Instructions for the Internal Capital Adequacy Assessment Process (ICAAP) No. (4/2025)

CENTRAL BANK OF JORDAN Central Bank of Jordan No.: 18437/1/10 Date: 13/5/1447 AH Corresponding to: 4/11/2025 AD

Instructions for the Internal Capital Adequacy Assessment Process (Internal Capital Adequacy Assessment Process, “ICAAP”) No. (4/2025)

In the context of Pillar 2 of the Basel Committee on Banking Supervision (Pillar 2 Supervisory Review Process, “SRP”), and based on the provisions of Article No. (36/a) and Article No. (99/b) of the Banks Law No. (28) of 2000 and its amendments, and in the Central Bank's endeavor to continue applying best international banking practices in line with the Core Principles for Effective Banking Supervision issued by the Basel Committee and its keenness to strengthen the banking system and ensure its financial stability and achieve effective risk management in banks, it has been decided to issue these instructions, which shall be effective from 2026/1/1.

These instructions are considered part of the comprehensive supervisory framework adopted by the Central Bank, and complementary to the currently effective instructions related to regulatory capital requirements and corporate governance for banks and any subsequent instructions that will be issued in this regard.

Governor Dr. Adel Al-Sharkas

Instructions and their annexes attached.

Page 1 of 1

---

CENTRAL BANK OF JORDAN Central Bank of Jordan

Instructions for the Internal Capital Adequacy Assessment Process (Internal Capital Adequacy Assessment Process, “ICAAP”) No. (4/2025)

---

CENTRAL BANK OF JORDAN Central Bank of Jordan

Contents

Topic	Page
Chapter One: Pillar 2 of the Basel Committee on Banking Supervision Decisions	2
First: The Two Main Axes of Pillar 2 of the Basel Committee on Banking Supervision Decisions	2
Second: The Principle of Proportionality	4
Chapter Two: Internal Capital Adequacy Assessment Process	5

1. Scope of Application of the Internal Capital Adequacy Assessment Process | 6
2. Periodicity of Providing the Internal Capital Adequacy Assessment Process Document | 6
3. Governance of the Application of the Internal Capital Adequacy Assessment Process | 6
4. The Internal Capital Adequacy Assessment Process as an Integral Part of the Comprehensive Management Framework | 8
5. Identification of All Material Risks and Their Consideration in the Internal Capital Adequacy Assessment Process | 10
6. Risk Measurement Methodologies for the Purpose of the Internal Capital Adequacy Assessment Process | 10
7. Capital Adequacy Assessment | 12
8. Capital Planning | 13
9. Stress Testing | 14
10. Periodic Review of the Internal Capital Adequacy Assessment Process | 15
11. General Provisions | 16 Annex No. (1) Risks to be Measured | 17 Annex No. (2) Report Components | 20

---

CENTRAL BANK OF JORDAN Central Bank of Jordan

Chapter One Pillar 2 of the Basel Committee on Banking Supervision Decisions (Pillar 2 Supervisory Review Process)

In the context of the Central Bank of Jordan's endeavor to apply best international practices in banking supervision, Pillar 2 is being applied, which complements Pillar 1 according to the Basel Committee on Banking Supervision framework. Pillar 2 aims to develop and use the best techniques for risk management in terms of monitoring and dealing with them, in addition to ensuring that banks maintain sufficient capital to meet all risks associated with their business, by strengthening the link between the bank's risk profile and its risk management and mitigation systems and its capital planning, so that the bank's management bears the responsibility for ensuring that the bank maintains sufficient capital to cover its risks beyond the minimum required limits.

First: Pillar 2 is divided into two main axes

A. First Axis (related to banks) Where banks are expected to establish sound and effective procedures for assessing the size, types, and distribution of capital and strategies for maintaining it continuously and in proportion to the risks they are exposed to or may be exposed to, in accordance with the Internal Capital Adequacy Assessment Process (ICAAP), and within a robust governance and internal control framework. Accordingly, every bank must continuously have mechanisms and work procedures to ensure this.

