Integrated Risk Management Guidelines for Financial Institutions

Department of Financial Institutions & Markets Bangladesh Bank Head Office, Dhaka DFIM Circular No.- 03 Date: 24 January, 2016 Managing Director/Chief Executive Officer All Financial Institutions in Bangladesh. Dear Sir, Integrated Risk Management Guidelines for Financial Institutions Considering the ongoing challenges arising from increased competition, introduction of new products and services and expansion of diversified financial businesses of Financial Institutions (FIs), Bangladesh Bank has already issued several guidelines and directives on risk management along with five core risk guidelines. The Integrated Risk Management Guidelines are prepared to involve FIs to adopt improved policies and procedures in line with international best practices for their risk management framework. The guidelines will help FIs strengthening their risk management system as a whole. The guidelines encompass all the probable risks associated with financing companies. The policies and procedures of the integrated risk management guidelines has been formulated in light with all the earlier guidelines. The guidelines will be treated as supplement to the existing risk management guidelines. The instructions of these guidelines will come into effect immediately. Yours sincerely, (Md. Shah Alam) General Manager Phone: 9530178

Integrated Risk Management Guidelines for Financial Institutions January 2016 DEPARTMENT OF FINANCIAL INSTITUTIONS AND MARKETS BANGLADESH BANK

        Chief Coordinator Md. Shah Alam General Manager Editorial Panel Md. Rafiqul Islam Deputy General Manager Md. Iqbal Hossain Deputy General Manager Md. Rukunuzzaman Joint Director Mohammad Mahbub Alam Joint Director Sharmin Rahman Joint Director Kazi Arif Uz Zaman Deputy Director Md. Saifuzzaman Deputy Director Md. Shahidul Islam Deputy Director Shamma Tabassum Deputy Director H S Tareq Ahmed IDLC Finance Limited   

PREAMBLE The credit crisis of the first decades of this century has forced credit institutions to take a critical look at how they manage risk and has exposed some significant weaknesses in risk management across the financial services industry. The collapse of several high profile credit institutions, the emergency bailout of others, the hundreds of billions of dollars of write‐downs, efforts by credit institutions to raise fresh capital were all signs that something had gone very badly wrong.   The crisis has highlighted an urgent need for improved integrated risk management procedures for credit institutions. In light of this, it became inevitable to prepare robust risk management guidelines for the Financial Institutions (FIs) licensed under Financial Institution Act, 1993. By following these guidelines, FIs will be able to bring greater judgment to decision making, based on a clear understanding of the products and the risks involved. In the new risk management culture, every employee of FIs should consider him or herself a risk manager with a shared understanding of the organizational risk appetite, underpinned by a clear governance structure for managing risk, incorporating ‘three lines of defense’: the first line being the business unit; the second one is the independent risk management function itself; and the third one is the internal audit.   Because of the vast diversity in risk, there is no single prescribed risk management system that works for all. Each FI should tailor risk management program to its needs and circumstances. Regardless of the risk management program design, each program should cover and provide structured way of risk identifying, measuring, monitoring and controlling. For this, there should be a sound risk management system having the following elements:  

1. active board and senior management oversight;  
2. adequate policies, procedures and limits;
3. adequate risk measurement, monitoring and management information system; and
4. comprehensive internal controls. Bangladesh Bank has already issued five core risk guidelines for FIs. The integrated risk management guidelines are prepared in line with internationally accepted best risk management principles and practices supplementary to those five core risk guidelines.   Since the very first credit was extended, FIs have amassed vast experience in managing risk, which makes the risk management weaknesses exposed. These weaknesses have been compounded by the global nature of the financing system. Moving forward, FIs should get back to basics through a renewed focus on understanding the risks that they take. By strengthening their risk governance regimes, they should help to make them more flexible to meet changing conditions. The integrated risk management guidelines will facilitate the FIs in all the way to establish a sound and suitable risk management system within the institution.    (S .K. Sur Chowdhury) Deputy Governor Bangladesh Bank

  

iv Table of Contents Page CHAPTER‐ 1:        BACKGROUND 1.1 Overview 01 1.2 Objectives 02 1.3 Scope 02 1.4 Legal Framework 02 CHAPTER ‐2:        CREDIT RISK MANAGEMENT 2.1 Credit Risk 03 2.2 Credit Risk Management 03 2.3 Credit Risk Management Framework 04    2.3.1 Establishing an Appropriate Credit Risk Environment 04    2.3.2 Organizational Structure for Credit Risk Management 06    2.3.3 Policy and Procedure 10      2.3.3.1 Credit Risk Policy 10      2.3.3.2 Limit Setting 12      2.3.3.3 Credit Origination 12      2.3.3.4 Credit Approval 15      2.3.3.5 Credit Monitoring 17 2.4 Measurement of Credit Risk 18    2.4.1 Pre‐sanction Stage 19      2.4.1.1 Credit Risk Grading 19      2.4.1.2 Internal Risk Rating System 19    2.4.2 Post‐sanction Stage 23      2.4.2.1 Micro‐level Analysis 23      2.4.2.2 Macro‐level Analysis 24 2.5 Concentration Risk 25 2.6 Data Maintenance 30 2.7 Credit Risk Monitoring  and Control 31 2.8 Credit Risk Mitigation 31    2.8.1 Managing Problem Credit 31    2.8.2 Managing Credit Concentration Risk 32    2.8.3 Credit Risk Transfer 33 CHAPTER‐ 3:       MARKET RISK MANAGEMENT 3.1 Market Risk 34 3.2 Interest Rate Risk 34    3.2.1 Effects of Interest Rate Risk 34    3.2.2 Sources of Interest Rate Risk 35

v    3.2.3 Measuring Interest Rate Risk 37      3.2.3.1 Maturity/Re‐pricing Schedule 38    3.2.4 Interest Rate Risk Management Program 42    3.2.5 Interest Rate Risk Management Policies 43    3.2.6 Interest Rate Risk Management and Control Procedures 43 3.3 Equity Price Risk 43    3.3.1 Equity Price Risk Policies 44    3.3.2 Effective Equity Price Risk Management 44    3.3.3 Securities Portfolio Management Program 45    3.3.4 Measuring Equity Price Risk 46 3.4 Managing Market Risk 47    3.4.1 Board Oversight 48    3.4.2 Senior Management Oversight 48 CHAPTER‐ 4:         LIQUIDITY RISK MANAGEMENT 4.1 Liquidity Risk 50 4.2 Liquidity Risk Indicators 50 4.3 Managing Liquidity Risk 51    4.3.1 Liquidity Risk Management Framework 51    4.3.2 Board Oversight 53    4.3.3 Senior Management Oversight 54 4.4 Strategy for Managing Liquidity Risk 55 4.5 Liquidity Policies 56 4.6 Procedures and Limits 57 4.7 Liquidity Risk Management Process 57 4.8 Measurement of Liquidity Risk 57    4.8.1 Contingency Funding Plans 57    4.8.2 Maturity Ladder 59    4.8.3 Liquidity Ratios and Limits 61 4.9 Internal Controls 63 4.10 Monitoring and Reporting Risk Exposures 64 CHAPTER‐ 5:     OPERATIONAL RISK MANAGEMENT 5.1 Operational Risk   65 5.2 Importance of Operational Risk Management 65 5.3 Components of Operational Risk 66 5.4 Categorization of Operational Risk 66 5.5 Operational Risk Management Principles 67 5.6 Operational Risk Management Process 69 5.7 Operational Risk Management Framework 69 5.8 Key Risk Indicators 70 5.9 Operational Risk Management Responsibilities 70

vi    5.9.1 Board’s Responsibilities 70    5.9.2 Senior Management’s Responsibilities 71 5.10 Policies and Procedures 72 5.11 Identification and Assessment 73 5.12 Mitigation of Operational Risk 74 5.13 Monitoring 75 5.14 Reporting 76 5.15 Establishing Control Mechanism 78 5.16 Resiliency, Continuity and Contingency Planning 78 5.17 Internal Controls 78 CHAPTER‐ 6:       REPUTATION  RISK MANAGEMENT 6.1 Reputation Risk 81 6.2 Factors Causing Reputation Risk 81 6.3 Consequences of Reputation Risk 82 6.4 Roles and Responsibilities 82 6.5 Reputation Risk Management Process 82 CHAPTER ‐7:       STRATEGIC RISK MANAGEMENT 7.1 Strategic Risk 84 7.2 Strategic Plan 85 7.3 Strategic Risk Management 86    7.3.1 Board Oversight 86    7.3.2 Senior Management Oversight 86    7.3.3 Role of Business Unit 87    7.3.4 Identification, Measurement and Monitoring of Strategic Risk 87 7.4 Common Causes of Strategic  Failure 88    7.4.1 Planning Issues 88    7.4.2 Implementation Issues 89 7.5 Strategic Risk Control 89 CHAPTER‐ 8:       COMPLIANCE RISK MANAGEMENT 8.1 Compliance Risk 91 8.2 Consequences of Non‐compliance 91 8.3 Policies and Procedures 92 8.4 Compliance Risk Management 93    8.4.1 Organizational Role in Compliance Risk Management 94      8.4.1.1 Role of  the Board 94      8.4.1.2 Role of the Senior Management 94      8.4.1.3 Role of Compliance Function Unit 95    8.4.2 Conflict of Interest between Compliance Function and Other Business Unit 95    8.4.3 Access to Information and Personnel 96

vii    8.4.4 Identification and Assessment of Compliance Risk 96      8.4.4.1 Identification 96      8.4.4.2 Assessment 97    8.4.5 Monitoring and Mitigating Compliance Risk 98    8.4.6 Differences between Compliance and Internal Audit 99    8.4.7 Control Mechanism of Compliance Risk 99 CHAPTER‐ 9:       MONEY LAUNDERING RISK MANAGEMENT 9.1 Money Laundering Risk 101 9.2 Consequences of Money Laundering 102 9.3 Characteristics of  Effective AML Risk Management 102 CHAPTER ‐10:      ENVIRONMENTAL RISK MANAGEMENT 10.1 Environmental Risk 103 10.2 The characteristics of effective Environmental Risk Management (ERM) 103 10.3 Purpose of Environmental Risk Management 104 10.4 Managing ERM 104 CHAPTER ‐11:      CAPITAL MANAGEMENT 11.1 Capital Management 105 11.2 Importance of Capital Management 105 11.3 Framework of Capital management 105 11.4 Roles and Responsibilities of Board of Directors and Senior Management 105 11.5 Monitoring of Capital Adequacy 106 CHAPTER ‐12:     MANAGEMENT INFORMATION SYSTEM 12.1 Management Information System (MIS) 107 12.2 Data Maintenance 107 12.3 Characteristics of MIS 107 12.4 MIS Model 108 12.5 Managing MIS 109 Bibliography 110 Appendix A 111

viii LIST OF ACRONYMS ALCO     Asset Liability Management Committee AML   Anti Money Laundering BB   Bangladesh Bank BIU   Basel Implementation Unit   CEO     Chief Executive Officer CFP   Contingency Funding Plan   CIB   Credit Information Bureau CP   Capital Plan CRG   Credit Risk Grading CRM     Credit Risk Management CRMC   Credit Risk Management Committee CRMD   Credit Risk Management Department CRP   Credit Risk Policy CRT   Credit Risk Transfer ERM   Environmental Risk Management FIs     Financial Institutions HHI     Herfindahl‐Hirschman Index ICAAP   Internal Capital Adequacy Assessment Process KYC   Know Your Customer MTF   Medium Term Funding   NII   Net Interest Income NIM   Net Interest Margin NPL   Non Performing Loans RMU   Relationship Management Unit RSA   Risk Sensitive Asset RSL   Risk Sensitive Liability RU   Recovery Unit VaR   Value at Risk   

Integrated Risk Management Guidelines for Financial Institutions| Page 1 CHAPTER ‐ 1 BACKGROUND 1.1Overview Global financial system, as a whole, has been facing complex and interrelated challenges. The advancement of technology, the accelerating pace of business, globalization, increasing financial sophistication and immoral practice in financing are enhancing the frequency and complexity of risks. These factors are affecting business environment quite frequently which are exposing Financial Institutions (FIs) to newer risk.   In order to face the ongoing challenges of increased competition and expansion of diversified financial business of FIs, Bangladesh Bank (BB) has issued several prudential guidelines and directives on risk management. Since early 2000s, with the compulsion of implementing the Basel Accord, BB has been undertaking a paradigm shift in its supervision strategies from traditional to risk based approach. As part of this process, the concept of risk weighted asset was first introduced in 2003 for the FIs in Bangladesh. Since then BB has issued five core risk management guidelines, namely Asset‐Liability Management (2005), Credit Risk Management (2005), Internal Control and Compliance Framework (2005), ICT Security (2010), and Prevention of Money Laundering and Terrorist Financing (2012). A guideline on Environmental Risk Management was also issued for FIs in 2012. Along with these, Prudential Guidelines on Capital Adequacy and Market Discipline for Financial Institutions (2011), Stress Testing (2012) and Guidelines on Products and Services of Financial Institutions in Bangladesh (2013) were also issued as tools to analyze risks with different aspects. With a view to address and manage all the risks in more prudent and organized way, BB issued DFIM circular no‐01/2013 where FIs are instructed to prepare and submit a comprehensive risk management paper on monthly basis. The Integrated Risk Management Guidelines for FIs are prepared to involve FIs to adopt improved policies and procedures in line with international best practices for their risk management framework. For this purpose, the Guidelines encompass all the probable risks that include credit risk, market risk, liquidity risk, operational risk, compliance risk, strategic risk, reputation risk, environmental risk, and money laundering risk. Management

Integrated Risk Management Guidelines for Financial Institutions| Page 2 Information System (MIS) is also addressed in the guidelines to secure information technologies of FIs. The policies and procedures of this integrated risk management guidelines formulated in light with all the earlier guidelines and proper compliance thereof will help the FIs to strengthen their risk management system. 1.2 Objectives The purpose of risk management is to identify potential problematic areas before they occur so that risk‐handling strategies may be planned and invoked in advance across the life of the product or project to mitigate adverse impacts on achieving objectives. The purposes of this guidelines are‐  i. strengthening the overall risk management framework in a systemic way; ii. establishing better risk management culture within the institutions; iii. promoting the inclusive risk management approach within the FIs; and iv. introducing some techniques in managing (identifying, measuring, monitoring and mitigating risks) all possible risks under formal organizational set up and with standard policies and procedures. 1.3 Scope These guidelines will be applicable to all FIs in Bangladesh. For the purpose of these guidelines, FIs refer to the institutions licensed under the Financial Institutions Act, 1993. The risk management process described in the guidelines is complementary to the existing guidelines, circulars, circular letters and directives issued by BB.   1.4 Legal Framework This guidelines are issued under section 18 of the Financial Institutions Act, 1993. FIs will have to consider these guidelines as benchmark and will design their own risk management system accordingly.   

Integrated Risk Management Guidelines for Financial Institutions| Page 3 CHAPTER ‐ 2 CREDIT RISK MANAGEMENT 2.1Credit Risk Credit risk is undoubtedly one of the most crucial issues in the field of financial risk management. It can be defined as a potential loss arises when a debtor or financial instrument issuer is unwilling or unable to meet its contractual obligation to repay the debt according to the agreed terms with the lenders or financial institutions. It can occur when the counterpart either defaulting or making late payments of interest or principal.   This loss stems from outright or partial default due to inability or unwillingness of a customer or counter party to meet commitments in relation to lending, trading, settlement and other financial transactions. Alternatively losses may result from reduction in portfolio value due to actual or perceived deterioration in credit quality. For most FIs, loans are the largest and most obvious source of credit risk; however, credit risk may emerge from both on and off‐balance sheet activities. Credit risk is not only associated with direct accounting loss but also with economic exposures. This encompasses opportunity costs, transaction costs and expenses associated with a non‐performing asset over and above the accounting loss. Credit risk not necessarily occurs in isolation. The same source that endangers credit risk for the institution may also spread it to other risks. For instance, overall inferior portfolio of an FI may lead it to liquidity problem. 2.2Credit Risk Management (CRM) The effective management of credit risk is a critical component of a comprehensive approach to risk management. It is essential for long‐term success of any FI. The goal of credit risk management is to maximize an FI’s risk‐adjusted rate of return by maintaining credit risk exposure within acceptable parameters. FIs need to manage the credit risk inherent in the entire portfolio as well as the risk in individual credits or transactions.   Credit risk management is a continuous effort of identifying, measuring, monitoring and mitigating the credit risk in both pre‐sanction stage as well as post‐sanction stage. Following table refers the applicability of the steps in those two stages.

Integrated Risk Management Guidelines for Financial Institutions| Page 4 Table‐1: Steps of CRM Steps of CRM Pre‐sanction stage Post‐sanction stage Risk Identifying √  √  Risk  Assess/Measuring √  √  Risk Monitoring x √  Risk Control/Mitigation √  √  2.3 Credit Risk Management Framework   Although specific credit risk management practices may differ among FIs depending upon the nature and complexity of their credit operations, a comprehensive credit risk management program should address four steps mentioned in Table‐1. These should be applied in conjunction with the assessment of asset quality, adequacy of provisions and reserves, and disclosure of credit risk. The credit risk management framework will include the followings: a. Establishing an appropriate credit risk environment b. Setting up organizational structure for credit risk management c. Formulating Policy & Procedure 2.3.1  Establishing an Appropriate Credit Risk Environment a. Role of Board The board of directors should have responsibility for approving and periodically (at least annually) reviewing the credit risk strategy and credit risk policies of the FI. The strategy should reflect the FI’s risk appetite and the level of profitability it expects to achieve over various credit risks.   The strategy should include a statement of FI’s willingness to grant credit based on exposure type (for example, commercial, consumer, and real estate), economic sector, geographical location, maturity and anticipated profitability. This might also include the identification of

Integrated Risk Management Guidelines for Financial Institutions| Page 5 target markets and the overall characteristics that the FI would want to achieve through its credit portfolio (including levels of diversification and concentration tolerances).   The responsibilities of the board with regard to CRM shall include the followings: i. ensuring that appropriate policies, plans and procedures for credit risk management are in place; ii. ensuring the FI implements sound fundamental policies; iii. defining delegation of credit approving powers; iv. defining the FI’s overall risk tolerance in relation to credit risk; v. ensuring that top management as well as staffs responsible for credit risk management possess expertise and knowledge to accomplish the risk management function; vi. ensuring that FI’s significant credit risk exposure is maintained at prudent levels and consistent with the available capital.   vii. reviewing trends in portfolio quality and the adequacy of FI’s provision for credit losses; viii. ensuring that internal audit reviews the credit operations to assess whether or not the FI’s policies and procedures are adequate and implemented; ix. reviewing exposures to insiders and their related parties, including policies related thereto; x. reviewing the authority delegated to management; xi. outlining the content and frequency of management report to the board on credit risk management. b. Role of Senior Management Senior management should have responsibility for implementing the credit risk strategy approved by the board of directors and developing policies and procedures for identifying, measuring, monitoring and controlling credit risk. Such policies and procedures should address credit risk in all activities along with individual borrower and portfolio as a whole.  

Integrated Risk Management Guidelines for Financial Institutions| Page 6 The responsibilities of senior management with regard to credit risk management shall include: i. developing credit policies and credit administration procedures for board approval; ii. implementing credit risk management policies to ensure effective credit risk management process; iii. outlining the content and frequency of management report to the board on credit risk management and ensuring implementation; iv. monitoring and controlling the nature and composition of the FI’s credit portfolio; v. monitoring the quality of credit portfolio and ensuring that the portfolio is thoroughly and conservatively valued and adequate provisions are kept against probable losses. vi. establishing internal controls and setting clear lines of accountability and authority; and vii. establishing lines of communication for the timely dissemination of credit risk management policies, procedures and other credit risk management information to all respective officials. c. Role of Business Units Respective business units should identify and manage credit risk inherent in their products and activities. FIs should ensure that the risks of products and activities new to them are subject to adequate risk management procedures and controls before being introduced or undertaken, and approved in advance by the board of directors or its appropriate committee. 2.3.2 Organizational Structure for Credit Risk Management   FI should design its organizational structure for CRM by considering the size, complexity and diversification of its credit activities. It must facilitate effective management oversight and proper execution of CRM and control processes. a. Credit Risk Management Committee (CRMC): Each FI, depending upon its size, should constitute a CRMC, ideally comprising of heads of Credit Risk Management

Integrated Risk Management Guidelines for Financial Institutions| Page 7 Department (CRMD), credit department and treasury. This committee should be empowered to oversee credit risk taking activities and overall credit risk management function. The CRMC will also report to FI’s risk management forum on regular interval.   The CRMC should be mainly responsible for‐  i. the implementation of the credit risk policy/strategy approved by the board; ii. monitoring credit risk throughout the FI and ensuring compliance;   iii. recommending the board, for its approval, clear policies on standards for presentation of credit proposals, financial covenants, rating standards and benchmarks; iv. deciding large credit exposures, standards for loan collateral, portfolio management, loan review mechanism, risk concentrations, risk monitoring and evaluation, pricing of loans, provisioning, regulatory/legal compliance, etc. b. Credit Risk Management Department (CRMD): Further, to maintain credit discipline and to enunciate credit risk management and control process there should be a separate functional unit independent of loan origination function. Credit policy formulation, credit limit setting, monitoring of credit exceptions/exposures and review/monitoring of documentation are functions that should be performed independently of the loan origination function. Ideally, the FIs should institute a CRMD for this purpose.  Small FIs where it might not be feasible to establish such structural hierarchy, there should be adequate compensating measures to maintain credit discipline, introduce adequate check and balance and standards to address potential conflicts of interest.   Typical functions of CRMD include: i. To follow a holistic approach in management of risks inherent in FIs portfolio and ensure the risks remain within the boundaries established by the board or CRMC.

