Internal Capital Adequacy Assessment Process (ICAAP) Guideline

Table of Contents

1. INTRODUCTION ..............................................................................................................................4
2. DEFINITIONS ...................................................................................................................................5
3. PURPOSE, APPLICATION AND SCOPE ..........................................................................................7
4. PRINCIPLE OF PROPORTIONALITY.................................................................................................8
5. THE ICAAP ......................................................................................................................................8
6. KEY ELEMENTS OF A SOUND ICAAP .............................................................................................9 6.1 Board and Senior Management Oversight......................................................................... 10 6.2 Sound Capital Assessment and Planning ........................................................................... 11 6.3 Comprehensive Assessment of Risks................................................................................... 16 Credit Risk .............................................................................................................................................. 16 Operational Risk ................................................................................................................................... 19 Market Risk............................................................................................................................................. 19 Concentration Risk............................................................................................................................... 20 Interest Rate Risk in the Banking Book (IRRBB)................................................................................ 22 Liquidity Risk........................................................................................................................................... 23 Other Risks/Considerations................................................................................................................. 24 6.4 STRESS TESTING.......................................................................................................................... 31 6.5 MONITORING AND REPORTING ............................................................................................. 33 6.6 INTERNAL CONTROLS REVIEW................................................................................................. 35
7. GROUP ICAAPS............................................................................................................................35
8. SETTING THE TARGET CAPITAL LEVEL ..........................................................................................36
9. DOCUMENTING THE ICAAP.........................................................................................................36
10. SUPERVISORY REVIEW OF THE ICAAP.........................................................................................38
11. SUPERVISORY ACTIONS...............................................................................................................40 Appendix 1.A- ICAAP Format............................................................................................................42 The ICAAP Document ......................................................................................................................... 42
12. EXECUTIVE SUMMARY.............................................................................................................. 42
13. BACKGROUND ......................................................................................................................... 43
14. SUMMARY OF CURRENT AND PROJECTED FINANCIAL AND CAPITAL POSITIONS ........ 43
15. CAPITAL ADEQUACY............................................................................................................... 43
16. RISK AGGREGATION AND DIVERSIFICATION....................................................................... 45
17. CAPITAL POLICY....................................................................................................................... 46
18. CAPITAL PLAN........................................................................................................................... 46
19. CHALLENGE AND ADOPTION OF THE ICAAP...................................................................... 46

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 3 | P a g e 9. FUTURE ACTION PLAN.............................................................................................................. 47 10. USE OF ICAAP WITHIN THE BANK ........................................................................................... 47 Appendix 1.B- Risk Appetite Statement (RAS) ................................................................................48 Appendix1.C- ICAAP Submission Summary....................................................................................50

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 4 | P a g e

1. INTRODUCTION 1.1. Basel II is built on the “Three Pillar Approach” in which total capital requirements are the result of not only a regulatory minimum capital calculation (Pillar 1) but also a comprehensive assessment of capital needs by banks for all their risks (Pillar 2 – Supervisory Review and Evaluation Process ) and strong disclosure requirements (Pillar 3 – Market Discipline). 1.2. The Pillar 2 Supervisory Review and Evaluation Process (SREP) is an integral part of the Basel II Framework and essentially focusses on the review of the Internal Capital Adequacy Assessment Process (“ICAAP”) developed by the regulated financial institution. It is intended to ensure that banks1 not only have adequate capital to support all material risks in their business but that they also develop and use better risk management techniques in monitoring and managing these risks. Under Pillar 2, a bank’s management bears responsibility for ensuring that the bank has adequate capital to support its risks beyond the minimum Pillar 1 requirements. 1.3. In addition, under Pillar 2, supervisors are required to evaluate how well banks assess their capital needs relative to their risks and take measures, where appropriate. The supervisory evaluation is therefore intended to generate an active dialogue between banks and supervisors so when excessive risks, insufficient capital or deficiencies are identified, prompt and decisive action can be taken to reduce risk, address deficiencies or restore capital. 1.4. In particular, banks would be required to demonstrate that they have well-designed internal processes to: a. assess both the risks to which it is exposed and the risk management processes in place to manage and mitigate those risks; b. evaluate its capital adequacy relative to its risks; and c. consider the potential impact of unforeseen events such as economic downturns. 1.5. The financial market crisis of 2007-09 and the current global pandemic underscore the critical importance of effective risk management, including stress testing for enhancing financial soundness and stability of a banking organization and provides encouragement for financial institutions to effectively identify, measure, monitor and control their risk.

1 See definition of a bank in section 2 of this Guideline.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 5 | P a g e 1.6. The crisis also emphasized the importance of effective, rigorous, forward looking capital planning and long-term capital management. In particular, a bank’s ability to withstand uncertain market conditions is bolstered by a strong capital position that considers potential changes in its strategy and volatility in market conditions over time. As such the ICAAP should be used a key tool to aid decision-making and enhance capital planning. 1.7. Financial institutions in Trinidad and Tobago should seek to implement an ICAAP that is proportional to their nature, scale, complexity, risks and business strategy. The ICAAP must be documented, approved by the board of directors and updated regularly2 . 2. DEFINITIONS 2.1 “business or strategy risk” means the current or prospective risk to earnings and capital arising from imperfections in business strategy formulation, inefficiencies in implementing business strategy, non-adaptability or less adaptability with the changes in the business environment and adverse business decisions. 2.2 “bank” means a licensee or financial holding company as defined in the Financial Institutions Act, 2008. 2.3 “capital planning” means a multidimensional internal process resulting in a plan presenting a multi￾year projection of capital demand and supply of the financial institution taking into account its strategy, operational plans and unexpected events. 2.4 “capital policy”means the principles and guidelines used for capital planning, capital issuance, and usage and distributions. It is a component of the capital plan and includes internal capital goals, quantitative or qualitative guidelines for dividends and stock repurchases, strategies for addressing potential capital shortfalls, and internal governance procedures regarding capital policy principles and guidelines. 2.5 “climate risk” mean the risk emanating from the effects of climate events such as extreme weather, temperature increases, epidemics and changes in the earth’s eco-systems.

