br>• The review process is carried out by internal and external auditors.

Page 4 of 8

Banking and Currency Control Department

3. Types of risks that must be covered in the Internal Capital Adequacy Assessment Process report:

• Credit risks
• Market risks
• Operational risks
• Liquidity risks
• Legal risks
• Interest rate margin risks (for Islamic banks)
• Interest rate risks
• Reputational risks
• Strategic risks
• Conduct risks
• Funding risks
• Credit concentration risks
• Regulatory risks
• Money laundering risks
• Any other risks defined by the bank's framework.

Page 5 of 8

Banking and Currency Control Department

4. Structure of the Internal Capital Adequacy Assessment Process report:

-1 Executive Summary: This section must provide an overview of the methodology used to prepare the Internal Capital Adequacy Assessment Process report, the main results, and an assessment of whether the bank has sufficient capital.

-2 Introduction: This section provides an overview of the process the bank followed when conducting its ICAAP report. It must include a reference description of the internal assessment and the approval process for evaluating internal capital adequacy. It must also provide details on the relevant policies and systems used by the bank to identify, manage, and monitor risks according to the acceptable level of risk policies.

-3 Environment and Governance: This section must identify the different products and services offered by the bank and the matter under which those products and services are subject to their corporate governance arrangements. It must also include the roles and responsibilities of relevant functions, as well as a description of internal and external auditing.

-4 Risk Appetite Statement: This section provides a detailed high-level report on the bank's willingness to face potential risks, reviewed by the Board of Directors.

-5 Comprehensive Risk Framework (Internal Risk Assessment Process): This section must provide a brief description of the bank's risk identification process and explain how the bank identifies areas of inherent risk.

-6 Capital Planning: In this part, capital adequacy is covered. This section must identify the bank's expected capital needs and the desired level of capital, which must align with the bank's strategic objectives and desired business plan.

Page 6 of 8

Banking and Currency Control Department

-7 Liquidity Planning: This part contains the bank's liquidity risk management policy. It must also identify the main assumptions and conclusions from stress tests on cash flows conducted by the risk management department.

Additionally, liquidity planning must include a quantitative analysis of liquidity risks.

.i Liquidity Coverage Ratio (LCR) Shows the adequacy of high-quality liquid assets to meet short-term liquidity needs (30 days). Liquidity Coverage Ratio = High-quality assets / Net cash outflows over 30 days ≤ 100%.

.ii Net Stable Funding Ratio (NSFR) This ratio measures the value of the bank's available long-term funding sources (more than one year) compared to the deployment in assets and financial liabilities requiring stable funding. Net Stable Funding Ratio = Value of available stable funding / Value of required stable funding ≤ 100%.

-8 Stress Testing: Stress testing is one of the bank's risk management methods and is used to assess potential impacts on the bank's financial position for a set of specific changes in risk factors, which correspond to reasonable exceptional events. The Internal Capital Adequacy Assessment Process should include stress testing to complement other quantitative and qualitative assessments, where senior management has a more complete view of the bank's risks.

-9 Report Review and Approval of Results: Review by the Board of Directors and senior management, in addition to risk management and audit management. A section regarding the results of the report must also be added, explaining how the results were used by the bank and included in decision formulation, business planning, and risk management processes, as well as integrating results into risk mitigation settings.

Additionally, any significant changes made to the current process compared to previous ICAAP processes, and a list of all relevant documents and policies used in reviewing, preparing, and implementing the Internal Capital Adequacy Assessment Process report.

Page 7 of 8

Banking and Currency Control Department

If carried out correctly, the Internal Capital Adequacy Assessment Process provides senior management and regulatory authorities with information that enables the bank to manage risks better and make better decisions regarding future strategy and rapid response to any local or global economic events.

Banks must reduce the volume of work and analysis required to prepare the report and allow sufficient time to conduct a comprehensive process.

End...

Page 8 of 8