Integrated Risk Management Guidelines for Financial Institutions| Page 8 ii. The department also ensures that business lines comply with risk parameters and prudential limits established by the board or CRMC. iii. Establish systems and procedures relating to credit risk identification, management information system, monitoring the quality of loan portfolio and early warning. The department will take remedial measure when deficiencies/problems are identified. iv. The department should undertake portfolio evaluations and conduct comprehensive studies on the environment to test the resilience of the loan portfolio. Despite the need for a separate or independent oversight, the front office or loan origination function should be cognizant of credit risk, and maintain high level of credit discipline and standards in pursuit of business opportunities. c. Relationship Management Unit (RMU)/Marketing Unit : The responsibilities of RMU include the followings: i. To act as initiator to contact borrowers at primary stage.   ii. To collect and maintain detailed information of borrower’s business and industry. RMU should proactively analyze the financial performance and transactions behavior of the borrowers. iii. To be responsible for the timely and accurate submission of credit applications for new proposals.   iv. To highlight any deterioration in borrower’s financial standing and amend the borrower’s Risk Grading in a timely manner.   v. To inform CRMC/approval authority regarding the structuring of facilities, potential deterioration in accounts or for any credit related issues. vi. To monitor the borrower after disbursement that includes keeping track of borrowers’ compliance with credit terms, identifying early signs of irregularity, conducting periodic valuation of collateral and ensuring timely repayments.   vii. To maintain credit files that include all correspondence with the borrower, sufficient information necessary to assess the financial health of the borrower, repayment performance etc.  

Integrated Risk Management Guidelines for Financial Institutions| Page 9 d. Credit Administration: The credit administration function is critical in ensuring that proper documentation and approvals are in place prior to the disbursement of financial facilities. It is essential that the functions of credit administration be strictly segregated from RMU in order to avoid the possibility of controls being compromised or issues not being highlighted at the appropriate level. The functions of credit administration includes the followings: i. To ensure the completeness of documentation in accordance with approved terms and conditions; ii. To monitor insurance coverage of assets pledged as collateral, and is properly assigned to the FI; iii. To maintain control over all security documentation; iv. To control facility disbursements only after all terms and conditions of approval have been met; and v. To monitor borrower’s compliance with covenants and agreed terms and conditions, and general monitoring of account conduct/performance. e. Internal Audit/Control: Internal audit will randomly test all aspects of CRM in order to determine that: i. credit activities are in compliance with the FI’s credit and accounting policies and procedures, and with the laws and regulations to which these credit activities are subjected to; ii. existing credit facilities are duly authorized, and are accurately recorded and appropriately valued on the books of the FI; iii. credit exposures are appropriately rated; iv. credit documentation is completed; v. potential problem accounts are being identified on timely basis and determine whether the FI’s provision for credit losses is adequate; and vi. CRM information reports are adequate and accurate. f. Recovery Unit (RU): The RU should directly manage accounts with sustained deterioration (a Credit Risk Grading of Sub‐Standard or worse). FIs may wish to

Integrated Risk Management Guidelines for Financial Institutions| Page 10 transfer EXIT accounts graded 4 to 5 to the RU for efficient exit based on recommendation of CRMC. Whenever an account is handed over from RMU to RU, a Handover/Downgrade Checklist [Please refer to the Appendix 3.4.1 and Appendix 3.4.2 of the Credit Risk Management‐Industry Best Practice: issued by Bangladesh Bank vide FID circular no. 10 dated 18 September, 2005. FIs should follow the any subsequent changes of Appendix 3.4.1 and 3.4.2 of the above circular] should be completed. The RU’s primary functions are to: i. determine action plan/recovery strategy of loan account; ii. pursue all options to maximize recovery, including placing customers into receivership or liquidation as appropriate; iii. ensure adequate and timely loan loss provisions are made based on actual and expected losses; and iv. regular review of grade 6 or worse accounts.   2.3.3 Policy & Procedure 2.3.3.1 Credit Risk Policy (CRP) Every FI must have a credit risk policy as part of its overall credit risk management framework and get it approved by the board. This policy should clearly outline the FI's view of business development priorities and the terms & conditions that should be applicable for credits to be approved. It should at least include: a. Detailed and formalized credit evaluation/appraisal process; b. Credit origination, administration and documentation procedures; c. Formal credit approval process; d. Approval procedure of credit extension beyond prescribed limits and other exceptions to the CRP ; e. Risk identification, measurement, monitoring and control techniques;

Integrated Risk Management Guidelines for Financial Institutions| Page 11 f. Internal rating (risk grading) systems including definition of each risk grade and clear demarcation for each risk grade in line with BB regulations and policies; g. Risk acceptance criteria; h. Credit approval authority at various levels including authority for approving exceptions and responsibilities of staffs involved in credit operations; i. Roles and responsibilities of staffs involved in origination and management of credit; j. Acceptable and unacceptable types of credit. In order to determine the acceptability of credit, FI may focus on nature of borrowers, credit facilities, collateral security, or geographic sectors etc.; k. ‘Lending Guidelines’ that clearly outline the senior management’s view of business development priorities and the terms & conditions that should be adhered to in order for facilities to be approved [Please refer to section 1.1 of Credit Risk Management‐Industry Best Practice: issued by Bangladesh Bank vide FID circular no. 10 dated 18 September, 2005. FIs will follow the any subsequent changes of 1.1 of the guidelines]; l. Concentration limits on single party or group of connected parties, particular industries or economic sectors, geographic regions and specific products. FIs are allowed to set their own stringent internal exposure limits, as long as they are at least as strict as prudential limits or restrictions set by BB; m. Pricing of credits; n. Guidelines on write‐offs; o. Guidelines on regular monitoring and reporting systems, including borrower follow‐up and mechanisms to ensure that loan proceeds are used for the stated purpose; p. Guidelines on management of problem loans; q. Guidelines on loan rescheduling and restructuring; and r. The process to ensure appropriate reporting.

Integrated Risk Management Guidelines for Financial Institutions| Page 12 In order to deal with credit risk effectively, CRP must be communicated throughout the FI, implemented through suitable procedures, and periodically reviewed to cope up with changing internal and external circumstances. Any significant deviation or exception to these policies must be communicated to the board as well as senior management and corrective measures should be taken. It is the responsibility of senior management to ensure effective implementation of the CRP. 2.3.3.2 Limit Setting FIs will consider the credit strength of the borrower, purpose of credit, economic conditions and the risk appetite while setting credit limits.  FIs will review credit limits periodically, at least semi‐annually, to reassess the credit quality and potentiality of the borrowers. All requests for increases in credit limits should be authenticated by the appropriate authority.   2.3.3.3  Credit Origination FIs should meticulously conduct credit and risk assessment before granting any credit facility. The results of this assessment should be presented in credit proposal that will be originated by respective relationship manager. This will be further reviewed by the CRMD for identification of risk and probable mitigation. Relationship manager will also be primarily responsible for ensuring the accuracy and authenticity of the information provided for credit proposal. For this purpose, he/she must be familiar with the FI’s Lending Guidelines and should conduct due diligence including Know Your Customer (KYC) and other relevant issues on new borrowers, principals, and guarantors.   Credit proposal prepared for approval should address assessment made by relationship manager. This will contain at least the following information in details: a.   Amount and type of facilities proposed b.    Purpose of facilities c.     Facility structure (Tenor, Covenants, Repayment Schedule, Interest) d.     Security arrangements e.      Government and regulatory Policies f.      Economic risks

Integrated Risk Management Guidelines for Financial Institutions| Page 13 The following risk areas should be focused while preparing credit proposal:   Borrower Analysis: The majority shareholders, management team and group or affiliate companies should be assessed. Any issues regarding lack of management depth, complicated ownership structures or inter‐group transactions should be addressed. Industry Analysis: The key risk factors of the borrower’s industry should be assessed. Any issues regarding the borrower’s position in the industry, overall industry concerns or competitive forces should be addressed and the strengths and weaknesses of the borrower relative to its competition should be identified. Supplier/Buyer Analysis: Customer or supplier concentration of borrower should be addressed, as these could have a significant impact on the future viability of the borrower. Historical Financial Analysis: Preferably an analysis of minimum 3 years historical financial statements of the borrower should be presented. If corporate guarantee is provided against the proposed credit, guarantor’s financial statements should also be analyzed. The analysis should address the quality and sustainability of earnings, cash flow, leverage, profitability and the strength of the borrower’s balance sheet.   Projected Financial Performance: In case of any proposal of term facilities with tenure of 1 year or more, a projection of the borrower’s future financial performance should be included. The financial analysis will judge the sufficiency of cash flow to service debt repayments. Facilities should not be granted if projected cash flow is insufficient to repay debts. Credit Background: Credit application should clearly state the status of the borrower in the Credit Information Bureau (CIB) report. The application should also contain liability status with other Banks & FIs and their opinion of past credit behavior. Account Conduct: For existing borrowers, the historic performance in meeting repayment obligations (trade payments, cheques, interest and principal payments, etc) should be assessed.

Integrated Risk Management Guidelines for Financial Institutions| Page 14 Adherence to Lending Guidelines: Credit applications should clearly state whether or not the proposed application is in compliance with the FI’s Lending Guidelines.   Mitigating Factors: Mitigating factors for identified risks in the credit assessment should be explored. Possible risks include, but are not limited to: margin sustainability and/or volatility, high debt load (leverage/gearing), overstocking or debtor issues; rapid growth, acquisition or expansion; new business line/product expansion; management changes or succession issues; customer or supplier concentrations; and lack of transparency or industry issues. Facility Structure: The amounts and tenors of proposed credit facilities should be justified based on the projected repayment ability and facility purpose. Excessive tenor or amount relative to business needs increases the risk of fund diversion and may adversely impact the borrower’s repayment ability. Purpose of Credit: FIs have to make sure that the credit is used for the purpose it was borrowed. In case of corporate facilities, where borrower owns group of companies, such diligence becomes more important. FIs should classify such connected companies and conduct credit assessment on consolidated/group basis. Project Implementation: In case of a large expansion, which constitutes   investment of more than 30% of total capital of FIs or for a green field project, project implementation risk should be thoroughly assessed. Project implementation risk may involve construction risk (gestation period, regulatory and technical clearances, technology to be adopted, availability of infrastructure facilities), funding risk, post project business risk, financial and management risk. Security: A current valuation of collateral should be obtained and the quality and priority of security being proposed should be assessed internally and preferably by a third party. Facilities should not be granted based solely on security. Adequacy and the extent of the insurance coverage also to be assessed. Type of Control on Cash Flow: The credit application should contain and assess whether there is any control on the borrower’s cash flow for securing the repayment. This may include payment assignment from export proceed, payment assignment from customers of the borrower etc.

Integrated Risk Management Guidelines for Financial Institutions| Page 15 Exit Option: Credit application should clearly state the exit option from the borrower in case of early identification of deterioration of grading of the borrower. Name Lending: Credit proposals should not be unduly influenced by an over reliance on the sponsoring principal’s reputation or their perceived willingness to inject funds into various business enterprises in case of need. These situations should be discouraged and treated with great caution. Rather, credit proposals and the granting of facilities should be based on sound fundamentals, supported by a thorough financial and risk analysis.[For the template for credit application, please refer to Credit Risk Management‐Industry Best Practices: issued by Bangladesh Bank vide FID circular no. 10 dated 18 September, 2005] 2.3.3.4  Credit Approval FIs’ credit approval process should establish accountability in the process of approving as well as altering the credit structure. A potential area of exploitation arises from granting credit to connected and related parties, sometimes called “insiders”, that include an FI’s promoters, major shareholders, subsidiaries, affiliate companies, directors, and executives. The relationship includes the ability to exert control over or influence an FI’s policies and decision‐making, especially concerning credit decisions. It is crucial for an FI to systematically identify and track extensions of credit to insiders. It is important to ensure whether credit granting decisions are made rationally and according to approved policies and procedures.   In no case should a loan be granted to a related party with terms and conditions more favorable to the borrower than on a similar loan to an unrelated party. Terms and conditions include amount of the loan, interest rate, amount and type of collateral required, repayment schedule, origination fee, and the possibility of extension or rescheduling.    The delegation of authority needs to be clearly documented and must include the followings   as a minimum:

• Absolute and/or incremental credit approval authority being delegated
• Executives or positions to whom authority is being further delegated
• Ability of recipients to further delegate risk approval authority

Integrated Risk Management Guidelines for Financial Institutions| Page 16

• Restrictions, if any, placed on the use of delegated risk‐approval authorities The degree of delegation of authority will depend on a number of variables including:
• Nature of financial products
• Degree of market responsiveness required
• Types of risks being assessed
• Institution’s risk philosophy and credit culture
• Experience of credit executives The following guidelines should be applied in the approval/sanctioning of facilities:
• Credit approval authority must be delegated in accordance with the instructions mentioned in Guidelines on Products & Services of Financial Institutions in Bangladesh issued vide DFIM Circular Letter no. 12 dated 27 November, 2013;
• Delegated approval authorities must be reviewed annually by Board of Directors;
• The credit approval function should be separated from the marketing/relationship management function;
• Approvals must be evidenced in writing, or by electronic signature.
• Approval records must be kept in file with the credit applications;
• All credit risks must be authorized by executives within the authority limit delegated to them;
• All applications must be reviewed by the head of CRMD for independent assessment and identification of risks and approved by respective committees or individuals delegated;
• The aggregate exposure to any borrower or borrowing group must be used to determine the approval authority required;
• A monthly summary of all new facilities approved, renewed, enhanced, and a list of proposals declined stating reasons thereof may be reported by CRMC/risk management to the Chief Executive Officer (CEO); and
• Any breaches of lending authority should be reported to CEO, head of Internal Control, and head of CRMD.  

Integrated Risk Management Guidelines for Financial Institutions| Page 17 2.3.3.5 Credit Monitoring FIs need to articulate a system that enables them to monitor quality of the credit portfolio on a regular basis and take remedial measures as and when any deterioration occurs. These procedures need to define criteria for identifying and reporting potential problem credits and other transactions to ensure that they are subject to more frequent monitoring as well as possible corrective action, classification and/or provisioning. Establishing an efficient and effective credit monitoring system would help senior management to monitor the overall quality of the total credit portfolio & its trends. It would also help to reassess credit strategy/policy accordingly before encountering any major setback.   The FIs credit policy should explicitly provide procedural guideline relating to credit monitoring. At the minimum, FIs should lay down procedure relating to:

• The roles and responsibilities of individuals in‐charge for credit risk monitoring;
• The assessment procedures and analysis techniques (for individual loans & overall portfolio);
• The frequency of monitoring;
• The periodic examination of collaterals and credit covenants;
• The frequency of site visits; and
• The identification of deterioration in any credit; An effective credit monitoring system must:
• ensure that the FI understands the current financial condition of the borrowers;  
• ensure that all credits are in compliance with existing covenants;
• follow how the customers use approved credit lines;
• ensure that projected cash flows on major credits meet debt servicing requirements;
• ensure that, where applicable, collateral provides adequate coverage relative to the obligor’s current condition; and
• identify and classify potential problem credits on a timely basis.

Integrated Risk Management Guidelines for Financial Institutions| Page 18 Following factors also need to be taken into consideration: Financial Position and Business Conditions: FIs need to watch carefully the financial status of the borrowers. The key financial performance indicators namely profitability, equity, leverage and liquidity should be analyzed. While making such analysis, due consideration should be given to business/industry risk, borrowers' position within the industry and external factors such as economic condition, government policies and regulations. For companies whose financial position is dependent on key management personnel and/or shareholders, for example, in small and medium enterprises, FIs would need to pay special attention to the assessment of the capability and capacity of the management/shareholder(s). Conduct of Accounts: In case of an existing borrower, FIs should monitor the borrower’s transaction activity and repayment history.   Loan Covenants: FI should regularly review the credit in terms of the borrower’s ability to adhere to financial covenants stated in the credit agreement, and any breach detected should be addressed promptly. Reassess the value of collaterals: FIs need to reassess the value of collaterals on a periodic basis. Appropriate inspection should be conducted to verify the existence and valuation of the collateral. The frequency of such valuation should depend upon nature of collaterals. For instance, credits granted against shares need more frequent revaluation as compared to those collateralized by mortgage of a residential property or such illiquid assets. In case of credit facilities secured against inventory or goods at the obligor’s premises, appropriate inspection should be conducted to verify the existence and valuation of the collateral.  If such inventory or goods are perishable or such that their value diminish rapidly (e.g. electronic equipment/computers), additional precautionary measures should be taken. 2.4 Measurement of Credit Risk To serve the purpose of credit risk measurement, a number of evaluation methods have evolved over time.  The outcome of the evaluation process is generally a rating grade/score that depicts the degree of credit risk associated with the borrower. Continuous up‐dating of these grades help the FIs to focus attention on deteriorating credits well before they

Integrated Risk Management Guidelines for Financial Institutions| Page 19 become impaired. Therefore, the assessment is required for both pre and post sanction stages. 2.4.1 Pre‐Sanction Stage 2.4.1.1  Credit Risk Grading (CRG) Credit Risk Grading (CRG) is an important tool for credit risk management as it helps the FIs to understand various dimensions of risk involved in different credit transactions. The aggregation of such grading across the borrowers, activities and the lines of business can provide better assessment of the quality of credit portfolio of an FI. CRG is vital to take decisions both at the pre‐sanction and post‐sanction stages. At the pre‐sanction stage, CRG helps the sanctioning authority to decide whether to lend or not; what should be the lending price; what should be the extent of exposure; what should be the appropriate credit facility; what are the various facilities; what are the various risk mitigation tools to put a cap on the risk level. For calculation and grading, instructions of Credit Risk Management‐Industry Best Practices: issued by Bangladesh Bank vide FID circular no. 10 dated 18 September, 2005 and subsequent changes thereon will be applicable. 2.4.1.2 Internal Risk Rating System Along with the CRG or any other methodology prescribed by BB, FIs may also deploy their own credit risk rating methodology at this pre‐sanctioned stage. This necessitates that FIs should simultaneously use their internal resources to know their customers to such extent and in such a manner, which help them to effectively and efficiently manage their portfolios. Such rating should be aligned with FIs’ own strategies and derived from the historical credit data of that FI or the industry as a whole.   FIs may adopt any of the methodologies or techniques of their own keeping in view of their size, complexity of operations and clientele base. The methodologies/techniques should be flexible to accommodate present and future risk profile of the FI, the anticipated level of diversification and sophistication in lending activities. However, whatever the method used, the result of the evaluation should provide meaningful information which can be further

Integrated Risk Management Guidelines for Financial Institutions| Page 20 used for effective credit risk measurement and management of the credit exposure at an individual level as well as at a portfolio level. a. Scope of Ratings The internal risk ratings should be based on a two tier rating system: i. An obligor rating, based on the risk of borrower default, represents the probability of default by a borrower or group in repaying its obligation in the normal course of business and that can be easily mapped to a default probability bucket.   ii. A facility rating, based on transaction specific factors, determines the loss parameters in case of default and represents loss severity of principal and/or interest on any business credit facility.   b. Rating Criteria To ensure that FIs are consistently taking into account available information, they must use all relevant and material information in assigning ratings to borrowers and facilities. They must take into consideration the maximum available attributes of an obligor; financial as well as managerial, quantitative as well as qualitative. They should also make optimal use of market generated information.   Obligor Ratings: In order to assign obligor ratings the FIs are required to consider, but not limited to, the following aspects of the borrower:   i. Financial Condition including:  

• Economic and financial situation  
• Leverage  
• Profitability  
• Cash flows   ii. Management and ownership structure  
• Ownership structure  
• Management and quality of internal controls  
• Promptness/assessment of the willingness to pay  

Integrated Risk Management Guidelines for Financial Institutions| Page 21

• Strength of Sponsors   iii. Qualitative factors:  
• CIB report  
• Sector of business  
• Industry properties and its future prospects   iv. Others:  
• Country risk  
• Comparison to external ratings.  
• Credit information from other sources   Facility Ratings: In order to assess the facility ratings, the FI should consider the relevant and material information including:   i. Facility  
• Nature and purpose of loan  
• Loan structure  
• Product type  
• Priority of rights in case of bankruptcy  
• Degree of collateralization  
• Composition of collateral   ii. Collateral  
• Nature  
• Quality  
• Liquidity  
• Market value  
• Exposure of the collateral to different risks  
• Quality of the charge   
• Legal status of rights  
• Legal enforceability  
• Time required for disposing off In the case of credits to individuals, factors such as personal income, wealth, debt burden and other relevant personal information should also be considered. Although the qualitative

Integrated Risk Management Guidelines for Financial Institutions| Page 22 factors are not sometimes measurable, however, the persons analyzing these aspects should be careful and conservative in their approach.   FIs should be vigilant about the quality and reliability of data. Given the difficulty in forecasting future events and the influence they will have on a particular borrower’s financial condition, FIs must take a conservative view of projected information. c. The Architecture of Internal Rating System In order to design the architecture of internal rating system, FIs may consider the followings sequential steps:

• Define some comprehensive indicators
• Develop a model using historical data along with futuristic consideration
• Give the weight on each indicator  
• Input the data of the applicants
• Calculate the credit risk score from the model
• Derive the rating/grade of the applicant from the defined rating scales. A rating system with large number of grades on rating scale becomes more costly due to the fact that for superior gradation, the cost of acquiring and analyzing added information increases sharply. However, it is important that there should be sufficient grades to depict precise characterization of the fundamental risk profile of a loan or a portfolio of loans. d. Exposures to be Rated Preferably all the credit applications of the FI should be assigned a risk rating prior to the sanctioning. However considering the cost, it might not be feasible for FIs to rate all the credit exposures. The FIs may decide on their own which exposure needs to be rated. The decision to rate a particular loan could be based on factors such as exposure amount, business line or both. Generally corporate and commercial exposures are subject to internal ratings and FIs can use credit scoring models for consumer/retail loans. Credit scoring models may be developed by analyzing statistics and picking out characteristics that are believed to relate to creditworthiness, mostly used for consumer loans. Factors, like age group, occupation, salary, residency status, credit payment history etc. need to consider to design the model.