2 The frequency of review and update of the ICAAP is to be guided by section 9 of this Guideline.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 6 | P a g e 2.6 “credit concentration risk” means the risk that any single exposure or group of exposures with the potential to produce losses large enough relative to a bank’s capital, total assets, or overall risk level may threaten a bank’s health or ability to maintain its core operations. 2.7 “credit risk” means the risk that a borrower or counterparty will fail to meet its obligations in accordance with agreed terms. 2.8 “diversification effects” means the effect of taking into account the potential reduction in the overall risk quantification of a bank stemming from the assumption that individually estimated risks will not fully materialize at the same time. 2.9 “financial holding companies” means a company required to obtain a permit in accordance with sections 67(4) and 68(2) of the Financial Institutions Act, 2008. 2.10 “financial institution”/ “institution” means a bank as defined at point 2.2. 2.11 “funding liquidity risk” means the risk that a bank will not be able to meet adequately both expected and unexpected current and future cash flow and collateral needs without affecting either daily operations or the financial condition of the firm. 2.12 “interest rate risk in the banking book” means the current or prospective risk to the capital and earnings of a financial institution arising from adverse movements in interest rates that affect the financial institution’s banking book positions. 2.13 “licensee” means an institution licensed by the Central Bank in accordance with the Financial Institutions Act, 2008. 2.14 “liquidity risk” means the combination of both funding liquidity risk and market liquidity risk. 2.15 “material risk” means a capital-related downside risk that, based on the institution’s internal definitions, has a material impact on its overall risk profile and may affect the capital adequacy of the institution. 2.16 “market risk” means the risk of losses in on and off-balance sheet positions arising from adverse movements in market prices.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 7 | P a g e 2.17 “market liquidity risk” means the risk that a firm cannot easily offset or eliminate a position at the market price because of inadequate market depth or market disruption. 2.18 “operational risk” means the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events and includes legal risk, but excludes strategic and reputational risk. 2.19 “residual risk” means the amount of risk remaining after inherent risks have been reduced by risk controls. 2.20 “reputational risk” refers to the risk arising from negative perception on the part of customers, counterparties, shareholders, investors, debt-holders, market analysts, other relevant parties or regulators that can adversely affect an institution’s ability to maintain existing, or establish new, business relationships and continued access to sources of funding. 2.21 “reverse stress testing” means a stress test which starts from the identification of the pre-defined outcome including the point of non-viability and then explores scenarios and circumstances that might cause that outcome to occur. 2.22 “risk aggregation” means defining, gathering and processing risk data according to the institution’s risk reporting requirements to enable the institution to measure its performance against its risk tolerance/appetite including sorting, merging or breaking down sets of data. 2.23 “risk appetite” means the level and type of risk an institution is able and willing to assume in its exposures and business activities given its business objectives and obligations to stakeholders. 3. PURPOSE, APPLICATION AND SCOPE 3.1 This Guideline is made pursuant to regulation 6 of the Financial Institutions (Capital Adequacy) Regulations, 2020. 3.2 The purpose of the Guideline is to: - 3.2.1 provide guidance to financial institutions on the design of their internal ICAAPs; and 3.2.2 establish the format of the ICAAP document that is to be submitted to the Central Bank.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 8 | P a g e 3.3 This Guideline applies: - 3.3.1 on a consolidated basis to financial holding companies in accordance with regulation 4 (b) of the Financial Institutions (Capital Adequacy) Regulations 2020 ; 3.3.2 on a consolidated basis to licensees who are parent companies to include subsidiaries of the licensee and companies in which the licensee is a significant shareholder; and 3.3.3 on an individual basis to licensees that are not part of a group. 4. PRINCIPLE OF PROPORTIONALITY 4.1 The implementation of the ICAAP by financial institutions should be guided by the principle of proportionality. In this regard, the ICAAP should be commensurate with the nature, scope, scale and the degree of complexity in the financial institution’s business activities. The Central Bank also expects financial institutions to update their ICAAP as necessary to reflect changes in business operations or strategy or the occurrence of material events. For example, increasing complexity in business activities should be accompanied by more sophisticated approaches in designing the ICAAP. 4.2 The Central Bank therefore expects to see variation in the approaches adopted in the design of the ICAAP as well as in the length and format of the ICAAP documents. 4.3 Aspects of the ICAAP where differences are anticipated include the:- i. methodologies used in measuring/assessing risks and in determining the related internal capital requirement; ii. type and nature of the stress tests adopted; iii. structure of the institution’s risk control systems; and iv. scope and detail of ICAAP reporting. 5. THE ICAAP 5.1 The Central Bank expects that the ICAAP would encourage financial institutions to adopt sufficiently robust techniques to measure risks and evaluate capital that are commensurate with their size, business model, complexity and risks. Quantitative techniques should be accompanied by sound corporate governance and risk management frameworks. Total capital must be consistent with the institution’s risk profile, business model, and operating environment.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 9 | P a g e 5.2 The Board of a financial institution has primary responsibility for the capital management of the institution. This obligation goes beyond the need to ensure compliance with minimum regulatory capital requirements but rather requires the Board to adopt a holistic approach to ensure that the financial institution holds capital commensurate with its risk profile. Consistent with that overarching responsibility, each financial institution is required to have an ICAAP that has been approved by its Board. 5.3 A thorough and comprehensive ICAAP, which includes robust policies, methodologies, techniques and procedures, is a vital component of a strong risk management program. The ICAAP should determine the optimal level of capital required by the institution to support the nature and level of its risk. 5.4 Each financial institution is responsible for developing and implementing its own ICAAP for the purpose of setting internal capital targets and developing strategies for achieving those internal targets that are consistent with its business plans, risk profile and operating environment. Board of directors and senior management should ensure that sufficient resources are allocated for development of a comprehensive ICAAP. 5.5 The ICAAP should be an ongoing process comprising, among other things, strong governance arrangements, efficient processes for managing and mitigating all material risks and an effective regime for assessing and maintaining adequate capital. In particular, the institution’s ICAAP must demonstrate that it has sufficient capital. Capital should be forward looking and it should be sufficient to cover potential losses not only under normal conditions but also under extreme but plausible events (stressed scenarios). 6. KEY ELEMENTS OF A SOUND ICAAP An effective ICAAP should comprise, at a minimum, the following six components: 6.1 Board and Senior Management Oversight; 6.2 Sound Capital Assessment and Planning; 6.3 Comprehensive Assessment of Risks; 6.4 Stress Testing; 6.5 Monitoring and Reporting; and 6.6 Internal Control Review.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 10 | P a g e Each component is discussed in detail in the following paragraphs. 6.1 Board and Senior Management Oversight 6.1.1 A financial institution’s board has the ultimate responsibility for the sound operation and financial condition of the financial institution. While the operationalization of a risk management framework can be delegated to senior management, the board should review and approve the main objectives of the ICAAP and agree on the main assumptions of risk identification and risk measurement. 6.1.2 The financial institution’s ICAAP should be reviewed by senior management at least annually or upon the occurrence of specific trigger events (e.g. where an opportunity for a significant acquisition has emerged). The review should take into account, inter alia, whether the processes relating to the ICAAP successfully achieved the objectives, the continuing relevance of any key components, the reasonableness and validity of any assumptions and scenarios used in the capital assessment process and the validity of the estimated future capital requirements. Any changes in the ICAAP should also be approved by the Board. 6.1.3 The Board has responsibility for setting the financial institution’s risk appetite. The Board must, at least on an annual basis, review the risk appetite and risk tolerance. In setting its risk appetite3 and governance framework, financial institutions should have regard to the guidance is the Central Bank’s Corporate Governance Guideline. Robust governance and reporting frameworks should also be put in place to ensure that the institution’s strategies and decisions align with the stated risk appetite. 6.1.4 The senior management should establish a sound risk management framework that is approved by the Board and ensures a comprehensive assessment of all risks of the financial institution. There should also be a system in place that integrates the financial institution’s assessment of risk into its determination of internal capital needs. The Board and senior management should ensure that the formality and sophistication of the risk management processes are appropriate to the risk profile, size, complexity and business plan of the financial institution. 6.1.5 The Board and senior management should ensure that strong internal controls supported by written policies and procedures are implemented. These should be effectively communicated by senior

3 See Appendix B for detail on the Risk Appetite Statement

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 11 | P a g e management throughout the organization. A method for monitoring compliance with internal policies and procedures should also be established. 6.1.6 The Board and senior management should ensure that the financial institution has adequate internal capital to support all its risks. As part of the ICAAP, capital adequacy planning by the financial institution should relate to the financial institution’s risk. The internal capital determined should enable the financial institution to operate as a going concern and be sufficient to provide for business growth. Internal capital must, at a minimum, meet the regulatory minimum. However, as a matter of prudence the Central Bank generally expects financial institutions to hold an adequate capital buffer above the minimum regulatory capital, commensurate with their individual risk profile and taking into account all material risks and unforeseen events. 6.1.7 The Board is primarily responsible for determining the current and future capital needs of the financial institution taking into account its strategic objectives. Specifically, the institution should, among other things, take into account the institution’s capital needs, anticipated capital expenditures, desirable capital level, and external capital sources. Capital plans should also take into account, the dividend policy and anticipated balance sheet growth and acquisitions. 6.1.8 The Board should ensure that the ICAAP is not merely a compliance activity adopted by the institution. Board and senior management must be clearly involved in the ICAAP and it is expected that the ICAAP is included as an integral part of the management and decision-making culture of the financial institution. 6.2 Sound Capital Assessment and Planning 6.2.1 Capital assessment and planning is a necessary complement to a robust regulatory framework. Sound capital planning is critical for determining the prudent amount, type and composition of capital that is consistent with a long-term strategy that allows for pursuit of business objectives while also withstanding a stress event. 6.2.2 Financial institutions should have a system in place for effective capital assessment that is sufficiently comprehensive, appropriately forward-looking and adequately formalized. Among other things, the capital plan should take into account the strategic objectives/ plans of the institution and be appropriate to the nature of risks posed by its business activities and operating environment.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 12 | P a g e 6.2.3 A sound capital assessment and planning process should enable the Board and senior management to make informed decisions on the appropriate amount and composition of capital needed to support the financial institution’s business strategies across a range of potential scenarios and outcomes. 6.2.4 The fundamentals of a sound capital assessment include: i. a clear and documented process for evaluating risks and determining whether or not a risk should result in an explicit amount of capital being held; ii. policies and procedures designed to ensure that the institution identifies, measures, and reports all material risks requiring capital; iii. a process that relates capital to current and anticipated future levels of risk in accordance with the institution’s risk appetite; iv. a process for determining capital adequacy goals with respect to risk, taking account of the institution’s strategic focus and business plan; and v. a process of internal controls, reviews and audits to ensure the integrity of the overall risk management process. 6.2.5 Financial institutions may design their internal capital assessments in different ways depending upon the size, nature and complexity of operations and level of sophistication of their risk management practices. 6.2.6 The choice of methodology, however, should ensure the institution’s ability to collect the necessary information and to calculate the necessary inputs in a reliable manner. The actual calculation and allocation of internal capital should be supplemented by robust qualitative procedures and measures to identify, manage, control, and monitor all material risks. 6.2.7 The internal capital assessment must demonstrate that the institution has enough capital not only to meet minimum regulatory capital requirements but also to withstand a range of severe but plausible shocks. 6.2.8 Financial institutions as part of their capital planning process should: i. assess both the risks to which they is exposed and the risk management processes in place to manage and mitigate those risks; ii. evaluate its capital adequacy relative to their risks; iii. consider capital needs which may vary over time with economic, financial, or credit cycles; and

