E-SKOK Recommendation on Good Practices for Managing Operational, Interest Rate, Liquidity, and Concentration Risk in Cooperative Savings and Loan Societies

1 Financial Supervision Commission E-SKOK Recommendation regarding good practices in the field of managing operational risk, interest rate, liquidity and concentration in cooperative savings and loan societies Warsaw, September 2016

2 Introduction This document is issued pursuant to Article 62(2) of the Act of 5 November 2009 on cooperative savings and loan societies (Journal of Laws of 2013, item 1450, as amended) and constitutes a collection of good practices regarding the management of operational risk, interest rate, liquidity, and concentration in cooperative savings and loan societies (hereinafter: societies). Risk management in financial institutions is one of the pillars of their safe and efficient functioning. It should be noted that proper management of operational, interest rate, concentration, and liquidity risks is of fundamental importance for the safety and development of the cooperative savings and loan sector, directly translating into the safety of members' deposits, the stable functioning of societies, and the financial results of the sector. The provisions of the E-SKOK Recommendation relate to four basic types of risk considered by the supervisor (in addition to credit risk, to which Recommendation A-SKOK relates), namely: operational risk, interest rate risk, liquidity risk, and concentration risk. Important areas covered by the scope of the Recommendation are the mutual relations between the management board and the supervisory board of the society regarding key risk management issues, as well as the identification, measurement, and assessment of risk. The Recommendation also relates to mitigating risk, its monitoring and reporting, and the functioning of internal control in societies. The Recommendation is divided into two parts:

