Guidelines on a Bank's Internal Capital Adequacy Assessment Process (ICAAP)

Guidelines on a Bank’s
Internal Capital Adequacy
Assessment Process
(“ICAAP”)
Prudential Supervision Department
Document BS12
Issued: December 2007
Ref #3202148

2
Introduction

1. This document sets out guidelines issued under section 78(3) of the Reserve Bank of
   New Zealand Act 1989 (“the Act”).
2. Section 78 of the Act relates to a bank’s ability to carry on business in a prudent
   manner. Sections 78(1)(c) to (g) list the matters to which the Reserve Bank of New Zealand (RBNZ) must confine its consideration in:
   a. having regard, under section 73(2)(c) of the Act, to the ability of an applicant for registration as a registered bank to carry on its business in a prudent manner; or b. determining under section 77(2)(f) or section 113(1)(e) of the Act that a registered bank has not carried on its business in a prudent manner.
3. Section 78(3) of the Act permits the Governor to issue guidelines for the purpose of
   interpreting any of the matters referred to in sections 78(1)(c) to (g). The guidelines in this document fall within the scope of the following matters in section 78(1):
   78(1)(c) Capital in relation to the size and nature of the business; 78(1)(d) Loan concentration and risk exposures; 78(1)(f) Internal controls and accounting systems; and 78(1)(fa) Risk management systems and policies.
4. These guidelines apply to all New Zealand-incorporated registered banks that are
   subject to a condition of registration requiring them to have an internal capital adequacy assessment process (ICAAP) for assessing their overall capital adequacy in relation to risk profile and a strategy for maintaining adequate capital to support risks. The purpose of this document is to provide guidance on how a bank should establish, operate and maintain its ICAAP.
5. “Pillar 1” of “Basel II” (the revised capital adequacy framework issued by the Basel
   Committee on Banking Supervision) sets out minimum capital requirements for credit, operational, and market risks. “Pillar 2” of Basel II is intended to ensure that banks have adequate capital to support all the risks in their business, and includes the requirement on banks to have an ICAAP. Guidelines Need for ICAAP
6. A registered bank must have an internal capital adequacy assessment process (ICAAP)
   that enables the bank to ensure that it has adequate overall capital in relation to its risk profile. Bank’s responsibility for ICAAP
7. Each registered bank is responsible for its ICAAP. In the case where a bank is a
   member of a larger banking group, the bank may base its approach on group-wide methodologies. In all cases the bank’s board of directors retains the ultimate Ref #3202148 BS12 December 2007

3 responsibility for ensuring the overall capital adequacy of both the New Zealand banking group and the registered bank on a solo basis. Proportionality
8. The level of detail and sophistication of the analysis required in a bank’s ICAAP
depends on the size, nature and complexity of the bank’s business.

Board and senior management oversight of risk
9. A sound risk management framework is a pre-requisite for the effective assessment of a
bank’s overall capital adequacy position. This framework should include robust board and senior management oversight, risk monitoring and reporting processes, and regular independent review. There should be credible and consistent policies and procedures to identify, measure, and report all material risks that the bank faces.
10. The board is responsible for setting the bank’s tolerance for risk, and ensuring that the
bank’s business remains within that risk tolerance. To achieve this, the board should ensure that management establishes a framework for assessing the various risks, develops a system to relate risk to the bank’s capital level, and sets up a method for monitoring compliance with internal risk management policies.
11. Bank management should understand the nature and level of risk that the bank takes.
They are responsible for ensuring that internal risk management processes are appropriately sophisticated and formal for the size and nature of the bank’s business. Bank management is responsible for establishing strong internal processes that state capital adequacy goals with respect to risks. Documentation of ICAAP
12. The registered bank’s ICAAP should be fully specified (including its methodologies,
assumptions and procedures), and formally documented. The board or its appropriately delegated sub-committee should approve the ICAAP and its components, review them on a regular basis, and approve any revisions where appropriate. Senior management are responsible for the detailed development of the bank’s ICAAP. Comprehensive coverage of risks that the bank faces
13. A registered bank’s ICAAP should capture all material risks that the bank faces,
including the following:
a. Risks1 not fully captured under Pillar 1. Such risks could include underestimation of credit risk in the Pillar 1 standardised credit approach, risks of internal ratings migrations in the Pillar 1 internal model-based approach to credit risk, and residual risk stemming from credit risk mitigation. Also under this heading, the Ref #3202148 BS12

