GUIDANCE NOTE
ON
INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS
November 2016

Preface

The vibrant growth of financial institutions globally and the increased development of bank products have brought about challenges that require functioning systems in banks for mitigating against risks. The regulatory capital framework places increased emphasis on risk management and banks are required to employ suitable procedures and systems in order to ensure their capital adequacy. These procedures are referred collectively as the Internal Capital Adequacy Assessment Process (ICAAP). ICAAP is the formal process through which a bank identifies, measures, aggregates and monitors material risk, to ultimately build a risk profile that becomes the basis for allocating capital. ICAAP Documents of banks are reviewed by the Central Bank of Kenya (CBK) through Supervisory Review Process (SREP). SREP is not only intended to ensure that banks have adequate capital to support all the risks in their businesses, but also to encourage banks to develop and use better risk management techniques in monitoring and managing these risks.

The purpose of the guidance note is to assist banks in the implementation of ICAAP in accordance with the requirements of Clause 4.4 of the Central Bank of Kenya Prudential Guideline on Capital Adequacy (CBK/PG/03).

Guidance Note On Internal Capital Adequacy Assessment Process (Icaap)

1. Introduction

a. All institutions are required to develop an ICAAP document that ensures that total capital levels are adequate and consistent with their strategies, business plans, risk profiles and operating environment on a going concern basis.

b. CBK recognizes that there is no single correct approach to conducting the ICAAP. As such, the focus of this Guidance Note is on providing high level minimum requirements rather than prescriptive criteria on ICAAP methodologies or techniques that should be employed.

c. Institutions should design their ICAAP to cater for their individual needs and circumstances.

d. CBK will review and evaluate the soundness and use of institutions' ICAAP as part of its risk-based supervisory process through the Supervisory Review and Evaluation Process (SREP).Through SREP, CBK will explore through dialogue with institutions, how institutions identify, measure, aggregate and monitor risks they take, and how they set their overall risk-bearing capacity. The dialogue will be structured to cover elements such as internal governance, organization of the institution's business, and how the institution allocates capital against risk.

The Supervisory Review and Evaluation Process is illustrated in the diagram below: e. Based on SREP, the Central Bank may require any bank to, among other things, take action to improve its capital and risk management processes if it is not satisfied with an institution's ICAAP.

2. General Rules For Icaap

Institutions are required to develop an ICAAP that is:- a. Formalized and documented.

b. Detailed and sufficiently indicating the current and prospective total capital necessary to support all material risks that the institution is exposed to in a forecasted period for a minimum of three years and ideally for five years.

c. Subject to internal review and approval by board and management.

d. Comprehensive in coverage of risks. The ICAAP should adequately identify and measure the risks associated with the institution's business and the assessment of how much capital is needed to support these risks.

e. Indicative of the interactions between the various risks under both normal and stressed conditions. Institutions should identify all risks including external risk factors that may arise from the regulatory, economic or business environment.

f. Relates the institution's capital adequacy goals to risks, strategic focus and business plan. g. Ensures the integrity of the overall management process by the inclusion of a process of internal controls, independent reviews and audits.

h. Integrates adequate policies, controls and procedures to validate, on a regular basis, the methodology, data and the robustness of the systems and processes involved in modelling the probabilities of occurrence, and the potential consequences of individual risks and their aggregation.

i. Exhibits a simple and intuitive presentation.

3. Principle Of Proportionality

CBK expects a fair degree of variation from institutions with regards to the length and format of their ICAAP documents. However, the ICAAP documents should be proportional to the size, nature and complexity of an institution's business activities. This is because the ICAAP should be proportionate to the institution's risk profile. The principle of proportionality shall apply to the following aspects of ICAAP:- a. The methodologies used in measuring/assessing risks and in determining the related internal capital.

b. The type and nature of the stress tests adopted. c. The treatment of correlation among risks and the determination of total internal capital.

d. The organizational structure of the risk control systems.

e. The scope and detail of ICAAP reporting to the CBK.