1. Common part relating to all types of risk included in the Recommendation.

2. Part relating to the individual types of risk included in the Recommendation and containing provisions specific to them. In preparing the provisions of this Recommendation, the supervisor took into account: • Basel Committee on Banking Supervision standards, adapted to the specificity of the cooperative savings and loan sector, considering the fact that societies primarily serve natural persons and their range of offerings is more limited than in banks, and that they serve only their members, who are assumed to be linked by a bond defined in the society's statute; • guidelines developed by the World Council of Credit Unions (WOCCU) and guidelines of the International Network of Credit Union Regulators (ICURN); • problems and threats identified during inspection processes and analytical supervision of the SKOK sector. Operational risk, due to its comprehensive nature, can have a significant impact on the activity and situation of cooperative savings and loan societies, especially since, in addition to the environment and external events, its source is the society as an entity managed in a specific way. As indicated by available studies, operational risk is the second most important type of risk in financial institutions after credit risk. Moreover, analyses of spectacular losses in the global financial system indicate that – although they manifested in the area of credit or market risk – their actual source was operational risk. Interest rate risk, being an inherent element of the financial intermediation process and transformation of repricing maturities, constitutes one of the significant types of risk in the activity of financial institutions. International experience indicates that the inability to manage this type of risk or even the lack of control over it has historically led to numerous bankruptcies of financial institutions. Liquidity risk is inextricably linked to the activity of financial institutions and constitutes one of the basic types of risk in activities where there is a transformation of maturities – the maturity of long-term assets and the due date of short-term liabilities. Inability to manage liquidity risk, even in the case of solvent institutions, creates a significant threat to the institution's activity. Concentration risk, which arises from excessive concentrations due to exposures to individual society members or groups of related and dependent society members – in a manner other than the membership bond defined in the statute, can lead to losses large enough to threaten the financial condition of the institution or its ability to conduct basic activity, or lead to a significant change in the institution's risk profile. Starting work on the E-SKOK Recommendation, similar to previous Recommendations issued for the SKOK sector, the supervisor adopted assumptions based on the need to take into account similarities resulting from offering the same types of financial products and conducting activity based on a similar functioning model as banks (and thus being exposed to a similar degree of risk – both in terms of types of risk and its scale depending on the organizational solutions adopted and decisions made), as well as differences resulting from regulations concerning the SKOK sector compared to regulations directed at banks and different stages of development of these entities. Scope of application of the Recommendation to individual societies and the role of the National Savings and Loan Society Due to the significant diversification of societies in terms of the scale of their activity (balance sheet total, number of members, number of employees, etc.) and the associated risk, the principle of proportionality applies when applying the provisions of the E-SKOK Recommendation. According to this principle, the manner of implementing these recommendations and the goals indicated in them may differ in individual societies. Therefore, the Recommendation should be treated as a collection of good practices, but the application of these practices should depend, among other things, on how well they fit the specificity and risk profile of the society, the particular legal conditions in which it operates, and the ratio of the costs of their implementation to the benefits derived from them (also from the perspective of the safety of society members). At the same time, the supervisor expects that decisions regarding the scope and manner of implementing the solutions indicated in the Recommendation will be preceded by in-depth analysis and supported by appropriate argumentation. For the purpose of determining the scope of application of selected provisions of the E-SKOK Recommendation, societies were divided into three groups: • GROUP I – societies meeting both criteria jointly: the society's balance sheet total is less than 50 million PLN, and the number of members is lower than 10 thousand; • GROUP II – societies with a balance sheet total of at least 50 million PLN, but not more than 200 million PLN (regardless of the number of members), and societies with a balance sheet total below 50 million PLN and a number of members of at least 10 thousand; • GROUP III – societies with a balance sheet total above 200 million PLN (regardless of the number of members). To the smallest societies (GROUP I), only the main recommendations (i.e., Recommendation 1, Recommendation 2, etc.) apply directly, and in the scope covered by detailed recommendations (i.e., recommendations 1.1, 1.2, etc.), societies may introduce their own solutions, keeping in mind that these solutions ensure the realization of goals specified in the individual recommendations. Furthermore, societies from GROUP I may decide not to apply Recommendations 11, 18, 24, and 32 regarding the conduct of stress tests (and consequently other recommendations, to the extent that they concern stress tests), as well as Recommendations 9, 12, 13, 14, 15, and 16 regarding operational risk, Recommendation 23 regarding liquidity risk, and Recommendations 31 and 34 regarding concentration risk. Societies from GROUP II may decide not to apply Recommendations 11, 18, 24, and 32 regarding the conduct of stress tests (and consequently other recommendations, to the extent that they concern stress tests), as well as detailed recommendations within Recommendation 12, 13, 14, 15, and 16 regarding operational risk. In the case of the largest societies (GROUP III), the supervisor expects the implementation of the Recommendation in its full scope, i.e., main and detailed recommendations. Taking into account the tasks of the National Cooperative Savings and Loan Society (hereinafter: National Society) specified in Article 44(2) of the Act on cooperative savings and loan societies, in order to ensure the most efficient implementation of the Recommendation's provisions by cooperative savings and loan societies and considering the need to reduce organizational burdens for societies associated with this process, the supervisor expects that the National Society will support societies in the process of improving the management of risk types included in the Recommendation and adapting to the provisions of the Recommendation – according to needs reported by individual societies (e.g., in the organization of specific processes, or determination of limits restricting specific risk types included in the Recommendation), so as to significantly facilitate (especially for smaller societies) adaptation to the Recommendation. Whenever individual recommendations mention "borrower" or "loan," the provisions of these recommendations also apply to "lenders" and "advances," unless otherwise specified or if the inability of the society to adapt to a given provision results from the specificity of advances. Furthermore, for the purposes of the Recommendation, the terms "society member" and "borrower" are used interchangeably. The Financial Supervision Commission expects that the E-SKOK Recommendation regarding good practices in the field of managing operational, interest rate, liquidity, and concentration risk in cooperative savings and loan societies, constituting an annex to Resolution No. 684/2016 of the Financial Supervision Commission of 27 September 2016 (Journal of Regulations of the KNF item ……) will be implemented no later than 31 December 2017.

6 Glossary of Terms

1. Alternative sources of financing – potentially available liquidity sources strengthening the society's ability to survive crisis events. Depending on the nature, severity, and duration of the crisis event, potential financing sources may include, for example: a) increase in deposits, b) extension of liability due dates, c) securitization of assets, d) sale of highly liquid assets, e) drawing on granted credit lines, f) loan or advance from the credit-investment fund or loan from the stabilization fund of the National Society.

2. Scenario analysis – involves conducting an analysis assuming scenarios of simultaneous change of multiple co-occurring risk factors and studying their impact on the society's situation.

3. Sensitivity analysis – involves conducting an analysis assuming changes in individual risk factors, as well as combinations of such changes, and statically analyzing their impact on the society's situation.

4. Risk appetite – the current and future readiness of the society to take on risk. Risk appetite should be embedded in the assumptions of the society's overall activity strategy. It should also correspond to the following activity conditions, such as: a) activity strategy and strategic goals, b) operational goals, c) the role the society plays in the financial system, d) financial condition, e) ability to raise financing.

