Recommendation G on Interest Rate Risk Management in Banks

1 Financial Supervision Commission

Recommendation G concerning interest rate risk management in banks Warsaw, February 2024

2 Introduction This Recommendation (hereinafter: Recommendation, Recommendation G) is issued pursuant to Article 137(1)(5) of the Act of 29 August 1997 – Banking Law (consolidated text: Journal of Laws of 2023, item 2488, as amended; hereinafter: Banking Law Act), Article 12(1b) of the Act of 20 July 2000 on the publication of normative acts and certain other legal acts (Journal of Laws of 2019, item 1461), Article 11(1) and Article 67(2) of the Act of 21 July 2006 on the supervision of the financial market (consolidated text: Journal of Laws of 2024, item 135), and replaces Recommendation G of the Banking Supervision Commission concerning interest rate risk management in banks from 2002 (hereinafter: Recommendation G of 2002), which contained a set of rules regarding good practices in interest rate risk management. The objective of interest rate risk management is to maintain the variability of financial results and economic value measures, resulting from changes in interest rates, within limits that do not threaten the safety of the bank, in accordance with applicable regulations and internal regulations adopted by the bank. Recommendation G takes into account current conditions regarding products generating interest rate risk and techniques for managing this risk. The Bank should observe and implement the provisions of this Recommendation in compliance with applicable regulations, in particular from the following catalog:

• Banking Law Act,
• Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ EU 2013, L 176 of 27.6.2013, p. 1, as amended),
• Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014 (OJ EU 2016, L 171 of 29.6.2016, p. 1, as amended),
• Guidelines issued pursuant to Article 84(6) of Directive 2013/36/EU specifying criteria for identifying and assessing risk arising from potential changes in interest rates and managing and mitigating this risk, as well as assessing and monitoring credit spread risk arising from activities within the banking book of institutions (EBA/GL/2022/14) of 20 October 2022 issued by the European Banking Authority (EBA),
• Regulation of the Minister of Finance, Funds and Regional Policy of 8 June 2021 on the risk management system and internal control system as well as remuneration policy in banks (Journal of Laws 2021, item 1045, as amended),
• Regulation of the Minister of Finance, Funds and Regional Policy of 27 July 2021 on the detailed method of estimating internal capital and conducting by the bank reviews of strategies and procedures for estimating and continuously maintaining internal capital (Journal of Laws 2021, item 1408),
• Regulation of the Minister of Development and Finance of 6 March 2017 on the criteria and method of conducting supervisory examination and assessment in banks (consolidated text: Journal of Laws 2022, item 1201). This Recommendation should also be applied in compliance with other Recommendations of the Financial Supervision Commission to the extent resulting from their subject matter. The Recommendation refers to interest rate risk management principles in the trading book and in the banking book.

3 When a given recommendation refers only to one of the books, this is indicated in its content. The Bank adapts to the provisions of the Recommendation taking into account the principle of proportionality understood as adequate adaptation of adopted solutions to the nature, size and scale of the bank's activity, the complexity of the business model and the bank's risk profile. In the case of cooperative banks operating in an association or in a system of institutional protection within the meaning of the Act of 7 December 2000 on the functioning of cooperative banks, their association and affiliated banks (consolidated text: Journal of Laws of 2022, item 1595, as amended), the supervisory authority intends that the principles of interest rate risk management be developed with the support of affiliated banks or entities managing the institutional protection system, taking into account the individual specificity and risk profile of each affiliated bank and the principle of proportionality. In these banks, the process of creating regulations concerning interest rate risk management, despite the active role of the affiliated bank or the entity managing the institutional protection system, must not, however, contradict the scope of duties and statutory responsibility of the governing bodies of affiliated cooperative banks defined in individual recommendations. Affiliated banks and entities managing institutional protection systems should support affiliated cooperative banks in developing analytical tools for the purpose of measuring interest rate risk, including preparing and conducting supervisory outlier tests. Furthermore, the intention of the supervisory authority is that entities managing protection systems monitor and control interest rate risk at the level of entities co-creating these systems. Principles relating to the bank's policy and detailed prudential requirements concerning interest rate risk management have been specified in the subsequent chapters of this Recommendation. Recommendation G also defines the expected direction of actions undertaken by the management board and supervisory board of the bank within the interest rate risk management process. Areas covered by the Recommendation Recommendations constituting this regulation relate to matters concerning interest rate risk management in banks and cover the following areas: I. Management board and supervisory board. II. Identification and measurement of interest rate risk and tools supporting the interest rate risk management process. III. Interest rate risk management. IV. Monitoring and reporting on interest rate risk. V. Internal control system. The provisions of Recommendation G should be treated as supplementary to the provisions of laws and regulations as well as EBA guidelines and should not be interpreted in a manner inconsistent with them. The Financial Supervision Commission expects that Recommendation G, constituting an annex to Resolution No. 60/2024 of the Financial Supervision Commission of 26 February 2024 (Journal of Laws of KNF item 5) will be implemented by banks no later than 31 December 2024.