Integrated Risk Management Guidelines for Financial Institutions| Page 23 e.  Few more aspects for internal rating system FIs may also consider the following scenario for internal rating system: i. Since the rater and reviewer of rating generally follow the same basic thought, to ensure uniformity in the assignment and review of risk grades, the credit policy should explicitly define each risk grade; lay down criteria to be fulfilled while assigning a particular grade, as well as the circumstances under which deviations from criteria can take place. ii. The credit policy should also explicitly narrate the roles of different parties involved in the rating process. iii. Assigning rating is basically a judgmental exercise for which the models, external ratings and written guidelines/benchmarks will serve as input. iv. FIs should take adequate measures to test and develop a risk rating system prior to adopting one. Adequate validation testing should be conducted during the design phase as well as over the life of the system to ascertain the applicability of the system to the FI’s portfolio. 2.4.2 Post‐Sanction Stage 2.4.2.1 Micro‐level Analysis FIs should also establish an internal credit rating system for each loan/lease account so that it can track the risk associated with a particular obligor in continuous basis. The rating principle would be similar to that of internal risk rating for pre‐sanction stage as discussed in section 2.4.1. However, at this stage, real transaction data and trend can be incorporated in the rating system. Top on that, regulatory instructions regarding the loan/lease classification may also be included in such rating system.  Financial Position  Management  Covenants  External Factors  Transaction Data Credit Risk Rating  Classification  Provisioning  Capital Charge

Integrated Risk Management Guidelines for Financial Institutions| Page 24 2.4.2.2 Macro‐level Analysis For the purpose of prudent risk management, it is necessary to have macro level illustration (overall portfolio of respective FI) of credit risk along with the micro level analysis. This would help to re‐strategizing the risk mitigation plans for the following credit group exposures: Table‐2: Broad Credit Exposure Groups Serial No. Group 1.   Sector wise 2.   Product wise 3.   Region wise 4.   Top 10/20/50 borrowers   FIs may consider following perspectives for macro‐level analysis during post sanction stage for all the groups mentioned in table‐2: a. Credit Amount: Following risk measuring indicators may be used for evaluating risk associated to credit amount:

• Credit Growth
• Concentration
• Large Loan b. Credit Quality: Following risk measuring indicators may be used to judge credit quality:
• Classification  
• Rescheduling
• Restructuring
• Written‐off
• Provisioning
• Law Suit
• Recovery
• Top 10 defaulter c. Credit Enhancement: Following risk measuring indicators may be used to review credit enhancement:
• Eligible collateral as a percentage of outstanding loan/lease amounts

Integrated Risk Management Guidelines for Financial Institutions| Page 25

• Eligible collateral coverage against Non Performing Loans (NPLs) FIs may derive the trend for each indicator from best possible frequently available data in regular interval. From these, they may design the credit risk chart to illustrate the severity of risk indicators related to credit amount, quality and enhancement. d. Stress Test: Uncertainties always remain in calculating risk. This is due to the fact that risk calculation is an estimation that requires certain prerequisites. In this regard, stress tests may be a good tool to deal with such uncertainties A stress test is a way of evaluating the sufficiency of portfolio management policy and financial strength against a certain assumed but probable stress situation. Stress scenarios include a decline in credit growth, a drop in stock prices, deterioration in the business condition of large borrowers, and large fluctuations in risk components.   The results of stress tests need to be actively used by the management, risk management sections, and marketing section in discussing portfolio management for near future. The results of such stress tests should be considered meticulously by the management as this is significant in determining an appropriate level of capital buffer and necessary countermeasures.   2.5 Credit Concentration Risk Concentration risk arises when an FI invests its most or all of the assets to a single or few individuals or entities or sectors or products. That means when any FI fails to diversify its loan and investment portfolios, concentration risk emerges.   The concentration risk can be measured for each group mentioned in Table‐2 by using Herfindahl Hirschman Index (HHI). It is a widely used indicator of concentration risk which is defined as the sum of the squares of the relative portfolio shares of all group elements. Here, for the purpose of credit concentration risk, group elements may be referred as sector, products, region, top 10/20/50 etc. It is measured as: ܫܪܪ ൌ ∑ ܵ௜ ௡ ଶ ௜ୀଵ    where, Si= Share (%) of each element across the total portfolio.

Integrated Risk Management Guidelines for Financial Institutions| Page 26 Well‐diversified portfolios with a very large number of small borrowers have an HHI value close to zero, whereas heavily concentrated portfolios can have a considerably higher HHI value. In the extreme case of a single borrower, the HHI takes the value of 1. Measurement: a. HHI≤0.010 indicates homogeneous concentration risk. b. 0.100>HHI>0.010 indicates satisfactory concentration risk. c. 0.180>HHI>0.100 indicates moderate concentration risk. d. HHI>0.180 indicates high concentration risk.   

Integrated Risk Management Guidelines for Financial Institutions| Page 27 Following table shows an example of Product‐wise Concentration Risk by using HHI Table‐3: Product‐wise Concentration Risk by using HHI Particulars February, 2015 March, 2015 Asset side Products Outstanding (BDT in million) % of total loan (S) (S2 ) Outstanding (BDT in million) % of total loan (S) (S2 ) Corporate Finance: 1.    Lease Finance 250 0.064 0.004 300 0.065 0.004 2.    Term Loan 500 0.128 0.016 550 0.119 0.014 3.    Project Finance 100 0.026 0.001 100 0.022 0.000 4.    Working Capital          Finance 200 0.051 0.003 180 0.039 0.002 5.    Short Term 100 0.026 0.001 220 0.048 0.002 Sub Total Corporate Finance: 1150 0.295 0.08 1350 0.293 0.086 Consumer Finance: 1.    Auto/car Loan 100 0.026 0.001 120 0.026 0.001 2.    Lease Financing           for  vehicle 50 0.013 0.000 40 0.009 0.000 3.    Personal Loan 100 0.026 0.001 200 0.043 0.002 4.    Loan against TDR 50 0.013 0.000 80 0.017 0.000 Sub Total Consumer Finance: 300 0.077 0.006 440 0.095 0.009 Agriculture Finance : 1.    Lease Finance 20 0.005 0.000 0 ‐  ‐  2.    Term Loan 80 0.021 0.000 10 0.002 0.000 3.    Working Capital          Finance 50 0.013 0.000 50 0.011 0.000 4.    Agriculture Trade           Finance 10 0.003 0.000 10 0.002 0.000 5.    SME Agriculture 20 0.005 0.000 20 0.004 0.000 Sub Total Agriculture Finance   180 0.046 0.002 90 0.020 0.000   

Integrated Risk Management Guidelines for Financial Institutions| Page 28 Table‐3: Product‐wise Concentration Risk by using HHI (Continued) Particulars February, 2015 March, 2015 Asset side Products Outstanding (BDT in million) % of total loan (S) (S2 ) Outstanding (BDT in million) % of total loan (S) (S2 ) SME Finance: ‐  ‐  ‐  ‐  1.    Lease Finance 50 0.013 0.000 20 0.004 0.000 2.    Term Loan 100 0.026 0.001 80 0.017 0.000 3.    Working Capital   Finance 150 0.038 0.001 150 0.033 0.001 4.    Woman Entrepreneur Loan 50 0.013 0.000 80 0.017 0.000 5.    SME Tailored Loan 0 ‐  ‐  0 ‐  ‐  6.    Work Order financing 20 0.005 0.000 20 0.004 0.000 Sub Total SME Finance: 370 0.095 0.009 350 0.076 0.006 Housing Finance: 1.    Real estate (individual Consumer) 50 0.013 0.000 100 0.022 0.000 2.    Project/ Commercial   80 0.021 0.000 200 0.043 0.002 Sub Total Housing Finance: 130 0.033 0.001 300 0.065 0.004 Equity Finance: 1.    Investment in             Preference share 30 0.008 0.000 20 0.004 0.000 2.    Common stock 150 0.038 0.001 150 0.033 0.001 Sub Total Equity Finance: 180 0.046 0.002 170 0.037 0.001 Syndication Finance: 1.    Syndication Lease         Finance           100 0.026 0.001 250 0.054 0.003 2.    Syndication Term              Finance           300 0.077 0.006 300 0.065 0.004 3.    Syndication          Working       0 ‐  ‐  100 0.022 0.000 Sub Total Syndication Finance: 400 0.103 0.011 650 0.141 0.020

Integrated Risk Management Guidelines for Financial Institutions| Page 29 Table‐3: Product‐wise Concentration Risk by using HHI (Continued) Particulars February, 2015 March, 2015 Asset side Products Outstanding (BDT in million) % of total loan (S) (S2 ) Outstanding (BDT in million) % of total loan (S) (S2 ) Bonds: ‐  ‐  ‐  ‐  1.    Corporate Bond 50 0.013 0.000 50 0.011 0.000 2.    Zero coupon bond 100 0.026 0.001 100 0.022 0.000 3.    Asset backed   securitization   bond 80 0.021 0.000 80 0.017 0.000 Sub Total Bonds: 230 0.059 0.003 230 0.050 0.002 Capital Market Investment: 1.   Capital Market   Investment   700 0.079 0.006 600 0.130 0.017 Sub Total Capital Market Investment: 700 0.179 0.032 600 0.130 0.017 Others: 0.259 0.067 ‐  ‐ 1.    Factoring 10 0.003 0.000 50 0.011 0.000 2.    Loans against   deposit 50 0.441 0.195 80 0.017 0.000 3.    Work order   finance   80 0.021 0.000 100 0.022 0.000 4.    Institutional Loans 120 0.464 0.215 200 0.043 0.002 Sub Total Others: 260 0.067 0.004 430 0.093 0.009 Grand Total 3900 1 0.1578 4610 1 0.1546 From the above example FIs will get the following result‐    FIs can also measure concentration of their liabilities. For this purpose, they can categorize liabilities in different ways such as borrowings from call money market, institutional borrowings, term deposits from public etc. February, 2015 March, 2015 Comment   HHI Index 0.158 0.155 Result: 0.180>HHI>0.100 which indicates moderate concentration risk in product wise investment for the month of February and March.

Integrated Risk Management Guidelines for Financial Institutions| Page 30 2.6 Data Maintenance The keys for gathering information on borrowers and transactions are to track the life cycle of credit, for example, from origination of a loan to collection of its claim, and gather long‐ term information on initial grades, rating records, and final collection. In addition, the database should be arranged in a way that enables various analyses in an efficient manner.   a. Borrower Data: This data base will include borrower ratings, initial grading and rating updates, changes in evaluation from initial to final ratings along with quantitative, qualitative and external information. b. Transaction Data: Transaction related data may comprise of facility ratings, credit amounts, cash flow information, purpose of credit extension, facility type, collateral type, collateral value, timing of appraising collateral, coverage ratio of collateral and the secured level of collateral and guarantees.   c. Default Data: Default data consists of final disposition process, timing of default, default conditions (for example, legal bankruptcy, loans in arrears, and relaxing of conditions), exposures at default, amount and timing of collection, collection method, collection cost and discount rate for obtaining the present values of collections at the time of default.                                          Life Cycle of Credit                                                                 Credit Building a Database Origination Initial Grading   Rating Update Final Collection Repayment Loan Renewal Loan Sales& Liquidation Default Collection Borrower Data & Rating Data Transaction Data

Integrated Risk Management Guidelines for Financial Institutions| Page 31 2.7    Credit Risk Monitoring & Control FIs should have monitoring and control procedures and systems in place that provide an early indication of deteriorating financial health of a borrower so that it can minimize the potential credit losses. It should be clearly mentioned in the monitoring and control procedures and systems that the monitoring team will report at least the following exceptions to relevant executives in CRMD and CRMC:

• Past due principal or interest payments, past due trade bills, account excesses, and breach of facility covenants;
• Non‐receipts of financial statements on a regular basis and any covenant breaches or exceptions made; and
• Action not taken on time for findings of any internal, external or regulator inspection/audit. 2.8 Credit Risk Mitigation 2.8.1 Managing Problem Credit FIs should establish a system that helps identifying a problem credit ahead of time, when there may be more options available for remedial measures. Once the credit is identified as a problem, it should be managed under a dedicated remedial process.   FIs credit risk policies should clearly set out how the FIs will manage problem credits. Responsibility for problem credits may be assigned to the originating business function, a specialized workout section, or a combination of both, depending upon the size and nature of the credit and the reason for its problems. When an FI has significant credit‐related problems, it is important to segregate the workout function from the credit origination function. The additional resources, expertise and more concerted focus of a specialized workout section normally improve collection results. In such case, the Recovery Unit (RU), as a separate unit, shall manage accounts with sustained deterioration (a risk rating of sub‐ standard or worse).   A problem credit management process encompasses the following basic elements. a. Negotiation & follow up: A proactive effort should be taken in dealing with borrowers to implement remedial plans by maintaining frequent contact and

Integrated Risk Management Guidelines for Financial Institutions| Page 32 internal records of follow‐up actions. Rigorous efforts at an early stage may prevent FIs from litigations and loan losses. b. Workout remedial strategies: Sometimes appropriate remedial strategies such as restructuring of the credit facility, enhancement in credit limits, or reduction in interest rates help improve the borrower’s repayment capacity. However, it depends upon business conditions, the nature of problems being faced and most importantly the borrower’s commitment and willingness to repay the credit. While such remedial strategies often bring up positive results, FIs need to exercise great caution in adopting such measures and ensure that such a policy must not encourage borrowers to default intentionally. The FI’s interest should be the primary consideration in case of any such workout plans. Before implementation, the workout plan must be approved by the competent authority at the FI. c. Reviewing collateral and security documents: FIs have to ascertain the credit recoverable amount by updating the values of available collateral with formal valuation. Security documents should also be reviewed to ensure the completeness as well as enforceability of contracts and collateral/guarantee. d. Status report and review: Problem credits should be subject to more frequent review and monitoring. The review should update the status and development of the credit accounts and progress of the remedial plans. Progress made on problem credit should be reported to the senior management. 2.8.2   Managing Credit Concentration Risk Strategies to manage or mitigate the concentration risk may vary. Depending on the current status of the portfolio, FIs may design their short and long term plans to deal with the credit concentration risk. While setting the limits on lending in each group elements, FIs should consider the followings: a. Current exposure must be within the prescribed limit set by the regulators (if any); b. Credit quality of that group element; c. Profitability of that group element; d. Current economic trend and prospects as well as risks of that group element; and e. Expertise and professionalism to manage that group element.

Integrated Risk Management Guidelines for Financial Institutions| Page 33 Depending on such analysis, FIs would set the overall risk appetite for their portfolio. A continuous monitoring on the above issues should be required to redefine the strategies. 2.8.3   Credit Risk Transfer (CRT) Over the last decade, a variety of financial tools have been developed for transferring credit risk between financial institutions. Following are some of the tools may be used for CRT: a. Loan Sale: The simplest CRT mechanism, the loan sale, in which a lender sells all of its obligations and future payments from a commercial loan to a third party.   b. Syndication: In a typical syndication, the lead FI (or bank) and the borrower agree on the terms of the loan, and the lead FI (or bank) then assembles a syndicate of lenders. In a syndication more lenders participate in financing which reduces the risk of individual lender. c. Securitization: Although more widely used for retail lending (such as through residential mortgage‐backed securities), securitization is used increasingly for corporate lending. A traditional securitization involves transferring a pool of loans or other debt obligations to a third party, typically a corporate entity established just to own the loan pool, which then issues securities that are claims against the pool’s interest and principal payments.   d. Credit derivatives: These are financial instruments that transfer some or all of the credit risk of an underlying debt obligation or a borrower (or groups of obligations or borrowers) from one party to another without necessarily transferring the underlying asset.   