B. Second Axis (related to the Supervisory Review Process “SRP”) It is concerned with verifying that banks have sound risk management arrangements, strategies, processes, and mechanisms for the risks they are exposed to or may be exposed to – including those arising from stress test results and systemic risks – and ensuring adequate capital and liquidity levels. Accordingly, and within this framework:

1. The Central Bank will assess the effectiveness of banks in evaluating their capital needs relative to their risks and their strategies in this regard, evaluate their ability to monitor and ensure their compliance with capital adequacy requirements, and take necessary actions in light of the results of the Supervisory Review Process.
2. The Central Bank expects banks to operate with capital adequacy ratios higher than the prescribed minimum limits, and may require banks to operate with capital adequacy ratios exceeding those limits, both at the individual bank level and/or at the aggregate bank level.
3. The Central Bank will intervene at early stages to prevent capital from falling below the minimum levels required to face the risks the bank is exposed to, and will require immediate actions to address this in accordance with the provisions of the Banks Law No. (28) of 2000 and its amendments and any instructions issued thereunder in this regard.

---

CENTRAL BANK OF JORDAN Central Bank of Jordan

4. Furthermore, within the framework of the Supervisory Review Process (SRP), the Central Bank will assess the bank's business model (Business Model Assessment), its governance and risk management (Governance and Risk Management Assessment), risks affecting capital (Assessment of Risks to Capital), and risks related to liquidity and funding (Assessment of Risks to Liquidity and Funding).
5. The Supervisory Review Process will include dialogue between the Central Bank and the bank, and the dialogue will mainly address the outcomes of the Supervisory Review Process, including several axes, such as those related to the risks assessed during the Internal Capital Adequacy Assessment Process, their measurement methodologies and the results of this process, the bank's capital structure and capital planning, stress tests and their results, and any material matters affecting the results of the Supervisory Review Process.
6. Based on the results of the Supervisory Review Process, the Central Bank will: A. Take appropriate corrective actions. B. Subject the bank to an additional capital increase (Bank-Specific Pillar II Capital add-on) as determined by the Central Bank, as this requirement increases the minimum capital requirements for banks and for each bank individually. C. Oblige the bank to prepare and/or implement a satisfactory Capital Restoration plan and/or strengthen its capital to meet additional risks resulting from the review process.
7. In addition to what is stated in item (6), the Central Bank, based on continuous follow-ups and supervisory procedures, will intensify supervision of the bank and oblige it to take some or all of the corrective actions stipulated in the Banks Law and any instructions issued thereunder (including activating early intervention procedures) in this regard, in addition to obliging it to take one or more of the following actions: A. Strengthen the systems and procedures related to the bank's risk management and internal controls. B. Strengthen the Internal Capital Adequacy Assessment Process. C. Reduce risks, which includes imposing restrictions and/or prohibiting certain operations or branching. This is in case of identifying weaknesses or indicators of weakness in the bank, including: A. Excessive risk-taking. B. Weakness in risk culture and governance. C. Unsound lending practices. D. Structural imbalances in the bank's liquidity management. E. Non-compliance with legislation and supervisory requirements. F. Significant concentration in the bank's portfolio (credit and/or investment). G. Violations of the bank's approved policies and procedures. H. External factors, including risks of presences in specific geographical areas.

---

CENTRAL BANK OF JORDAN Central Bank of Jordan

Second: The Principle of Proportionality (Proportionality) It is considered one of the most important principles in the Supervisory Review Process, as the Central Bank will adopt the principle of proportionality and risk-based supervision principles during this process. The same applies to banks, as each bank must conduct the Internal Capital Adequacy Assessment Process, taking into account the principle of proportionality, without affecting the importance and effectiveness of the Internal Capital Adequacy Assessment Process. This principle of proportionality will take into account at least the following aspects: A. The nature, size, and complexity of the bank's operations, the systemic importance of the bank, and the size of its customer base. B. The quality of the bank's products and services. C. The bank's Risk Profile, including the extent of its international presence and the size of its foreign exposures, and the extent to which it carries out high-risk operations. D. The adequacy of the organizational structure to ensure effective risk management and achieve effective supervision.

---

CENTRAL BANK OF JORDAN Central Bank of Jordan

Chapter Two Internal Capital Adequacy Assessment Process (Internal Capital Adequacy Assessment Process, “ICAAP”)

The Internal Capital Adequacy Assessment Process is an important input into the Supervisory Review Process (SRP), as it contributes to the Pillar 2 assessment process. Thus, a good assessment process reduces uncertainty related to assessing the risks the bank is exposed to or may be exposed to, and gives the Central Bank a higher level of confidence in the bank's ability to continue operating by maintaining sufficient capital and/or effectively managing its risks.