4 Glossary of used terms Risk appetite – understood as the bank's current and future willingness to take risks. CSRBB – credit spread risk in the banking book (ang. credit spread risk from the banking book). EVE – economic value of equity (ang. economic value of equity) understood in accordance with the IRRBB and CSRBB Guidelines. IRRBB – interest rate risk in the banking book (ang. interest rate risk in banking book). Bank management – the management board of the bank, directors of organizational units, acting independently or jointly, depending on the importance of the issue. Measurement methods – measurement methods include both models and other methods that are not models within the meaning of Recommendation W. IRRBB measures – understood in accordance with the IRRBB and CSRBB Guidelines. Model – understood in accordance with Recommendation W. NII – net interest income (ang. net interest income). Recommendation H – Recommendation H of the Financial Supervision Commission concerning the internal control system in banks. Recommendation S – Recommendation S of the Financial Supervision Commission concerning good practices in managing mortgage-backed credit exposures. Recommendation W – Recommendation W of the Financial Supervision Commission concerning model risk management in banks. CRR Regulation – Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ EU 2013, L 176 of 27.6.2013, p. 1, as amended). BMR Regulation – Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014 (OJ EU 2016, L 171 of 29.6.2016, p. 1, as amended). Mismatch risk – understood in accordance with the IRRBB and CSRBB Guidelines. Basis risk – understood in accordance with the IRRBB and CSRBB Guidelines. Customer option risk – understood in accordance with the IRRBB and CSRBB Guidelines.

5 Supervisory Outlier Test – (ang. Supervisory Outlier Test) a test defined in the delegated regulation of the Commission issued pursuant to the authorization contained in Article 98(5a) of Directive 2013/36/EU1. IRRBB and CSRBB Guidelines – Guidelines issued pursuant to Article 84(6) of Directive 2013/36/EU specifying criteria for identifying and assessing risk arising from potential changes in interest rates and managing and mitigating this risk, as well as assessing and monitoring credit spread risk arising from activities within the banking book of institutions (EBA/GL/2022/14) of the European Banking Authority, 20.10.2022. Systemic importance – importance consistent with the category assigned in the BION process.

1 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ EU 2013, L 176 of 27.6.2013, p. 338, as amended).

6 I. Management board and supervisory board The management board of the bank is responsible for developing and approving, in written or electronic form, and ensuring compliance with the policy on interest rate risk management. The management board bears responsibility for interest rate risk management. The bank's management board should ensure the employment of a sufficiently large and qualified staff enabling effective interest rate risk management. The bank's management board should appoint persons responsible for implementing and currently executing the bank's policy on interest rate risk management. The bank should develop, in written or electronic form, and then implement interest rate risk management procedures, taking into account the provisions of the policy on interest rate risk management. The supervisory board, within the framework of fulfilling its functions and responsibility for the risk management system, should supervise the implementation of the interest rate risk management policy. The bank's management board should assess the adopted policy on interest rate risk management at least once a year regarding the manner of its practical application and assess the need for its update. The bank's management board should inform the supervisory board of the results of the assessment of the adopted policy along with recommendations for any necessary changes. The organizational structure of the bank, in a manner corresponding to the scale of activity and risk profile, should ensure the separation of functions between organizational units: a) conducting operations affecting interest rate risk, including managing the interest rate risk position, b) responsible for identifying, measuring, monitoring and controlling interest rate risk. The bank should identify interest rate risk in the process of planning new activities involving the introduction and development of new products and services and entering new markets, as well as significant changes to existing products and services and changes in the markets in which it operates.