Integrated Risk Management Guidelines for Financial Institutions| Page 34 CHAPTER ‐ 3 MARKET RISK MANAGEMENT 3.1 Market Risk Market risk can be defined as the risk of losses in on and off‐balance sheet positions of an FI arising from adverse movements in market rates or prices such as interest rates, equity prices, foreign exchange rates, commodity prices and general credit spreads. Market risk of an FI may arise, broadly, in any of the following forms:

• Interest Rate Risk,
• Equity Price Risk, and  
• Credit Spread. 3.2 Interest Rate Risk Interest rate risk arises when the value of an FI’s cash flows changes due to a change in the absolute level of interest rate. Basically this risk arises from the mismatch of re‐pricing dates of cash flows (including final maturities). It has potential impact on an FI’s earnings and net asset values. The volume of risk depends on the magnitude and direction of interest rate changes and the size of the maturity structure of the mismatch portion. 3.2.1   Impacts of Interest Rate Risk The immediate impact of change in interest rate is on the FI's net interest income, while a long term impact is on the FI's net worth since it affects the economic value of FI's assets, liabilities and off‐balance sheet exposures. The impact, due to change in interest rate, can be assessed in the following three ways: a. Earning Perspective Changes in interest directly affect the earnings of FIs. FIs must focus on the variation in interest rate while analyzing its impact on earnings. The most traditional approach for assessing interest rate risk from earning perspective is to measure the changes in Net Interest Income (NII) which is the difference between the total interest income and the total interest expense. FIs can also measure their impact on earnings by using Net Interest Margin (NIM) that quantifies the difference between the interest income

Integrated Risk Management Guidelines for Financial Institutions| Page 35 generated by FIs and the amount of interest paid out to their lenders, relative to the amount of their interest earning assets.   b. Economic Value Perspective Variations in market interest rates can also affect the economic value of an FI's assets, liabilities, and off‐balance sheet positions. The economic value of an FI can be viewed as the present value of its expected net cash flows (expected cash flows on assets minus expected cash flows on liabilities) plus expected net cash flows on off‐balance sheet positions. The economic value perspective reflects the sensitivity of the net worth of an FI’s due to interest rate fluctuations. Since the economic value perspective considers the potential impact of interest rate changes on the present value of all future cash flows, it provides a more comprehensive view of the potential long‐term effects of changes in interest rates than is offered by the earnings perspective. c. Embedded Losses FIs may contain some gains or losses on their future performance due to past interest rate movements for holding instruments that are not marked to market. These types of embedded gains or losses may be reflected over time in the FI's earnings. 3.2.2   Sources of Interest Rate Risk The key sources of interest rate risk are: Interst Rate Risk Re-pricing risk Yield curve risk Basis risk Option risk

Integrated Risk Management Guidelines for Financial Institutions| Page 36 a. Re‐pricing Risk Re‐pricing risk arises from the timing difference in the maturity (for fixed rate) and re‐ pricing (for floating rate) of FI’s assets, liabilities and off‐balance sheet positions. For instance, an FI that funded a long‐term fixed‐rate credit with a short‐term deposit could face a decline in both the future income arising from the position and its underlying value if interest rates increase. These declines arise because the cash flows on the credit are fixed over its lifetime, while the interest paid on the funding is variable, and increases after the short‐term deposit matures.   b. Yield Curve Risk The graph that plots the interest rate of similar‐quality bonds against their maturities, ranging from shortest to longest is known as yield curve. Changes in the yield curve are based on bond risk premiums and expectations of future interest rates. The yield curve risk arises from an adverse shift in market interest rates associated with investing in a fixed income instrument which is ultimately reflected with the steepness of the yield curve.   If the yield curve flattens, then the yield spread between long‐and short‐term interest rates narrows, and the price of the bond will change accordingly. If the bond is a short‐ term bond maturing in three years and the three‐year yield decreases, the price of this bond will increase. If the yield curve steepens, this means that the spread between long‐  and short‐term interest rates increases. Therefore, long‐term bond prices will decrease relative to short‐term bonds.   c. Basis Risk The risk that offsetting investments in a hedging strategy will not experience price changes in entirely opposite directions from each other. This imperfect correlation between the two investments creates the potential for excess gains or losses in a hedging strategy. The probability that affects with unfavorable different changes in opposite portfolio is known as Basis Risk. The more the instrument to be hedged and the underlying assets are imperfect substitutes, the bigger the basis risk is. For example, if an FI incurs losses from underlying asset due to 60 basis point change, it is supposed to

Integrated Risk Management Guidelines for Financial Institutions| Page 37 gain same amount from hedged assets. But if gain from hedged assets is lower than the losses from underlying assets, the FI will incur basis risk. d. Option Risk FIs may offer credit to the borrowers which give them right to prepay the balances. On the other hand, FIs receive funds from depositors by providing them right to withdraw it before maturity, often without any penalties. The option risk arises if FIs fail to manage these kinds of asymmetrical pay off characteristics. In case of such credits and deposits, FIs may expose to an unfavorable market condition that can lead them to losses. 3.2.3 Measuring Interest Rate Risk FIs essentially should have interest rate risk measurement systems that capture all material sources of interest rate risk and that assess the effect of interest rate changes in ways that are consistent with the scope of their activities. The assumptions underlying the system should be clearly understood by risk management authority. Depending on the complexity and range of activities of an FI, it should have interest rate risk measurement systems that assess the effects of rate changes on both earnings and economic value. These systems should provide meaningful measures of an FI’s current levels of interest rate risk exposure, and should be capable of identifying any excessive exposures that might arise.  While measuring the interest rate risk, systems should‐   a. assess all material interest rate risk associated with an FI’s assets, liabilities, and off balance sheet positions;   b. utilize generally accepted financial concepts and risk measurement techniques; and   c. have well documented assumptions and parameters. For measuring interest rate risk, FIs use a variety of methods. The level of sophistication and complexity of individual method varies. The most frequently used methods are the analysis of maturity and re‐pricing schedules (simply termed as gap analysis), net interest income, the duration gap method, and simulation methods.

Integrated Risk Management Guidelines for Financial Institutions| Page 38 3.2.3.1   Maturity/Re‐pricing Schedule Maturity/Re‐pricing Schedule is the simplest and commonly used techniques for measuring the interest rate exposure of an FI. It distributes interest sensitive assets, liabilities and off balance sheet position into a certain number of predetermined time buckets according to their maturity (if fixed‐rate) or time remaining to their next re‐pricing (if floating‐rate).   a. Gap Analysis The sensitivity of FIs profits against the changes in interest rate can be directly measured by Gap Analysis. Gap analysis refers to the difference between interest Rate Sensitive Assets (RSA) & interest Rate Sensitive Liabilities (RSL) in each time buckets. Gap is positive when RSA>RSL and negative when RSA<RSL.   The risk position of an FI can be estimated by using Interest Rate Sensitive Ratio.     Interest Rate Sensitive Ratio = RSA/RSL Considering the business or product nature of an FI, to safeguard the company from inordinate exposure to interest rate movements in shorter span, ratio of RSA to RSL (RSA/RSL) is proposed to be close to 1.0 while allowing the range of 0.7 to 1.2, up to one year time bucket on cumulative basis. b. Measuring Risk to Net Interest Income (NII) The spread between interest paid out on deposits and interest earned on assets is the net interest income. In order to quantify the interest rate risk FIs should measure effect of interest rate change on net interest income. Change in net interest income can be measured by considering gap between RSA and RSL. ∆NII = ∆i X Periodic Gap X Periodic Bucket   Where,   ∆NII = Changes in Net Interest Income ∆i     = Changes in interest rate Periodic Gap = (RSA – RSL) Maturity Buckets = 1 day to 30 days, 1 month to 2 months and so on.

Integrated Risk Management Guidelines for Financial Institutions| Page 39 The correlation between ∆i and ∆NII is positive while the Gap is positive and that of negative while the Gap is negative. Gap schedules help estimating changes in FI’s net interest income due to changes in market interest rates in following ways: The size of the interest rate movement used in the analysis can be based on a variety of factors, including historical experience, simulation of potential future interest rate movements, and the judgment of management.   c. Duration Analysis Duration is the time‐weighted average maturity of the present value of the cash flows from assets, liabilities and off‐balance sheet items. It measures the relative sensitivity of the value of these instruments to changing interest rates (the average term to re‐pricing), and therefore, reflects how changes in interest rates will affect the FI’s economic value, that is, the present value of equity. In general, duration exhibits the following characteristics:

• As maturity increases, duration increases and the bond’s price becomes more sensitive to interest rate changes;
• For two instruments with the same maturity, a high‐coupon instrument will have a lower duration than a low‐coupon instrument and will also be less Types of Gap Changes in Interest Rate Changes in   NII RSA = RSL Increase No Change RSA = RSL Decrease No Change RSA > RSL Increase Increases RSA > RSL Decrease Decreases RSA < RSL Increase Decreases RSA < RSL Decrease Increases

Integrated Risk Management Guidelines for Financial Institutions| Page 40 price‐sensitive. A larger proportion of a high coupon’s cash flows will be received sooner and thus the average time to receipt of the cash flows will be less;

• A given fixed income instrument will have a higher duration in a low interest rate environment than in a high interest rate environment;
• Duration may be positive or negative. A fixed rate instrument would have a positive duration, and an increase in interest rates would generally decrease the market value of the instrument. Mortgage servicing rights and interest‐ only (IO) mortgage backed securities generally have a negative duration, since an increase in interest rates would decrease the pre‐payment speed of the underlying mortgages, increasing the market value of the instruments;
• Durations are additive when weighted by the amount of the contract. For example, if a portfolio consists of two bonds of equal market value, one with duration of six and the other with duration of two, the duration of the portfolio would be four. Formula for Duration (D): where: t = period in which the coupon is received C = periodic (usually semiannual) coupon payment y = the periodic yield to maturity or required yield n = number periods M = maturity value P = market price of bond

Integrated Risk Management Guidelines for Financial Institutions| Page 41 Measuring Duration Gap To measure duration gap and the impact of net changes in the market value of equity, an FI should:

• Estimate the market value of each on‐balance sheet rate sensitive assets and liabilities of the FI to arrive at market value of equity;
• Calculate the durations of each asset and liability of the on‐balance sheet portfolio arrive at the aggregate weighted average duration of assets and liabilities;
• Calculate the duration GAP by subtracting aggregate duration of liabilities from that of assets;
• Estimate the changes in the economic value of equity due to change in interest rates on on‐balance sheet positions based on the three interest rate changes i.e. 1%, 2% and 3%;
• Calculate surplus/(deficit) on off‐balance sheet items under the assumption of three different interest rate changes i.e. 1%, 2% and 3%; and
• Estimate the impact of net change (both for on‐balance sheet and off‐balance sheet) in the market value of equity. Formula:   Weighted average duration of assets, (DA) =∑ W୅୧ ∗ DA୧ ௡ ௜ୀଵ Weighted average duration of liabilities, (DL) = ∑ W୐୧ ∗ DL୧ ௡ ௜ୀଵ Duration gap: DGAP ൌ ܣܦ െ ቂ ெ௏௅ ெ௏஺ቃ DL  MVE = (െDGAP)ቂ ୧ ሺଵା୷ሻ ቃ MVA Where,   y = Yield to maturity DA= Duration of assets DL= Duration of liabilities MVA= Market value of assets MVL= Market value of liabilities MVE= Market value of equity Total Assets = Market value of total assets     

Integrated Risk Management Guidelines for Financial Institutions| Page 42 d. Simulation Approach: Simulation models are sophisticated models and a valuable complement to gap and duration analysis. It can be Static and Dynamic. Static Approach  ‐ the cash flows arising solely from the FI's current on balance sheet and off‐balance sheet positions are assessed. Dynamic Approach ‐ the simulation builds in more detailed assumptions about the future course of interest rates and expected changes in a FI's business activity over that time. Simulation models are useful tools for strategic planning; they permit FIs to effectively integrate risk management and control into the planning process. Their forecasts are based on a number of assumptions including:

• future levels and directional changes of interest rates;
• the slope of the yield curve and the relationship between the various indices that the FI uses to price credits and deposit;
• pricing strategies for assets and liabilities as they mature; and
• the growth, volume and mix of future business. Simulation is usually used to measure interest rate risk by estimating what effect changes in interest rates, business strategies, and other factors will have on net interest income, net income and interest rate risk positions. Simulation models can also be used to calculate the present value and durations of assets and liabilities. 3.2.4 Interest Rate Risk Management Program Significant factors in managing interest rate risk include the frequency, volatility and direction of rate changes, the slope of the interest rate yield curve, the size of the interest sensitive position and the basis for re‐pricing at rollover dates. A comprehensive interest rate risk management program requires: a. establishing and implementing sound and prudent interest rate risk policies; b. developing and implementing appropriate interest rate risk measurement techniques; and

Integrated Risk Management Guidelines for Financial Institutions| Page 43 c. developing and implementing effective interest rate risk management and control procedures. 3.2.5  Interest Rate Risk Management Policies In order to manage interest rate risk, there should be a sound and prudent interest rate risk management policy. This may contain:   a.   an interest rate risk philosophy governing the extent to which the FI is willing to assume interest rate risk; and   b.  explicit and prudent limits on the FI’s rate risk exposure.   3.2.6 Interest Rate Risk Management and Control Procedures FIs should develop and implement effective and comprehensive procedures and information systems to manage and control interest rate risk in accordance with its interest rate risk policies. These procedures should be appropriate to the size and complexity of the FIs’ interest rate risk‐taking activities.   Internal inspections/audits are a key element in managing and controlling FI’s interest rate risk management program. They should, at a minimum, randomly test all aspects of interest rate risk management activities in order to: a. ensure interest rate risk management policies and procedures are being adhere to;   b. ensure effective management controls over interest rate risk positions;   c. verify the adequacy and accuracy of management information reports; and   d. ensure that personnel involved in interest rate risk management fully understand the FI’s interest rate risk policies and risk limits and have the expertise required to make effective decisions consistent with the interest rate risk policies.   Assessments of the interest rate risk operations should be presented to the board on regular basis for review.   3.3 Equity Price Risk Equity risk, at its most basic and fundamental level, is the financial risk involved in holding equity in a particular investment. It often refers to equity in companies through the

Integrated Risk Management Guidelines for Financial Institutions| Page 44 purchase of common or preferred stock. Equity risk could arise due to adverse change in the value of‐ 

• listed shares held directly by the FI;  
• listed shares held by an FI’s subsidiary;
• listed shares used as collateral for loans from an FI or an FI’s subsidiary (whether or not the loan was made for the purpose of buying the shares);  
• any unlisted shares.   3.3.1 Equity Price Risk Policies FIs should have sound and effective policies on equity risk management approved by the board. It will at least include‐   a. clear authorities, conservative limits, and assigned responsibilities; b. formal procedures to report how and why exceptions have occurred, and how they have been resolved; and c. risk monitoring, valuation, and control functions should be defined specifically. 3.3.2 Effective Equity Price Risk Management An effective equity risk management system should have the following criteria –   a. management should have broad capital market experience and should establish strong policy controls and risk limits; b. trading and sales personnel should have broad experience in the products traded, technically competent, and comfortable with the FI's culture; c. risk management personnel should have an in‐depth understanding of equity market risk and risk management principles; d. equity investments to a company in which FI has never invested before should subject to a formal review program; e. management reports should be prepared independently of the investing and trading function and should provide a comprehensive and accurate summary of investing and trading activity;

Integrated Risk Management Guidelines for Financial Institutions| Page 45 f. FI should have to conduct stress tests regularly and has a precise understanding and measurement of how much profitability, balance sheet capital, and regulatory capital may be affected by major declines in the equity market prices; g. if the FI has a subsidiary that invests in shares directly or lends to customers for purchase of shares, it should closely monitor the financial condition and performance of the subsidiary, and calculate its risk‐adjusted return on the invested capital in that subsidiary; and h. if the FIs have shares in unlisted companies, they should consider these investments as extremely high‐risk, and devote significant staff resources to obtain, verify, and analyze financial information on these companies. 3.3.3 Securities Portfolio Management Program Securities portfolio management should involve controlling and minimizing securities portfolio risks across a variety of dimensions, such as quality, portfolio concentration/diversification, maturity, volatility, marketability, type of security, and the need to maintain adequate liquidity. A comprehensive securities portfolio management program requires: a. Establishing and implementing sound and prudent policies to effectively manage the securities portfolio, securities activities and position risk. The policy should include‐  i. the extent to which an FI is willing to assume position risk; ii. general areas of securities activities in which an FI is prepared to engage or is restricted from engaging, including the FI's policy with respect to acquiring securities of related parties; iii. minimum quality and rate of return expectations for the securities portfolio; and iv. securities portfolio concentration and exposure limits. b. Developing and implementing effective securities portfolio management processes. To develop and maintain a sound securities portfolio, each FI must have‐ 

Integrated Risk Management Guidelines for Financial Institutions| Page 46 i. an effective formal evaluation process that provides for an objective analysis and assessment of securities investment proposals; and ii. clearly defined, prudent and appropriate levels of delegation of securities transaction approval authority, formally established in writing. c. Developing and implementing comprehensive procedures to effectively monitor and control the nature, characteristics, and quality of the securities portfolio and the extent of position risk assumed. This procedure will, at least, include‐  i. Systems to measure and monitor securities positions; ii.   Controls governing the management of the securities portfolio; and iii.    Independent inspections or audits. 3.3.4 Measuring Equity Price Risk Value at Risk Value at Risk (VaR) is generally accepted and widely used tool for measuring market risk inherent in trading portfolios. VaR estimates the predicted maximum loss (or worst loss) over a target horizon for  a given confidence level. It is a statistical estimate derived by translating the riskiness of any financial instrument into a common standard. FIs may use a 99% or a 95% confidence level, and calculate each day return on its trading portfolios.  However, an inherent limitation of VaR is that it gives no information about how much losses could exceed their expected levels. Generally there are three methods of computing VaR: a. Parametric or variance‐covariance method b. Historical simulation method c. Monte Carlo simulation method Among these methods, the historical simulation method is simple to apply and fairly straight forward to explain. Data sets used for this method are easily available. Therefore, FIs are encouraged to calculate VaR for secondary market shares that are held for trading using historical simulation method. However, to calculate the VaR for overall investment portfolio (except credits), FIs may use the variance covariance method.

Integrated Risk Management Guidelines for Financial Institutions| Page 47 Variance‐covariance method The following formula can be used to assess the VaR of a portfolio consisting more than two stocks: Portfolio VaR= Total Portfolio X SD of Portfolio Where, Standard Deviation, SD = [S1 2 + S2 2 + S3 2 + 2S1S2P(1,2) + 2S1S3P(1,3) + 2S2S3P(2,3)]1/2 Here, S1 = the standard deviation or volatility of the first asset S2 = the standard deviation or volatility of the second asset S3 = the standard deviation or volatility of the third asset P = Correlation between assets Historical simulation method Let us assume an FI has a portfolio of three stocks (namely A,B,C) of one unit each. To calculate VaR of that portfolio the FI needs to collect the historical market price of each of the stocks in the portfolio for last 100 days. Then, the following formulae are to be applied: Weight A=   a) Total weighted return to portfolio market price (%) =      Then, the 99th percentile will be the VaR at 99% confidence level. 3.4 Managing Market Risk FIs should put in place a set of systems and procedures appropriate to its size and complexity of its operations for identifying, measuring, monitoring and controlling market risk. The risk appetite in relation to market risk should be assessed keeping in view the capital of the FI as well as exposure to other risks. Once the market risk appetite is determined, FIs should develop a market risk‐taking strategy in order to maximize returns while keeping exposure to market risk at or below the pre‐determined level.       Closing Market Price of Stock A Closing Market Price of Stock (A+B+C) Total weighted return Closing Market Price of Stock (A+B+C) X100

Integrated Risk Management Guidelines for Financial Institutions| Page 48 3.4.1 Board Oversight Market risk exposure is an important part of risk management process. The Board of Directors should have clear oversight regarding market risk.  They should be responsible to: a.   define FI's overall risk appetite in relation to market risk; b. ensure that FI's overall market risk exposure is maintained at prudent levels and consistent with the available capital; c. ensure that senior management as well as individuals responsible for market risk management possesses sound expertise and knowledge to accomplish the risk management function; d. ensure that the FI implements sound fundamental principles that facilitate the identification, measurement, monitoring and control of market risk; e. ensure that adequate resources (technical as well as human) are devoted to market risk management; d. review and approve market risk policies based on recommendations by the FI's senior management; e. review periodically, at least once a year, the market risk management, policy, procedures and relevant  information systems; d. outline the content and frequency of management report on market risk (for each type of risk) to the Board; e. ensure that an independent internal inspection or audit reviews securities portfolio management functions aligning with the FI’s existing policies and procedures; and f. review the trends in securities portfolio quality and value. 3.4.2 Senior Management Oversight In case of managing market risk, senior management of an FI is responsible to: a. develop and recommend market risk management policies for approval to the Board; b. implement the market risk management policies;

Integrated Risk Management Guidelines for Financial Institutions| Page 49 c. develop and implement procedures that translate business policy and strategic direction set by the board into operating standards that are well understood by FI's personnel; d. ensure adherence to the lines of authority and responsibility that Board has established for measuring, managing, and reporting market risk; e. oversee the development, implementation and maintenance of an appropriate MIS that identify, measure, monitor, and control FI's market risk; f. establish effective internal controls to monitor and control market risk; g. establish and utilize a method for accurately measuring the FI's market risk. h. ensure that an independent inspection/audit function reviews and assesses the market risk management program; i. ensure that all types of market risks are managed and controlled within the market risk management program; j. develop lines of communication to ensure the timely dissemination of the market risk policies and procedures to all individuals involved in the market risk management process; k. report comprehensively on the market risk management program to the Board as per policy; and l. monitor and control the nature, composition and quality of the FI's securities portfolio and ensure that the securities portfolio is soundly and conservatively valued.   