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 13 | P a g e iv. consider the potential impact on earnings and capital from potential economic downturns and in particular the effects of a sudden, sustained downturn. 6.2.9 Financial institutions should consider capital needs for multiple time horizons (immediate, medium and long term needs). In addition, for example, they should evaluate whether long-run capital targets are consistent with short-run goals based on current and planned changes in risk profile and the recognition that satisfying additional capital needs can require significant lead time. 6.2.10 Capital planning should factor in the potential difficulties of raising additional capital during downturns or other times of stress. 6.2.11 There are four fundamental components of a sound capital planning process that should be considered: i. internal control and governance; ii. capital policy and risk capture; iii. forward-looking view; and iv. a management framework for preserving capital. Each of the aforementioned elements in 6.2.11 are discussed below:- i. Internal Controls and Governance i. Financial institutions should have in place a formalized capital planning process that is administered through an effective governance structure. ii. Irrespective of how an institution’s capital planning process is designed, it should aim to produce an internally consistent and coherent view of an institution’s current and future capital needs. iii. It is important that a capital planning process reflects the input of different experts from across a financial institution, including but not limited to staff from business, risk, finance and treasury departments. There should be a strong link between the capital planning, budgeting and strategic planning processes of a financial institution. iv. Financial institutions must have a formal process in place to identify situations where competing assumptions are made. In this context, differences in strategic planning and capital allocation across the institution should be escalated for discussion and approval by senior management and, where appropriate, by the Board. v. Capital plans and their underlying processes and models should be subject to regular independent validation.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 14 | P a g e vi. Sound practice typically involves a management committee or similar body that works under the auspices of an institution’s Board and guides and reviews efforts related to capital planning. vii. The Board should set forth the principles that underpin the capital planning process including the forward strategy for the institution, an expression of risk appetite, and a perspective on striking the right balance between reinvesting capital in the operations and providing returns to shareholders. viii. Capital plans should be approved at least annually by the Board or one or more of its committees. ii. Capital policy and risk capture i. Financial institutions should have a written capital policy that is agreed by the senior management and approved by the Board. The capital policy should specify the principles that management will follow in making decisions about how to deploy capital. ii. The capital policy should reference a suite of capital and performance-related metrics against which management monitors the institution including: a. regulatory capital measures e.g. the capital adequacy ratio (“CAR”) and common equity Tier 1 (“CET1”) ratio; and b. return measures e.g. return on equity (ROE), return on risk-adjusted capital (RORAC) and risk-adjusted return on capital (RAROC). iii. Financial institutions should identify triggers and limits for every metric specified in the capital policy. Capital policies should incorporate minimum thresholds that are monitored by managers to ensure that the financial institution remains strong. iv. A monitoring framework should be put in place and complemented by a clear and transparent formal escalation protocol for situations when a trigger or limit is approached and/or breached, at which point a timely decision needs to be taken. v. An important input to a capital policy is an expression of risk tolerance/appetite that should be approved and renewed annually by the Board. iii. Forward-looking view i. Financial institutions should incorporate rigorous, sufficiently severe but plausible, forward-looking stress testing or scenario analyses in their capital planning process as these techniques provide a forward view on the sufficiency of the capital base of a financial institution.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 15 | P a g e ii. An effective capital planning process requires a financial institution to assess the risks to which it is exposed as well as to consider the potential impact on earnings and capital from an assumed economic downturn. Stress testing therefore needs to be an integral component of the capital planning process. iii. Stress testing and scenario analyses provide a view as to how the capitalization of the financial institution could be jeopardized if there were a dramatic institution-specific or economic change. Without such a component, a capital plan would be highly vulnerable, and thus any actions pursuant to it may not adequately insulate the institution against future adverse developments. iv. Stress testing or scenario analyses should incorporate all relevant risks to the financial institution and conservatively capture and account for changes in key risk factors across all portfolios and businesses under appropriately severe forward-looking scenarios. In addition, the institution should have the ability to conduct stress testing on a consistent basis and in ad hoc scenarios outside the normal stress testing procedures. iv. Management Framework for Preserving Capital i. It is important that actions to maintain capital are clearly defined in advance and that the management process allows for plans to be updated swiftly to allow for better decision-making in changing circumstances. ii. For a capital planning process to be meaningful, the Board and senior management should rely on it. In particular, the process should provide information on the degree to which an institution’s business strategy and capital position may be vulnerable to unexpected changes in conditions. iii. The Board and senior management of a financial institution should ensure that the capital policy and associated monitoring and escalation protocols remain relevant alongside an appropriate risk reporting and stress testing framework. iv. Board and senior management are also responsible for prioritizing and quantifying the capital actions available to them to cushion against unexpected events which may include reductions in or cessation of common stock dividends, equity raises and/or balance sheet reductions (e.g. monetizing business units or reducing credit origination). v. Financial institutions should ensure that actions to maintain capital are clearly defined in advance. Guiding principles should therefore be developed for determining the appropriateness of particular actions under different scenarios, which take into account

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 16 | P a g e relevant considerations, such as economic value added, costs and benefits, and market conditions. 6.3 Comprehensive Assessment of Risks 6.3.1 The ICAAP should address all material risks faced by the financial institution. Adequate explanations to justify the conclusions reached on the materiality of risk should be provided (including explanations for risks identified as immaterial). The ICAAP should also consider any additional capital that may be required for the risks identified having regard to the institution’s risk management and mitigation strategies. 6.3.2 Specifically, the ICAAP should explicitly address risks included under the minimum regulatory capital requirements (i.e. credit, market and operational risks under Pillar 1) as well as risks not captured (or not adequately captured) under Pillar 1. External risks, for example, those arising from business cycle effects and the macroeconomic environment should also be considered. The techniques used in assessing material risks should be commensurate with the nature, scope and complexity of the institution’s activities. 6.3.3 Financial institutions must demonstrate how they combine their risk measurement approaches to arrive at the overall internal capital for the respective risks. 6.3.4 The sections below provide guidance on risks that the Central Bank expects to be addressed in the ICAAP, including credit risk, market risk, interest rate risk in the banking book and credit concentration risk. However, this is not intended to be an exhaustive list of risks and financial institutions are to include in their capital assessment any other material risks to which they are exposed. Institutions should also be mindful of the capital adequacy effects of concentrations which may arise within each risk type. Credit Risk 6.3.5 Financial institutions should have methodologies that enable them to assess the credit risk of exposures to individual borrowers or counterparties as well as at the portfolio level. 6.3.6 The credit review of capital adequacy should cover (where relevant) the following four areas:

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 17 | P a g e i. risk rating systems; ii. portfolio analysis/ aggregation; iii. large exposures and risk concentrations; and iv. securitization and complex structured instruments. 6.3.7 Internal risk ratings are an important tool in monitoring credit risk. The internal risk ratings must support the identification and measurement of risk from all credit exposures, as well as being integrated into the overall analysis of credit risk and capital adequacy of the financial institution. 6.3.8 The credit review process must be comprehensive and, at a minimum, have the ability to: i. generate detailed internal ratings for all credit exposures; ii. determine an adequate level of loan loss reserves and provisions for losses in other assets held; iii. identify credit weakness at the portfolio level, especially large exposures and credit risk concentrations; and iv. consider the risks involved in securitization programmes and complex credit derivative transactions. 6.3.9 The sophistication of the methodologies used to quantify credit risk should be appropriate to the scope and complexity of the institution’s credit risk taking activities. Less complex credit risk taking activities may incorporate a variety of methodologies but should, at minimum, take into consideration: i. historical loss experience; ii. forecast and past economic conditions; iii. attributes specific to a defined group of borrowers; and iv. other characteristics directly affecting the collectability of a pool or portfolio of loans. Cross Border Lending 6.3.10 Financial institutions that engage in cross border lending are subject to increased risk including country risk, concentration risk, foreign currency risk (market risk) as well as regulatory, legal, compliance and operational risks, all of which should be reflected in the ICAAP. 6.3.11 Laws and regulatory actions in foreign jurisdictions could make it much more difficult to realize assets and security in the event of a default. Where regulatory, legal and compliance risks associated with

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 18 | P a g e concentrations in cross border lending are not considered elsewhere in an institution’s risk assessment process, additional capital may be required for this type of lending in an institution's ICAAP. 6.3.12 Financial institutions must have credit risk mitigation (“CRM”) techniques in place which are approved by the Board. These may include altering business strategies, reducing limits or increasing capital buffers in line with the desired risk profile. Institutions must consider possible concentrations that might arise as a result of employing risk mitigation techniques. 6.3.13 While financial institutions use CRM techniques to reduce their credit risk, these techniques potentially give rise to residual risks that may render overall risk reduction less effective. Examples of these risks include legal risk and documentation risk. In assessing its CRM strategies, financial institutions should ensure that these residual risks are measured, monitored and reported. A capital charge should be applied. Securitization 6.3.14 Where securitization activities4 are material, an institution’s ICAAP needs to consider the risks arising from originating, structuring, distributing and/or investing in such assets, both on and off balance sheet, including risks that are fully captured in minimum regulatory capital requirements. These may include, for example, reputational risk. 6.3.15 Asset performance may cause assets to return to the balance sheet through amortization and repurchase. Disruptions in market demand for asset-backed paper may leave assets in securitization pipelines on the balance sheet or force the originator to support its own paper. These have adverse implications for capital and liquidity that should be part of the institution’s capital and liquidity planning. 6.3.16 Financial institutions should develop prudent contingency plans specifying how it would respond to capital pressures that arise when access to securitization markets is reduced. The contingency plans should also address how the institution would address valuation challenges for potentially illiquid positions held for sale or for trading. The risk measures, stress testing results and contingency plans should be incorporated into the institutions’ risk management processes and ICAAP and should result

4 E.g. securitization of own-assets for risk transfer and/or funding; provision of backstop credit facilities to third-party conduits and the provision of non-contractual or implicit support to securitization vehicles. Credit Risk Mitigation