7 The introduction of a new financial product in the bank should be preceded by a formal preparatory process including, among other things, the identification of all significant risks (including the impact of this product on interest rate risk), the establishment of limits, accounting rules, reporting and risk measurement, and formal approval by the bank's management. II. Identification and measurement of interest rate risk and tools supporting the interest rate risk management process The bank should have appropriate internal systems, databases and analytical tools supporting interest rate risk management. The functionality of these internal systems, databases and analytical tools should support the bank in fulfilling regulatory requirements and applying internal methods of measuring interest rate risk. The bank should have a reliable and effective process for identifying and measuring interest rate risk. The bank, as part of the stress testing program, should conduct stress tests serving to assess the impact of market factors on interest rate risk. III. Interest rate risk management at the consolidated level and limiting interest rate risk Interest rate risk management should be conducted at the individual and consolidated level, if the bank is required to meet the requirements established in parts two to four, part seven and part seven A of the CRR Regulation based on its consolidated situation. The bank should apply limits approved by the management board or the appropriate committee limiting interest rate risk. These limits should reflect systemic importance, the nature, scale and complexity of the bank's activity. Implemented limits should ensure that exposure to interest rate risk is maintained in accordance with the bank's interest rate risk appetite. The bank should ensure that mechanisms for limiting interest rate risk are adequate, feasible and fully understandable to the appropriate employees.

8 IV. Monitoring and reporting on interest rate risk The bank should have an interest rate risk monitoring system enabling the rapid acquisition of managerial and supervisory information and a rapid response by the bank to existing threats. The bank should have a reliable and trustworthy managerial information system in the area of interest rate risk enabling effective decision-making. This system should provide information on the interest rate risk to which the bank is exposed, enabling the assessment of interest rate risk, including the assessment of the consequences of management decisions, and serve to monitor compliance with limits. V. Internal control system The bank should ensure that the internal control system, operating in accordance with the provisions of Recommendation H, covers the area of interest rate risk management.

9 I. Management board and supervisory board The management board of the bank is responsible for developing and approving, in written or electronic form2, and ensuring compliance with the policy on interest rate risk management. 1.1. The policy on interest rate risk management should result from the risk management strategy approved by the supervisory board for the conducted activity, in particular reflecting the risk appetite specified in the strategy and accepted by the supervisory board of the bank. 1.2. The interest rate risk management policy should specify in particular: a) the responsibility of the bank's management for interest rate risk management and for the manner of monitoring this activity, b) in the scope of identification, measurement and assessment of interest rate risk, principles:

• taking into account all risk factors significant for the bank, taking into account possible correlations between them – including those that may only manifest under stress conditions,
• ensuring a proper and proportional approach (including corresponding assumptions) to the measurement and assessment of interest rate risk; when allocating internal capital for interest rate risk, various types of IRRBB (mismatch risk, basis risk, customer option risk) should also be included,
• conducting stress tests examining the impact of factors from the bank's external environment on interest rate risk, ensuring the consideration of dependencies between risk factors,
• validation of internal methods of measuring interest rate risk used in the bank (both developed by the bank and provided by external suppliers), as well as the introduction, use and assessment of the effectiveness of statistical tools supporting measurement, c) in the scope of acceptance and limiting interest rate risk, principles:
• taking into account in the interest rate risk management process, risk resulting from the specificity of the bank's product offer,
• acceptance of assumptions and parameters adopted in the interest rate risk measurement process
• determining a level of interest rate risk that fits within the risk appetite,
• taking into account interest rate risk in the process of planning new activities,
• taking into account interest rate risk in the process of estimating internal capital, including the allocation of internal capital separately for interest rate risk in the trading book and banking book,

2 Within the meaning of Article 781 § 1 of the Act of 23 April 1964 – Civil Code (Journal of Laws of 2023, item 1610, as amended).