This following part of the instructions regulates the general provisions for conducting the Internal Capital Adequacy Assessment Process by banks in a way that contributes to improving this process, with a focus on specific key aspects from a supervisory perspective. It does not aim to define detailed requirements for all aspects related to the Internal Capital Adequacy Assessment Process, as the adequacy of applying this process in proportion to the bank's specific circumstances remains the bank's responsibility. These instructions are the minimum that banks must adhere to, in addition to being guided by papers issued by the Basel Committee on Banking Supervision and any subsequent papers issued by it, and taking into account best international practices in this regard.

The Internal Capital Adequacy Assessment Process aims to ensure the availability of adequate capital levels consistent with the bank's Risk Profile, taking into account the effectiveness of risk management procedures, the adequacy of internal control systems, strategic planning, and the business environment. The Internal Capital Adequacy Assessment Process must be forward-looking and comprehensive of all risks.

The Internal Capital Adequacy Assessment Process is not just a report prepared by the bank; it is a precise process characterized by the following:

1. Effective supervision by the bank's Board of Directors, Senior Executive Management, and relevant committees.
2. Sound capital assessment.
3. A comprehensive process for identifying, assessing, measuring, mitigating, controlling, monitoring risks, and reporting them in a timely manner.
4. Effective and comprehensive internal control systems.
5. Appropriate information management systems at the business lines level and at the bank level as a whole (banking group).
6. Monitoring and reporting.

---

CENTRAL BANK OF JORDAN Central Bank of Jordan

Accordingly, the Central Bank expects the bank regarding the Internal Capital

6.2 Measurement methodologies must be comprehensive, covering all quantitative and qualitative aspects, including those difficult to measure (e.g., due to lack of available data), and develop appropriate methodologies relying on professional judgment, considering the bank's ability to control, monitor, and mitigate risks.

6.3 Each type of risk must be measured consistently within the banking group, including hypotheses, measurement methodologies, and capital definitions.

6.4 When measuring risks, risk diversification must not be taken into account, and the cumulative effects of individual risks must be evaluated.

6.5 The bank must, within the Internal Capital Adequacy Assessment Process (ICAAP), measure Pillar 1 risks using its internal methodologies based on its risk assessment.

6.6 The bank must be able to demonstrate the appropriateness of its measurement methodologies for its specific circumstances, risk profile, and the size and complexity of its operations, even if methodologies prepared by external service providers are used.

6.7 The bank must consider that the greater the uncertainty in the measurement results, the greater the need for conservatism.

6.8 The bank must provide a data quality framework that includes all risk-related data and quality standards (such as accuracy, completeness, timeliness), in line with the principles of Effective Data Aggregation and Risk Reporting issued by the Basel Committee on Banking Supervision (BCBS 239), as the accuracy of risk measurement fundamentally depends on data quality.

6.9 All measurement methodologies must be subject to regular independent internal validation, considering the importance of risks and the complexity of measurement methodologies, and comparing estimated risk levels with realized ones, with validation results documented.

The validation entity must be organizationally and operationally independent from the measurement methodology development unit, in line with the size and complexity of the bank's operations. This validation process must be separated from internal audit to ensure complete separation between the second and third lines of defense in the bank's internal control system.

6.10 Independent validation results must be presented to senior executive management and the risk management committee derived from the Board of Directors, and used when reviewing methodologies and considered in the capital adequacy assessment.

6.11 Measurement methodologies (quantitative and qualitative) must be comprehensively documented, at a minimum as follows:

6.11.1 A detailed description of the data used (time period, entities included in the assessment, and any subsequent data adjustments, etc.).

6.11.2 A presentation of all hypotheses, measurement methodologies, and their justifications, including risks classified as "difficult to measure."

6.11.3 A historical summary of validation results for these methodologies.

---

CENTRAL BANK OF JORDAN

البنك المركزي الأردني

7. Capital Adequacy Assessment

7.1 The bank must measure and disclose the required capital volume based on the levels of risks it is or may be exposed to.

7.2 The bank must manage its capital adequacy over a future period ranging from (3-5) years, ensuring compliance with regulatory requirements and its ability to handle internal and external capital constraints continuously.