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 19 | P a g e in an appropriate level of capital under Pillar 2 in excess of the minimum requirements commensurate with the Board’s stated risk appetite/tolerance. Operational Risk 6.3.17 The failure to properly manage operational risk can result in a misstatement of an institution’s risk/return profile and expose the institution to significant losses. Financial institutions should therefore develop a robust framework for managing operational risk and evaluate the adequacy of capital given this framework. 6.3.18 The framework must cover the institution’s appetite and tolerance for operational risk, as specified through the policies for managing this risk. This would include the extent and manner in which operational risk is transferred outside the institution, for example, by insurance. It should also include policies outlining the institution’s approach to identifying, assessing, monitoring and controlling/mitigating the risk. 6.3.19 Financial institutions should be able to assess the potential risks resulting from inadequate or failed internal processes, people, and systems, as well as from events external to the bank (for example cyber-attacks). This assessment should include the effects of extreme events and shocks relating to operational risk. Events could include a sudden increase in failed processes across business units or a significant incidence of failed internal controls. Market Risk 6.3.20 Financial institutions should have methodologies that enable them to assess and actively manage all material market risks, wherever they arise throughout the institution (i.e. position, trading desk, business line or firm-level). 6.3.21 Financial institutions should be able to identify risks in trading activities resulting from a movement in market prices. This determination should consider factors such as illiquidity of instruments, concentrated positions, one-way markets, non-linear/deep out-of-the money positions, and the potential for significant shifts in correlations. Exercises that incorporate extreme events and shocks should also be tailored to capture key portfolio vulnerabilities to the relevant market developments.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 20 | P a g e 6.3.22 For more sophisticated financial institutions, the assessment of internal capital adequacy for market risk, at a minimum, should be based on appropriate models including value-at-risk (VaR) or similar modelling and stress testing, including an assessment of concentration risk and the assessment of illiquidity under stressful market scenarios. 6.3.23 Stress tests applied by a financial institution and, in particular, the calibration of those tests (e.g. the parameters of the shocks or types of events considered) should be reconciled to a clear statement setting out the premise upon which the institution’s internal capital assessment is based. 6.3.24 The market shocks applied in stress tests must reflect the nature of portfolios and the time it could take to hedge out or manage risks under severe market conditions. 6.3.25 Concentration risk should be pro-actively managed and assessed and concentrated positions should be routinely reported to senior management. Concentration Risk 6.3.26 Financial institutions should explicitly consider the extent of their credit risk concentrations in their assessment of capital adequacy under Pillar 2. The assessment of concentration risk in an institution’s ICAAP should not be a mechanical process, but one in which each financial institution determines, in the context on its business model, its own specific vulnerabilities. An appropriate level of capital for risk concentrations should also be incorporated in the institution’s ICAAP. 6.3.27 A risk concentration is any single exposure or group of similar exposures (e.g. to the same borrower or including protection providers, geographic area, industry or other factors) with the potential to produce:- (a.) losses large enough (relative to an institution’s earnings, capital, total assets or overall risk level) to threaten the financial institution’s creditworthiness or ability to maintain its core operations; or (b.) a material change in the institution’s risk profile. 6.3.28 Financial institutions should be able to identify and aggregate similar risk exposures across the firm, including across legal entities, asset types (e.g. loans, derivatives and structured products), and risk areas (e.g. the trading and geographic regions). They should carefully assess the various sources of credit concentration risk. The typical situations in which risk concentrations arise include:

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 21 | P a g e (a.) exposures to a single counterparty, borrower or group of connected counterparties or borrowers; (b.) exposures to industry or economic sectors, including exposures to regulated and non￾regulated financial institutions, hedge funds and private equity firms; (c.) geographical regions; (d.) exposures arising from credit risk mitigation techniques, including exposure to similar collateral types or to a single or closely related credit protection provider; (e.) trading exposures/market risk; (f.) exposures to counterparties (e.g. hedge funds and hedge counterparties) through the execution or processing of transactions (either product or service); (g.) funding sources; (h.) assets that are held the banking book or trading book, such as loans, derivatives and structured products; and (i.) off-balance sheet exposures, including guarantees, liquidity lines and other commitments. 6.3.29 While risk concentrations often arise due to direct exposures to borrowers and obligors, a financial institution may also incur a concentration to a particular asset type indirectly through investments backed by such assets (e.g. collateralized debt obligations), as well as exposure to protection providers guaranteeing the performance of the specific asset type (e.g. mono-line insurers). 6.3.30 Risk concentrations should be viewed in the context of a single or a set of closely related risk-drivers that may have different impacts on a financial institution. These concentrations should be integrated when assessing an institution’s overall risk exposure. A financial institution should consider concentrations that are based on common or correlated risk factors that reflect more subtle or more situation-specific factors than traditional concentrations, such as correlations between market, credit risks and liquidity risk. 6.3.31 Financial institutions should be particularly attentive to identifying credit risk concentrations and ensuring that their effects are adequately assessed. In particular, financial institutions should have in place effective internal policies, systems and controls to identify, measure, monitor, control and mitigate their risk concentrations in a timely manner. Not only should normal market conditions be considered, but also the potential build-up of concentrations under stressed market conditions, economic downturns and periods of general market illiquidity.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 22 | P a g e 6.3.32 In addition, financial institutions should consider the various types of dependence among exposures and assess scenarios that consider possible concentrations arising from contractual and non￾contractual contingent claims. The scenarios should also combine the potential build-up of pipeline exposures together with the loss of market liquidity and a significant decline in asset values. 6.3.33 When conducting stress tests, a financial institution should incorporate all major risk concentrations and consider potential changes in market conditions which could adversely impact its performance and capital adequacy. 6.3.34 Risk concentrations should be analyzed on both an individual and consolidated basis. Credit concentration risk calculations shall be performed at the counterparty level (i.e. large exposures), at the portfolio level (i.e. sectoral and geographical concentrations) and at the asset class level (i.e. liability and assets concentrations). 6.3.35 The framework for managing credit risk concentrations should be clearly documented and should include a definition of the credit risk concentrations relevant to the financial institution and how these concentrations and their corresponding limits are calculated. Limits should be defined in relation to an institution’s capital, total assets or, where adequate measures exist, its overall risk level. 6.3.36 Financial institutions should ensure that there are procedures in place to communicate risk concentrations to the Board and senior management in a manner that clearly indicates where in the institution each segment of a risk concentration resides. 6.3.37 There could be several approaches to the measurement of credit concentration in the financial institution’s portfolio. Approaches include ratios, the Herfindahl-Hirshman Index (HHI) or the Gini Co￾efficient. Financial institutions, however, are free to adopt any method which is appropriate to the institution’s risk and risk profile and which has objective and transparent criteria for such measurement. Interest Rate Risk in the Banking Book (IRRBB) 6.3.38 Financial institutions must be familiar with all elements of IRRBB, actively identify their IRRBB exposures and take appropriate steps to measure, monitor and control it.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 23 | P a g e 6.3.39 In particular, the measurement process should include all material interest rate positions of the financial institution and consider all relevant repricing and maturity data. Such information will generally include current balance and contractual rate of interest associated with the instruments and portfolios, principal payments, interest reset dates, maturities, the rate index used for repricing, and contractual interest rate ceilings or floors for adjustable-rate items. The system should also have well￾documented assumptions and techniques. 6.3.40 Financial institutions must identify the IRRBB inherent in all products and activities, and ensure that these are subject to adequate procedures and controls. Significant hedging or risk management initiatives must be approved by the Board before being implemented. 6.3.41 The management of IRRBB should be integrated within the broad risk management framework of the financial institution and aligned with its business planning and budgeting activities5 . 6.3.42 The Board and senior management have responsibility for understanding the nature and the level of the IRRBB exposure of the financial institution. The Board should approve broad business strategies as well as overall policies with respect to IRRBB. The IRRBB policies should be documented and should include clear guidance regarding the acceptable level of IRRBB, given the institution’s business strategies. 6.3.43 In measuring IRRBB, financial institutions should take into account a wide and appropriate range of interest rate shock and stress scenarios. The institution’s ability to generate stable earnings sufficient to maintain its normal business operations should also be considered. 6.3.44 Financial institutions are responsible for determining the optimal level of capital to support their operations and should ensure that it is sufficient to cover IRRBB and its related risks. Liquidity Risk 6.3.45 Liquidity is critical to the ongoing viability of a financial institution. Liquidity risk may impact capital adequacy. Therefore, Board and senior management should consider the relationship between liquidity and capital. For example, banks’ capital positions can affect their ability to obtain liquidity, especially in a crisis. Each financial institution must therefore have adequate systems in place for

5 Details on the risk management framework for IRRBB will be included in the Central Bank’s “Guideline for Interest Rate Risk in the Banking Book”

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 24 | P a g e measuring, monitoring, and controlling liquidity risk. Banks should evaluate the adequacy of capital given their own liquidity profile and the liquidity of the markets in which they operate.6 Other Risks/Considerations 6.3.46 The Central Bank requires the internal capital allocation process of financial institutions to cover all risk, which, though not identified above, are material for the institution for example, strategic risk, reputational risk, pension risk, country risk, settlement risk, and residual risk. Although additional risks such as strategic and reputational risk are not easily measurable, financial institutions should develop techniques for evaluating and managing all aspects of their risks. A. REPUTATIONAL RISK (a.) Reputational risk often arises because of inadequate management of other risks including insurance, market, credit, and operational risks, whether they are associated with direct or indirect involvement in the sale or origination of complex financial transactions or relatively routine operational activities. (b.) Reputational risk can lead to the provision of implicit support7, which may give rise to credit, liquidity, market and legal risk – all of which can have a negative impact on an institution’s earnings, liquidity and capital position. (c.) An institution should identify potential sources of reputational risk to which it is exposed. This includes the institution’s business lines, liabilities, affiliated operations, off-balance sheet vehicles and markets in which it operates. The risks that arise should be incorporated into the institution’s risk management process and appropriately addressed in its ICAAP and liquidity contingency plans. (d.) Financial institutions should have in place appropriate policies to identify sources of reputational risk when entering new markets, products or lines of activities. In addition, an institution’s stress