5. Credit exposure – the society's receivables from loans and advances, debt limits (including credit and overdraft cards), acquired receivables, checks, promissory notes, realized guarantees, other receivables of a similar nature, and granted off-balance sheet commitments.

6. Group of related members – a group of related and dependent society members in a manner other than the membership bond defined in the statute, characterized by the potential to generate losses large enough to threaten the society's financial condition or ability to conduct basic activity, or to lead to a significant change in the society's risk profile.

7. Organizational unit – a basic element of the organizational structure separated due to functions in the organization or according to other criteria.

8. Key processes – processes indicated by the society within its activity that condition the realization of the society's strategy (including business strategy and risk management strategy).

9. Critical processes – processes indicated by the society within its activity, in the case of which rapid recovery of operational efficiency may be of significant importance from the perspective of the institution's business continuity.

10. Yield curve – a curve illustrating the mutual relationships between interest rates and different maturity dates.

11. Liquidity gap (realistic) – a compilation of mismatches between asset maturity dates and liability due dates in a given time interval, taking into account assumptions regarding possible behaviors of asset, liability, and off-balance sheet positions to realistically determine the future level of liquidity. Estimating realistic cash flows requires the society to develop its own, prudent technique for their assessment, taking into account assumptions regarding, among others, early deposit withdrawals, later loan repayments, stability of financing sources, rules of impact on the liquidity position of contingent liabilities and receivables, and other off-balance sheet transactions, costs of forced asset sales, or changes in economic situation and changes in member preferences regarding products.

12. Liquidity gap (contractual) – a compilation of mismatches between asset maturity dates and liability due dates in a given time interval, prepared based on estimates of cash flows to determine the future level of liquidity. Estimating cash flows involves determining the remaining periods to asset maturity and liability due dates, as well as off-balance sheet positions, by compiling these assets, liabilities, and off-balance sheet positions in cumulative time intervals, counting from the date of preparation of the compilation. The occurrence of a positive/negative difference between the sum of maturing assets and the sum of due liabilities and off-balance sheet positions in a given time interval indicates the maintenance of a positive/negative gap.

13. Long-term liquidity – the ability to perform all monetary obligations on time on the payment date falling in the period above 12 months.

14. Short-term liquidity – the ability to perform all monetary obligations on time on the payment date falling in the period of 30 consecutive days.

15. Medium-term liquidity – the ability to perform all monetary obligations on time on the payment date falling in the period from 1 to 12 months.

16. External entities cooperating with the society in the implementation of its tasks – entities that cooperate with the society in the scope of the society's tasks specified in Article 3 of the Act.

17. Operational risk profile – the scale and structure of exposure to operational risk; it determines the degree of exposure to operational risk and can be expressed in selected structural dimensions chosen by the society (such as, among others, types of operational events, key processes) and scale dimensions (such as, among others, estimated potential loss size); to determine it, the society uses, among others, available information on operational events (including regarding their frequency and severity) and information derived from the use of operational risk management tools.

18. Reserve requirement – a reserve of liquid funds maintained by the society in accordance with Article 38(3) and (5) of the Act of 29 August 1997 on the National Bank of Poland (Journal of Laws of 2013, item 908, as amended).

19. Liquid reserve – a reserve of liquid funds maintained by the society in accordance with Article 38 of the Act.

20. Concentration risk – the threat resulting from excessive concentration towards individual society members or groups of related and dependent society members – in a manner other than the membership bond defined in the statute, characterized by the potential to generate losses large enough to threaten the society's financial condition or ability to conduct basic activity, or to lead to a significant change in the society's risk profile. Excessive concentration due to credit exposures may occur towards individual members, groups of related members, members operating in the same economic sector, geographic region, conducting the same activity, and credit exposures denominated in the same currency or indexed to the same currency.

21. Operational risk – the threat of occurrence of a loss resulting from inadequate or failed internal processes, people, and systems, or from external events, including legal risk.

22. Liquidity risk – the threat of loss of ability to finance assets and timely performance of obligations in the course of normal society activity or under other foreseeable conditions, causing the necessity to incur unacceptable losses.

23. Interest rate risk – the threat resulting from the exposure of the society's current and future financial results and its capital to the adverse impact of interest rate changes.

24. Reverse test – involves conducting an analysis assuming the occurrence of negative consequences from the materialization of risk and determining scenarios within scenario analysis that could lead to such situations.