7.3 The bank must, based on the results of the Internal Capital Adequacy Assessment Process, take all necessary measures (increasing capital and/or mitigating risks and/or not distributing dividends) immediately as capital approaches the regulatory requirement levels.

7.4 The bank must meet minimum capital requirements at all times as follows:

7.4.1 Minimum requirements for the Baseline Scenario must include:

7.4.1.1 Minimum requirements for Pillar 1 risks (9.5%),

7.4.1.2 Additional capital for Pillar 2 (result of the supervisory review process),

7.4.1.3 Capital buffers required under the Central Bank's instructions regarding minimum regulatory capital adequacy requirements [Conservation Buffer, external presence instructions, and instructions for dealing with Domestic Systemically Important Banks (D-SIBs)], and any additional buffers requested subsequently by the Central Bank or the Basel Committee on Banking Supervision.

7.4.2 Minimum requirements when conducting stress tests must include:

7.4.2.1 Minimum requirements for Pillar 1 risks (9.5%),

7.4.2.2 Additional capital for Pillar 2 (result of the supervisory review process).

7.5 The bank must maintain a Management Buffer to ensure capital adequacy at all times and to continue operations at a level exceeding the minimum requirements under the requirements and its internal needs.

7.6 The bank must determine the Management Buffer appropriately, commensurate with the uncertainty in risk assessment, and considering any constraints related to capital management (including the business model's ability to support dividend distribution and executive bonuses), allowing for flexibility in the bank's operational decisions and considering competitiveness.

7.7 The bank must ensure capital adequacy from an Economic Capital perspective, considering its size, complexity of operations, business model, and types of risks, in addition to the standard perspective of capital adequacy calculated according to regulatory requirements (Regulatory Capital), such that:

7.7.1 Inherent risks are identified from an Economic Perspective.

7.7.2 The concept of economic capital adequacy is identified, enabling continuity and following its strategy.

---

CENTRAL BANK OF JORDAN

البنك المركزي الأردني

7.7.3 The Internal Capital Adequacy Assessment Process covers all risks with a significant impact on capital from an economic perspective.

7.7.4 The bank uses its own procedures/models to identify and measure risks and capital from an economic perspective.

7.7.5 The bank must consider the results of risk and capital adequacy assessment from both the economic and standard perspectives mutually informing each other. Reports related to this must be submitted to senior executive management, the Board of Directors, and relevant committees, so that this is considered when making operational and strategic decisions and when reviewing risk management frameworks.

7.7.6 Document the differences between measurement results according to the standard and economic perspectives for Pillar 1 risks and reflect them in the Internal Capital Adequacy Assessment document.

7.7.7 The bank should follow best practices when applying the economic perspective, including the paper issued by the Basel Committee on Banking Supervision (Range of Practices and Issues in Economic Capital Frameworks) and any papers issued specifically.

8. Capital Planning

8.1 The bank must determine and maintain the required level of capital based on the current situation and expectations/estimates of capital requirements according to its strategic plan and budget, considering harsh but possible scenarios, and conducting an assessment of all risks included in the Internal Capital Adequacy Assessment Process, including the quantitative and qualitative aspects of those risks.

8.2 When planning capital, the bank must consider and document the following at a minimum:

• Coverage of a future period ranging from (3-5) years.
• Analysis of deviations compared to the plan prepared for the previous period.
• Summary of the strategic plan and the bank's risk appetite.
• Summary of stress tests conducted and their results.
• Impact of any expected changes in legal, regulatory, and accounting frameworks.
• Statement of capital instruments used to cover capital requirements and their composition.
• Administrative and corrective measures within the plan.
• Matters related to significant future developments and improvements the bank intends to make, if any.

8.3 The bank must assess its ability to increase capital or access capital markets in normal and abnormal times.

---

CENTRAL BANK OF JORDAN

البنك المركزي الأردني

9. Stress Testing

9.1 The bank must apply appropriate stress testing procedures, considering the relevant instructions, and these procedures must form an integral part of the bank's governance and risk management culture and be reflected in the Internal Capital Adequacy Assessment Process.

9.2 Within the framework of stress testing, the bank must:

9.2.1 Include all the bank's entities (subsidiaries and branches) and all inherent risks in stress tests from both (Normative and Economic Perspectives).