1 Pending further consideration, the RBNZ’s regulatory capital requirement for market risk extends to include interest rate risk in the banking book (IRRBB). The latter is thus a Pillar 1 risk rather than a Pillar 2 risk in the RBNZ’s initial implementation of Basel II. December 2007

4 bank should have in place polices and systems to both monitor and control concentrated exposures to credit and other risks, and in turn consider whether additional capital is a suitable risk mitigant. b. Risks not taken into account by Pillar 1 processes, that is, all other material risks arising from the bank’s business such as reputation risk, strategic risk and liquidity risk.
c. Risk factors external to the bank, that is, risks that have not already been covered
arising from the regulatory, economic or business environment in which the bank operates. Relating capital to risk
14. The ICAAP should include a consistent approach to deriving capital requirements from
the bank’s risk measurement, in line with its established level of risk tolerance. For instance, when calibrating its capital needed against other risks, a bank that uses internal models for Pillar 1 risks should aim to achieve confidence levels for those other risks that are no lower than the Pillar 1 assumed confidence levels. Depending on proportionality considerations and industry developments over time, banks may design their ICAAP in various ways.
15. To assess overall capital adequacy, banks should consider not only quantitative
techniques but should also include an element of qualitative assessment or management judgment of both capital model inputs and outputs.
16. Banks are likely to ascertain that some risks they face are easier to measure than others.
An ICAAP can hence involve a mixture of rigorous risk capital estimates and more judgment-based estimates. Risks should be included if they are material, even if they are hard to quantify. However, there could be a trade-off between the importance of allocating capital to such risks, and the robustness of the bank’s approach to mitigating and managing theses risks. ICAAP should be forward-looking
17. The ICAAP should take into account forward-looking factors such as changes in the
bank’s strategic plans. It is important for both the board and senior management to examine a bank’s current and future capital requirements in relation to its strategic business objectives. The strategic plan should clearly delineate the bank’s near- and longer-term capital needs, capital expenditures required for the foreseeable future, target capital levels, and external capital sources. Capital planning and budgeting should be a key feature in the strategic planning process.
18. For ICAAP purposes, bank management should ensure that the capital adequacy would
be appropriate for a range of business conditions at different points in the business cycle. Also, the bank should perform rigorous and forward-looking stress tests that identify plausible severe loss events or adverse changes in market conditions, and assess their impact on the bank’s capital adequacy. Ref #3202148 BS12 December 2007

5
Risk monitoring and reporting processes
19. The bank should establish an adequate system for monitoring and reporting risk
exposures. The system should help assess how changes in the bank’s risk profile affect capital needs.
20. The board and senior management should receive regular reports or updates on the
bank’s risk profile and capital needs. These reports should enable senior management to carry out the following tasks:
a. Evaluate the level and trend of material risks and their effect on capital requirements; b. Evaluate the sensitivity and reasonableness of central assumptions used in the capital measurement system;
c. Determine that the bank holds sufficient capital against various risks;
d. Determine that the bank meets its internal capital adequacy goals; and e. Assess its future capital requirements based on the bank’s reported risk profile and in turn make necessary adjustments to the bank’s strategic plan accordingly. Regular review of ICAAP
21. The bank should review its ICAAP with sufficient frequency to ensure that it continues
to cover the bank’s risks, and that its capital coverage reflects the actual risk profile. The bank should also review its ICAAP in response to any changes in the bank’s strategic focus, business plan, operating environment, or other factors that materially affect assumptions or methodology.
22. The ICAAP and its review process should be subject to periodic independent internal
review to ensure its integrity, accuracy and reasonableness. Where appropriate, this review may involve internal or external audits. The outcomes of these reviews should be reported to the board in ensuring the bank’s prudent conduct of business. These reviews should cover among other things:
a. whether the ICAAP is appropriate for the nature, scale, and complexity of the bank’s activities; b. whether the data inputs into the capital assessment are accurate and complete;
c. whether the severe loss scenarios used in the ICAAP are both reasonable and
valid; and d. stress-testing and analysis of assumptions and inputs. Ref #3202148 BS12 December 2007