Instruction No. 3/2019

Instruction No. 3/2019 BO No. 1/2019 Supplement • 2019/01/25 .................................................................................................................................................................................................. Topics Supervision :: Prudential Standards Mod. 99999940/T – 01/14

Index Text of the Instruction Annex I – Report on the ICAAP Annex II – ICAAP Quantitative Information

Text of the Instruction Subject: Internal Capital Adequacy Assessment Process (ICAAP) The rigorous assessment and determination of the level of internal capital underlying the risk profile of a credit institution or an investment firm are essential conditions for the implementation of sustainable business strategies, assuming they are supported by adequate controls. In particular, the planning of the evolution of internal capital is considered fundamental to ensure its adequacy, on a permanent basis, to the institutions' risk profile, notably in crisis or recession scenarios.

Considering the provisions of Articles 115-J and 196(1) of the General Regime of Credit Institutions and Financial Companies (RGICSF), approved by Decree-Law No. 298/92 of 31 December, in its current wording, credit institutions and investment firms must have solid, effective, and complete strategies and processes to assess and maintain, on a permanent basis, the amounts, types, and distribution of internal capital they consider adequate to cover the nature and level of risks to which they are or may be exposed.

The Bank of Portugal, under Article 116-A of the RGICSF, is responsible for analyzing the provisions, strategies, processes, and mechanisms applied by credit institutions and investment firms to comply with the RGICSF and Regulation (EU) No. 575/2013 of the European Parliament and of the Council of 26 June 2013, and, based on this assessment, to decide whether these provisions, strategies, processes, and mechanisms, as well as the own funds held by the institutions, guarantee sound management and coverage of their risks.

The European Banking Authority (EBA) published on 10 February 2017 the “Guidelines on information collected under the ICAAP and ILAAP for SREP purposes” (Guidelines on ICAAP and ILAAP or EBA/GL/2016/10), which aim to ensure convergence of supervisory practices for the assessment of the Internal Capital Adequacy Assessment Process (ICAAP) and the Internal Liquidity Adequacy Assessment Process (ILAAP), within the Supervisory Review and Evaluation Process (SREP), in accordance with the EBA Guidelines on common procedures and methodologies for the SREP of 19 December 2014 (EBA/GL/2014/13).

Instruction No. 3/2019 BO No. 1/2019 Supplement • 2019/01/25 Topics Supervision :: Prudential Standards .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

Specifically, the aforementioned Guidelines on ICAAP and ILAAP specify, in accordance with the principle of proportionality, the information that competent authorities must collect from institutions in order to carry out their assessments in accordance with the criteria specified in the SREP Guidelines.

Considering that, in accordance with Article 16(3) of Regulation (EU) No. 1093/2010 of the European Parliament and of the Council of 24 November 2010, it is the responsibility of the Bank of Portugal, as the national competent authority, to make all efforts to comply with the guidelines and recommendations issued by the EBA, this Instruction proceeds to incorporate the Guidelines on ICAAP into the national regulatory framework.

The allocation of responsibilities between the Bank of Portugal, as the national competent authority, and the European Central Bank (ECB), under Council Regulation (EU) No. 1024/2013 of 15 October 2013, confers specific responsibilities on the ECB regarding the prudential supervision of credit institutions classified as significant under the aforementioned Regulation, which are therefore excluded from the scope of application of this Instruction.

In these terms, the Bank of Portugal, using the competence conferred by Article 17 of its Organic Law, approved by Law No. 5/98 of 31 January, in its current wording, and by the combined provisions of point (f) of paragraph 1 of Article 116 and paragraph 1 of Article 120, both of the RGICSF, approves the following Instruction:

Article 1. Object This Instruction aims to define the procedures relating to the Internal Capital Adequacy Assessment Process (ICAAP) and to establish the respective reporting models for ICAAP information to the Bank of Portugal, in order to ensure that the risks to which institutions are exposed are adequately assessed and that the internal capital they have is adequate relative to their respective risk profile.

