Cairo on: 7 April 2019

Dear Mr. / Chairman of the Board of Directors, Greetings,

In the context of the continuous efforts of the Central Bank of Egypt to apply international banking best practices to enhance the performance of the banking sector and develop its risk management methods, and with reference to the discussion paper on concentration risk issued in May 2011, as well as the decision of the Central Bank of Egypt Board of Directors dated January 6, 2016 regarding the establishment of certain supervisory limits to mitigate the concentration of banks' credit portfolios, the Central Bank of Egypt Board of Directors, in its meeting held on March 28, 2019, approved the following decision:

"Issuance of the attached supervisory instructions regarding the management of concentration risk within the framework of Pillar 2 of the Basel Accords, with implementation to begin by the end of March 2019."

Please be so kind as to alert your bank to take the necessary action to comply with the aforementioned instructions, and to provide us with the email address of the Head of the Bank's Risk Management Sector, via the email address for the Basel Department eg.org.cbe@unit.Basel at the earliest opportunity so that the forms for measuring individual and sectoral concentration risks can be sent.

Yours faithfully,

Gamal Naguib

Central Bank of Egypt - Basel Sector - Supervision and Oversight

Supervisory Instructions for the Management of Concentration Risk

In the framework of Pillar 2 of the Basel Accords

Contents

	Chapter	Page
First: General Framework		-1
Introduction
2	-2 Scope of Application
Second Chapter: Basic Concepts
-1 Definition and Types of Concentration Risk
3	-2 Methods to Mitigate Concentration Risk
Third Chapter: Qualitative Requirements for Concentration Risk
-1 Principles Specific to Banks
4	-2 Supervision and Monitoring by the Central Bank of Egypt
5	Fourth Chapter: Quantitative Methods for Measuring Credit Concentration Risk
-1 Individual Concentration Risk
6	-2 Sectoral Concentration Risk
7	Fifth Chapter: Stress Testing
9	Sixth Chapter: Numerical Examples for Calculating Capital Requirements to Cover Credit Concentration Risk
10

Chapter One General Framework ----------------------

-1 Introduction

In the context of the Central Bank of Egypt's efforts to strengthen the Egyptian banking sector and improve its efficiency in facing potential financial crises by applying international best practices in banking supervision, including Pillar 2 of the Basel Accords regarding the Supervisory Review Process (SRP), which aims to cover other fundamental risks not taken into account under Pillar 1, such as concentration risk, interest rate risk in the banking book, and liquidity risk, as well as ensuring the availability of sufficient additional capital to cover these risks.

In light of the above, it was decided to apply the following instructions regarding concentration risk, which are considered one of the main causes that may result in significant losses affecting the bank's performance, which may threaten its continuation of business operations.

These instructions include both the qualitative requirements for managing concentration risk in all its forms and the quantitative requirements for measuring credit concentration risk only, with banks required to comply with these requirements (qualitative and quantitative) as a minimum for managing all types of concentration risk in their portfolios.

-2 Scope of Application

1/2 These supervisory instructions apply to all banks operating in the Arab Republic of Egypt, including branches of foreign banks, according to the quantitative methods (which will be mentioned in the Fourth Chapter of these instructions) so that credit concentration risk is measured for the branches of individual banks 2 and foreign bank branches on a consolidated basis 1 on an individual basis (including banking groups, with declaration to the Central Bank of Egypt on a quarterly basis, within 20 days from the end of each quarter.

2/2 The Central Bank of Egypt also requires all banks to assess concentration risks arising from all other risks in their portfolios, such as those arising from market, liquidity, and operational risks, with the aim of managing all types of concentration risk related to the bank's various activities, and requiring stress testing for concentration risk on a periodic basis. Furthermore, the bank's assessment of concentration risk in all its aspects is an integral part of the Internal Capital Adequacy Assessment Process (ICAAP), which is subject to the Supervisory Review and Evaluation Process (SREP) by the Central Bank of Egypt in the framework of implementing Pillar 2 of the Basel Accords.