Integrated Risk Management Guidelines for Financial Institutions| Page 50 CHAPTER ‐ 4 LIQUIDITY RISK MANAGEMENT 4.1 Liquidity Risk Liquidity risk is the probability of loss to an FI arising from a situation where‐   there will not be enough cash and/or cash equivalents to meet the needs of depositors and borrowers;  sale of illiquid assets will yield less than their fair value; or  illiquid assets cannot be sold at the desired time due to lack of buyers. Liquidity is the ability of an institution to transform its assets into cash or cash equivalent in a timely manner at a reasonable price to meet its commitments as they fall due. Liquidity risk arises when the cushion provided by the liquid assets are not sufficient enough to meet maturing obligations. Accordingly, an FI short of liquidity may have to undertake transactions at heavy cost resulting in a loss of earnings or, in a worst case scenario, the liquidity risk may result in liquidation of the FI if it is unable to undertake transactions even at current market prices. Liquidity risk is often triggered by the consequences of other financial risks such as credit risk, interest rate risk etc. For instance, a large loan default or changes in interest rate can adversely impact an FI's liquidity position. Liquidity risk can be classified into four categories: a. Term liquidity risk (due to mismatch of maturities); b. Withdrawal/call risk (mass disinvestment before maturity); c. Structural liquidity risk (when the necessary funding transactions cannot be carried   out or carried out at less favorable terms); and d. Market liquidity risk. 4.2 Liquidity Risk Indicators FIs can have prior signal regarding liquidity risk from some potential internal indicators. Effective exercise and monitoring of such indicators by management/Asset Liability

Integrated Risk Management Guidelines for Financial Institutions| Page 51 Management Committee (ALCO) can minimize liquidity risk. Examples of such internal indicators are: a. A negative trend or significantly increased risk in any area or product line; b. Concentrations in either assets or liabilities; c. Deterioration in quality of credit portfolio; d. A decline in earnings performance or projections; e. Rapid asset growth funded by volatile large deposit; f. Deteriorating third party evaluation (negative rating) about the FI and negative publicity; and g. Unwarranted competitive pricing that potentially stresses the FIs. 4.3 Managing Liquidity Risk Liquidity risk management involves not only analyzing FIs' on and off‐balance sheet positions to forecast future cash flows but also how the funding requirement would be met. The later involves identifying the funding market in which an FI has access, understanding the nature of those markets, evaluating FIs current and future use of the market and monitoring signs of confidence erosion. The formality and sophistication of risk management process established to manage liquidity risk should reflect the nature, size and complexity of an FI's activities. FIs should have a thorough understanding of the factors that could give rise to liquidity risk and put in place the mitigating controls. FI's liquidity risk management procedures should be comprehensive and holistic. At the minimum, they should cover formulation of overall liquidity strategy, risk identification, measurement, and monitoring and control process. 4.3.1 Liquidity Risk Management Framework An important aspect of an effective liquidity risk management system is assessing future funding needs. By ensuring an effective liquidity risk management system an FI can reduce the probability of an adverse situation. Effective liquidity risk management requires both a top‐down and a bottom‐up approach. Strategy, principles and objectives are set at board

Integrated Risk Management Guidelines for Financial Institutions| Page 52 and management levels but the data necessary to feed the risk dashboard and analytics has to be obtained from funding desk. In particular, intra‐day liquidity management is an integral part of an improved liquidity risk management. Funding desk will prepare measurement reports on daily fund management and associated money market dealings for further use in an aggregated format to support strategic liquidity risk metrics. Ideally, the regular measurement reports that an FI generates will enable it to capture significant information and monitor liquidity more rigorously. Among all the measurement reports, liquidity gap analysis is a key tool for assessing an FI's cash inflows against its outflows to identify the potential for any net shortfalls going forward. The gap report should be generated by grouping rate sensitive liabilities, assets and off‐balance sheet positions into different time buckets according to residual maturity or next re‐pricing period, whichever is earlier. All investments, advances, deposits, borrowings, purchased funds, etc. that mature/re‐price within a specified time‐frame are interest rate sensitive. Similarly, any principal repayment of loan is also rate sensitive if the company expects to receive it within the time horizon. This includes final principal repayment and interim installments. Certain assets and liabilities carry floating rates of interest that vary with a reference rate and hence, these items get re‐priced at predetermined intervals. While calculating expected cash inflows and outflows, FIs must also estimate future liquidity needs and prospective investment decisions both in the short and long time periods. Asset Liquidity Management (ALM) desk must play a big role in this regard. ALM desk tracks, analyzes and reports balance sheet movements of the FI. In addition, it should also monitor the economic outlook and market movements in which the FI operates. The desk should recommend policies and procedures and provide all elements for decision‐making purpose to the ALCO. The ALCO should review policies and strategies suggested by ALM desk and approve them based on need analysis both in business terms and risk‐return terms. ALCO assesses liquidity positions of the FI not only on an ongoing basis but also examine how liquidity requirements are likely to evolve under different assumptions and suggest policies and limits accordingly.   Board should consider and approve policies and limits suggested by ALCO considering FI’s overall risk appetite and must ensure that there are adequate policies to establish an

Integrated Risk Management Guidelines for Financial Institutions| Page 53 effective liquidity management system. Audit committee should periodically review whether liquidity management is complying with risk limits, and whether management's strategies are consistent with the board's risk appetite. Since liquidity management is a technical issue requiring specialized knowledge and expertise, it is important that responsible officers have a good understanding of the nature and level of liquidity risk assumed by the FI and the means to manage that risk. It is critical that there be close links between those individuals responsible for liquidity and those monitoring market conditions, as well as other individuals with access to critical information. This is particularly important in developing and analyzing stress scenarios. 4.3.2 Board Oversight The prerequisites of an effective liquidity risk management include an informed board, capable management staffs having relevant expertise and efficient systems and procedures. It is primarily the duty of board of directors to understand the liquidity risk profile of the FI and the tools used to manage liquidity risk. The Board has to ensure that the FI has necessary liquidity risk management framework and the FI is capable of dealing with uneven liquidity scenarios. The board should approve the strategy and significant policies related to the management of liquidity. Generally, the responsibilities of the board include: a. providing guidance on the level of tolerance for liquidity risk;   b. establishing an appropriate structure for the management of liquidity risk and identifying lines of authority and responsibility for managing liquidity risk exposure;   c. continuously monitoring the FI’s performance and overall liquidity risk profile through reviewing various reports;   d. ensuring that senior management takes necessary steps to identify, measure, monitor and control liquidity risk; and   e. reviewing adequacy of the contingency plans of the institutions.     

Integrated Risk Management Guidelines for Financial Institutions| Page 54 4.3.3 Senior Management Oversight Senior management is responsible for the implementation of sound policies and procedures keeping in view the strategic direction and risk appetite specified by the board. To effectively oversee the daily and long‐term management of liquidity risk, senior management should at least: a. develop and implement procedures and practices that translate the Board's goals, objectives, and risk tolerances into operating standards that are well understood by FI personnel and consistent with the institution's intent and strategies;   b.   adhere to the lines of authority and responsibility that the Board has established   for managing liquidity risk;   c.   oversee the implementation and maintenance of management information and other systems that identify, measure, monitor, and control the institution's liquidity risk; and   d. establish effective internal controls over the liquidity risk management process and ensure that the same is communicated to all staffs.   The responsibility for managing the overall liquidity of the FI should be delegated to a specific group within the institution. This might be in the form of an Asset Liability Committee (ALCO) comprised of senior management of related departments.   At a minimum, the effective management of assets and liabilities should incorporate the following activities:  

• assessing current balance sheet position;  
• projecting exogenous factors like the economy, performance of counterparties, competition etc.;  
• developing assets and liability strategy;  
• simulating strategies;  
• determining the most appropriate strategy;  
• setting targets;  
• communicating targets to appropriate managers and staff; and  
• monitoring and reviewing performance.  

Integrated Risk Management Guidelines for Financial Institutions| Page 55 4.4 Strategy for Managing Liquidity Risk Each FI should have an agreed liquidity strategy for the day‐to‐day management of liquidity. This strategy should address the FI's goal of protecting financial strength and the ability to withstand stressful events in the market. The liquidity risk strategy defined by Board should enunciate specific policies on particular aspects of liquidity risk management, such as: a. Composition of assets and liabilities: The strategy should outline the mix of assets and liabilities to maintain liquidity. Liquidity risk management and asset/liability management should be integrated to avoid high costs associated with having to rapidly reconfigure the asset liability profile from maximum profitability due to increased liquidity. b. Diversification and stability of liabilities: A funding concentration exists when a single decision or a single factor has the potential to result in a significant and sudden withdrawal of funds. Since such a situation could lead to an increased risk, the Board and senior management should specify guidance relating to funding sources and ensure that the FI has diversified sources of funding day‐to‐day liquidity requirements. An FI would be more resilient to stressed market liquidity conditions if its liabilities were derived from more stable sources. In order to analyze the stability of liabilities or funding sources comprehensively, an FI needs to identify:

• liabilities that would stay with the FI under any circumstances;
• liabilities that run‐off gradually if problems arise; and
• liabilities that run‐off immediately at the first sign of problems. Each FI needs to have explicit and prudent policies that ensure funding is not highly concentrated with respect to:
• individual depositor;
• type of deposit instrument;
• market source of deposit; and
• term to maturity. c. Dealing with liquidity disruptions: The FI should put in place a strategy on how to deal with the potential for both temporary and long‐term liquidity disruptions. The inter FI market can be important source of liquidity. However, the strategy should take into

Integrated Risk Management Guidelines for Financial Institutions| Page 56 account the fact that in crisis situations access to inter FI market could be difficult as well as costly. The liquidity strategy must be documented in the liquidity policies, and communicated throughout the FI. The strategy should be evaluated periodically to ensure that it remains updated and effective. 4.5 Liquidity Policies Board of Directors should ensure that there are adequate policies to govern liquidity risk management process. While specific details vary across institutions according to the nature of their business, key elements of any liquidity policy includes:   a. general liquidity strategy (short and long‐term), specific goals and objectives in relation to liquidity risk management, process for strategy formulation and the level it is approved within the institution;   b. roles and responsibilities of individuals performing liquidity risk management functions, including structural balance sheet management, pricing, marketing, contingency planning, management reporting, lines of authority and responsibility for liquidity decisions;   c. liquidity risk management structure for identifying, monitoring, reporting and reviewing the liquidity position;   d. liquidity risk management tools (including the types of liquidity limits and ratios in place and rationale for establishing limits and ratios); and   e. contingency plan for handling liquidity crises.   To be effective the liquidity policy must be communicated down the line throughout the FI. It is important that the board and senior management ensure that policies are reviewed on a regular basis (at least annually) and when there are any material changes in the FI's current and prospective liquidity risk profile. Such changes could stem from internal circumstances (e.g. changes in business focus) or external circumstances (e.g. changes in economic conditions).   Reviews provide the opportunity to fine‐tune the FI's liquidity policies in light of its liquidity management experience and development of its business. Any significant or frequent

Integrated Risk Management Guidelines for Financial Institutions| Page 57 exception to the policy is an important barometer to gauge its effectiveness and any potential impact on FI's liquidity risk profile. 4.6 Procedures and Limits FIs should establish appropriate procedures, processes and limits to implement their liquidity policies. The procedural manual should explicitly narrate the necessary operational steps and processes to execute the relevant liquidity risk controls. The manual should be periodically reviewed and updated to take into account new activities, changes in risk management approaches and systems. 4.7 Liquidity Risk Management Process An effective liquidity risk management process should include systems to identify, measure, monitor and control its liquidity exposures. Management should be able to accurately identify and quantify the primary sources of an FI's liquidity risk in a timely manner. To properly identify the sources, management should understand both existing as well as future risk that the FI can be exposed to. Management should always be alert for new sources of liquidity risk at both the transaction and portfolio levels. Key elements of an effective risk management process should have an efficient MIS to measure, monitor and control existing and probable liquidity risks and report them to senior management and the board of directors. 4.8 Measurement of Liquidity Risk An effective liquidity risk measurement system not only helps in managing liquidity in times of crisis but also optimize return through efficient utilization of available funds. FIs should institute systems that enable them to capture liquidity risk ahead of time, so that appropriate remedial measures could be prompted to avoid any significant losses. Contingency funding plans, maturity ladder, liquidity ratios and limits etc. are commonly used as liquidity measurement and monitoring techniques that may be adopted by the FIs. 4.8.1   Contingency Funding Plans In order to develop comprehensive liquidity risk management framework, FIs should have plans in place to address stress scenarios. This is commonly known as Contingency Funding

Integrated Risk Management Guidelines for Financial Institutions| Page 58 Plan (CFP). CFP is a set of policies and procedures that serves as a blueprint for an FI to meet its funding needs in a timely manner and at a reasonable cost. A CFP is a projection of future cash flows and funding sources of an FI under market scenarios including aggressive asset growth or rapid liability erosion. To be effective, it is important that a CFP should represent management's best estimate of balance sheet changes that may result from a liquidity or credit event. A CFP can provide a useful framework for managing liquidity risk both in the short and long term. Further it helps ensuring that an FI can prudently and efficiently manage routine and extraordinary fluctuations in liquidity. Use of CFP for routine liquidity management For the purpose of day‐to‐day liquidity risk management, integration of liquidity scenario will ensure that the FI is best prepared to respond to an unexpected problem. In this sense, a CFP is an extension of ongoing liquidity management and formalizes the objectives of liquidity management by ensuring: a. a reasonable amount of liquid assets are maintained; b. measurement and projection of funding requirements during various scenarios; and c. management of access to funding sources. Use of CFP for emergency and distress environments Liquidity crisis may emerge all on a sudden. In case of a sudden liquidity stress, it is important for an FI to seem organized, candid, and efficient to meet its obligations to the stakeholders. Since such a situation requires a spontaneous action, FI that already has plans to deal with such situation can address the liquidity problem more efficiently and effectively. A CFP can help ensure that an FI's management and key staffs are ready to respond to such situations. FIs' liquidity is very sensitive to negative trends in credit, capital, or reputation. Deterioration in the FIs' financial condition (reflected in items such as asset quality indicators, earnings, or capital), management composition, or other relevant issues may result in reduced access to funding. Scope of CFP The sophistication of a CFP depends upon the size, nature, and complexity of business, risk exposure, and organizational structure. On the outset, the CFP should anticipate all the funding and liquidity needs of an FI by:

Integrated Risk Management Guidelines for Financial Institutions| Page 59 a. analyzing and making quantitative projections of all significant on and off balance‐ sheet funds; b. considering funds flows and their related effects; c. matching potential cash flow sources and uses of funds; and d. establishing indicators that alert management to a predetermined level of potential risks. The CFP should project on the FI's funding position during both short and long‐term liquidity changes, including those caused by liability erosion. The CFP should explicitly identify, quantify, and rank all sources of funding by preference, such as:

• reducing assets;
• modifying or increasing liability structure; and
• using other alternatives for controlling balance sheet changes. The CFP should include asset side as well as liability side strategies to deal with liquidity crises. The asset side strategy may include: whether or not to liquidate surplus money market assets, when to sell liquid or longer‐term assets, etc. While liability side strategies may specify policies such as pricing policy for funding, policy for early redemption request by retail customers, use of BB discount window etc. The CFP also chalks out roles and responsibilities of various individuals at the time of liquidity crises and the inter linkages of    the management information system between management, ALCO, traders, and others. 4.8.2   Maturity Ladder FIs may utilize flow measures to determine their cash position. A maturity ladder estimates an FI's cash inflows and outflows and thus net deficit or surplus (gap), both on a day‐to‐day basis and over a series of specified time periods. FIs need to focus on the maturity of its assets and liabilities in different tenors. Mismatch accompanied by liquidity risk and excessive longer tenor lending against shorter‐term borrowing can put an FI's balance sheet in a very critical and risky position. To address this risk and to make sure an FI does not expose itself in excessive mismatch, a bucket‐wise maturity profile of the assets and liabilities to be prepared to understand mismatch in every bucket. FIs should use following time buckets for preparing their Structural Liquidity Statement:

1. 1 day to 30 days

Integrated Risk Management Guidelines for Financial Institutions| Page 60 2. Over 1 month to 3 months 3. Over 3 months to 6 months 4. Over 6 months to 1 year 5. Over 1 year to 3 years 6. Over 3 years to 5 years 7. Over 5 years The number of time frames in a maturity ladder is of significant importance and up to some extent depends upon the nature of FI's liabilities or sources of funds. FIs, that relies on short term funding, will concentrate primarily on managing liquidity on very short term. However, other FIs might actively manage their net funding requirement over a slightly longer period. In the short term, an FI's flow of funds could be estimated more accurately and also such estimates are of more importance as these provide an indication of actions to be taken immediately. Further, such an analysis for distant periods will maximize the opportunity for the FI to manage the gap well in advance before it crystallizes. Consequently, FIs should use short time frames to measure near term exposures and longer time frames thereafter. FIs need to monitor the gap on periodic basis (at least once in a month in ALCO meeting). Moreover, FIs should monitor the gap on short term bucket more prudently. While making an estimate of cash flows, the following aspects need to be considered: a. the funding requirement arising out of off‐ balance sheet commitments also need to be accounted for; b. many cash flows associated with various products are influenced by interest rates or customer behavior. FIs need to take into account behavioral aspects along with contractual maturity. In this respect past experiences could give important guidance to make any assumption; c. some cash flows may be seasonal or cyclical; and d. management should also consider increases or decreases in liquidity that typically occur during various phases of an economic cycle. FIs should have sufficient liquidity to meet fluctuations in loans and deposits. As a safety measure FIs should maintain a margin of excess liquidity. To ensure that this level of

Integrated Risk Management Guidelines for Financial Institutions| Page 61 liquidity is maintained, management should estimate liquidity needs in a variety of scenarios. 4.8.3   Liquidity Ratios and Limits FIs may use a variety of ratios to quantify liquidity. These ratios can also be used to create limits for liquidity management. However, such ratios would be meaningless unless used regularly and interpreted considering qualitative factors.   To the extent that any asset‐liability management decisions are based on financial ratios, an FI's asset‐liability managers should understand how a ratio is constructed, the range of alternative information that can be placed in the numerator or denominator, and the scope of conclusions that can be drawn from ratios. Because ratio components as calculated by FIs are sometimes inconsistent, ratio‐based comparisons of FIs or even comparisons of periods within a single FI can be misleading. Examples of ratios and limits that can be used are:       a. Cash flow ratios and limits: One of the important sources of liquidity risk is an FI's failure to "roll over" a maturing liability. Cash flow ratios and limits attempt to measure and control the volume of liabilities maturing during a specified period of time. FIs earn money from mismatches, i.e. by borrowing short term and lending long term. An FI has to find out the right combination for longer term mismatch. The Medium Term Funding (MTF) ratio is based on the amount of liabilities with a contractual maturity of more than one year to assets with a contractual maturity of more than one year, that is MTF should be done on the basis of 1 year and above but less than 2 years term deposit. The desirable ratio of MTF should be at least 30% and 45% to be considered as an ideal situation. FI should use maturity profile for measuring the future cash flows in different time buckets. The cumulative mismatches (running total) across all time buckets shall be monitored in accordance with internal prudential limits set by ALCO from time to time. The mismatches (negative gap) during 1‐90 days, in normal course, should not exceed 15% of the cash outflows in this time bucket. If the Company, in view of

Integrated Risk Management Guidelines for Financial Institutions| Page 62 current asset‐liability profile and the consequential structure mismatches, needs higher tolerance level, it could operate with higher limit sanctioned by ALCO giving specific reasons on the need for such higher limit. b. Liability concentration ratios and limits: Liability concentration ratios and limits help to prevent an FI from relying on too few providers or funding sources. Limits are usually expressed either as a percentage of liquid assets or absolute amount. Sometimes, they are more indirectly expressed as a percentage of deposits, purchased funds, or total liabilities. c. Loan to Fund ratio: FIs should monitor its loan to fund ratio on regular basis. Ideally, loan to fund ratio should not exceed 95%. Any excess lending must be supported by confirmed sources of fund. ALCO should review this ratio in their monthly meeting and components of ‘confirmed sources of fund’ incase the ratio is over 95%. Loan to Fund Ratio = Loans and advances / (Equity + Reserve + Deposit +   Borrowings + Bond + other sources of fund)   d. Other Balance Sheet Ratios: Examples of common ratios used by FIs to monitor current and potential funding levels are:

• Total credit to total deposits;
• Liquid assets to total deposit;
• Liquid assets to short‐term liabilities; and
• Borrowed funds to total assets; etc. In addition to the statutory liquidity requirement and cash reserve requirement, the board and senior management should establish limits on the nature and amount of liquidity risk they are willing to assume. The limits should be periodically reviewed and adjusted when conditions or risk tolerances change. When limiting risk exposure, senior management should consider the nature of the FI's strategies and activities, its past performance, the level of earnings, capital available to absorb potential losses, and the board's risk appetite. Balance sheet complexity will determine how much and what types of limits an FI should establish over daily and long term horizons. While limits may not prevent a liquidity crisis, limit exceptions can be early indicators of excessive risk or inadequate liquidity risk management.

Integrated Risk Management Guidelines for Financial Institutions| Page 63 4.9 Internal Controls FIs should have adequate internal controls to ensure the integrity of their liquidity risk management process. These should be an integral part of the institution’s overall system of internal control aimed at promoting effective and efficient operations, reliable financial and regulatory reporting, and compliance with relevant laws, regulations and institutional policies. An effective system of internal control for liquidity risk includes:   a. a strong control environment;   b. an adequate process for identifying and evaluating liquidity risk;   c. the establishment of control activities such as policies and procedures;   d. adequate management information systems; and,   e. continuous review of adherence to established policies and procedures.   With regard to control policies and procedures, attention should be given to appropriate approval processes, limits, reviews and other mechanisms designed to provide a reasonable assurance that the FI's liquidity risk management objectives are achieved. Many attributes of a sound risk management process, including risk measurement, monitoring and control functions, are key aspects of an effective system of internal control. FIs should ensure that all aspects of the internal control system are effective, including those aspects that are not directly part of the risk management process.   In addition, an important element of an FI’s internal control system over its liquidity risk management process is regular evaluation and review. This includes ensuring that personnel are following established policies and procedures, as well as ensuring that the procedures that were established actually accomplish the intended objectives. Such reviews and evaluations should also address any significant change that may impact on the effectiveness of controls. The board should ensure that all such reviews and evaluations are conducted regularly by individuals who are independent of the function. When revisions or enhancements to internal controls are warranted, there should be a mechanism in place to ensure that these are implemented timely.   Breaches of the limit should receive prompt attention of appropriate management and should be resolved according to the processes described in approved policies.  