Article 2. Scope of Application 1 – This Instruction applies to all credit institutions and investment firms with headquarters in Portuguese territory and subject to the supervision of the Bank of Portugal, hereinafter referred to as institutions, which must provide the information provided for in this Instruction on an individual basis, except for those that are branches in Portugal, parent companies, or credit institutions included in consolidated supervision. 2 – Information must be provided on a consolidated basis when it concerns parent financial companies or parent mixed financial companies in Portugal, parent credit institutions in Portugal, parent investment firms in Portugal, or credit institutions controlled by parent financial companies or parent mixed financial companies in the Union where supervision, on a consolidated basis, is carried out by the Bank of Portugal.

Instruction No. 3/2019 BO No. 1/2019 Supplement • 2019/01/25 Topics Supervision :: Prudential Standards .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

3 – Without prejudice to the provisions in the preceding points, information must be provided on a sub-consolidated basis when it concerns credit institutions that are subsidiaries, if those credit institutions or their parent company, if it is a parent financial company or a parent mixed financial company, have a credit institution, an investment firm, a financial institution, or a management company for collective investment in transferable securities as a subsidiary in a third country, or hold a participation therein. 4 – Branches of parent credit institutions, parent investment firms, or parent financial companies with headquarters in the Union must provide the information provided for in this Instruction, and may reflect the processes and policies of the group to which they belong. 5 – This Instruction applies, on a consolidated basis, to the Integrated System of Mutual Agricultural Credit (SICAM), constituted by the Central Mutual Agricultural Credit Bank, its associated mutual agricultural credit banks, and the branches of the aforementioned institutions. 6 – Credit institutions classified as significant under Article 6(4) of Council Regulation (EU) No. 1024/2013 of 15 October 2013, which confers specific responsibilities on the ECB regarding the prudential supervision of these institutions, are not covered by the provisions of this Instruction.

Article 3. ICAAP Process 1 – Institutions must have solid, effective, and complete strategies and processes to assess and maintain on a permanent basis the amounts, types, and distribution of internal capital they consider adequate to cover the nature and level of risks to which they are or may be exposed, in order to ensure that they remain viable, maintaining adequate capitalization levels and carrying out effective risk management. 2 – For the purposes of the preceding paragraph, institutions must have an ICAAP process that complies with the minimum requirements and guidelines defined in this Instruction, which includes a management process and the institution's culture, and considers the regulatory context and the economic environment in which the institution operates, and which must be regularly reviewed by the institutions. 3 – Being an internal process of the institution, the design and implementation of the ICAAP must take into account the type, size, complexity, and business model of the institution, as well as the operational environment and the nature and risks of the activities carried out, making use of the data and definitions normally used by the institution for internal purposes. 4 – The ICAAP must be prospective in nature and take into account the institution's strategy, risk appetite, and the influence of macroeconomic factors. 5 – Institutions must ensure correct specification of the risk profile, on a current and prospective basis, ensuring that all materially relevant risks are properly assessed and managed, through adequate risk quantification and the existence of effective controls.

Instruction No. 3/2019 BO No. 1/2019 Supplement • 2019/01/25 Topics Supervision :: Prudential Standards .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

6 – Institutions must ensure that the internal capital they have is adequate relative to their respective risk profile, and it must be based on an assessment consistent and comparable with the institution's own funds. 7 – Institutions must ensure the existence of an organizational and technological structure and governance and internal control practices adequate for the assessment, management, and planning of internal capital and risks, and must ensure that the ICAAP and its management processes are formally documented, and a historical record of information must be maintained. 8 – Institutions must have the ability to demonstrate to the Bank of Portugal that the ICAAP is solid, effective, and comprehensive, as well as to clarify the methodologies and calculations used and the risks they seek to address. 9 – The ICAAP is the sole responsibility of the governing body of the institutions.