10

• appropriate selection of mechanisms for limiting interest rate risk, in particular limits limiting this risk. d) in the scope of monitoring interest rate risk, principles:
• monitoring interest rate risk at the individual and consolidated level (if according to recommendation 10 the bank manages interest rate risk at the consolidated level), taking into account the nature of the business lines distinguished by the bank,
• monitoring compliance with limits limiting interest rate risk,
• procedures in the event of exceeding limits limiting interest rate risk,
• determining the scope and frequency of reporting, including on limit exceedances, recipients of reports and cells responsible for their preparation. 1.3. The interest rate risk management policy should be specified in a separate document or be part of the market risk management policy. 1.4. The management board should ensure the adaptation of the interest rate risk management policy in the event of significant changes in the bank's activity profile or macroeconomic environment. 1.5. The bank's management board should ensure comprehensive inclusion of the area of interest rate risk management in the bank's risk management system, including with regard to reporting and review of interest rate risk management principles, internal control mechanisms and managerial information systems. The management board bears responsibility for interest rate risk management. The bank's management board should ensure the employment of a sufficiently large and qualified staff enabling effective interest rate risk management. The bank's management board should appoint persons responsible for implementing and currently executing the bank's policy on interest rate risk management. 2.1. The number and qualifications of staff responsible for interest rate risk management should be at such a level that the bank ensures continuity of interest rate risk management in any situation. 2.2. The basic tasks of persons appointed by the bank's management board responsible for implementing and currently executing the bank's policy on interest rate risk management should include: a) ensuring compliance of internal procedures with the policy adopted by the management board, b) defining the scope of tasks, duties and controls and responsibility for interest rate risk management of individual employees, c) ensuring periodic, independent control of adopted internal procedures and the manner of their implementation (this control may be conducted by the internal audit cell).

11 2.3. Persons appointed by the management board responsible for implementing and currently executing the bank's policy on interest rate risk management should ensure that employees are familiar with and understand the procedures used. The bank should develop, in written or electronic form, and then implement interest rate risk management procedures, taking into account the provisions of the policy on interest rate risk management. 3.1. Procedures concerning interest rate risk management should, among other things, specify the method and methods of: a) identification and measurement of interest rate risk, b) monitoring the interest rate risk management process, with particular regard to procedures ensuring compliance with the requirements specified in legal provisions and internal regulations, c) limiting interest rate risk through appropriate selection of mechanisms, in particular appropriate indicators and limits limiting interest rate risk, d) reporting (including scope, frequency, recipients of reports, cells responsible for their preparation) of the level of interest rate risk, compliance with limits and results of the action of models used to assess exposure to interest rate risk in the banking book and trading book, e) using (including description, scope and manner of use) IT tools/systems used in interest rate risk management, f) conducting stress tests, taking into account all interest rate risk factors identified by the bank as significant. Other areas where the development of internal procedures is required have been indicated in individual recommendations. 3.2. In the event of a significant change in the level of risk, significant changes in the macroeconomic environment, a change in the risk profile in the bank's activity or the identification of irregularities in the functioning of the interest rate risk management system, the bank should introduce necessary corrections and modifications to the internal procedures used.

12 The supervisory board, within the framework of fulfilling its functions and responsibility for the risk management system, should supervise the implementation of the interest rate risk management policy. The bank's management board should assess the adopted policy on interest rate risk management at least once a year regarding the manner of its practical application and assess the need for its update. The bank's management board should inform the supervisory board of the results of the assessment of the adopted policy along with recommendations for any necessary changes. 4.1. The management board should, no less than once every six months, provide the supervisory board and the risk committee, referred to in Article 9cb(1)(2) of the Act – Banking Law, or the combined committee, referred to in Article 9cb(5) of this Act (if the supervisory board has assigned such a committee to monitor the risk management system on an ongoing basis), reports on the interest rate risk borne by the bank, the use of limits and the consequences of decisions regarding interest rate risk management. The supervisory board should ensure that, if necessary, the bank's management board takes appropriate remedial actions. 4.2. The assessment of the adopted interest rate risk management policy should in particular