6 Refer to Principles for Sound Liquidity Risk Management and Supervision-2008 7 For example, in stressed conditions institutions may go beyond their contractual obligations to support their sponsored securitizations and off-balance sheet instruments. Further, where an institution sponsors activities such as money market mutual funds, in-house hedge funds and real estate investment trusts (REITs) it may decide to support the value of shares/units held by investors even though is not contractually required to provide the support.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 25 | P a g e testing procedures should take account of reputational risk so management has a firm understanding of the consequences and second round effects of reputational risk. (e.) Financial institutions should pay particular attention to the effects of reputational risk on their overall liquidity position, taking into account both possible increases in the asset side of the balance sheet and possible restrictions on funding, should the loss of reputation result in various counterparties’ loss of confidence. B. PARENT / GROUP RISK (a.) The importance of the parent’s or group’s financial strength is such that it should be addressed separately in the ICAAP including the ability of the parent / group to provide capital or liquidity support as may be appropriate. (b.) Where relevant, the risk arising from direct counterparty exposure to the parent should also be addressed including the impact on credit RWAs if a credit rating downgrade were to occur (and the likelihood of such a downgrade having a material effect on the institution’s RWAs and capital adequacy). C. STRATEGIC/BUSINESS RISK (a.) Strategic/business risks may impact on the capital of a financial institution as a result of adverse business decisions, improper implementation of those decisions, or a lack of responsiveness to political, fiscal, regulatory, economic, cultural, market or industry changes. (b.) Financial institutions should constantly review and assess the compatibility of their strategic goals with the prevailing environment in which they have material operations. There will be both quantitative and qualitative dimensions to the resources needed to carry out business strategies. These include effective communication channels, efficient operating systems, reliable delivery networks, and good quality management and staff. (c.) Quantitative considerations in the assessment of strategic risk may include, for example, operating expenses (for example as percentage (%) of operating income) and loans (both performing and non-performing). Qualitative considerations may include growth plans in areas such as deposits, loans/advances, profits, or expansion in cross border activity.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 26 | P a g e D. PENSION RISK (a.) Financial institutions that offer pensions must have in place appropriate systems for measuring, monitoring and controlling pension obligation risk and its impact on liquidity and profitability. Similarly, financial institutions that manage or provide trustee services for pension plans must also have adequate systems in place to ensure that these plans are administered appropriately from an operational and reputational standpoint. In assessing the level of risk, there should be a well-founded projection to evaluate the corresponding Pillar 2 capital charge. E. CLIMATE RISK (a.) The linkages between climate change and financial system risk are becoming increasingly evident and present unique challenges for financial institutions. For example, climate change may exacerbate credit, market, operational and reputational risk for financial institutions. (b.) The risks to financial institutions on account of climate change are far reaching, have uncertain and extended time horizons and have the potential to significantly impact business operations. It is therefore important, given the nature of climate risk, that institutions adopt a strategic, holistic and long-term approach, considering how climate-related risks might impact all aspects of their risk profile. (c.) Financial institutions should embed climate risk in their overall risk management framework. As a result, the institution’s policies, systems, management information and risk reports to the Board should reflect climate risk considerations. Specifically, the risk management framework should include robust structures to identify, measure, monitor, manage and report on exposure to climate risk. (d.) The institution’s ICAAP should incorporate a climate risk assessment of the financial institution. At a minimum, the institution should evaluate its portfolios and determine the materiality of the risks which may emanate from a climate event. (e.) The assessment should also consider the likely impact of climate events on all aspects of the operations of the financial institution. The likelihood of such climate risk events should also be ascertained. A contingency plan should also be developed to formalize the course of action that would be taken in the event of a climate event occurring.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 27 | P a g e (f.) Institutions should utilize scenario analysis to enable testing of their resilience to climate change events. In particular, climate risk related scenarios, using appropriate assumptions, should be incorporated into the institution’s stress testing framework. This should enable the institution to ascertain the potential loss and overall impact of possible climate events. This information along with the general assessment of the impact of climate change should inform decision making by the Board and senior management. F. VALUATION PRACTICES (a.) Financial institutions are expected to have adequate governance structures and control processes for fair valuing of exposures for risk management and financial reporting purposes. The valuation governance structures and related processes should be embedded in the overall governance structure of the institution and consistent for both risk management and reporting purposes. (b.) The governance structures and processes are expected to explicitly cover the role of the Board and senior management. In addition, the Board should receive reports from senior management on the valuation oversight and valuation model performance issues as well as all significant changes to valuation policies. (c.) Financial institutions should also have clear and robust governance structures for the production, assignment and verification of financial instrument valuations. Policies should ensure that the approvals of all valuation methodologies are well documented. In addition, policies and procedures should set out the range of acceptable practices for the initial pricing, marking-to￾market/model, valuation adjustments and periodic independent revaluation. (d.) New product approval processes should include all internal stakeholders relevant to risk measurement, risk control, and the assignment and verification valuations of financial instruments. (e.) Financial institutions should have control processes in place for measuring and reporting valuations that are consistently applied across the institution and integrated with risk measurement and management processes. In particular, controls should be applied consistently across similar instruments (risks) and consistent across business lines (books). These controls should be subject to internal audit. Regardless of the booking location of a new product, reviews and approval of valuation methodologies must be guided by a minimum set of considerations.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 28 | P a g e (f.) Further, the valuation/new product approval process should be supported by a transparent, well￾documented inventory of acceptable valuation methodologies that are specific to products or businesses. (g.) To establish and verify valuations for instruments and transactions in which it engages, a financial institution must have adequate capacity, including during periods of stress. This capacity should be commensurate with the importance, riskiness and size of these exposures in the context of the business profile of the institution. (h.) In addition, for those exposures that represent material risk, financial institutions are expected to have the capacity to produce valuations using alternative methods in the event that primary inputs and approaches become unreliable, unavailable or not relevant due to discontinuities or illiquidity. Financial institutions must test and review the performance of its models under stress conditions so that it understands limitations of the models under stress conditions. (i.) The relevance and reliability of valuations is directly related to the quality and reliability of the inputs. Financial institutions are expected to apply the accounting guidance provided to determine the relevant market information and other factors likely to have a material effect on an instrument's fair value when selecting the appropriate inputs to use in the valuation process. (j.) Where values are determined to be in an active market, a financial institution should maximize the use of relevant observable inputs and minimize the use of unobservable inputs when estimating fair value using a valuation technique. However, where a market is inactive, transactions may not be observable or observable inputs or transactions may not be relevant, such as in forced liquidation or distressed sale. In such cases, accounting fair guidance provides assistance on what should be considered, but may not be determinative. (k.) In assessing whether a source is reliable a financial institution should consider, among other things: a. the frequency and availability of the prices/quotes; b. whether those prices represent actual regularly occurring transactions on an arm's length basis; c. the breadth of the distribution of the data whether it is generally the relevant participants in the market;

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 29 | P a g e d. the timeliness the information relative to the frequency of valuations; e. the number of independent sources that produce the quotes/prices; f. whether the quotes/prices are supported by actual transactions; g. the maturity of the market; and h. the similarity between the financial instrument sold in a transaction and the instrument by the institution. (l.) A financial institution’s external reporting should provide timely, relevant, reliable and decision￾useful information that promotes transparency. Senior management should consider whether disclosures around valuation uncertainty can be made more meaningful. For instance, the financial institution may describe the modelling techniques and the instruments to which they are applied, the sensitivity of fair values to modelling inputs and assumptions and the impact of stress scenarios on valuations. G. SOUND COMPENSATION PRACTICES (a.) For a broad and deep risk management culture to develop and be maintained over time, compensation policies must not be unduly linked to short-term accounting profit generation. Compensation policies should be linked to longer-term capital preservation and the financial strength of the institution, and should consider risk-adjusted performance measures. (b.) The Board and senior management of a financial institution have the responsibility to mitigate the risks arising from remuneration policies in order to ensure effective risk management. (c.) The Board of a financial institution must actively oversee the compensation system’s design and operation that should not be controlled primarily by the chief executive officer and management team. Relevant board members and employees must have independence and expertise in risk management and compensation. (d.) In addition, the Board must monitor and review the compensation system to ensure the system includes adequate controls and operates as intended. The practical operation of the system should be regularly reviewed to ensure compliance with policies and procedures. Compensation outcomes, risk measurements and risk outcomes should be regularly reviewed for consistency with intentions.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 30 | P a g e (e.) Staff that are engaged in the financial and risk control areas must be independent, have appropriate authority and be compensated in a manner that is independent of the business areas they oversee and commensurate with their key role in the firm. Effective independence and appropriate authority of such staff is necessary to preserve the integrity of financial and risk management’s influence on incentive compensation. (f.) Compensation must be adjusted for all types of risk so that remuneration is balanced between the profit earned and the degree of risk assumed in generating the profit. In general, both quantitative measures and human judgment should play a role in determining the appropriate risk adjustments, including those that are difficult to measure such as liquidity risk and reputation risk. (g.) Compensation outcomes must be symmetric with risk outcomes and compensation systems should link the size of the bonus pool to the overall performance of the institution. Employees’ incentive payments should be linked to the contribution of the individual and business to the financial institution’s overall performance. (h.) The mix of cash, equity and other forms of compensation must be consistent with risk alignment. The mix will vary depending on the employee’s position and role. The financial institution should be able to explain the rationale for its mix. H. RISK AGGREGATION AND DIVERSIFICATION BENEFITS (a.) An effective ICAAP should assess the risks across the entire financial institution. A financial institution choosing to conduct risk aggregation among various risk types or business lines should understand the challenges in such aggregation. (b.) When aggregating risks, financial institutions should ensure that any potential concentrations across more than one risk dimension are addressed, given that losses could arise in several risk dimensions simultaneously, stemming from the same event or a common set of factors. For example, a localized natural disaster could generate losses from credit, market, and operational risks at the same time. (c.) A financial institution should have systems capable of aggregating risks based on its selected framework. For example, a financial institution calculating correlations among risk types should