4. Key Elements/Components Of A Sound Icaap

An effective ICAAP should comprise the following six components:-

(I) Board And Senior Management Oversight

The Board and senior management of an institution should:
a. Ensure that the bank has adequate capital to support its risks. At a minimum, the capital required should enable the bank to operate as a going concern and be sufficient to provide for business growth.

b. Establish adequate and effective capital planning and management policies as stipulated under clause 3.3.2 of the CBK's Prudential Guideline on Corporate Governance (CBK/PG/02).

c. Review the ICAAP policies, with changes approved by the Board; at least annually or whenever such review is prompted by specific events (e.g. an opportunity for a significant acquisition has emerged). Further, the policies should always be in compliance with the applicable supervisory and regulatory requirements.

d. Ensure that the bank has in place a capital plan which clearly outlines its current and future capital needs, anticipated capital expenditures, desirable capital level, external capital sources and any capital action required.

e. Develop guiding principles for determining the appropriateness and priority of a particular action under different scenarios, taking into account relevant considerations such as economic value added, costs and benefits and market conditions.

f. Ensure that the definition of the bank's capital used in its ICAAP is stated clearly and is consistently applied. This definition of capital should be aligned to the definition in the CBK's Prudential Guideline on Capital Adequacy (CBK/PG/03).

(Ii) Sound Capital Planning

The process of sound capital planning should meet the following requirements:- a. The approved ICAAP document should include the capital plan setting out capital targets and time horizons for achieving them. The document should also provide in broad terms the capital planning process and the responsibilities that come along with it. Institutions should declare intention to comply with regulatory capital requirements and provide a general contingency plan for dealing with divergences and unexpected events.

b. The amount of capital held should reflect not only the measured amount of risks, but also an additional amount to account for potential uncertainties as identified in the ICAAP.

c. There should be a process to state the institution's capital adequacy goals in relation to risks, taking into account its strategic focus and business plan.

d. The institutions should develop an internal strategy for maintaining capital levels which should also incorporate factors such as growth expectations, future sources and uses of funds, and dividend policy.

e. Other considerations taken into account when developing ICAAP such as external rating goals and market image leads to the requirement of the institutions to show how the considerations have influenced its decisions concerning the amount of capital to be held.

f. Institutions are required to implement their ICAAP on a consolidated basis in a banking group. That is, institutions conducting their ICAAP at the group level should ensure that their consolidated capital is adequate to support the volume and risk characteristics of parent and subsidiary activities as well as being sufficient to absorb potential losses arising from such activities.

(Iii) Comprehensive Identification/Assessment Of Risks

a. The policies and procedures to identify, measure, monitor, control, and report the risks inherent in an institution's activities should be comprehensive and should be monitored and reviewed continually. Some of the risks to be considered by banks in their ICAAP process are outlined under Annex A.

b. Risk measurement systems should be sufficiently comprehensive and rigorous to capture the nature and magnitude of the risks faced by the institutions, whilst differentiating risk exposures consistently among risk categories and levels of riskiness.

c. Adequate controls should be in place to ensure the objectivity and consistency of risk identification and measurement and that all material risks (both on- and off-balance sheet) are adequately addressed.

d. Detailed analyses should be conducted to support the accuracy or appropriateness of the risk measurement techniques used.

e. Limitations of risk quantification and measurement methods should be identified and understood through appropriate processes.

f. Those risks that are not easily quantifiable should be evaluated using qualitative assessment and management judgment. Nevertheless, institutions should recognize the biases and assumptions embedded in, and the limitations of, the qualitative approaches used, with a view to ensuring that the potential impact of the relevant risk is not underestimated.

g. To facilitate firm-wide risk management and oversight, institutions should have in place appropriate infrastructure and Management Information Systems.

h. If institutions use third-party inputs or other tools (e.g. credit ratings, risk measures and models) to produce risk management information, they should have adequate procedures in place to ensure that such inputs and tools are subject to initial and ongoing validation.

i. If institutions employ risk mitigating techniques, they should understand the risk to be mitigated and the potential effects of that mitigation and have in place appropriate policies and procedures to control risks associated with these techniques.