Integrated Risk Management Guidelines for Financial Institutions| Page 64 4.10 Monitoring and Reporting Risk Exposures Senior management and the board, or a committee thereof, should receive reports on the level and trend of the FI's liquidity risk at least half yearly. From these reports, senior management and the board should learn how much liquidity risk the FI is assuming, whether management is complying with risk limits, and whether management's strategies are consistent with the board's expressed risk appetite. The sophistication or detail of the reports should be commensurate with the complexity of the FI.   

Integrated Risk Management Guidelines for Financial Institutions| Page 65 CHAPTER ‐ 5 OPERATIONAL RISK MANAGEMENT 5.1 Operational Risk   Operational Risk is the risk of financial losses related to breakdown in internal control and corporate governance. Such breakdown can be the result of human error, inadequate or failed internal processes and technical systems, fraud, or from any other adverse external events. Of all the risks that an FI can face, operational risk may be the most devastating and at the same time, the most difficult to anticipate. Its appearance can result in sudden and dramatic reductions in the value of an FI. Operational risk differs from other risks since it is typically not taken in return for an expected reward rather exists in the natural course of corporate activity. At the same time, failure to manage operational risk properly can misinterpret the risk profile of FI and expose it to significant losses. 5.2   Importance of Operational Risk Management An FI can obtain the following values through operational risk management: a. Validate and improve the reliability and effectiveness of business operations and the operation of the risk management framework; b. Enhance the risk‐based decision‐making process and improve the risk management capability of its employees; c. Enhance confidence in planning process and prevents delay and cost overruns in the execution process; d. Develop organizational capability in ensuring safety of employees; e. Increase accuracy and visibility of risk information; f. Quickly identify the institution’s operational deficiencies; g. Increase management foresight;   h. Optimize business performance; and i. Reduce the cost and complexity of operational risk process.

Integrated Risk Management Guidelines for Financial Institutions| Page 66 5.3   Components of Operational Risk Operational risk can be subdivided into two components: a. Operational strategic risk, and b. Operational failure risk a.  Operational Strategic Risk Operational strategic risk arises from the environmental factors that are usually beyond the control of an FI. It may also arise from a new strategic initiative, such as getting into a new line of business or redoing how current business is to be done in the future. It is also defined as external operational risk. The operational strategic risk factors may be political, government policies, regulatory issues, societal, ethnic values, competition etc. b.  Operational Failure Risk An FI uses people, process, and technology to achieve business plans. Operational failure risk arises if any of these factors fail to perform properly. A certain level of the failures may be anticipated and should be built into the business plan. These failures can be expected to occur periodically, although both their impact and their frequency may be uncertain. 5.4   Categorization of Operational Risk   Operational risk of an FI may arise from different events. The risk event can be of the following types‐  a. Internal Fraud b. External Fraud c. Employment Practices and Workplace Safety d. Clients, Products and Business Practices e. Damage to Physical Assets f. Business Disruption and System Failure g. Execution, Delivery, and Process Management FIs face above risk events most frequently for the following circumstances‐  

• Embezzlement
• Unauthorized trading

Integrated Risk Management Guidelines for Financial Institutions| Page 67

• Misappropriation of assets
• Fraudulent transfer of funds
• Theft of customer funds
• Fraudulent payment
• Misuse of confidential information
• Cybercrime
• Robbery
• Environmental issues
• Wrongful termination of employees
• Discrimination at workplace
• Natural disaster/ Accidental issues
• Regulatory breach
• Pandemic
• Fiduciary breach
• Compromised customer information
• Terrorist attack etc. FIs are required to adopt and utilize standard categorization of operational risk. They should consider their products in this categorization mechanism. For each combination of products and event types there may be one or more circumstances. FIs should carefully observe the related circumstances for each combination to deal with the operational risk effectively. 5.5 Operational Risk Management Principles All financial institutions, regardless of their size or complexity, should address following fundamental principles in their approach to operational risk management‐   a. Level of risk appetite that the financial institution is willing to accept, together with the basis for managing those risks are to be fixed by the board. b. Effective and integrated operational risk management framework of an FI is to be ensured. c. Risk management framework should incorporate a clearly defined organizational structure, with defined roles and responsibilities for all aspects of operational risk

Integrated Risk Management Guidelines for Financial Institutions| Page 68 management/monitoring and appropriate tools that support the identification, assessment, control and reporting of key risk indicators. d. All categories of operational risk applicable to the FI should be recognized, understood and properly defined. Furthermore, it is to be ensured that the operational risk management framework adequately covers all the categories of operational risk.   e. Operational risk policies and procedures should be clearly defined, documented and communicated.   f. All business and support functions should be an integral part of the overall operational risk management framework in order to manage the key operational risks effectively. g. Identification, assessment, mitigation, monitoring and reporting of operational risks are to be done primarily by the line management. h. Proper training is to be organized for establishing the risk management culture within the financial institution.     

Integrated Risk Management Guidelines for Financial Institutions| Page 69 5.6 Operational Risk Management Process FIs need to manage operational risk after categorization. The process of operational risk management will be as follows: 5.7 Operational Risk Management Framework Operational risk management framework should clearly address all the components associated with operational risks. The framework should cover‐   a. institution’s tolerance limit of the risk defined by the board;   b. prioritization of operational risk management activities including the extent of, and manner in which, operational risk is to be managed and mitigated; Identification of operational risk Collection of data for assessment Assessment of risk Framing of risk policies and actions Culture and awareness of risk Risk monitoring and reporting Evaluation of actions for mitigation of risk

Integrated Risk Management Guidelines for Financial Institutions| Page 70 c. include the policies outlining the institution’s approach to identify, assess, monitor and control/mitigate the operational risk; and d. responsibilities and reporting between operational risk control functions, business lines and support functions should be clearly separated in order to avoid conflict of interest. 5.8 Key Risk Indicators In the operational risk management framework there must be some key risk indicators that shall provide the management an early‐warning, specifying the areas where pre‐defined thresholds exist and thus shall highlight the potential danger spots in a timely fashion. Based on the nature of activities, financial institutions should identify appropriate indicators that provide early warning of an increased risk of future losses. Such indicators should be forward‐looking and could reflect potential sources of operational risk such as rapid growth, the introduction of new products, employee turnover, transaction breaks, system failure, and so on. When thresholds are directly linked to these indicators an effective monitoring process can help identifying key material risks in a transparent manner and enable the financial institution to act upon these risks appropriately. Regular reviews should be carried out by internal audit, to analyze the control environment and test the effectiveness of implemented controls, thereby ensuring business operations are conducted in a controlled manner. 5.9 Operational Risk Management Responsibilities Operational risk management is an overall process. Both the Board and the senior management of  an FI should be responsible for the operational risk management principles.   5.9.1  Board’s Responsibilities The fundamental premise of sound operational risk management in an FI primarily depends on the Board’s leadership and directives. Keeping that in mind, the Board of Directors of an FI should take the lead in establishing a strong operational risk management culture in the company that to be guided by strong risk management policies and procedures. Operational risk management will be most effective where organizational culture emphasizes high standards of ethical behavior at all levels. So, the Board of an FI should

Integrated Risk Management Guidelines for Financial Institutions| Page 71 encourage such culture in the organization, which establishes through both actions and words, the expectations of integrity for all employees in conducting the business of the FI. The Board is responsible for creating an organizational culture that places high priority on effective operational risk management and adherence to sound operating controls. Generally, the Board’s responsibilities shall include the following: a. To lead the institution through establishing a strong operational risk management culture within the company; b. To establish management structure capable of implementing the FI’s operational risk management framework specifying clear lines of management responsibility, accountability and reporting; c. To approve the policies for operational risk management of the institution to be prepared under the guidelines of the principles; d. To set the strategic direction in relation to operational risk based on the requirements and obligation to the stakeholders of the FI; e. To set tolerance level of the risk management; f. To establish code of conduct and ethical practices within the company through human resources setting clear expectations for integrity and ethical values of the highest standard; g. To monitor institution’s safety and soundness on account of operational risk; h. To provide clear guidance and direction to the senior management regarding the principles underlying the operational risk management framework; and i. To monitor and review the operational risk management policies and procedures along with the framework regularly to ensure that the institution is managing the operational risks. This review process should also aim to assess industry best practice in operational risk management appropriate for the institution’s activities, systems and processes. 5.9.2  Senior Management’s Responsibilities Strong and consistent support and ethical behavior of senior management for managing risk convincingly reinforces codes of conduct and ethics within the institution. Clear

Integrated Risk Management Guidelines for Financial Institutions| Page 72 expectations and accountabilities ensure that institution’s employees understand their roles and responsibilities for operational risks, as well as their authority to act. So, it is the senior management’s responsibility to translate the principles in the policies through identifying the acceptable business practices prohibiting conflicts among the employees. Generally, the senior management’s responsibilities shall include the following: a. To translate the operational risk management framework into specific policies and procedures that can be implemented and verified within the business; b. To implement the policies and procedures within the organization as approved by the Board; c. To clearly assign authority, responsibility and reporting relationships within the employees to encourage and maintain the accountability and ensure that the necessary resources are available to manage operational risk effectively; d. To ensure that the financial institution's operational risk management policies and procedures has been clearly communicated to all employees; e. To assess the appropriateness of the risk management process in light of the risks inherent in the institution’s business policy; f. To ensure that institution possesses qualified employees with the necessary experience, technical capabilities and access to resources, and that employee responsible for monitoring and enforcing compliance with the FI’s risk policy have authority and are independent from the units they oversee; and g. To ensure that the financial institution’s remuneration policies are consistent with its appetite for risk. 5.10  Policies and Procedures The fundamental premise of sound operational risk management is to understand the nature and complexity of the risks inherent in the institution’s business, products, services and activities. A vital means of understanding the nature and complexity of operational risk is to have the components of the risk framework fully integrated into the overall risk management processes of the institution. The framework should be appropriately integrated into the risk management processes across all levels of the institution.

Integrated Risk Management Guidelines for Financial Institutions| Page 73 FIs should develop, implement and maintain the policies and procedures of the operational risk management that is fully integrated with the institution’s overall risk management processes. The policies and procedures for operational risk management will depend on a range of factors, including its nature, size, complexity and risk profile.   The operational risk management policies should include the following: a. The strategy given by the Board; b. The systems and procedures to introduce effective operational risk management framework; and c. The structure of operational risk management function and the roles and responsibilities of individuals involved. The policy should establish a process to ensure that any new or changed activity, such as new products or systems conversions, will be evaluated for operational risk prior to coming into effect. It should be approved by the board and documented. The policy should be regularly reviewed and updated, to ensure that it continues to reflect the environment within which the institution operates. 5.11  Identification and Assessment Risk identification and assessment are fundamental characteristics of an effective operational risk management system. Effective risk identification considers both internal and external factors. Sound risk assessment allows the institution to better understand its risk profile and allocate risk management resources and strategies most efficiently.   FIs should identify and assess the operational risk inherent in all existing products, activities, processes and systems and its vulnerability to the risk. FIs should also ensure the inherent operational risk while introducing or undertaking new products, activities, processes and systems. FIs should consider the following tools to identify and assess the operational risk: a. Self risk assessment: An FI assesses its operations and activities against a menu of potential operational risk vulnerabilities. This process is internally driven and often incorporates checklists and/or workshops to identify the strengths and weaknesses of the operational risk environment. b. Risk mapping: Risk mapping identify the key steps in business processes, activities and organizational functions. It also identifies the key risk points in the overall

Integrated Risk Management Guidelines for Financial Institutions| Page 74 business process. Risk mapping can reveal individual risks, risk interdependencies, and areas of control or risk management weakness. They also can help prioritize subsequent management action.   c. Risk indicators: Risk indicators are statistics and/or metrics, often financial, which can provide insight into a financial institution's risk position. These indicators are to be reviewed on a periodic basis (such as monthly or quarterly) to alert financial institutions to changes that may be indicative of risk concerns. Such indicators may include the number of failed trades, staff turnover rates and the frequency and/or severity of errors and omissions. Threshold/limits could be tied to these indicators such that when exceeded, could alert management on areas of potential problems. d. Historical data analyses: The use of data on an FI’s historical loss experience could provide meaningful information for assessing its exposure to operational risk and developing a policy to mitigate the risk. An effective way of making good use of this information is to establish a framework for systematically tracking and recording the frequency, severity and other relevant information on individual loss events. 5.12  Mitigation of Operational Risks Some significant operational risks have low probabilities but potentially very large financial impact. Moreover, not all risk events can be controlled, e.g. natural disasters. Risk mitigation tools or programs can be used to reduce the exposure to, or frequency and/or severity of such events. For example, insurance policies can be used to externalize the risk of "low frequency, high severity" losses which may occur as a result of events such as third‐ party claims resulting from errors and omissions, physical loss of securities, employee or third‐party fraud, and natural disasters. However, FIs should view risk mitigation tools as complementary to, rather than a replacement for, thorough internal operational risk control. Having mechanisms in place to quickly recognize and rectify legitimate operational risk errors can greatly reduce exposures. Careful consideration also needs to be given to the extent to which risk mitigation tools such as insurance truly reduce risk, or transfer the risk to another business sector or area, or even create a new risk e.g. legal or counterparty risk.

Integrated Risk Management Guidelines for Financial Institutions| Page 75 Investments in appropriate processing technology and information technology security are also important for risk mitigation. However, FIs should be aware that increased automation could transform high‐frequency, low‐severity losses into low‐frequency, high‐severity losses. The latter may be associated with loss or extended disruption of services caused by internal factors or by factors beyond the institution's immediate control e.g. external events. Such problems may cause serious difficulties for FIs and could jeopardize an FI’s ability to conduct key business activities. FIs should therefore establish disaster recovery and business continuity plans that address this risk. 5.13 Monitoring FIs should implement a process to regularly monitor operational risk profiles and material exposures to losses. There should be regular reporting of pertinent information to senior management and the board of directors that supports the proactive management of operational risk.   An effective monitoring process is essential for adequately managing operational risk. Regular monitoring activities can offer the advantage of quickly detecting and correcting deficiencies in the policies, processes and procedures for managing operational risk. Promptly detecting and addressing these deficiencies can substantially reduce the potential frequency and/or severity of a loss event.  Senior management should establish a program to: a. monitor assessment of the exposure to all types of operational risk faced by the financial institution; b. assess the quality and appropriateness of mitigating actions, including the extent to which identifiable risks can be transferred outside the financial institution; and c. ensure that adequate controls and systems are in place to identify and address problems before they become major concerns.   It is essential that:

• responsibility for the monitoring and controlling of operational risk should follow the same type of organizational structure that has been adopted for other risks, including market and credit risk;

Integrated Risk Management Guidelines for Financial Institutions| Page 76

• senior management ensure that an agreed definition of operational risk together with a mechanism for monitoring, assessing and reporting is designed and implemented; and
• this mechanism should be appropriate to the scale of risk and activity undertaken. In addition to monitoring operational loss events, financial institutions should identify appropriate indicators that provide early warning of an increased risk of future losses. Such indicators (often referred to as key risk indicators or early warning indicators or operational risk matrix) should be forward‐looking and could reflect potential sources of operational risk such as rapid growth, the introduction of new products, employee turnover, transaction breaks, system downtime, and so on. When thresholds are directly linked to these indicators an effective monitoring process can help identify key material risks in a transparent manner and enable the financial institution to act upon these risks appropriately. Regular reviews should be carried out by internal audit, or other qualified parties, to analyze the control environment and test the effectiveness of implemented controls, thereby ensuring business operations are conducted in a controlled manner. The results of monitoring activities should be included in regular management and board reports, as should compliance reviews performed by the internal audit and risk management functions. 5.14  Reporting Appropriate reporting mechanisms should be in place at required levels that support proactive management of operational risk. FIs should ensure that its reports are comprehensive, accurate, consistent and actionable across business lines and products. Reports should be manageable in scope and volume since effective decision‐making is impeded by both excessive amounts and paucity of data. FIs should produce reports both in normal and stressed market conditions. The frequency of reporting should reflect the risks involved and the pace and nature of changes in the operating environment. For regular reporting senior management should establish a program to: a. monitor all types of assessed operational risk faced by the institution;

Integrated Risk Management Guidelines for Financial Institutions| Page 77 b. assess the quality and appropriateness of mitigating actions, including the extent to which identifiable risks can be removed; and c. ensure that adequate controls and systems are in place to identify and address problems before they become major concerns. Senior management should ensure that information is available to  the Audit Committee of Directors on a timely basis, in a form and format that will aid in monitoring and control of the business. The reporting process should include information such as:

• the critical operational risks facing or potentially facing, by the financial institution;
• risk events and issues together with intended remedial actions;
• the effectiveness of actions taken;
• details of plans formulated to address any exposures where appropriate;
• areas of stress where crystallization of operational risks is imminent; and
• the status of steps taken to address operational risk. In general, the Board of Directors should receive the most critical and important information from the Audit Committee of the Directors to enable them to understand the institution’s overall operational risk profile and focus on the material and strategic implications for the business. Operational risk reports may contain internal financial, operational, and compliance indicators, as well as external market or environmental information about events and conditions that are relevant to decision making.   Operational risk reports should include:  
• breaches of the institution’s risk appetite and tolerance levels, as well as thresholds or limits;  
• details of recent significant internal operational risk events and losses; and  
• relevant external events and any other potential impact on the FI.   Data capture and risk reporting processes should be analyzed periodically with a view to continuously enhancing risk management performance as well as advancing risk management policies, procedures and practices.   

Integrated Risk Management Guidelines for Financial Institutions| Page 78 5.15 Establishing Control Mechanism Control activities are designed to address the operational risks that an FI has identified. For all material operational risks that have been identified, the institution should decide whether to use appropriate procedures to control and/or mitigate the risks, or bear the risks. For those risks that cannot be controlled, the FI should decide whether to accept these risks, reduce the level of business activity involved, or withdraw from this activity completely. To be effective, control activities should be an integral part of the regular activities of an FI. A framework of formal, written policies and procedures is necessary; it needs to be reinforced through a strong control culture that promotes sound risk management practices. 5.16 Resiliency, Continuity and Contingency Planning FIs should have business resiliency, continuity and contingency plans in place to ensure an ability to operate on an ongoing basis and limit losses in the event of severe business disruption. Resiliency, continuity and contingency plans should incorporate business impact analysis, recovery strategies, testing, training and awareness programs, and communication and crisis management programs. An FI should identify critical business operations, key internal and external dependencies, and appropriate resilience levels. Plausible disruptive scenarios should be assessed for their financial, operational and reputational impact, and the resulting risk assessment should be the foundation for recovery priorities and objectives. These plans should establish contingency strategies, recovery and resumption procedures, and communication plans for informing management, employees, regulatory authorities, customer, suppliers, and civil authorities (if applicable). FIs should periodically review these plans to ensure contingency strategies remain consistent with current operations, risks and threats, resiliency requirements, and recovery priorities. 5.17 Internal Controls Internal control systems should be established to ensure adequacy of the risk management framework and compliance with a documented set of internal policies concerning the risk management system. Principal elements of this could include‐ 

Integrated Risk Management Guidelines for Financial Institutions| Page 79 a. top‐level reviews of the FI’s progress towards the stated objectives; b. policies, processes and procedures concerning the review, treatment and resolution of non‐compliance issues; and c. a system of documented approvals and authorizations to ensure accountability to the appropriate level of management. Although a framework of formal, written policies and procedures is critical, it needs to be reinforced through a strong control culture that promotes sound risk management practices. Board and senior management are responsible for establishing a strong internal control culture in which control activities are an integral part of the regular activities of an FI. Operational risk can be more pronounced where FIs engage in new activities or develop new products (particularly where these activities or products are not consistent with the FI’s core business strategies), enter unfamiliar markets, and/or engage in businesses that are geographically distant from the head office. It is therefore important for FIs to ensure that special attention is paid to internal control activities including review of policies and procedures to incorporate such conditions. FIs should have in place adequate internal audit coverage to verify that operating policies and procedures have been implemented effectively. The board (either directly or indirectly through its audit committee) should ensure that the scope and frequency of the audit program is appropriate to the risk exposures. Audit should periodically validate that the FI's operational risk management framework is being implemented effectively across the institution. To the extent that the audit function is involved in oversight of the operational risk management framework, the board should ensure that the independence of the audit function is maintained. This independence may be compromised if the audit function is directly involved in the operational risk management process. The audit function may provide valuable input to those responsible for operational risk management, but should not itself have direct operational risk management responsibilities. An effective internal control system also requires existence of appropriate segregation of duties and that personnel are not assigned responsibilities which may create a conflict of

Integrated Risk Management Guidelines for Financial Institutions| Page 80 interest. Assigning such conflicting duties to individuals, or a team, may enable them to Risk Management Guidelines for FIs conceal losses, errors or inappropriate actions. Therefore, areas of potential conflict of interest should be identified, minimized, and subjected to careful independent monitoring and review. In addition to segregation of duties, FIs should ensure that other internal practices are in place as appropriate to control operational risk  which include‐  a. close monitoring of adherence to assigned risk limits or thresholds; b. maintaining safeguards for access to, and use of, FI's assets and records; c. ensuring that staffs have appropriate expertise and training; d. identifying business lines or products where returns appear to be out of line with reasonable expectations e.g. where a supposedly low risk, low margin trading activity generates high returns that could call into question whether such returns have been achieved as a result of an internal control breach; and e. regular verification and reconciliation of transactions and accounts.     