3/2 Banks may apply internal methods for measuring concentration risk other than the supervisory method mandated by the Central Bank of Egypt, but only for their own risk management purposes and not for supervisory purposes. In this case, those banks must - if the Central Bank decides - declare the methodology used in these internal methods as well as their results.

                                                                                                                                                                 1
                                                                                                                            which do not have financial subsidiaries.
                                                                                                                                                                 2
Measurement on a consolidated bank basis includes all its branches inside and outside Egypt and all other financial companies affiliated with it (excluding insurance companies) in which the bank (or the bank and its related parties) owns more than 50% of shareholders' equity or any percentage that enables it to control that entity.

2

Chapter Two Basic Concepts ------------------------------------

-1 Definition and Types of Concentration Risk

1/1 Concentration risk arises from the bank's reliance in conducting its activities on allocating funds to limited activities or to a limited number of customers or on limited sources to obtain financing or any other services, and generally concentration risk relates to the different types of risks to which the bank is exposed, which may result in:
Significant losses that threaten the bank's ability to carry out its main activities and/or A fundamental change in the risk structure to the detriment of the bank.

2/1 Regarding the types of concentration risk, they may arise from any of the following sources:
o Credit risk: Arises from the concentration of the bank's allocations to a single customer and its related parties 3 directly or indirectly (Individual Concentration) or the concentration of allocations to groups of parties whose probability of default is correlated with common factors (such as sectoral concentration, geographical concentration, etc.), which may lead to potential large losses that may threaten the financial position of the bank or its ability to carry out its main activities.

o Market risk: Arises from the concentration of investments in the trading book (for example, concentration of investments in securities issued by a single entity) or from the concentration of balance sheet items in specific currencies.

o Liquidity risk: Arises from concentration in a limited number of depositors and reliance on limited financing sources or concentration in specific types of assets.

o Operational risk: Arises, for example, from reliance on a single technological system or specific operational systems or a limited number of external service providers (Outsourcing).

-2 Methods to Mitigate Concentration Risk

Banks can use a set of tools that contribute to mitigating concentration risk, which may include, but are not limited to, a combination of the following:

Internal limits: Establishing a comprehensive limits system that includes internal limits for the bank's allocations to a single customer or the customer and its related parties, reflecting the permitted risk level regarding concentration risk, with continuous monitoring of these limits to verify their adequacy and activate them on a permanent basis. For example, the bank may set limits for allocations at the sector, country, or bank product level. In addition, banks must determine, monitor, and set appropriate limits for interconnected allocations, whether on or off the balance sheet.

Portfolio management: Actively and continuously monitoring and managing the bank's portfolios to enable it to make adjustments in its new activities to address and correct any existing large concentrations or avoid those that may appear in the future.

Risk transfer: Transferring credit risk to another party using a systematic approach, either directly by selling the asset (loan) or securitizing its loan portfolio, or indirectly by conducting hedging operations with other parties (by purchasing credit derivatives or obtaining guarantees or sureties).

Holding additional capital: Availability of additional capital (within the framework of Pillar 2) above the minimum regulatory capital required under Pillar 1 of the Basel Accords.

3 Related parties refer to those controlled by the customer for the concept stated in Article (51) of the Central Bank, Banking and Currency Law issued by Law No. (88) of 2003 and its amendments.

3

Chapter Three Qualitative Requirements for Concentration Risk ------------------------------ -1 Principles Specific to Banks

Banks must comply with a set of qualitative requirements and principles regarding the management and control of concentration risk in all its forms, which can be summarized as follows:

1/1 The bank must have a clear policy regarding concentration risk that forms a fundamental aspect of the general framework of its risk management process. This policy must be accurate, documented, and approved by the Board of Directors. This policy must also be subject to periodic review to take into account any changes that may occur in the acceptable risk level of the bank and its surrounding business environment.

2/1 The bank must have appropriate internal procedures, including the existence of an effective information system to identify, measure, manage, and monitor the policies and limits adopted by it in this regard, ensuring that these and the declaration of all types of concentration risk are consistent with the nature and complexity of the bank's activities.