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 31 | P a g e consider data quality and consistency, and the volatility of correlations over time and under stressed market conditions. (d.) Financial institutions should also exercise caution when including risk diversification benefits in their ICAAP. In considering the possible effects of diversification, management should be systematic and rigorous in documenting decisions and in identifying assumptions used at each level of risk aggregation. Assumptions on diversification are often based on expert judgment and are difficult to validate. (e.) Financial institutions should exercise caution in their assessment of diversification benefits, in particular between different classes of risk, and should consider whether such benefits exist under stressed conditions. Irrespective of the methodology chosen, assumed correlations are likely to deviate during times of stress, leading to underestimation of capital. Consequently, inter￾risk diversification benefits may not be considered and associated uncertainty in aggregating capital estimates across risk types and business lines should translate into greater capital needs. 6.4 STRESS TESTING 6.4.1 Stress testing is an important tool that should be used by financial institutions as part of their internal risk management. In particular, stress testing alerts the management of an institution to adverse unexpected outcomes related to a broad variety of risks and provides an indication of how much capital might be needed to absorb losses should large shocks occur. 6.4.2 Stress testing also supplements other risk management approaches and measures. In particular, it plays an important role in: i. providing forward looking assessments of risk; ii. overcoming limitations of models and historical data; iii. supporting internal and external communication; iv. feeding into capital and liquidity planning procedures; v. informing the setting of an institution’s risk tolerance; vi. addressing existing or potential, institution-wide risk concentrations; and vii. facilitating the development of risk mitigation or contingency plans across a range of stressed conditions.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 32 | P a g e 6.4.3 Stress testing should be undertaken by a financial institution to improve its understanding of the vulnerabilities that it faces under adverse conditions. The stress tests should incorporate the analysis of the impact of a range of events of varying nature, severity and duration. Events may be economic, financial, operational, legal or relate to any risk that might have an impact on the institution. 6.4.4 Financial institutions are therefore expected to have in place appropriate stress testing processes. These should form an integral part of the governance and risk management culture of a financial institution and should be reflected in the ICAAP. 6.4.5 The role of the Board and senior management is critical to ensuring the appropriate use of stress testing in the risk governance and capital planning of financial institutions. Among other things, the Board and senior management should be involved in setting the stress testing objectives and defining the scenarios. 6.4.6 Stress test results should also contribute to strategic decision making by the Board and senior management and foster discussion regarding assumptions such as the cost, risk and speed with which new capital could be raised or positions hedged or sold. Institutions may also use reverse stress testing to supplement stress testing exercises. 6.4.7 Reverse stress testing is a risk management tool used to increase a financial institution’s awareness of its business model vulnerabilities. Reverse stress testing should be appropriate to the nature, size and complexity of the institution’s business plans and of the risks it bears. 6.4.8 Where reverse stress testing reveals that a financial institution’s risk of business failure is unacceptably high, the financial institution should devise realistic measures to prevent or mitigate the risk of business failure, taking into account the time that it would have to react to these events and implement those measures. 6.4.9 In carrying out its reverse stress testing, a financial institution should consider scenarios in which the failure of one or more of its major counterparties or a significant market disruption arising from the failure of a major market participant, whether or not combined, would cause the financial institution to fail.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 33 | P a g e 6.4.10 A financial institution’s capital planning process should incorporate rigorous, forward looking stress testing that identifies possible events or changes in market conditions that could adversely impact the institution. 6.4.11 Under the ICAAP, financial institutions should examine future capital resources and capital requirements under adverse scenarios. In particular, the results of forward-looking stress testing should be considered when evaluating the adequacy of an institution’s capital buffer. Capital adequacy should be assessed under stressed conditions against a variety of capital ratios, including regulatory ratios, as well as ratios based on the institution’s internal definition of capital resources. In addition, the possibility that a crisis impairs the ability of even very healthy institutions to raise funds at reasonable cost should be considered. 6.4.12 A financial institution should use the results of its stress testing not only to assess capital needs, but also to determine the measures that should be put in place to minimize the adverse effect of any of the risks covered by the stress tests. 6.4.13 While stress testing has a leading role to play in strengthening corporate governance and the resilience of individual financial institutions and the financial system, on its own it cannot address all risk management weaknesses. Stress testing should be a part of a comprehensive risk management framework. 6.4.14 The Central Bank expects that the number of scenarios used in stress testing exercises will vary depending nature of the operations of the financial institution. As a minimum, however, institutions are expected to identify at least one systemic or market-wide scenario and at least one idiosyncratic or group/institution-specific scenario. 6.5 MONITORING AND REPORTING 6.5.1 Financial institutions should establish an adequate system for monitoring and reporting risk exposures and assessing how changes to their risk profile affects the need for capital. In particular, senior management should receive regular reports on an institution’s risk profile and capital needs. 6.5.2 These reports should allow senior management to: i. evaluate the level and trend of material risks and their effect on capital levels;

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 34 | P a g e ii. evaluate the sensitivity and reasonableness of assumptions used in the capital assessment measurement system; iii. determine that the institution holds sufficient capital for its various risks and is in compliance with established capital adequacy goals; and iv. assess the future capital requirements based on the institution’s reported risk profile and make necessary adjustments to the institution’s strategic plan accordingly. 6.5.3 The Board should, at least once a year, assess and document whether the processes relating to the ICAAP implemented by the financial institution successfully achieve the objectives that it envisaged. 6.5.4 Senior management should also receive and review the reports regularly (at least annually) to evaluate the sensitivity of the key assumptions and to assess the validity of the institution’s estimated future capital requirements. In light of such an assessment, appropriate changes in the ICAAP should be instituted to ensure that the underlying objectives are effectively achieved. Management Information Systems (MIS) 6.5.5 Financial institutions should have management information systems (MIS) that are commensurate with their size, complexity and risk. 6.5.6 The MIS should facilitate timely, adequate and accurate identification, measurement and monitoring of risks by Senior Management. It should also allow for reporting to the Board with regards to the bank’s risk profile and capital needs. To achieve this, the MIS should: (a.) enable risks to be aggregated across business lines, as well as support customized identification of concentrations and emerging risks; (b.) facilitate evaluation of the impact of various economic and financial shocks; (c.) be adaptable and responsive to changes in underlying risk assumptions; (d.) incorporate multiple perspectives of risk exposure to account for uncertainties in risk measurement; and (e.) have the capacity to capture limit breaches and be supported by procedures to report and rectify such breaches.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 35 | P a g e 6.6 INTERNAL CONTROLS REVIEW 6.6.1 The internal control structure of a financial institution is essential to the capital assessment process. Effective control of the capital assessment process includes an independent review and, where appropriate, the involvement of internal or external audits. 6.6.2 The Board of a financial institution has a responsibility to ensure that management establishes a system for assessing the various risks, develops a system to relate risk to the institution’s capital level, and establishes a method for monitoring compliance with internal policies. The Board should regularly verify whether its system of internal controls is adequate to ensure well-ordered and prudent conduct of the business. 6.6.3 A financial institution should conduct periodic reviews of its risk management process to ensure its integrity, accuracy, and reasonableness. Areas that should be reviewed include: i. the appropriateness of the institution’s capital assessment process given the nature, scope and complexity of its activities; ii. identification of large exposures and risk concentrations; iii. accuracy and completeness of data inputs into the institution’s assessment process; iv. reasonableness and validity of scenarios used in the assessment process; and v. stress testing and analysis of assumptions and inputs. 7. GROUP ICAAPS 7.1 Where relevant, the ICAAP of a financial institution should also take into account the risks to which that institution is exposed due to its membership in a broader group. These risks include contagion risks, counterparty risks, reputational risks and risks related to operational dependencies such as shared functions and systems. Assessment of capital resources at a group level will need to have regard to the transferability of capital between group entities in a range of market conditions. 7.2 A financial institution may make use of a group ICAAP (i.e. the ICAAP produced at the parent level) or components of that ICAAP. However, where this is the case, the ICAAP must adequately identify the risks and capital needs of each licensed or regulated institution in the group. Further, the Board of each regulated entity in the group is still required to ensure that the Group ICAAP is appropriate and meets the requirements of the capital standards in relation to the regulated institution.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 36 | P a g e 8. SETTING THE TARGET CAPITAL LEVEL 8.1 A key component of an ICAAP is the setting of target levels of capital. Financial institutions as part of the ICAAP should set capital targets based on its own assessments of its capital needs8 . Both the quantity and quality of capital should be assessed. 8.2 An institution should consider both bottom-up (for example, by summing capital amounts for individual risks) and top-down (for example, via stress testing of the overall capital position) perspectives on the adequacy and composition of its capital. 8.3 The Board should satisfy itself that the capital targets set are in line with the institution’s risk appetite. In addition, the following should be taken into account in setting capital targets: (a.) regulatory capital requirements; (b.) internal assessments of capital needs, including those arising from the institution’s business plans and strategy; (c.) the likely volatility of profit and the capital surplus; (d.) the dividend policy; (e.) where relevant, ratings agency assessments; and (f.) access to additional capital. 9. DOCUMENTING THE ICAAP 9.1 The ICAAP must be documented, including methodologies, assumptions, procedures, responsibilities. The financial institution’s capital plan must also be documented and submitted as an appendix to the ICAAP. A periodic review (at least annual) of the ICAAP should be carried out by the Board. 9.2 For all financial institutions, the first ICAAP submission will be due by January 31, 2022 using data from the most recent audited financial year end. Thereafter, financial institutions will be required to submit the ICAAP within four (4) months of their financial year end, with such frequency as indicated in section 9.3 below, based on the principle of proportionality.