25. Act – the Act of 5 November 2009 on cooperative savings and loan societies (Journal of Laws of 2013, item 1450, as amended).

26. Threshold values – quantities, upon exceeding which actions/conditions specified in the contract are triggered.

27. Threshold events for off-balance sheet positions in the context of liquidity loss risk – events related to off-balance sheet positions, the occurrence of which triggers actions contained in contracts generating liquidity demand.

28. Crisis events/situations/conditions – the most severe scenarios of extreme conditions that can affect the society's ability to sell assets or restrict access to financing sources.

29. Ability to compensate for shortages – a plan for maintaining a liquidity surplus or having access to liquidity sources relative to the normal condition scenario in the short, medium, and long-term time horizons, and in the event of realization of extreme scenarios, as well as a plan for further methods of obtaining liquidity, whether through new financing sources, adaptation of activity, or other actions specified in the liquidity contingency plan. The ability to compensate for shortages includes a liquidity surplus and is significantly broader than it.

10 List of Recommendations Recommendations relating to all types of risk included in the Recommendation Management Board and Supervisory Board Recommendation 1 The society's management board is responsible for developing and implementing written risk management policies for: a) operational risk, b) interest rate risk, c) liquidity risk, d) concentration risk. Recommendation 2 The society should develop in written form and implement procedures for managing individual types of risk resulting from the risk management policies included in the Recommendation. Recommendation 3 The society's management board should appoint persons responsible for risk and ensure the implementation of the society's policies regarding the management of risk types included in the Recommendation. Recommendation 4 The society's management board should, at least once a year or in the event of significant changes, assess the adopted policies regarding the risk types included in the Recommendation in terms of their application and the possible need to introduce changes. The society's management board should inform the supervisory board of the assessment results. Recommendation 5 The supervisory board, within the fulfillment of its functions and responsibility for the risk management process in the society, should supervise the implementation of risk management policies included in the Recommendation. Recommendation 6 The society's organizational structure, in a manner corresponding to the scale of activity and risk profile, should ensure functional division within the organization (maintaining its organizational coherence allowing for full control and decision-making by the society's bodies) between units: a) conducting operations affecting the types of risk included in the Recommendation, b) responsible for monitoring and controlling these types of risk.

Internal Control Recommendation 7 Internal control in the society should cover the society's activity in the scope of risk types included in the Recommendation. Recommendations regarding individual types of risk included in the Recommendation Operational Risk Management Board and Supervisory Board Recommendation 8 The society should adapt processes and resources (especially employment, IT support) to the scale and complexity of the conducted activity, considering the necessity to ensure efficient management of operational risk. Identification, Measurement, Assessment, and Tools Supporting the Operational Risk Management Process Recommendation 9 The society should identify threats related to operational risk for all significant areas of the society's activity, as well as for the creation of all new and modifications of existing products, processes, and systems. Recommendation 10 Operational risk management should be based on a reliable risk assessment conducted in accordance with approved procedures. Recommendation 11 The society, as part of the operational risk assessment, should conduct stress tests, whose programs are regularly reviewed and evaluated for effectiveness and fit for purpose, both qualitatively and quantitatively. Periodic (conducted at least once a year) stress tests should include estimates of operational events and losses, as well as scenario tests covering the analysis of potential threats. Based on the tests, the manner of handling individual identified types of risk within operational risk should be determined, including their maximum acceptable level. Counteracting and Mitigating Interest Rate Risk Recommendation 12 The society should define, in accordance with the type and level of identified risk types within operational risk, actions counteracting risk, aimed at avoiding, mitigating, or transferring it. Recommendation 13 The society should possess a business continuity management system, including business continuity plans and contingency plans, ensuring uninterrupted operation of the society at a specified level, taking into account the society's operational risk profile. Recommendation 14 The society, as part of the risk management process, should apply risk transfer mechanisms based on conducted analyses and stress tests. Monitoring and Reporting of Operational Risk Recommendation 15 The society should possess a system for monitoring operational events and a defined limit system (e.g., KRIs), enabling observation of the operational risk profile and effective functioning of the management information system. Recommendation 16 The society should make every effort to ensure that data obtained by it for reporting purposes (especially for management purposes) is reliable and characterized by high quality, including ongoing control of this quality. It should also control the impact of the quality of this data on the risk management process. Interest Rate Risk Identification, Measurement, Assessment, and Tools Supporting the Process of Managing Interest Rate Risk