Article 4. ICAAP Reporting 1 – In accordance with the principle of proportionality, credit institutions must report to the Bank of Portugal information relating to the ICAAP, strictly complying with one of the following models, without prejudice to presenting additional information they consider relevant: a) Full model: includes all sections and matters contained in Annexes I and II to this Instruction; b) Intermediate model: includes sections A, B.1, B.2, B.3, B.4 (except point (iii)), B.5 (except point (iii)), C.1 (except points (iv)), C.2 (except point (iv)), C.3, C.4, C.5, C.6 contained in Annex I and Annex II to this Instruction; c) Simplified model: includes section A points (i) and (ii), B.1 point (iii), B.3 point (iii), C.1 points (v) and (viii), C.2 points (iii) and (vi), C.3 points (i), (iv) and (vi), C.4 points (ii) and (iii), C.5 point (ii), C.6 (except point (v)) of Annex I and Annex II to this Instruction. 2 – The Bank of Portugal communicates to each credit institution which of the reporting models referred to in the preceding paragraph it must comply with, without prejudice to its ability to request additional information it considers relevant. 3 – The Bank of Portugal communicates to credit institutions any changes regarding the reporting model to be applied. 4 – ICAAP information, included in the models referred to in paragraph 1 of this article, which has been reported to the Bank of Portugal with the same reference date and which remains valid and up-to-date, does not need to be resubmitted; in the applicable model, the report, the date thereof, and the location where the reported information is described must be identified.

Instruction No. 3/2019 BO No. 1/2019 Supplement • 2019/01/25 Topics Supervision :: Prudential Standards .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

5 – The Bank of Portugal may request, at any time, the information provided for in paragraph 1 of this article from institutions not covered by that paragraph. 6 – The Bank of Portugal may determine that institutions review the reported document whenever the information subject to reporting contains errors or inaccuracies.

Article 5. Reporting Frequency 1 – The governing body of credit institutions must submit the ICAAP report to the Bank of Portugal, in accordance with the reporting model assigned under the previous article, by 31 March of each year. 2 – The report referred to in the preceding paragraph must have as its reference date 31 December of the previous year. 3 – The reference data necessary for carrying out the ICAAP may be based on provisional accounts or estimates. If, subsequently, relevant changes to the accounts are verified, an update of the report must be sent to the Bank of Portugal within a maximum period of one month after the occurrence of such changes.

Article 6. Submission of Report The report referred to in the previous article must be sent to the Bank of Portugal on computer media through the BPNET system.

Article 7. Repealing Norm Bank of Portugal Instruction No. 15/2007 of 15 May 2007 is repealed.

Article 8. Entry into Force This Instruction enters into force the day following its publication.

Annex I – Report on the ICAAP A. Executive Summary (i) Identification of the consolidation perimeter for ICAAP purposes and the reference date of the assessment carried out; (ii) Indication of those responsible for the development of the ICAAP and its approval; (iii) Presentation of internal capital estimates for covering materially relevant risks, divided by categories and, where applicable, subcategories of risks; (iv) Presentation of the results of the aggregation of internal capital estimates; (v) Indication of own funds and internal capital levels, divided by capital instrument; (vi) Presentation of the quantitative results obtained through the carrying out of stress tests; (vii) Indication of the main changes verified in the ICAAP and/or its results, compared to the previous report; (viii) Main conclusions of the ICAAP regarding the institution's risk profile, the adequacy of internal capital levels, and the assessment of capital needs.

B. General Scope Information B.1. Business model and strategy (i) Description of the current business model, identifying the main business lines, markets, geographies, branches, and products in which the institution operates, as well as including a description of the main sources of cost and revenue, divided by business lines, products, markets, and branches, where applicable; (ii) Description of the changes planned by the institution for the current business model and for the underlying activities; (iii) Presentation of projections of key financial indicators for the main business lines, markets, and branches, where applicable; (iv) Description of the relationship between the business strategy and the ICAAP process.

B.2. Organizational information (i) Description of the institution's general internal governance procedures, including the functions and responsibilities of risk management and control, in particular the procedures supporting the ICAAP;

Instruction No. 3/2019 BO No. 1/2019 Supplement • 2019/01/25 Topics Supervision :: Prudential Standards .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

(ii) Description of reporting circuits and respective reporting frequency to the governing body on matters of risk management and control, in particular the communication flows on matters related to the ICAAP; (iii) Description of the interaction process between risk measurement and monitoring and risk-taking practices, including details on the definition and monitoring of limits as well as the process and measures defined for handling excesses to the same; (iv) Description of material risk management processes and their evolution, detailing: the interaction of capital and liquidity management, including the interaction between the ICAAP and the ILAAP; the interaction between the management of various risk categories and risk management at the institution level; and the integration of the ICAAP and ILAAP into risk management and the overall management of the institution.