Integrated Risk Management Guidelines for Financial Institutions| Page 81 CHAPTER ‐ 6 REPUTATION RISK MANAGEMENT 6.1 Reputation Risk   Reputation risk is a hidden danger that can pose a threat to the survival of the biggest and best‐run companies. It can often wipe out a large amount of money in market capitalization or lost revenues and can occasionally result in a change at the uppermost levels of management. Reputation risk may arise from the possibility that negative publicity regarding the FI and its business practices, in the territory or elsewhere through related entities, and whether accurate or not, will adversely impact the operations and position of the FI. Reputation risk may also arise from an institution or its affiliate, being domiciled in a jurisdiction where the legal and organizational framework for the regulation and supervision of FIs is generally viewed as failing to meet international standards for the protection of consumers of financial services and for the prevention of sheltering the proceeds of organized crime. Reputation risks are very difficult to measure as they deal with mostly intangible factors and thus are difficult to manage.   Reputation risk can emerge at all business levels and has the following key components:   a. Corporate reputation risk which relates to an FI’s performance, strategy, execution and delivery of its services. This is closely knotted with management’s reputation risk in their ability to create shareholder value and managing capital pricing.   b. Operational or business reputation risk where an activity, action, or stance taken by an FI, any of its affiliates or its officials will impair its image with one or more of its stakeholders resulting in loss of business, and/or disproportionate decrease in the value of institution.   6.2 Factors Causing Reputation Risk: Reputation risk may arise from the following sources: a. Adverse media coverage;

Integrated Risk Management Guidelines for Financial Institutions| Page 82 b. Customer complain/negative public opinion regarding an institution's practices (whether authentic or not);   c. Controversial product design;   d. Unethical practice by the FI; e. Employee dissatisfaction/internal mismanagement/lack of professional attitude.   6.3 Consequences of Reputation Risk: Consequences of reputation risk may as follows: a. decline in investors’ confidence and in its customer base which leads to fall in revenue; b. cause liquidity difficulties, fall in share price and a significant reduction in market capitalization;   c. hamper motivation of  organization’s  employees;   d. forced into acquisition in case reputation is severely damaged; and e. increase in litigation expenses due to direct and indirect losses of stakeholders.   6.4 Roles and Responsibilities   The board is ultimately responsible for ensuring that an appropriate structure and process is in place to effectively manage reputation risk. The FI’s audit and risk management committees should be responsible for internal control systems including those relating to reputation risk means through which exposures related to reputation risks are managed. Senior management should establish non‐financial reputation risk indicators so that appropriate action could be instituted to manage the communication of information into the market place.   6.5 Reputation Risk Management Process Reputation risk can arise from many aspects of an institution’s operations. Failure to manage properly the other risks could result in loss of market share or credibility. Even where no monetary loss is incurred, there could still be reputation damage. FIs thus have to implement a sound and comprehensive risk management process to identify, monitor, control and report all risks that may cause damage to the institution’s reputation. The effective reputation risk management may include the following:  

Integrated Risk Management Guidelines for Financial Institutions| Page 83 a. management will anticipate, identify and respond to changes of a market or regulatory nature that affect its reputation in the marketplace; b. management should be fully aware of an event that has the potential to impact an FI’s reputation. All material events should immediately be escalated to the Compliance or Risk Manager, Managing Director or Public Relations.   c. the FI will take necessary steps if  there is any violations of laws, regulations, best practices of the institution and consumer rights that could affect its reputation; d. FI will ensure that there is no general release of information to the public, press without approval from senior management.

Integrated Risk Management Guidelines for Financial Institutions| Page 84 CHAPTER ‐ 7   STRATEGIC RISK MANAGEMENT 7.1  Strategic Risk Strategic risk is the possible losses that might arise from adverse business decisions, substandard execution and failure to respond properly to changes in the business environment. This type of risk originated from some factors that may be both internal and external. These factors may have both favorable and detrimental effect on FI. FI can control the risk resulting from internal factors such as; a. Organizational structure: Organizational structure plays an important role for implementation of any strategic and business plan. Organizational structure should be consistent with the strategy and plans of the institution. It should be free from the conflict of interest among directors, shareholders, managements and  staffs. b. Work processes and procedures: Proper work processes and procedures facilitate the execution of business plans in appropriate and accelerated manner. In order to avert shortfalls of internal controls, the board of every FI should establish guidelines on responsibilities, policies and procedures. c. Personnel: The success of strategic and business plan depends on level of expertise and vision of the board, management and staff.   Incompetency of management and staff would enhance risk exposures that ultimately worsen performance of FI. d. Information: Formulation of strategic and business plan and revision thereafter requires sufficient and accurate information in a timely manner. This helps management taking necessary and corrective measures. e. Technology: FIs should have state of art technology in such a way so that they can easily accomplish complex transactions, can have formatted statement as per their requirement and serve customers’ need. Sophisticated technology will give them extra edge in being competitive while keeping pace with growing new business lines.

Integrated Risk Management Guidelines for Financial Institutions| Page 85 Risk arises from external factors are in most cases beyond the control of FI. These factors affect the accomplishment of the goals determined in the respective strategic plan. Such factors may comprise the followings: i.   Competition: FIs should consider existing as well as upcoming competition among the homogeneous institutions while devising strategic and business plan.   Such consideration must be focused in setting prices and designing new products. ii.   Change of target customers: Demographic structure, consumers profile and preference may influence the future investment decisions of FI which may ultimately affect the earnings of the institutions. iii.   Technological changes: If an FI fails to adopt sophisticated and updated technology which could develop more efficient systems.   iv.   Economic factors: Inability to assess and monitor global, regional and national economic trends and forecasts that might affect profitability of FI. v.   Regulations: Failure of complying with any change in laws and regulations which might affect the implementation of strategic and business plans of FIs.   7.2   Strategic Plan Strategic plan is primarily used for implementing and managing the strategic direction of an existing organization for a period of at least five years. It is used to provide focus, direction and action in order to move the organization from where they are now to where they want to go. Strategic plan is critical to prioritizing resources i.e. time, money and people to grow the revenue and increase the return on investment.   A strategic plan must be documented and approved by board so that it can be used to communicate the direction of the organization to the staff and stakeholders. It should contain at least the followings:   a.   Analysis of the external environment in which the FI operates, including the STEEPLE (Social, Technological, Economic, Environmental, Political, Legal and Ethical) analysis; b. Critical review of the institutional performance including SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis;

Integrated Risk Management Guidelines for Financial Institutions| Page 86 c.   FI’s strategic goals and objectives;   d. Description of the FI’s risk management system; e.   Mission, goals and operating plans for each of the FI’s units; and f.   FI’s quantitative projection of financial statements for the planning period. 7.3 Strategic Risk Management Strategic Risk Management is a process for identifying, assessing and managing risks and uncertainties, affected by internal and external events or scenarios that could inhibit an FI’s ability to achieve its strategy and strategic objectives with the ultimate goal of creating and protecting the values of shareholders and stakeholders.   7.3.1 Board Oversight The mission and vision of the FI should reflect the direction to which the FI is heading in the medium to long term. Aligning with the mission and vision, the board of directors will design strategic road map in its strategic plan. On the basis of strategic plan, the board should‐   a. set up a corporate governance structure which clearly indicates the lines of responsibilities and accountability; b. establish communication channels appropriate for effective implementation of the plans; and c. ensure that senior management is sufficiently qualified and experienced. The board should be sound enough about the financial market, economic and competitive conditions and ensure that the strategic plan adopted by them is implemented effectively and reviewed at least once in a year.   7.3.2 Senior Management Oversight Management of an FI is responsible for implementing the approved strategic and business plans. Senior management must translate the strategic goals into realistic operational goals, prioritizing them in terms of their importance. Strategic goals should be distributed to smaller executable segments assigned to different business units within the overall set up of the institution.   

Integrated Risk Management Guidelines for Financial Institutions| Page 87 7.3.3   Role of Business Unit   An effective measurement and monitoring process is indispensable in order to manage strategic risk in a proper way. To assess the adequacy and aptness of strategic risk monitoring and reports, as well as the information system of the FI, each business unit must consider the following factors: a. Business units must prepare reports frequently that will highlight material risks and strategies mounted to counter them.   b. Contents of those reports should be submitted to higher level;   If any business unit of FI fails to address and manage strategic risk prudently, it may spread throughout the FI. This would result into degradation of the FI’s position within the industry.   7.3.4 Identification, Measurement and Monitoring of Strategic Risk Effective strategic risk management is all about the process of identification, assessment, quantification, prioritization, developing risk mitigation action plan and monitor. A typical strategic risk management process would contain at least the following steps‐  a. Identify the risks in the following categories‐ 

• Industry
• Technology
• Brand
• Competitors
• Customers
• Project  
• Regulations etc. b.  Assess the aforesaid identified risks on the basis of following criteria‐  i. Severity ii. Probability iii. Timing iv. Changing probability over time.

Integrated Risk Management Guidelines for Financial Institutions| Page 88 c.   Mapping the risks to provide visual representation of associated risks across    categories and criteria. d.  Quantifying the risks with a view to express those in monetary term. e.  Prioritizing the risks as per their significance and impact f. Developing proper risk mitigating action plan is crucial for minimizing potential    losses. For every major risk identified, there should be a team responsible for preparing a formal mitigation plan. The plan should outline the risks assessment and assign responsibility for executing countermeasures.   g. Monitoring the risks by assigned group and responsible parties. 7.4 Common Causes of Strategic Failure Strategic failure of an FI may be viewed from two broad aspects such as Planning and Implementation. 7.4.1 Planning Issues: The planning issues for strategic failure are‐  a. strategic planning set by an FI is not compatible with its risk tolerance level and deviate from its core business activities; b. strategic planning set by an FI is based on poor or inadequate evaluation of the strategies adopted; c. strategic planning set by an FI is imprudent or overly aggressive relative to its business size and complexity;   d. improper diversification strategy is adopted by an FI;    e. an FI sticks to its precious strategies without updating them by considering probable environmental changes, thus rendering those strategies ineffective and irrelevant; f. inadequate risk assessment is made before an FI launches business in new markets or offers new products and services; and g. a successful FI is over‐confident of its past experience when making strategic decisions, thereby stifling innovation and reducing flexibility.   

Integrated Risk Management Guidelines for Financial Institutions| Page 89 7.4.2 Implementation issues: Strategic failure may take place if ‐  a. an FI is not prompt in responding to changes in its operating environment, and therefore has not adequately considered the need for strategic changes; b. a strategy is poorly implemented because of the lack of necessary operational/functional support; c. an FI does not have adequate in‐house expertise to implement its new strategy; d. an FI fails to take account of the difficulties in engendering change before   implementing its new strategies;   e.  an FI does not have adequate managerial resources and expertise to look   after its business operations; f. an FI has lost its competitive advantages through the erosion or deterioration of factors that created the advantages to start with; g. an FI has not successfully implemented an acquisition deal due to various   reasons; h. an FI has not successfully implemented a joint venture deal due to various   reasons; i. resources (tangible or intangible) deployed to implement the strategies of an   institution are inadequate; and j. an FI fails to controls and monitor the progress of implementing a strategy properly. 7.5  Strategic Risk Control There must have some effective control mechanism for successful accomplishment of strategic risk management. In order to control strategic plan effectively an FI should:   a. establish a policy or plan for management that should be reviewed at least once in a year. It must be consistent with the organizational set up and should cover the required training and qualifications for each position and career path;

Integrated Risk Management Guidelines for Financial Institutions| Page 90 b. evaluate performance against set goals at least annually. The review should determine whether performance is satisfactory and management is capable of achieving the goals or not; c. monitor and control performance of outsourcing arrangements; d. formulate compensation guidelines for management and employees considering financial position of the FI; e. design training plan and retain sufficient budget for this; and f. have retention plan for its employees.   

Integrated Risk Management Guidelines for Financial Institutions| Page 91 CHAPTER ‐ 8   COMPLIACNE RISK MANAGEMENT 8.1   Compliance Risk Compliance risk can be defined as the current or prospective risk of legal sanction and material financial loss the FI may suffer as a result of its failure to comply with laws, its own regulations, code of conduct, and standards of the best practice as well as from the possibility of incorrect interpretation of effective laws or regulations. Compliance risk is sometimes also referred to the risk adherence to principles of integrity and fair dealing. Some common sources of compliance risk are‐ 

• violations or noncompliance with laws and regulations and prescribed standards;
• lack of or inadequate compliance with contractual obligations and other legal documentation;
• complaints by customers and other counterparties;
• impairment of third party’s interest;
• pending litigation procedures;
• involvement in money laundering, insider trading, violation of taxation rules, forgery and damage from computer hacking by the institution, its intermediaries or its customers; and
• lack of proper knowledge and delayed response by management to comply with laws and regulations. 8.2 Consequences of Non‐compliance Compliance risk has become very complex and expensive with extensive new regulations, multiple overlapping information sources, and operational impacts that are difficult to identify and track. For non‐compliance FIs suffer a lot, some of them are mentioned below‐  a. inability to grapple with the continued complexity in complying with regulators’ expectations;   b. continued rising cost of non‐compliance resulting from litigation, penalties, and the cost of mediation. This increasing cost is also reflected in increased staffing in first, second, and third lines of defense;

Integrated Risk Management Guidelines for Financial Institutions| Page 92 c. compliance failures continuing to increase reputational risk and threatening to impose a significant drag on overall business performance  ‐ both for individual institutions and the industry as a whole; and d. adverse business impact of:

• negative news on customer satisfaction and retention;
• higher opportunity costs and slower growth;
• heavily publicized non‐compliance fueling a cycle of public and legislative demand for enhanced regulation and enforcement. 8.3 Policies and Procedures FIs should put in place adequate policies and procedures for managing compliance risk. Compliance policy should explain the main processes by which compliance risk is to be identified and managed through all levels of the FI’s organizational structure. The policy should also define the compliance function as an independent function, with specific roles and responsibilities of the compliance staff, and detailing the compliance officer’s communication methods with the management and staff in the various business units.   Compliance risk management policy should be a part of the overall risk management policy of the FI, and should precisely determine all important processes and procedures in minimizing the institution’s compliance risk exposure. It should be clearly formulated and in writing. The policy must contain, at least the following: a. definition of compliance risk; b. objectives of compliance risk management; c. procedures for identifying, assessing, monitoring, controlling and managing compliance risk; d. well defined authorities, responsibilities and information flows for compliance risk; and e. clear statement of the institution’s accepted tolerance for compliance risk exposure.   

Integrated Risk Management Guidelines for Financial Institutions| Page 93 Procedures for compliance risk should contain at a minimum:  

• entitlement of the required legal documents which will establish FI’s claim on the collateral on loans and leases. These also include verification, by the FI's legal expert, of the legitimacy of the collateral.  
• definition of standard procedures for foreclosures;  
• standardized contracts for FI’s products, clients, and other services with third parties. The terms or conditions of a contract should be confirmed by the FI's legal expert. Special attention should be paid to the procedures for changing the terms of a signed contract. The FI's legal expert should also confirm annexes to any contract;
• legal due diligence of the FI’s major clients and counterparties, vendors and outsourcing companies;   
• documentation standards for all initiated court proceedings against or on behalf of the institution. Permanent and accurate information and documents of the institution’s effectiveness in court proceedings is also needed. The FI's legal experts should keep a list of all court proceedings with their opinion on the possible result of the case, as well as, a list of court cases that in the name of the institution are led by outside attorneys. In addition, the FI should separately retain data describing the types of claims for which the institution has usually initiated litigation and in which cases the institution was sued;   
• definition of the major mitigating actions to compliance risk (e.g., through reviewing contract terms by experienced lawyers, restricted dealings to reputable counterparts, placing limits on exposure to legal interpretations, etc.);
• clear documentation standards for the FI’s shareholders;  
• documentation standards for all decisions made by the regulators in respect of the FI and written communications between the regulators and the institution;         
• procedures for safeguarding of original legal documents; and
• regular compliance checks.   8.4   Compliance Risk Management Compliance risk management is a process for identifying, assessing, monitoring and mitigating risks and uncertainties associated with non‐compliance issues arises from internal

Integrated Risk Management Guidelines for Financial Institutions| Page 94 and external events or scenarios that may deter the ultimate objectives and credibility of the organization. 8.4.1   Organizational Role in Compliance Risk Management The most widespread obstacle is that the compliance function’s domain is not defined properly. As a result, roles and responsibilities for managing emerging sources of compliance risk are not clear. FIs, in such a scenario should rethink about their organizational role in structuring, adopting new competency models, and taking a fresh look at new approaches. 8.4.1.1     Role of the Board The Board should be aware of the major aspects of the FI's compliance risk as a separate risk category. For overseeing an FI’s compliance risk management process the board is responsible for the following: a. ensuring that the FI’s organizational   structure, culture, infrastructure, financial means, managerial resources and capabilities, as well as systems and controls are appropriate and adequate to meet the FI’s compliance risk management process;. b. approving a compliance risk management policy that provides the senior management with clear guidelines and procedures for managing compliance risk;.   c. reviewing an FI's compliance risk management policy periodically to ensure proper guidance provided for effectively managing the institution’s compliance risk; and d. ensuring that an FI's compliance risk management system is subject to implementation by the senior management and a qualified compliance officer/staff, and reviewed by an effective and comprehensive internal audit function. 8.4.1.2 Role of the Senior Management Senior management is responsible for the effective management of the FI’s compliance risk including:   a. establish and implement the FI’s compliance risk management framework based on criteria and standards set by the board. b. assist the board in developing policies to meet the FI’s compliance   goals and objectives.

Integrated Risk Management Guidelines for Financial Institutions| Page 95 c. proper alignment of internal human & technical resources and processes for compliance risk management; d. ensuring that employees at all levels fully understand their individual roles and responsibilities in implementing compliance risk management framework. e. ensuring ongoing compliance training that covers compliance requirements for all business lines, particularly when entering new markets or offering new products. f. submitting compliance risk management report to board of directors. 8.4.1.3 Role of Compliance Function Unit   In order to ensure proper and effective compliance risk management, there may be a separate compliance unit along with internal audit function. The compliance function unit should be independent with sufficient resources and clearly specified activities. The concept of independence involves four related elements‐  First, the compliance function should have a formal status within the FI.   Second, there should be a group of compliance officer with overall responsibility for coordinating the management of the FI’s compliance risk.   Third, compliance function staff, in particular, the head of compliance should not be placed in a position where there is a possible conflict of interest between their compliance responsibilities and any other responsibilities they may have.   Fourth, compliance function staff should have access to the information and personnel necessary to carry out their responsibilities. The concept of independence does not mean that the compliance function unit will not have any relationship with business units. Compliance function and business units should help each other to identify and manage compliance risks at an early stage.   The functions of compliance unit are to identify, assess, monitor and control/mitigate the compliance risk. Accordingly, the unit will also inform senior management through regular reporting about FI’s compliance risk. 8.4.2 Conflict of Interest between Compliance Function Unit and Other Business Units The independence of the head of compliance and any other staff having compliance responsibilities may be undermined if they are placed in a position where there is a real or potential conflict between their compliance responsibilities and their other responsibilities.