3/1 The bank must establish an appropriate structure for permitted concentration limits within its internal policies and its overall risk measurement and management framework, paying special attention to risk areas for which the Central Bank of Egypt has not established specific measurement methods and quantitative requirements. In light of this, procedures must be established to allow for the appropriate use of these limits and to ensure that they are not exceeded under any circumstances. 4/1 In light of the concentration limit structure established by the bank, sub-limits for allocations at the level of economic activity sectors, geographical areas, collateral and guarantees, etc., are established, as well as at the level of financing sources such as the interbank market and the number of depositors, within a financing policy characterized by an acceptable level of diversification. 5/1 The bank must regularly and periodically do the following:

• Conduct a detailed review of the risk environment surrounding its various sectors.

• Apply appropriate stress tests and analytical scenarios.

• Carefully review the economic performance of current borrowers.

• Review the necessary credit approvals for new businesses and activities.

• Review the risk mitigation methods used and the validity, enforceability, and continuous implementation of their legal status.

• Review the bank's financing strategy to ensure effective diversification in financing sources and maturities.

• Review the business strategy.

6/1 The bank must, within the framework of managing its concentration risk, adopt appropriate methods to mitigate such risks, such as risk transfer and active and continuous management and monitoring of credit portfolios, or any other methods the bank deems appropriate in this regard. 7/1 The bank must build adequate additional capital of high quality (from the components of the first tier of the capital base) to cover concentration risk, within the framework of the Internal Capital Adequacy Assessment Process approved by the Board of Directors, taking into consideration the qualitative aspects of concentration risk management, as well as the results of stress tests and their implications and the management's ability to take effective corrective actions when necessary.

1/2 The Central Bank of Egypt will through desk supervision and its reporting system, as well as through on-site supervision, conduct a comprehensive assessment of concentration risk at banks in all its qualitative and quantitative aspects, allowing it to make comparisons between similar banks so that the Central Bank of Egypt can determine the extent of the safety of the management of these risks at banks. 2/2 The Central Bank of Egypt will use quantitative and qualitative indicators to assess the degree of concentration risk at banks and the ability of the bank to the risk assessment system in force at the Central Bank taking into account prudent management of these risks according to the policies and limits established, as well as the results of stress tests used by the bank in this regard.

3/2 Within the risk assessment system of the Central Bank of Egypt, banks that exceed limits and must be subject to continuous review and/or are expected to hold additional regulatory capital will be identified, which may require specialized on-site inspection for this purpose. 4/2 If the monitoring process conducted by the Central Bank of Egypt through its various supervisory tools reveals a high volume of risk concentration and/or inadequate management of these risks, the bank will be required to take a set of corrective measures according to the degree of concentration present, which include the following:

• Mitigating concentration risk and diversifying its portfolio, or
• Building additional capital, or
• Both of the aforementioned measures.

In addition to the aforementioned corrective measures, the bank must conduct the previously mentioned reviews (in Item 5/1 .of this Chapter) more deeply 5/2 In all cases, regardless of the Central Bank of Egypt's assessment, the bank must declare any significant results related to concentration risk and any corrective measures taken by it regarding concentration risk.

Chapter Four Quantitative Methods for Measuring Credit Concentration Risk --------------------------------------

In the framework of measuring credit concentration risk under Pillar 2 of the Basel Accords, all banks operating in Egypt must calculate individual concentration risk regarding allocations to a single customer and its related parties, as well as sectoral concentration risk regarding allocations to parties whose probability of default is linked to their activity in the same economic sector (according to the different economic sectors listed below) In all cases, banks must allocate additional capital to face credit concentration risk without taking any provisions or any type of collateral into account, according to the quantitative methods to be followed in this regard as follows:

-1 Individual Concentration Risk 4

1/1 Individual concentration risk arises from the concentration of the bank's allocations to a single customer and related parties directly or indirectly. Banks must measure individual concentration risk using the Individual Concentration Index (ICI) method.
2/1 Banks must use the Individual Concentration Index method to measure individual concentration risk for the portfolio of allocations to 5 Companies and Retail simultaneously and calculate the additional capital required in this regard.