9.2.2 Define stress tests based on scenarios and sensitivity analyses, with these scenarios and analyses taking a time horizon of more than one year.

9.2.3 Prepare reverse stress tests that lead to capital adequacy ratios falling below prescribed limits.

9.2.4 Prepare adverse scenarios reflecting the bank's specific weaknesses, commensurate with the nature of its business and the risks it faces, based on historical and hypothetical events, including exceptional but possible events with a severe enough impact on regulatory and internal capital adequacy ratios. These scenarios must cover economic events and severe financial shocks, the bank's specific weaknesses, and its exposures to key counterparties.

This is in addition to considering the stress test scenarios and sensitivity analyses issued by the Central Bank annually.

9.2.5 Adopt stress tests by the risk committee derived from the Board of Directors and senior executive management.

9.2.6 Subject the design of stress tests to regular internal review and independent validation.

9.2.7 Document material risks and define scenarios accurately, specifically documenting the following:

• Types of stress tests performed and their objectives.
• Description of the units responsible for identifying, reviewing, and approving the design of each stress scenario.
• Clear justifications for scenario selection (probability of occurrence and suitability for the bank) and their severity.
• Justifications for excluding any material risk from stress tests, if any.
• Justifications for using risk mitigants included in the tests, if any.

9.3 Based on the results of stress tests, the bank must:

9.3.1 Review weaknesses to identify potential losses and capital needs that may arise from adverse conditions and scenarios that could lead to capital adequacy ratios falling below prescribed limits.

9.3.2 Ensure that corrective measures taken by management are realistic, prudent, and executable in normal and abnormal times.

---

CENTRAL BANK OF JORDAN

البنك المركزي الأردني

9.3.3 Use stress test results effectively, as follows:

9.3.3.1 Re-evaluate inherent risks and adverse scenarios for each test, with tests reviewed at least annually, and more frequently if necessary.

9.3.3.2 Consider tests in important bank decisions and risk management, especially in determining the bank's risk appetite.

9.3.3.3 Reverse test results will reveal the bank's main weaknesses and the reasonableness of the risks it assesses, and thus can be used to evaluate the comprehensiveness and conservatism of the Internal Capital Adequacy Assessment Process framework.

10. Periodic Review of the Internal Capital Adequacy Assessment Process

10.1 Periodic reviews of the Internal Capital Adequacy Assessment Process must be conducted, considering the following at a minimum:

10.1.1 These reviews must be conducted by the three lines of defense according to their roles and responsibilities.

10.1.2 Review key elements related to the process annually - including the process governance framework, internal documentation framework, bank entities included in the process, scope of inputs, risk identification and measurement methodologies, methodology used for capital adequacy assessment, stress testing framework, and data quality and aggregation - and the process must be comprehensively covered at least every three years.

10.1.3 Establish sufficient policies and procedures for periodic reviews.

10.1.4 Ensure these reviews lead to proactive adjustments to the Internal Capital Adequacy Assessment Process in case of material changes affecting the business (such as entering new markets, offering new services or products) or the banking group structure.

10.1.5 These reviews must result in effective challenge by supervisory bodies (second and third lines of defense).

10.1.6 Use the results of these reviews effectively, document them adequately, and report to senior executive management, the Board of Directors, and relevant committees if the outputs of these reviews are materially negative and require corrective actions.

10.2 In addition to what is stated in item (10.1) above, the Internal Audit Department must review the Internal Capital Adequacy Assessment Process (both its quantitative and qualitative aspects) and ensure its alignment with internal and regulatory requirements, ensuring its integrity, accuracy, and reasonableness. The review must cover, at a minimum, within three years:

10.2.1 The appropriateness of the bank's capital assessment process with the scope and complexity of its activities.

10.2.2 The accuracy and completeness of inputs for the assessment process and data aggregation.

10.2.3 Review the outputs of the Internal Capital Adequacy Assessment Process and ensure the use of its results in decisions made.

---

CENTRAL BANK OF JORDAN

البنك المركزي الأردني

10.2.4 Identify weaknesses resulting from the review and report on them to the Board of Directors, relevant committees, and senior executive management to take corrective actions regarding them.

10.3 In addition to the above, the Internal Audit Department must ensure annually that the first and second lines of defense have performed their roles adequately regarding periodic review.

