NATIONAL BANK OF POLAND

BANKING SUPERVISION COMMISSION

Banking Supervision Inspectorate

RECOMMENDATION G

concerning

interest rate risk management in banks

Updated text
Warsaw, 2002

---

The following recommendation replaces "Recommendation G of 23 June 1999 concerning interest rate risk management in banks".

Recommendations:

Role of the Supervisory Board and Management

Recommendation 1:

The supervisory board oversees the compliance of the bank's risk-taking policy, including interest rate risk, with the bank's strategy and financial plan.
Accordingly, the supervisory board should receive periodic information from management presenting in a clear, concise and understandable manner the types and magnitude of interest rate risk to which the bank is exposed.

Recommendation 2:

The management is responsible for organizing an effective interest rate risk management process and overseeing its efficiency, introducing necessary corrections and improvements as needed. The sophistication of the risk management process should be commensurate with the magnitude of risk and the complexity of the bank's products.
The management should in particular ensure that written policies and procedures for interest rate risk management are implemented and updated in the bank. Operational interest rate risk management may be delegated to appropriate bank units. The management simultaneously bears responsibility for such a division of key tasks in the risk management process to avoid potential conflicts of interest. This particularly applies to ensuring the independence of measurement, monitoring and control functions from operational activities resulting in position-taking by the bank. Units performing control functions should submit reports on risk exposure directly to bank management.
The management is also responsible for aligning the bank's interest rate risk and its management process with the overall risk level accepted by the supervisory board, as well as for proper formalization and sophistication of this process.

Policy Principles

Recommendation 3:

Interest rate risk management should be comprehensive and consolidated. Consolidated risk management means covering all bank units, including foreign branches, in the management process, as well as estimating the potential impact of subsidiary units on the bank's financial situation. The comprehensive nature of management means, on the one hand, taking into account all types of interest rate risk relevant to the bank, and on the other hand, managing interest rate risk not in isolation but closely linked with other types of risk, such as credit, liquidity or foreign exchange risk.

Recommendation 4

The introduction of a new financial product affecting the bank's interest rate risk should be preceded by a formal preparatory process including, inter alia, the identification of all material risks, establishment of limits, accounting principles, reporting, risk measurement and formal approval by bank management.

Measurement and Monitoring System

Recommendation 5:

The bank management should exercise due diligence to ensure that the bank accurately identifies interest rate risk and measures it in a timely manner and with appropriate frequency.
The risk measurement system should be adapted to the nature and scope of the bank's operations, product portfolio, and those features of its activities that are relevant from the perspective of interest rate risk.
The measurement system should enable management to assess the impact of potential interest rate changes on both financial results and the updated balance sheet value of equity.
Risk measurement should take into account the bank's current and planned activities.
Measurement methods, and especially the underlying assumptions, should be subject to periodic analysis and historical verification.

Recommendation 6:

The bank management is responsible for developing interest rate risk management policy principles and approving limits that keep the bank's overall exposure to interest rate risk within a range consistent with strategy and the risk tolerance level accepted by the supervisory board. Limit compliance should be subject to regular monitoring.

Recommendation 7:

The bank management should exercise due diligence in ensuring regular measurement of the bank's vulnerability to losses under adverse market conditions, including the breakdown of key assumptions. It is advisable to incorporate the results of these measurements when establishing, reviewing or amending interest rate risk management policy principles, including interest rate risk limits.

Recommendation 8:

The bank management should ensure that the bank has a reliable, fast and accurate information system for management, enabling effective decision-making. This system should provide information on the magnitude of interest rate risk to which the bank is exposed, enable assessment of management decisions' consequences, and serve monitoring limit compliance.
Information for bank management and committees dealing with interest rate risk should be provided at a frequency of no less than once a month for the banking portfolio, while a higher frequency is recommended for the trading portfolio.
The bank management is responsible for creating appropriate conditions, including decisions on allocating adequate financial resources, for the efficient collection and processing of information for interest rate risk management purposes.

Internal Control

Recommendation 9:

The structure and operation of the internal control system are crucial for effective risk management and safe bank operations. Bank Management should implement and regularly evaluate the effectiveness of internal control mechanisms regarding risk management, including interest rate risk.

A detailed discussion of the presented recommendations is contained in Annex 1.

---

Annex 1

Detailed Notes on Recommendation G concerning interest rate risk management in banks

Introduction

1. Interest Rate Risk and Its Sources

Interest rate risk is the risk arising from the exposure of the bank's current and future financial results and its capital to the adverse impact of interest rate changes. The interest rate risk management principles described in the Recommendations apply to all balance sheet and off-balance sheet positions of the bank sensitive to interest rate changes. Interest rate risk applies to both the trading portfolio and the banking portfolio¹. Capital requirements regarding general interest rate risk for primary positions² arising from primary positions classified in the trading portfolio are specified in the Banking Supervision Commission Resolution 5/2001.