3/1 The Individual Concentration Index is calculated using the Herfindahl Index (HI) and the Adjustment Factor (AF), according to the following equation:

$$ICI=H\times AF=\frac{\sum_{i=1}^{1000}\ x^{\ 2}}{\left(\sum_{i=1}^{1000}\ x\right)^{2}}\times\frac{\sum_{i=1}^{1000}\ x}{\sum_{i=1}^{1000}\ x\ 2}\times100\ =\ \frac{\sum_{i=1}^{1000}\ x^{\ 2}}{\sum_{i=1}^{1000}\ x\sum\ y}\times100.$$

Where:
X : Represents the total allocations of the bank to the largest 1000 customers (taking into account that the concept of customer includes the customer and related parties) or the total allocations of the bank as a whole if the number of its customers is less than 1000 customers for Companies and Retail without deducting any provisions and without taking any type of collateral into account.

Y: Represents the total allocations in both the Companies and Retail portfolios, without deducting any provisions and without taking any type of collateral into account. This balance includes all allocations to Companies and Retail customers, including commercial paper discounted, credit facilities, loans, debt instruments, shares, off-balance sheet items, and any form of financial support.

Based on the result obtained from applying the previous equation, the additional capital ratio required to cover credit concentration risk (as a percentage of capital requirements for credit risk for Companies for Retail under Pillar 1) can be determined according to Table No. (1) below, which shows the relationship between the Individual Concentration Index (ICI) and the additional capital required to cover individual concentration risk (through which the capital requirement value for covering individual concentration risk is calculated).

4 Section Six provides a numerical example for measuring individual concentration risk using the Individual Concentration Index (ICI) method. 5 The Companies portfolio includes medium-sized companies, while the Retail portfolio includes allocations to individuals as well as micro and small enterprises according to the definition stated in the circular letter issued on March 5, 2017.

		Ind
	Individual Concentration
	Index
	ICI
	)
	%
		(
	Add
tional Capital Required
b (
%)	0	0.1 >= ICI > 0.0
2		0.2 >= ICI > 0.1
4	0.4 >= ICI > 0.2
6	1.0 >= ICI > 0.4
8	100 >= ICI > 1.0

4/1 When the bank has a capital requirement for the largest 50 customers under Pillar 1 according to the capital adequacy standard 6 The following is done:

If the capital requirement for the largest 50 customers under Pillar 1 according to the capital adequacy standard is greater than the capital requirement to cover individual concentration risk under Pillar 2 for the largest 1000 customers (including the 50 customers), only the capital requirement for the largest 50 customers under Pillar 1 is considered, and the bank is not required in this case to calculate an additional capital requirement to cover individual concentration risk under Pillar 2. If the capital requirement for the largest 50 customers under Pillar 1 according to the capital adequacy standard is less than the capital requirement to cover individual concentration risk under Pillar 2, the capital requirement for the largest 50 customers under Pillar 1 is considered, and the bank is also required to build the difference between them under Pillar 2 as an additional capital requirement for individual concentration risk.

5/1 If the bank does not have a capital requirement for the largest 50 customers under Pillar 1 according to the capital adequacy standard, the full additional capital requirement to cover individual concentration risk under Pillar 2 is considered.

-2 Sectoral Concentration Risk 7

1/2 Sectoral concentration risk arises from large concentrations among groups of parties whose probability of default is linked to their activity in one economic sector.

	1) The
	Real Estate and Leasing Industry
11)
Textile Manufacturing
and Ready-Made Garments	2) Agriculture and Forestry
	Exploitation and Tree Cultivation
12) Financial and Insurance Services
(Financial Services other than	3) Food, Beverage, and Tobacco
Banking Services)	Manufacturing
13) Social and Administrative Activities
and Education	4) Wholesale and Retail Trade and

---

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 42,180-character original (57% of the document). The remainder was not translated. The complete original-language text is stored with this document.]