10.4 The bank must ensure the presence of qualified staff within the Internal Audit Department capable of reviewing the Internal Capital Adequacy Assessment Process and ensuring its alignment with internal and regulatory requirements, ensuring its integrity, accuracy, and reasonableness.

11. General Provisions

11.1 The bank must re-supply the Central Bank with the results of the Internal Capital Adequacy Assessment Process in case of material changes (occurring during the year) that have a tangible impact on the assumptions and methodologies used in this process.

11.2 The bank must provide an information system that ensures risk monitoring and shows its impact on capital adequacy in a timely manner to ensure the effective use of the Internal Capital Adequacy Assessment Process.

11.3 The Central Bank may request the bank to recalculate capital requirements if it is found that there is a deficiency in the calculation process that negatively affects the ability to rely on the results of the Internal Capital Adequacy Assessment Process.

11.4 The bank must document the steps and procedures followed to comply with the Central Bank's requirements regarding minimum capital limits.

11.5 Banks must prepare recovery plans commensurate with their business size and the results of the Internal Capital Adequacy Assessment Process, approved by the Board of Directors.

11.6 Reports and worksheets related to the Internal Capital Adequacy Assessment Process are an integral part of the Internal Capital Adequacy Assessment document, and the Central Bank may request any of them within the supervisory review process.

11.7 The Internal Capital Adequacy Assessment document must include the axes mentioned in Annex No. (2) at a minimum.

11.8 The bank must provide the Central Bank with a template summarizing the results of the Internal Capital Adequacy Assessment Process, attached to the Internal Capital Adequacy Assessment document.

11.9 Those responsible for preparing and reviewing the Internal Capital Adequacy Assessment Process must read the bank's inquiries and answers attached to these instructions to ensure proper application and understanding of the provisions of these instructions.

11.10 Islamic banks must apply these instructions, considering the risks associated with the nature of their business, including Sharia compliance risks.

11.11 These instructions shall be effective as of January 1, 2026, and Circular No. (1533/10) dated February 3, 2010, and the attached guidelines regarding Pillar 2 of Basel II (Supervisory Review), are repealed.

---

CENTRAL BANK OF JORDAN

البنك المركزي الأردني

Annex No. (1) Risks to be Measured

1. Concentration Risk in Credit Risk

• Capital adequacy requirements (Pillar 1) assume that banks hold diversified portfolios (i.e., they assume no concentration risk in credit risk), while in reality, there may be individual risk arising from large exposures to a single person or a group of related parties, and this type of concentration risk must be evaluated within the framework of the Internal Capital Adequacy Assessment Process.

• Concentration risk in credit arises when exposures to a single person or a group of related parties lead to a material change in the bank's credit risk profile and/or credit losses that threaten its solvency or its ability to continue its core operations.

• When measuring concentration risk, all types of exposures (direct and indirect) must be taken into account.

• In addition to concentration risk towards exposures to a single person or a group of related parties, concentration risk must be measured based on geographic/regional and sectoral concentration.

• The bank must employ appropriate methodologies to measure concentration risk and reflect the impact of measurement results by adding capital against them, and the methodology and results must be documented.

• Banks must analyze credit concentration risk at the banking group level and entity level (branch or subsidiary), as concentration risk at the consolidated level may not be material, while entity-level concentration risk may threaten the continuity of the entity.

2. Country Risk in Credit Risk

• Country risk is a type of concentration risk related to exposure to a specific country.

• Country risk arises when exposures to a specific country, including sovereign exposures, lead to a material change in the credit risk profile and/or losses that threaten the bank's solvency or its ability to continue operations.

• These risks must reflect the economic strength of the debtor's country and/or the debtor(s) located in this country. When measuring these risks, consideration must be given to the country's compliance with payment deadlines and any previous default cases, as well as risks related to future social or political events or any arrangements affecting the financial solvency of debtors (such as deposit freezes, confiscation, etc.).

3. FX Lending Risk

• FX lending is defined as banks providing loans in a currency different from the official currency of the country where the borrower resides.

• This risk arises when exchange rate fluctuations lead to a decrease in the value of exposures or a decline in the counterparty's ability to pay on time.