Integrated Risk Management Guidelines for Financial Institutions| Page 96 It is the preference of the management that compliance function staff performs only compliance responsibilities.  In case of shortage of manpower or at smaller FIs, compliance function staff may perform other tasks as well. In this case management should allocate responsibilities among them so that potential conflicts of interest can be avoided. 8.4.3 Access to Information and Personnel   The compliance function unit should have the right on its own initiative to communicate with any staff member and obtain access to any records or files necessary to enable it to carry out its responsibilities. The unit should be able to carry out its responsibilities on its own initiative in all departments of the FI in which compliance risk exists. It should have the right to conduct investigations of possible breaches of the compliance policy and to request assistance from specialists within the FI (e.g. legal or internal audit). The unit should be free to report to senior management on any irregularities or possible breaches disclosed by its investigations, without fear of retaliation or disfavor from management or other staff members. Although its normal reporting line should be to senior management, the unit should also have the right of direct access to the board of directors or to a committee of the board, bypassing normal reporting lines, when this appears necessary. Further, it may be useful for the board or a committee of the board to meet with the head of compliance at least quarterly, as this will help the board or board committee to assess the extent to which the FI is managing its compliance risk effectively. The compliance function should have the right to communicate with any staff member and obtain access to any records or files necessary to enable it to carry out its responsibilities. 8.4.4 Identification and Assessment of Compliance Risk FIs should identify and assess the compliance risk inherent in all existing/new rules, procedures, activities, contracts, court‐cases etc. 8.4.4.1 Identification   In order to understand its compliance risk profile an FI should identify the compliance risk arising from various sources. Sources of compliance risk of FIs may be broadly categorized as following:

Integrated Risk Management Guidelines for Financial Institutions| Page 97 a. Internal Compliance: Risks resulting from noncompliance of internal rules, policies and procedures; and b. External Compliance: Risks resulting from noncompliance of external laws and regulations.   8.4.4.2 Assessment   After identifying compliance risks FIs have to define the appropriate approach to assess each risk. Numerous tools can be used for assessing compliance risk, such as:   a.   Self‐assessment: FIs will assess its operations and activities against a list of potential compliance risk vulnerabilities. This process is internally driven and often incorporates checklists to identify the strengths and weaknesses of the compliance risk environment. b.   Risk indicators: Risk indicators are statistics or matrices that can provide insight into a FIs' risk position. For the purpose of compliance risk management, FI may develop such statistics or matrices which will include‐  

• law violations;  
• complains;
• initiated litigation procedures;  
• unfavorable court verdicts or number of finalized court cases on a periodical basis; and
• actual or suspected fraud or money laundering activities etc. For the above indicators, FIs will consider frequency as well as volume of losses (payments of damages, fines and court expenses etc.) while designing the matrices. c.   Risk mapping: For risk mapping, each department and/or unit of FIs should identify its risk associated with compliance issues. In this process, departments and/or units are outlined by degree of risk (for example credit unit/department can be outlined by the risk of the lack of contract enforcement or incorrect interpretation of the agreements). This exercise can disclose areas of weakness and help to identify priorities for management action regarding compliance.

Integrated Risk Management Guidelines for Financial Institutions| Page 98 The FIs should consider ways to measure compliance risk by using performance indicators, such as the increasing number of customer complaints, corrective measures taken against the institution, or litigation procedures as a result of noncompliance with laws and regulations. Compliance risk can also be measured by regular legal reviews on different FI’s products and services, and their relevant documentation in order to ensure that all contracts are in conformity with laws and regulations. This review may take place on each transaction individually or may cover the legal adequacy of standardized documentation and procedures.   8.4.5 Monitoring & Mitigating Compliance Risk FIs can monitor and take steps to mitigate compliance risk by following three steps: a. Prioritize activities Compliance required risk assessments, using common evaluation criteria, provide a score to quantify the vulnerability and business impact of non‐compliance so that business activities can be prioritized. Knowing what is important makes it easier to decide what to monitor and at what frequency to keep informed the board and regulators about risks that can lead to noncompliance in the institution.   b. Make regulatory alerts and updates actionable   Rather than have large volumes of highly technical and obtuse regulatory documents, FIs may work towards a clear executive summary that interprets the key action items, identifies what exactly needs to be done, the deadlines for action, impacted business areas, and those accountable in their organization. Moreover, instead of having this critical information, FIs may keep the information in such a manner so that they are searchable and connected to task activities with automated workflows, alerts, and updates that are tracked and reported on. This makes communication and interaction, along with monitoring and response, a streamlined exercise to reduce the burden of compliance on business areas. c. Business Impact FIs should follow regulatory policy changes on regular basis and should adopt these changes with their internal policies, impacted business processes and related resources.

Integrated Risk Management Guidelines for Financial Institutions| Page 99 Internal control procedures are related to internal policies. By integrating regulatory changes with the internal policies, FIs can realize what areas of their business are going to be impacted and what action needs to be taken. 8.4.6   Differences between Compliance and Internal Audit It is critically important that an internal audit function is to be fully independent to carry out their role effectively.  On the other hand, compliance must have the appropriate level of independence too.  There also has to be a strong element of cooperation, and indeed even a degree of integration, with all the units of an FI as compliance provides advisory and educational roles effectively.  And this is where the two functions diverge. Internal Audit’s objective is fundamentally assurance. Looking at the past and present to provide assurance that all activities are being carried out in accordance the written policy and procedure.   Compliance’s objective is fundamentally operational.   Looking at the present and towards the future to ensure that all activities are carried out in compliance with the prevailing regulatory requirements, because the appropriate policy and procedures are in place and being adhered to. To put this other way, two simple questions can be asked. Internal audit generally asks the question “are the FIs doing what is being said to do?” Whilst Compliance asks “do FIs decide what they would do to ensure compliance? Do they actually perform it? How is this going to be effective and who needs to know about it?” Finally the compliance function is concerned with regulatory risk only, so its scope of operation is more restricted than that of the internal audit function, which is concerned with all risks of the organization.    8.4.7 Control Mechanism of Compliance Risk   The compliance function and the audit function should be separate to ensure that the activities of the compliance function are subject to independent review. However, the scope and breadth of the activities of the compliance unit should be subject to periodic review by the internal audit function. Compliance risk should be included in the risk assessment

Integrated Risk Management Guidelines for Financial Institutions| Page 100 methodology of the internal audit function.  Therefore, it is important that there is a clear understanding within the FI as to how risk assessment and testing activities should be distributed between compliance and audit function, and that should be documented in the policy. The audit function should, of course, keep the head of compliance informed of any audit findings relating to compliance.   

Integrated Risk Management Guidelines for Financial Institutions| Page 101 CHAPTER ‐ 9 MONEY LAUNDERING RISK MANAGEMENT 9.1   Money Laundering Risk A definition of what constitutes the offence of money laundering under Bangladesh law is set out in Section 2 (v) of the Money Laundering Prevention Act’ 2012 (Act No. 5 of 2012) which is as follows:   Money laundering means: a. knowingly moving, converting, or transferring proceeds of crime or property involved in an offence for the following purposes:‐

• concealing or disguising the illicit nature, source, location, ownership or control of the proceeds of crime; or  
• assisting any person involved in the commission of the predicate offence to evade the legal consequences of such offence; b. smuggling money or property earned through legal or illegal means to a foreign country; c. knowingly transferring or remitting the proceeds of crime to a foreign country or remitting or bringing them into Bangladesh from a foreign country with the intention of hiding or disguising its illegal source; or   d. concluding or attempting to conclude financial transactions in such a manner so as to reporting requirement under this Act may be avoided; e. converting or moving or transferring property with the intention to instigate or assist for committing a  predicate offence; f. acquiring, possessing or using any property, knowing that such property is the proceeds of a predicate offence;   g. performing such activities so as to the illegal source of the proceeds of crime may be concealed or disguised;   h. participating in, associating with, conspiring, attempting, abetting, instigate or counsel to commit any offences mentioned above;   

Integrated Risk Management Guidelines for Financial Institutions| Page 102 9.2   Consequences of Money Laundering   Money laundering affects the FIs negatively in numerous ways, such as‐  a. money laundering induces uncertainties in the liability and asset base of an FI, which creates risks of monetary instability and even systemic crisis; b. failure to effectively deal with money laundering issues and terror financing can lead to severe loss of reputation and goodwill; and c. failure to comply with legal and regulatory requirements relating to the combating of money laundering and terror financing can lead an FI to major punitive action taken by the regulatory authorities. 9.3Characteristics of Effective Anti Money Laundering (AML) Risk Management The characteristics of effective AML risk management include the following: a. understanding the aspects of AML risk, management will exhibit strong commitment to  compliance; b. when deficiencies are identified, management will promptly implements meaningful corrective  action; c. authority and accountability for compliance should be defined clearly and enforced. d. the Board will approve an AML compliance program that includes adequate policies,   procedures, controls, and information systems; e. in order to ensure AML compliance, FIs will appoint proper personnel and arrange training, if necessary. f. FIs will maintain effective processes for customer identification; g. management will develop a control mechanism for high‐risk areas, products, services, and customers. FIs will also take necessary steps immediately against suspicious activity or substantive violations of law; and h. the compliance and controls system of FIs will promptly adapt to the changes in international lists regarding AML issues. The management of money laundering risk has been extensively described in the “Guidance Notes on Prevention of Money Laundering and Terrorist Financing” issued by BFIU circular no.‐04, dated: September 16, 2012 of Bangladesh Financial Intelligence Unit which should be adopted by FIs with all relevant amendments from time to time.

Integrated Risk Management Guidelines for Financial Institutions| Page 103 CHAPTER ‐ 10 ENVIRONMENTAL RISK MANAGEMENT 10.1   Environmental Risk The concept of Environmental Governance is becoming very important phenomenon now‐a‐ days. The effective handling of environmental issues and management of natural resources are significant for the survival of humanity. For this reason, FIs should consider the environmental issues while financing.   FIs in Bangladesh need to protect their financing from the risks arising out of the degrading environmental scenario and climate change. Failure to consider these environmental risks as a part of financing decisions will lead to an increase in non‐performing loans for FIs. Environmental risk is a facilitating element of credit risk arising from environmental issues. These increase risks as they bring an element of uncertainty or possibility of loss in the context of a financial transaction. 10.2 The characteristics of Effective Environmental Risk Management (ERM) The characteristics of ERM include the following: a. Identifying Risks: At the time of financing, all environmental issues relevant to the proposed business activity needs to be determined. b. Rating Risks: Once the environmental risks are identified, these need to be evaluated. c. Mitigating Risks: After evaluation of the environmental risk FIs will incorporate this in their risk planning design. d. Monitoring and controlling risks: FIs will monitor the environmental risks as a part of its credit monitoring during implementation stage. e. FIs will integrate ERM with credit risk management in all aspects since it is a facilitating element of credit risk.   

Integrated Risk Management Guidelines for Financial Institutions| Page 104 10.3 Purpose of Environmental Risk Management (ERM) The overall purpose of ERM is to understand and manage risks that arise from environmental concerns. This brings a focus on planning and implementing policies and procedures to mitigate environmental risks. The specific purposes of ERM are: a. to examine the environmental issues and concerns associated with potential business activities proposed for financing; b. to identify, evaluate and manage the environmental risks and the associated financial implications arising from these issues and concerns; and c. to address the environmental issues more effectively in credit risk appraisal process. ERM is applicable across all financing transactions undertaken by FIs as all of these occur within the context of environmental concerns. 10.4 Managing ERM The processes and procedures of ERM is described elaborately in‐  a. “Environmental Risk Management (ERM) Guidelines for Banks and Financial Institutions in Bangladesh” issued by DFIM Circular No. 04, dated: 06 April, 2011   b. Policy Guidelines for Green Banking vide GBCSRD Circular No.‐04. Dated: August 11, 2013 In order to manage ERM properly FIs should adopt the instructions of above mentioned guidelines and any subsequent change of those.   

Integrated Risk Management Guidelines for Financial Institutions| Page 105 CHAPTER ‐ 11 CAPITAL MANAGEMENT 11.1   Capital Management Capital management in FIs usually refers to implementing measures aimed at maintaining adequate capital, assessing internal capital adequacy and calculating its capital adequacy ratio. It is gaining increasing importance around the world, as reflected from taking several reform initiatives and changes in the prudential requirements in different countries in line with the reform measures proposed by the Basel Committee on Banking Supervision. 11.2 Importance of Capital Management Most of the risks of FIs can be quantified as numerical indicators, and this quantification naturally leads to the urge for increased capital need to be held to cover unexpected losses at a certain confidence level. Several implications are: a. capital management helps to ensure that the FIs have sufficient capital to cover the risks associated with its activities; b. as part of the Internal Capital Adequacy Assessment Process (ICAAP), management identifies the risks that the FIs are exposed to, and determines the means by which they should be mitigated; and c. capital is used to cover some of these risks, and the remainder of these risks is mitigated by means of collateral or other credit enhancements, contingency planning, additional reserves and valuation allowances, and other mechanisms.    11.3   Framework of Capital Management FIs should devise and establish suitable capital management systems complying regulatory instructions in order to calculate the capital adequacy ratio and secure adequate capital to cover the risks they face, from the standpoint of ensuring soundness and appropriateness of their businesses.    11.4    Roles and Responsibilities of Board of Directors and Senior Management The Board of directors and senior management will take the following steps:   a. Define the goals of capital management in a policy statement comprising

Integrated Risk Management Guidelines for Financial Institutions| Page 106 regulatory compliance issues and strategic plan that will help maintaining an appropriate balance between maximizing shareholder returns and protecting the interests of depositors and other creditors;    b. Review capital ratios, targets, and levels of different classes of capital against the FI’s risk profile and risk appetite under various probable stressed scenarios; c. Review the policies and specific measures for developing and establishing an adequate capital management system with a full grasping of the assessment, monitoring and control techniques of internal capital adequacy as well as the significance of capital management;  and d. Set an appropriate level of capital target for the short‐term, medium‐term and long‐term and develop a Capital Plan (CP) to achieve the target. The CP must identify the capital issuance requirements and options around capital products, such as the issuance of common equity, timing and markets to execute the CP under differing market and economic conditions.    11.5 Monitoring of Capital Adequacy The Basel Implementation Unit (BIU), in accordance with the capital management policy and the capital management rules, will monitor capital adequacy in light of the FI’s capital plan, internal environment (risk profile, the status of the use of risk limits, etc.) and external environment (economic cycle, markets, etc.). It will regularly report to the senior management as well as the risk management forum. The management of capital risk has been extensively described in the “Prudential Guidelines on Capital Adequacy and Market Discipline” issued by DFIM Circular No. 14, dated: December 14, 2011 of Bangladesh Bank which should   be adopted by FIs with all relevant amendments from time to time.   

Integrated Risk Management Guidelines for Financial Institutions| Page 107 CHAPTER ‐ 12 MANAGEMENT INFRORMATION SYSTEM 12.1 Management Information System (MIS) MIS is a multi‐disciplinary approach to the business management that provides required information to organizations. It helps organizations to manage themselves in an effective and efficient manner. MIS is essential for any organization to process and present data at regular interval. The system is largely capable of handling the data from collection stage to processing. FIs can analyze the data in a number of ways as per their requirement. The system needs to be kept under a constant review and modification to meet the corporate needs of the information. It supports the management of the business in every phase by giving the information which is crucial in that phase. It provides more information on the critical success factors for decision making. 12.2 Data Maintenance FIs should establish a strong database by maintaining an effective MIS model/program that supports them in the following ways: a. providing, collecting, and processing data; b. reducing operating cost; c. enhancing communication among staff; and d. identifying and measuring its risks on a timely manner and generate data and reports as per the requirement of the FI. The quality risk management of an FI mostly depends on the accuracy, validity, reliability and timeliness of available information. For effective monitoring of all types of risk, a robust MIS must be in place.   12.3 Characteristics of MIS An effective MIS takes data that originates in the areas of activity that is extractable to the manager at any given time, and organizes it into forms that are meaningful for making decisions.  

Integrated Risk Management Guidelines for Financial Institutions| Page 108 Effective MIS should have the following characteristics‐  a. Accuracy A key measure of the effectiveness of an MIS is the accuracy and reliability of its information. The accuracy of the data it uses and the calculations it applies determine the effectiveness of the resulting information. The sources of the data determine whether the information is reliable. Historical performance is often part of the input for an MIS, and also serves as a good measure of the accuracy and reliability of its output. b. Usefulness The information an FI receives from an MIS may be relevant and accurate. It will only be useful if it helps the FI to take proper decision associated with risk management.   c. Timeliness Management has to forecast based on data from the present, even when evaluating trends. The more recent the data, the more these decisions will reflect present reality and correctly anticipate their effects on the company. When the collection and processing of data are delayed, the MIS must take into consideration its potential inaccuracies due to age and present the resulting information accordingly, with possible ranges of error. d. Completeness An effective MIS presents all the most relevant and useful information for a particular decision. If some information is not available due to missing data, it highlights the gaps and either displays possible scenarios or presents possible consequences resulting from the missing data. Management should make appropriate decisions being aware of the missing information. An incomplete or partial presentation of information can lead to decisions that don't have the anticipated effects. 12.4 MIS Model The FIs have the freedom to choose any suitable model or program. The model should be consistent with the complexity and diversity of the FI’s business operations. While adopting

Integrated Risk Management Guidelines for Financial Institutions| Page 109 any such a model, FIs should keep in mind whether it is able to deal with the following issues or not: a. handling of voluminous data; b. confirmation of the validity of data and transaction; c. complex processing of data and multidimensional analysis; d. quick search and retrieval; e. mass storage; f. communication of the information system to the user on time; and g. fulfilling the changing needs of the information; 12.5 Managing MIS The processes and procedures of MIS is extensively described in “Guidelines on ICT Security for Scheduled Banks and Financial Institutions” issued by DFIM Circular No. 11, dated: November 09, 2015 of Bangladesh Bank. In order to manage MIS effectively FIs should adopt the instructions of above mentioned guideline and any subsequent change of it.   

Integrated Risk Management Guidelines for Financial Institutions| Page 110 Bibliography

1. Bangladesh Bank (2012).“Risk Management Guidelines for Banks” Bangladesh Bank.
2. Bank of Tanzania (2010). “Risk Management Guidelines for Banks and Financial Institutions.” Bank of Tanzania.
3. BIS (2003). “Basel Committee on Banking Supervision, Sound Practices for the Management and Supervision of Operational Risk.” Bank of International Settlement Publication, Switzerland.
4. BIS (2005). “Basle Committee, Compliance and the Compliance Function in Banks.”Bank of International Settlement Publication, Switzerland.
5. Milanova, E. (2010). “Market Risk Management in Banks‐  Models for Analysis and Assessment.”FACTA Universitatis Series: Economics and Organization 7(4): 395 – 410. Viewed on 17 June, 2015   http://facta.junis.ni.ac.rs/eao/eao201004/eao201004‐04.pdf
6. Federal Reserve System (1997). “Framework for Risk Focused Supervision of Large Complex Institutions.” Federal Reserve System, Washington D.C.
7. Brown, K. and Moles, P. (2014). “Credit Risk Management.” Edinburgh Business School Series: Heriot‐Watt University Publication, Edinburgh.UK. Viewed on20 June 2015 https://www.ebsglobal.net/documents/course‐tasters/english/pdf/h17cr‐bk‐taster.pdf
8. Harsh, S.B. (2015). “Management Information Systems.” Michigan State University. Viewed on01 June 2015 http://departments.agri.huji.ac.il/economics/gelb‐manag‐4.pdf   

Integrated Risk Management Guidelines for Financial Institutions| Page 111 Appendix A BB’s Instructions/Guideline Regarding Risks Management

1. Asset‐Liability Management vide FID Circular No.10, dated: September 18, 2005.
2. Credit Risk Management vide FID Circular No.10, dated: September 18, 2005.
3. Internal Control and Compliance Framework FID Circular No.10, dated: September 18, 2005.
4. Guidelines on ICT Security for Scheduled Banks and Financial Institutions vide DFIM Circular No. 11, dated: November 09, 2015 .
5. Guidance Notes on Prevention of Money Laundering and Terrorist Financing vide BFIU Circular No.04 dated: September 16, 2012.
6. Prudential Guidelines on Capital Adequacy and Market Discipline vide DFIM Circular No.14, dated: December 14, 2011.
7. Environmental Risk Management (ERM) Guidelines for Banks and Financial Institutions in Bangladesh vide DFIM Circular no. 04, date: 06 April, 2011.
8. Policy Guidelines for Green Banking vide GBCSRD Circular No.‐04. Dated: August 11,
10. Formation of Risk Management Forum (RMF) & Risk Analysis Unit (RAU)in the Financial Institutions (FIs)vide DFIM Circular No.01, dated: 07 April, 2013.