B.3. Risk appetite (i) Description of the integration of the risk appetite model into overall management and risk management, detailing the relationship with the institution's business model and strategy, risk strategy, and the ICAAP, including capital planning; (ii) Description of the process and general internal governance procedures, including the functions and responsibilities of the governing body and senior management, regarding the design and implementation of the risk appetite model; (iii) Description of the process for identifying material risks to which the institution is or may be exposed, which must include information on risk appetite/tolerance levels and limits defined for determining the materiality of risks; (iv) Description of the process for defining and allocating limits within the group, where applicable.

B.4. Stress tests (i) General description of the institution's stress test program, which must include details regarding the type of stress tests carried out, the set of assumptions, methodological aspects and models used, frequency, and technological infrastructure; (ii) Description of the internal governance aspects governing the stress test program, and in particular the stress tests used for ICAAP purposes; (iii) Description of the interaction between capital and liquidity stress tests, and in particular the specific ICAAP and ILAAP stress tests, and the role of reverse stress tests; (iv) Explanation of the use of stress tests and their integration into the risk control and management model.

B.5. Data and computer systems (i) Description of the process for collecting, storing, and aggregating risk information in the different structures of the institution, including data flows from branches to the group, where applicable; (ii) Description of the data flow and technological structure of risk information used for ICAAP purposes; (iii) Description of data controls applied to risk information used for ICAAP purposes; (iv) Description of the computer systems used for collecting, storing, aggregating, and disclosing risk information used for ICAAP purposes.

C. Specific ICAAP Information C.1. General structure of the ICAAP (i) Description of the consolidation perimeter for ICAAP purposes and justification of any differences relative to the scope of entities included for the determination of minimum own funds requirements and the ICAAP; (ii) Description of the general objectives and assumptions of the ICAAP, detailing how they ensure capital adequacy; (iii) Indication of the ICAAP time horizon and justification of any differences between risk categories and/or group entities; (iv) Indication of the approach to the ICAAP in terms of risk impact on accounting data or on the economic value of the institution, or on both, where applicable; (v) Description of the process for identifying materially relevant risks divided by categories and subcategories of risks, detailing the categories and subcategories of risks considered in the ICAAP and their respective definitions; (vi) Identification of techniques used for risk reduction, by risk category; (vii) Analysis of any differences between the risks covered in the ICAAP and the institution's risk appetite model; (viii) Description of differences in the ICAAP process, methodologies, or parameters used by the group and its respective group entities, where applicable.

C.2. Assessment, quantification, and aggregation of risks (i) Description of the characteristics of the models and methodologies for risk quantification/assessment, detailing the assumptions and parameters used (e.g., confidence intervals, holding periods, etc.) for all categories and subcategories of risks, accompanied by a sensitivity analysis of the models to changes in assumptions and parameters; (ii) Specification of the data and historical series used, detailing how the data of each entity covered by the ICAAP is included in the models. (iii) Indication of internal capital estimates for covering materially relevant risks, divided by categories and, where applicable, subcategories of risks. In the case where the institution does not determine an internal capital estimate for certain material risk subcategories, it must explain how these subcategories are incorporated into the quantification of the risk category; (iv) In the case where the models used for ICAAP purposes present significant differences from those approved by the Bank of Portugal for the calculation of own funds requirements, presentation of a detailed risk-by-risk comparison between the models, which includes, notably, methodological and parametrization differences and how these differences affect the assessment of internal capital and risks; (v) Description of the process for aggregating internal capital estimates for the entities and risk categories covered in the ICAAP, including the approach to any effects of inter- and intra-risk category diversification, describing how these correlations were determined; (vi) Indication of the results of the aggregation of internal capital estimates for the entities and risk categories covered in the ICAAP, including the effects