---

CENTRAL BANK OF JORDAN

البنك المركزي الأردني

• Banks must evaluate risks resulting from unhedged foreign currency lending as additional credit risks within the framework of the Internal Capital Adequacy Assessment Process, and determine concentration at the level of each foreign currency. For major currencies, it must be evaluated whether exchange rate movements are taken into account in default probabilities.

4. Operational Risk

• Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people, or systems, or from external events. This definition includes legal and compliance risks, and excludes strategic and reputational risks from operational risks.

• Within the framework of the Internal Capital Adequacy Assessment Process, banks must apply measurement methodologies for operational risks that align with their specific conditions and operational mechanisms. The bank must calculate additional capital against these risks if it is found that operational risks are not covered under Pillar 1 for the bank, and the methodology and results must be documented.

5. IT Risk and Cyber Security Risks

• IT risks arise from deficiencies in IT or its processing, or from weaknesses in the bank's IT strategy or policy, or from the bank's inadequate use of IT.

• Cyber security risks concern the risk of financial loss, operational disruption, or damage resulting from the failure of digital technologies used for information and/or operational functions introduced into the system through electronic means, due to unauthorized access, use, disclosure, disruption, modification, or destruction of the system.

6. Strategic Risk

• Strategic risk refers to risks arising from revenues resulting from contrary decisions, improper implementation of decisions, or weak response to changes in the business environment.

• All decisions with potential strategic impact must be taken at the strategic level, not the operational or executive level.

7. Reputational Risk

• Reputational risk is defined as risks arising from negative impressions by customers, counterparties, shareholders, investors, creditors, analysts, or other stakeholders, which may negatively affect the bank's ability to maintain existing relationships or establish new ones, and its ability to obtain financing.

• In the context of the Internal Capital Adequacy Assessment Process, banks must identify all sources of material reputational risk they are exposed to.

---

CENTRAL BANK OF JORDAN

البنك المركزي الأردني

8. Interest Rate Risk in the Banking Book (IRRBB)

• All material sources of interest rate risk in the banking book (IRRBB) must be measured (such as inherent gap risk, basis risk, option risk, etc.).

• The interest rate shock scenarios used by the bank must be severe enough and consistent with the expected level of conservatism in measurement.

• Behavioral assumptions must be taken into account (such as deposits without maturity dates, early repayment of fixed-rate loans, early withdrawal of deposits, early termination of contracts) and these assumptions must be documented.

• The bank should follow best practices regarding interest rate risk, including the paper issued by the Basel Committee on Banking Supervision and any papers issued subsequently or instructions issued by the Central Bank on this matter.

9. Climate-Related Financial Risks

• Refers to potential risks that may arise due to climate change or efforts to mitigate its effects.

• These risks can affect banks through various channels, such as increased credit risk due to deteriorating repayment capacity of companies, decline in the value of real estate collateral, or increased operational risk due to damage that may be inflicted on bank assets or service interruptions.

• The bank must comply with the requirements of the instructions related to climate risk management in effect.

---

CENTRAL BANK OF JORDAN

البنك المركزي الأردني

Annex No. (2) Report Components

1. Executive Summary

The executive summary aims to provide an overview of the framework, methodology, and results of the Internal Capital Adequacy Assessment Process, and must include the following:

a. The purpose of the report and the levels it covers [Jordan branches and abroad, Jordan branches, the banking group].

b. Summary of the preparation and review process of the Internal Capital Adequacy Assessment Process and the approval of results (flow of the ICAAP process).

c. The scope of the Internal Capital Adequacy Assessment in terms of bank entities included in the process, mentioning deviations from minimum regulatory requirements, if any.

d. Key features of the Internal Capital Adequacy Assessment Process (primarily objectives, main hypotheses, considered timeframes, etc.).

e. Key results of the Internal Capital Adequacy Assessment Process, including:

• A table showing the results of the internal assessment and the volume of capital required to be held to face inherent risks (the table includes assessment results for the year related to the financial statements prepared for the assessment and future years), compared with capital held.

• A table showing the results of stress tests and their impact on capital adequacy (Pillar I & II CAR, ICAAP CAR).

• A summary table of risks evaluated within the Internal Capital Adequacy Assessment Process and measurement methodologies used for each type, showing the required capital volume resulting from the assessment, and also showing the aggregation of risks.

• A summary showing the capital plan and the bank's capital management over the coming years, considering the results of the Internal Capital Adequacy Assessment Process and stress test results.