8 The target capital should not be less than the regulatory capital requirement under Pillar 1

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 37 | P a g e 9.3 The frequency for submission of the fully documented ICAAP will be based on the type of financial institution as follows: (a.) Domestic systemically important banks, FHCs, other banking groups9 would be required to submit a group ICAAP to the Central Bank annually within four months of their financial year end; (b.) All other commercial banks and selected non-banks should submit the ICAAP every two years, within four months of their financial year end. The non-banks to which this may be applicable will be determined and communicated after the first round of ICAAP submissions; and (c.) All other non-banks, should submit the ICAAP every three years, within four months of their financial year end. 9.4 Notwithstanding the aforementioned schedule for submission of the ICAAP, financial institutions should consistently monitor their internal and external environment and business operations to determine issues that may impact the ICAAP and associated capital targets. 9.5 A financial institution may be requested by the Central Bank to submit an updated ICAAP outside of the aforementioned timelines should there be any major change to its business’ model, operations, markets, or the economy or any other aspect that may significantly impact the risk profile. 9.6 The documented ICAAP should be supported by, at a minimum, the following documents/ processes: (a.) capital plan; (b.) business model; (c.) business and strategic plans; (d.) risk governance and risk management frameworks; (e.) risk appetite statement; (f.) stress-testing framework; (g.) risk data, including key risk indicators; (h.) any aggregation methodologies; (i.) details of the information technology systems; and (j.) internal audit reports covering the ICAAP.

9 This would apply whether the parent of the group is a bank or non-bank financial institution licensed under the FIA 2008.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 38 | P a g e 10. SUPERVISORY REVIEW OF THE ICAAP 10.1 The Central Bank will review the process by which a financial institution assesses its capital adequacy, risk position, resulting capital levels, and quality of capital held. The Central Bank will also evaluate the degree to which a financial institution has in place a sound internal process to assess capital adequacy. In keeping with the principle of proportionality, the frequency of these reviews will be based on the type of financial institution, in line with the frequency of its ICAAP submissions. 10.2 The Central Bank will place particular emphasis on the quality of the risk management and controls of a financial institution which may be assessed by any combination of: (a.) on-site examinations or inspections; (b.) off-site review; (c.) discussions with management of the financial institution; (d.) review of work done by internal or external auditors (provided it is adequately focused on the necessary capital issues); and (e.) periodic reporting. 10.3 The review and assessment of an institution’s ICAAP will form a significant part of the Central Bank’s risk-based supervisory model. The review will reflect the principle of proportionality as it relates to the nature, scale and complexity of the activities and the risks posed to the Central Bank’s supervisory objective of preserving safety and soundness of financial institutions. 10.4 The Central Bank will assess the degree to which internal targets and processes incorporate the full range of material risks faced by the financial institution. The Central Bank will also review the adequacy of risk measures used in assessing internal capital adequacy and the extent to which these risk measures are used operationally in setting limits, evaluating business line performance, and evaluating and controlling risks more generally. 10.5 The Central Bank will consider the results of sensitivity analyses and stress tests conducted by the institution and how these results relate to capital plans. 10.6 The Central Bank will review the financial institution’s processes to determine that: (a.) target levels of capital determined by the financial institution are comprehensive and relevant to the current operating environment; (b.) these levels are properly monitored and reviewed by senior management; and

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 39 | P a g e (c.) the composition of capital is appropriate for the nature and scale of the business of the financial institution. 10.7 The Central Bank will also consider the extent to which the financial institution has provided for unexpected events in setting its capital levels. This analysis should cover a wide range of external conditions and scenarios. The sophistication of techniques and stress tests used should be commensurate with the financial institution’s activities. 10.8 For specific areas under the Standardized Approach to be recognized for regulatory capital purposes such as operational risk, credit risk mitigation techniques and asset securitizations, financial institutions are required to meet a number of minimum requirements, including risk management standards and disclosures. The Central Bank will review the institution’s adherence to these minimum standards and qualifying criteria as an integral part of the supervisory review process. 10.9 In conducting its ICAAP reviews, the Central Bank will have regard to, inter alia, the:- (a.) soundness of the overall ICAAP given the nature and scale of business activities; (b.) degree of management involvement in the process e.g. whether target and actual capital levels are monitored and reviewed by the Board; (c.) extent to which the internal capital assessment is used routinely within a financial institution for decision-making purposes; (d.) extent to which a financial institution has provided for unexpected events in setting capital levels; (e.) quality of a financial institution’s management information reporting and systems; (f.) manner in which business risks and activities are aggregated; (g.) management’s record in responding to emerging or changing risks; (h.) reasonableness of the outcome of the ICAAP and in particular whether the:- i. amount of capital determined in the ICAAP is sufficient to support the risks faced by the financial institution; ii. levels and composition of capital determined in the ICAAP:-

1. is comprehensive and relevant to the institution’s current operating environment;
2. is appropriate for the nature and scale of the its business activities;
3. is appropriate for the adequacy of its risk management process and internal controls; and

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 40 | P a g e 4) consider external factors such as business cycle effects and the macroeconomic environment. 10.10 The Central Bank may, where necessary, request further information and meet with the Board and senior management of financial institutions in order to evaluate fully the comprehensiveness of the ICAAP and the adequacy of the governance arrangements around it. The institution’s management should be prepared to discuss and defend all aspects of the ICAAP, including both quantitative and qualitative components. 10.11 Among other things, the Board and senior management should be able to explain and demonstrate to the Central Bank: (a.) an understanding of the ICAAP consistent with their taking responsibility for it; (b.) how the ICAAP meets supervisory requirements; (c.) how material risks are defined, categorized and measured; (d.) how internal capital targets are chosen and how those targets are consistent with the overall risk profile, current operating environment and future business needs; and (e.) the reason for any differences between the target level of capital computed based on the ICAAP and the capital target determined by the Central Bank. 11. SUPERVISORY ACTIONS 11.1 The Central Bank will provide individual feedback to financial institutions on its supervisory review and evaluation of the ICAAP. Among other things, the Central Bank will typically require financial institutions to operate with an adequate buffer consistent with its ICAAP, above the Pillar 1 minimum regulatory capital requirement and may after discussion with the financial institution set a target capital ratio that is above the minimum Pillar 1 regulatory capital requirement. 11.2 Having carried out the review of the financial institution’s ICAAP, the Central Bank will take appropriate action if it is not satisfied with the results of the financial institution’s own risk assessment and capital allocation. It should be noted, however, that increased capital would not be the only option adopted by the Central Bank for addressing increased/ unmitigated risks. The Central Bank will consider a range of other options/ actions including: (a.) intensified monitoring and reporting; (b.) restriction or prohibition of certain activities; (c.) restriction or prohibition of the payment of dividends; and

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 41 | P a g e (d.) requiring the preparation and implementation of a satisfactory capital adequacy restoration plan. 11.3 The institution should also not regard capital as a substitute for addressing fundamentally inadequate controls or risk management processes. Financial institutions are expected to implement risk mitigating measures including strengthening risk management, applying internal limits, strengthening the level of provisions and reserves and improving internal controls etc. that are commensurate with their risk exposures, size and complexity.. 11.4 The Central Bank will use the combination of options best suited to the circumstances of the financial institution and the operating environment, keeping in mind its mandates to ensure financial stability, the safe and sound operations of financial institutions and to protect the interest of depositors.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 42 | P a g e Appendix 1.A- ICAAP Format The ICAAP Document i. The purpose of the ICAAP document is to apprise the Board of the financial institution of the full spectrum of its material risks, how the institution intends to mitigate those risks and how much current and future capital should be maintained by the institution given its risk profile and strategic/ business plans. The document should also demonstrate to the Central Bank the financial institution’s internal capital adequacy assessment process and the institution’s approach to capital management. ii. The Central Bank expects that the level of detail provided in the ICAAP document will vary from institution to institution given the differences in the nature, scope and complexity of operations. However, the fundamental framework including comprehensive assessment of risk, risk management and internal controls, setting of capital targets and involvement of board and senior management should be reflected in the ICAAP of all financial institutions. iii. While the Central Bank provides guidance on the format of the ICAAP document, financial institutions may make amendments to the format, where appropriate. In addition, institutions may append any documents that they deem necessary to support the detail presented in the ICAAP document. iv. Prior to submission to the Central Bank, the ICAAP document should be approved by the institution’s Board.