(Iv) Stress Testing

a. An institution's ICAAP should incorporate the results of forward-looking stress tests for a minimum of three years and ideally five years when evaluating the institution's capital adequacy based on plausible adverse circumstances.

b. Stress tests are quantitative and qualitative techniques used by banks to assess their vulnerability to exceptional, but plausible, events. They involve assessing the impact on banks' exposures of specific events (sensitivity analysis) or joint movements of a set of economic and financial variables under adverse scenarios (scenario analysis).

c. A bank should obtain a forward-looking view on the bank's capital adequacy through stress-tests and scenario analyses.

d. When measuring risks, comprehensive and rigorous stress tests should be performed to identify possible events or market changes that could have serious adverse effects or significant impact on the bank's capital and operations.

e. Stress-testing should form an integral part of the overall governance and risk management culture of a bank.

f. Stress-testing should be actionable, with the results from stress-testing analyses affecting decision-making at the appropriate management level, including the strategic business decisions of the board and senior management. Board and senior management involvement in the stress-testing programme is essential for its effective operation.

g. A bank should operate a stress-testing programme that promotes risk identification and control, provides a complementary risk perspective to other risk management tools, improves capital and liquidity management and enhances and external communication.

h. A bank should have written policies and procedures governing its stress testing programme.

i. The operation of the programme should be appropriately documented. j. For further guidance on CBK's expectations on stress testing, institutions are advised to refer to CBK's Prudential Guideline on Stress Testing (CBK/PG/20).

(V) Monitoring And Reporting

Banks should have a system for monitoring and reporting risk exposures and assessing how their changing business risk profiles affect their capital needs. They are therefore required to:
a. Evaluate the level and trend of material risks and their effects on capital levels; b. Evaluate the sensitivity and reasonableness of the key assumptions used in capital assessment; c. Determine that they hold sufficient capital against the various risks and ensure compliance with established capital adequacy goals; d. Assess future capital requirements based on reported risk profiles and indicate any necessary adjustments to be made to the banks' ICAAP document based on that assessment.

(Vi) Internal Control Review

a. In setting up its internal control system, the bank must ensure a strict segregation of duties and assignments of authority in addition to a clear, transparent and documented decisionmaking process in order to ensure congruency with internal decisions and workflows.

b. The function of risk control, internal audit and compliance can be regarded as instruments for fulfilling the requirement with regard to the internal control system within the institution. With regard to the ICAAP, the internal audit should thus review ongoing ICAAP application, monitor adherence to controls in place within the ICAAP, report any shortcomings identified to the board and senior management, and review the resolution of such shortcomings in the course of follow-up procedures.

c. The frequency of the independent reviews and audits may vary depending on the size and complexity of individual banks but should not be less than once every year.

5. Regulatory Reporting Of The Icaap

a. The ICAAP report should enable the CBK to conduct a complete, documented assessment of the key features of the capital planning process, the overall exposure to risks and the consequent calculation of total internal capital. An outline of an ICAAP report is attached as Annex B.

b. On an annual basis, banks shall, not later than 30th April, submit to the CBK their ICAAP report as at 31st December of the previous year.

c. Based on the capital reported at the close of the previous year, the ICAAP document shall provide the bank's strategies for taking on risk and ensuring that the related capital needs through the end of the current year are met.

d. The report is formally transmitted to the CBK by the institution. e. CBK has the responsibility of evaluating institutions' ICAAP report and their capital adequacy through the Supervisory Review and Evaluation Process (SREP).

f. The results obtained will be used in determining the required capital adequacy levels for the institution. CBK will engage institutions on the appropriateness of the ICAAP adopted vis-à-vis CBK's expectations detailed herein.