• Material changes (implemented or planned) in the risk management framework, the bank's strategy, risk appetite, and frameworks (ICAAP/ILAAP).

2. Business Background

This item includes a brief overview of:

• The bank's main business lines and (Business Profile), and the bank's main entities, showing the composition of the banking group, including subsidiaries, affiliates, and other significant investments.

• The bank's financial performance in recent years (Financial Background) with a description of the main cost and revenue items distributed by main business lines, markets, and entities.

• Growth projections for the coming years (Projected Business Plan), considering plans related to any developments/improvements concerning the bank's support operations (such as changes in IT infrastructure).

• Clarification on whether these developments have been taken into account in the Internal Capital Adequacy Assessment Process, and a description of the mechanism for taking them into account.

---

CENTRAL BANK OF JORDAN

البنك المركزي الأردني

3. Corporate Governance

This item includes a summary of the governance system, including committees derived from the Board of Directors, internal control controls at the bank level, lines of defense, and their appropriateness with its business model, size, complexity, and risks it faces. This axis includes the following matters:

• The general governance framework and the bank's risk culture.

• The responsibility of the Board of Directors, senior executive management, and relevant committees.

• The risk management framework and internal control (including defining roles and tasks related to the Internal Capital Adequacy Assessment Process).

• Explanation of the Internal Capital Adequacy Assessment Process (ICAAP Framework), including departments and persons responsible for preparing, reviewing, and approving the assessment.

• Description of the use of the Internal Capital Adequacy Assessment Process in capital planning, risk management, and the bank's operational and strategic activities, and an explanation of the information systems used in the process.

• Statement on whether any external service providers or independent consulting entities were relied upon when applying the Internal Capital Adequacy Assessment Process (such as outsourcing the preparation of economic scenarios and/or risk measurement methodologies, etc.), and attaching copies of their reports, if any.

• Details on any expected future improvements in the Internal Capital Adequacy Assessment Process, highlighting aspects under implementation (such as projects to automate data collection and risk management systems, changing risk measurement methodologies, etc.).

4. Risk Appetite Level This item includes:

• A description of the Bank's risk management objectives.
• An overview of other strategic risk management (specifically the Risk Appetite Framework (RAF), Internal Liquidity Adequacy Assessment Process (ILAAP), stress testing, and recovery plans).
• A matrix showing the Bank's acceptable risk level for all major types of risk and any derived sub-risks it may be exposed to, indicating whether they are material risks, and stating the acceptable risk limit and the maximum risk tolerance.

5. Risk Identification and Management Process This item includes:

• A comprehensive list of all major types of risk and sub-risks the Bank may be exposed to, clarifying whether the risks are material.

• A description of the governance for defining and assessing risks (Stakeholders, Frequency, and Scope), and the methodologies used to determine materiality (Materiality Thresholds).

• A description of the risk management function responsible for identifying, assessing, measuring, and monitoring risks, including information about the relevant units and committees.

• A description of risk monitoring processes, risk mitigation elements, and corrective actions.

• A statement on the consistency of the Internal Capital Adequacy Assessment Process (ICAAP) among the Bank Group's presence (branches and subsidiaries), including a summary reflecting the key strategies, assumptions, and methodologies adopted across these presences in this regard.

• In the event that this process differs for certain presences and requires their implementation using methodologies different from those applied to the rest of the Bank Group, a summary must be included detailing this difference and any material effects resulting from its application to the ICAAP at the Bank Group level.

• A statement of any potential constraints that hinder the transfer of capital within the Bank Group, taking those constraints into account in the ICAAP process.

6. Risk Measurement Methodologies, Assumptions Used, and ICAAP Results This item includes:

• A description of the risk measurement methodologies the Bank may be exposed to, including those that are difficult to measure quantitatively, in a manner that clarifies the main assumptions, the quantitative and qualitative inputs used in the process, and the results of assessing these risks and identifying what requires additional capital (in addition to the capital required to face the Pillar 1 risks calculated in accordance with the Regulatory Capital Instructions).
• A description of the data used.
• The results of the quantitative assessment of risks (stating each risk individually) and on an aggregated basis (Aggregation of risks), compared with the results of the ICAAP prepared for the previous year and the improvements made during the current year.
• The required capital in addition to the minimum Pillar 1 capital adequacy requirements with details

---