1. EXECUTIVE SUMMARY The executive summary should present an overview of the ICAAP methodology and results. Matters that should typically be covered include: i. the purpose of the document; ii. the main findings of the ICAAP analysis; iii. the capital the financial institution considers it should hold including how much and what composition of internal capital it considers it should hold as compared with the Pillar 1 minimum capital requirement (details with calculations should be provided); iv. the adequacy of the institution’s risk management processes; v. a summary of the financial position of the institution;

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 43 | P a g e vi. an overview of the institution’s strategy; vii. a brief description of the capital policy and dividend plan, how the institution intends to manage capital going forward and for what purposes; viii. commentary on the institution’s most material risks, why the level of risk is acceptable or what mitigating actions have been/will be put in place; ix. commentary on major issues where further analysis is required; x. the persons who have carried out the assessment, how it has been challenged, who has approved it and when. 2. BACKGROUND This section should include relevant organizational and historical financial data on the financial institution. This may include details of the group structure, profitability, dividends, capital resources, deposit liabilities and any conclusions that can be drawn from trends in the data that may have implications for the future. It should also give a brief description of expected changes to the institution’s current business profile. 3. SUMMARY OF CURRENT AND PROJECTED FINANCIAL AND CAPITAL POSITIONS This section should explain the present financial position of the financial institution, any changes to its current business profile, projected business volumes, projected financial position and future planned sources of capital. 4. CAPITAL ADEQUACY This section should include a detailed review of the capital adequacy of the financial institution covering the following information:- Timing i. The effective date of the ICAAP calculations, with details of any events that have happened since and that may materially change the ICAAP’s calculations. The impact of such events should be included. Risk Analysis i. Articulation of the institution’s risk appetite (see Appendix 1.B);

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 44 | P a g e ii. Identification of the areas of risk considered and the major risks arising in those areas, including at a minimum credit, market, operational, liquidity and concentration risk; iii. Identification of any risks that have been identified but deemed immaterial and the justification for this determination; iv. Details of mitigating actions in relation to major risks; v. Details of any restrictions on the ability to transfer capital into or out of the financial institution; vi. Conclusions arising out of the risk assessment including an analysis of significant movements in available capital and capital required since the last ICAAP and a comparison of the capital required under Pillar 1 calculations, as compared with the overall capital requirement identified by the ICAAP. Methodology and Assumptions i. A description of how the risk assessment has been carried out and what assumptions have been made; ii. An explanation of how the risk assessment relates to the internal capital target set by the financial institution is required; iii. Details on how capital is allocated for the following:- a. Pillar 1 risks – that is, credit, market and operational; b. risks not covered or not fully covered under Pillar 1and Pillar 2 risks; c. stress testing / scenario analysis. iv. Where internal models are used to quantify risks, the following information should be provided:- a. key assumptions and parameters within the capital modelling work and background information on the derivation of key assumptions; b. how parameters have been chosen, including the historical period used and the calibration process; c. limitations of the model; d. the sensitivity of the model to changes in the key assumptions or parameters chosen; e. validation work undertaken to ensure the continuing adequacy of the model(s). Sensitivity Analysis This section should detail the sensitivity tests undertaken to key assumptions and factors that have a significant impact on the broader financial condition of the institution e.g. changes in interest rates. Material changes in the financial risks to which the business is exposed should be explored and quantified as far as possible.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 45 | P a g e Stress Testing / Reverse Stress Testing i. This section should include an explanation of what methodology has been used and the rationale. Information such as the range of scenarios, key assumptions and confidence levels should be provided. ii. In addition to the stress test/reverse stress test scenarios used by financial institutions under the individual risk categories, institutions should include any other scenarios that it deemed necessary. Examples of scenarios include: a. how an economic downturn would affect the financial institution’s (or group) capital resources, Pillar 1 capital requirements and its future earnings; b. how changes in the credit quality of the credit risk counterparties of the financial institution affect its capital and credit risk requirement; c. an assessment of how the financial institution would continue to meet its regulatory capital requirements through a recession of varying severities; d. the impact of a downgrade of a financial institution or its sovereign of incorporation, it’s parent or the sovereign of incorporation of the parent; e. worse case losses as a result issues such as outsourcing, cyber-attack, fraud, or pending litigation. Group ICAAP / Stress Tests Where the financial institution has recourse to the parent’s ICAAP and/or stress testing, this should be stated together with an explanation as to how this has been used in the reporting institution’s ICAAP. 5. RISK AGGREGATION AND DIVERSIFICATION This section should describe how the results of separate risk assessments have been combined to obtain an overall view of capital adequacy. This requires some sort of methodology to be used to quantify the amount of capital required to support individual risks so that they can be aggregated into a total figure. Any adjustments made for diversification or risk correlations must be explained.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 46 | P a g e 6. CAPITAL POLICY The financial institution’s capital policy should:- i. describe how the institution manages, monitors and makes decisions regarding capital planning; ii. include internal post-stress capital goals10 and real-time targeted capital levels; guidelines for dividends and stock repurchases; and strategies for addressing potential capital shortfalls; iii. describe the manner in which consolidated estimates of capital positions are presented to senior management and the board of directors; iv. require staff with responsibility for developing capital estimates to clearly identify and communicate to senior management and the board of directors the key assumptions affecting various components that feed into the aggregate estimate of capital positions and ratios; v. require the aggregated results to be directly compared against the institution’s stated post stress capital goals and those comparisons should be included in the standard reporting to the senior management and Board. 7. CAPITAL PLAN This section should outline the key aspects of the institution’s capital needs to support its operations in the medium term (3 to 5 years), to support its strategic plan (forecasted/long-term) and to support unforeseen and unexpected events as set out in contingency plans. The detailed capital plan, if a separate document, should be submitted as an appendix to the ICAAP. 8. CHALLENGE AND ADOPTION OF THE ICAAP This section should: i. describe the extent of challenges with the ICAAP. It should also include any testing of the ICAAP during the period and provide details on the review and approval process; ii. detail the reliance placed on group ICAAPs and the rationale or inputs obtained from an external reviewer or internal audit. Relevant copies of such external or internal reports should be attached.

10 Post stress capital goals should provide specific minimum thresholds for the level and composition of capital that the firm intends to maintain during a stress period. The institution must be able to demonstrate through its own internal analysis, independently of any regulatory capital requirements, that remaining at or above its internal post-stress capital goals will allow the institution to continue to operate.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 47 | P a g e 9. FUTURE ACTION PLAN This section should include: i. a summary of significant deficiencies and weaknesses identified by the institution and action plans, including timeframes to address them including: a. changes in risk profile; b. improvements in governance and internal organization; c. changes in equity/capital targets. ii. Planned changes (improvements) in governance, risk management and internal controls including: a. improvements in risk policy; b. improvement in risk management tools. 10. USE OF ICAAP WITHIN THE BANK This section should state the extent to which the ICAAP is embedded in the operations of the financial institution and used for decision-making and capital planning, including the extent and use of capital modelling or scenario analysis and stress testing e.g. for setting prices and reviewing the level and nature of future business.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 48 | P a g e Appendix 1.B- Risk Appetite Statement (RAS) A. A well-developed risk appetite articulated through a Risk Appetite Statement (RAS) is an important component of an effective risk governance framework. Developing and conveying the financial institution’s RAS is essential to reinforcing a strong risk culture. B. An effective risk appetite statement should: a. include key background information and assumptions that informed the financial institution’s strategic and business plans at the time they were approved; b. be linked to the institution’s short- and long-term strategic, capital and financial plans, as well as compensation programs; c. establish the amount of risk the financial institution is prepared to accept in pursuit of its strategic objectives and business plan, taking into account the interests of its customers (e.g. depositors, policyholders) and the fiduciary duty to shareholders, as well as capital and other regulatory requirements; d. determine for each material risk and overall the maximum level of risk that the financial institution is willing to operate within, based on its overall risk appetite, risk capacity, and risk profile; e. include quantitative measures that can be translated into risk limits applicable to business lines and legal entities as relevant, and at group level, which in turn can be aggregated and disaggregated to enable measurement of the risk profile against risk appetite and risk capacity; f. include qualitative statements that articulate clearly the motivations for taking on or avoiding certain types of risk, including for reputational and other conduct risks across retail and wholesale markets, and establish some form of boundaries or indicators (e.g. non-quantitative measures) to enable monitoring of these risks; g. ensure that the strategy and risk limits of each business line and legal entity, as relevant, align with the institution-wide risk appetite statement as appropriate; and

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 49 | P a g e h. be forward looking and, where applicable, subject to scenario and stress testing to ensure that the financial institution understands what events might push the financial institution outside its risk appetite and/or risk capacity.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 50 | P a g e Appendix1.C- ICAAP Submission Summary ICAAP SUBMISSION SHEET Reporting Financial Institution: ICAAP Page Reference $’000’s Pillar 1 Risks Credit Risk RWA $0 Operational Risk RWA $0 Market Risk RWA $0 Pillar 1 RWA $0 Pillar 1 Capital Requirements $0 Other Risks Residual Credit Risk $0 Residual Operational Risk $0 Residual Market Risk $0 Interest Rate in the Banking Book $0 Cross Border Lending $0 Credit Risk Mitigation $0 Concentration Risk $0 Securitization Risk $0 Reputation Risk $0 Strategic Risk $0 Country Risk $0 Pension Risk $0 Climate Risk $0 Parent/Group Bank Risk $0 ……11 Pillar 2 Capital Requirement $0

11 Institutions should include any other material risk. Additional Rows may be inserted.

Internal Capital Adequacy Assessment Process (“ICAAP”) Guideline November 2020 Central Bank of Trinidad & Tobago 51 | P a g e Capital (as a % of RWA) Capital (000’s) CET1 $0 Tier 1 $0 Pillar 1 Requirement $0 Pillar 1+Pillar 2 Requirement $0 Pillar 1+Pillar 2 + Buffers12 $0 Minimum Capital Ratios CET1 4.5% Tier 1 6% Pillar 1 10% Capital Conservation Buffer 2.5% D-SIB Buffer …. 13

12 Buffers refer to the Capital Conservation Buffer and the D-SIB capital add-on. 13 As required by the Central Bank upon issuance of the D-SIB guidance.