In the event of any query or clarification, kindly direct the same to: The Director, Bank Supervision Department Central Bank of Kenya P. O. Box 60000 - 00200, Nairobi Tel: 2860000 Email: fin@centralbank.go.ke

Annex A Risks Subject To The Internal Capital Adequacy Assessment Process

a. Credit risk (including counterparty risk).

b. Market risks. c. Operational risk. d. Liquidity risk. e. Concentration risk: the risk arising from exposures to counterparties, groups of connected counterparties, and counterparties in the same economic sector or which engage in the same activity or are from the same geographic region.

f. Interest rate risk in the banking book: the risk arising from potential changes in interest rates; g. Residual risk: the risk that recognized credit risk mitigation techniques used by the bank may be less effective than planned.

h. Securitization risk: the risk that the economic substance of a securitization operation is not fully reflected in risk assessment and management decisions.

i. Business and Strategic risk: the current or prospective risk of a decline in profits or capital caused by changes in the business environment or erroneous decisions, the inadequate implementation of decisions or poor responsiveness to competitive developments.

j. Reputational risk: the current or prospective risk of a decline in profits or capital should customers, counterparties, shareholders, investors or supervisors take a negative view of the bank.

k. Liquidity risks; Banks' liquidity profile and the liquidity of the markets in which they operate.

l. Compliance with minimum standards and disclosure requirements. m. Factors external to the bank.

Annex B Outline For An Icaap Report

1. Strategies And Forecasting Horizon Adopted

a. Business plan and annual budgets; schedule of reviews of business plan and its components; extraordinary events necessitating review.

b. Reconciliation between time horizon of business plan and capital plan. c. Sources of Tier I and Tier II capital.

2. Corporate Governance, Organizational Arrangements And Internal Control Systems Connected With The Icaap

a. Description of the process for the preparation and updating of the ICAAP. b. Description of the process for reviewing the ICAAP.

c. Definition of the role and functions assigned to the board and senior management bodies for the purposes of the ICAAP.

d. Definition of the role and functions assigned to various corporate functions for the purposes of the ICAAP (for example, internal auditing, compliance, planning, risk management, and other units such as head office and branch network commercial units, accounting and audit).

e. Description of organizational and contractual safeguards relating to any elements of the ICAAP that is outsourced.

f. Indication of internal regulations relevant to the ICAAP.

3. Risk Exposures, Risk Measurement And Aggregation Methodologies, Stress Testing

a. Risk mapping: illustration of the position of the bank in respect of Pillar 1 and Pillar 2 risks.

b. Risk mapping in relation to bank's operating units and/or legal entities of the group. c. Techniques for risk measurement, internal capital determination and stress testing. d. Description, for every category of measurable risk, of the main characteristics of the main risk control and mitigation instruments.

e. General description of systems for control and mitigation of non-measurable risks.

4. Components, Estimation And Allocation Of Internal Capital

a. Quantification of internal capital for each risk and total internal capital.

b. Any methods for allocating internal capital (by operating unit and/or legal entity).

5. Reconciliation of internal capital, regulatory requirements and regulatory capital a. Reconciliation of total internal capital and regulatory requirements.

b. Listing and definition of capital components covering internal capital. c. Eligibility of components covering internal capital to be calculated for supervisory purposes; explanation of inclusion of ineligible components.

d. Estimate of cost of using other capital sources in addition to those used.

6. Self- Assessment Of Icaap

a. Identification of the areas of the process amenable to improvement. b. Planning of capital or organizational actions.

7. Organization Of The Icaap Report

a. Executive Summary. b. Design, Approval, Review, and Use of ICAAP.

c. Structure and Operations. d. Governance Structure e. Summary of business plan and strategy.

f. Risk Appetite Statement g. Risk Assessment and Capital Adequacy. h. Methodology and Assumptions. i. Stress Testing. j. Capital Planning. k. Use of Internal Models for Capital Assessment. l. Challenges and further steps.