Interest rate changes can have both positive and negative impacts on the bank's financial results and the updated balance sheet value of equity³. Financial result exposure resulting from interest rate changes mainly concerns interest income risk. These changes may also affect non-interest income (e.g., fee decline) or increase operational costs sensitive to interest rate changes.

Interest rate changes affect the updated economic value of assets, liabilities and off-balance sheet positions. This stems from the fact that the updated economic value of future cash flows, and in some cases the cash flows themselves, change with interest rate changes. The combined effect of updated economic value changes is reflected in the change in the updated balance sheet value of equity (economic value of equity). Taking into account changes in updated economic value is also related to the obligation to value portfolios at fair value.

Interest rate risk is inextricably embedded in banking as a financial intermediation and maturity transformation process, through which the bank generates revenue. Recognizing that interest rate risk cannot and should not be eliminated, banking supervision primarily focuses on the need to establish an adequate process for managing this risk and on the threats arising from excessive bank exposure to interest rate risk, which may result in a real reduction of financial results, weakened liquidity, reduced own funds, and in extreme cases, bank solvency.

Interest rate risk is a broad concept encompassing four main categories of risk: repricing mismatch risk⁴, customer option risk, basis risk and yield curve risk. Each of these types of risk should be subject to bank analysis. A detailed discussion of these types of interest rate risk is contained in Annex 2.

In most Polish banks over the past few years, interest rate risk in the form of repricing mismatch risk has been limited, partly because banks have tried to maintain instruments with variable interest rates and similar repricing periods on both sides of the balance sheet. Although progress has been made in recent years in measurement and reporting regarding repricing risk, banking supervision inspectors still encounter weaknesses in the assessment and reporting process for other types of interest rate risk, which in some cases may have negative consequences, e.g., leading to a measurable reduction in interest margins. For example, some banks index various balance sheet positions to reference rates not fully correlated with each other (e.g., WIBOR for loans, and NBP Lombard loan interest rate for deposits) without monitoring and limiting the resulting basis risk. Moreover, customer option risk is often completely overlooked, which in Polish banks mainly concerns deposits, though it is also observed on the loan side. Recent changes in Poland's macroeconomic (e.g., declining inflation), market conditions, as well as the development and complexity of banking products, may increase interest rate risk, thereby increasing requirements for managing various types of interest rate risk. Among the observed changes, more frequent appearance of fixed-rate mortgages and longer payment terms, financing long-term assets with short-term liabilities, and increasing customer competition forcing the granting of options⁵ are noted.

¹ Definitions of banking and trading portfolios are contained in §§ 2 and 3 of the Banking Supervision Commission Resolution No. 5/2001.
² Primary positions are defined in accordance with the provisions of Resolution 5/2001 of the Banking Supervision Commission.
³ The updated balance sheet value of equity (economic value of equity), also called "economic capital" or "equity economic value", represents the updated value of expected cash flows from assets, reduced by the updated value of expected cash flows concerning liabilities, plus or minus the updated value of expected cash flows from off-balance sheet positions. The updated economic value (net economic value) of a given instrument represents the estimated present value of expected net cash flows of that instrument discounted to take into account market interest rates. The updated economic value under certain conditions (including deep, liquid markets) is close to market value.

---

2. Key Elements of Interest Rate Risk Management

An effective interest rate risk management process requires, on the one hand, proper supervision by the bank's supervisory board, and on the other, active management involvement in introducing an adequate system for risk identification, measurement and monitoring, as well as reporting on risk and its control.

The specific method of managing interest rate risk depends on the nature (e.g., wholesale or retail market activities) and complexity of operations, balance sheet structure, bank size and organizational structure (multi-branch or single-branch), sophistication and scope of IT system integration, as well as the magnitude of exposure to interest rate risk. Each bank is required to prepare and implement interest rate risk management principles adapted to the mentioned parameters. In smaller banks not engaged in complex financial operations, a relatively simple interest rate risk management process is acceptable. At the same time, in such banks, interest rate risk does not necessarily have to be smaller, as opportunities for active management of a simple balance sheet to change the interest rate risk profile are significantly limited (lack of access to derivatives, securitization), and the capital base capable of absorbing interest rate changes is generally smaller. An additional difficulty in managing this risk in small banks is the frequent lack of specialized personnel. In large banks, which have more complex balance sheets containing complex and risky products, a more sophisticated interest rate risk management process is required, including the establishment of product-complexity-adapted measurement methods, more frequent reporting and limits.
For both groups of banks, especially large ones, a dynamic balance sheet approach is desirable, taking into account simulations of individual position sizes and changes in macroeconomic parameters. The functioning of effective internal control mechanisms is also required, including well-considered procedures guaranteeing, inter alia, safety and avoidance of conflicts of interest, as well as high-quality internal and external audit, a modern risk management department, and control mechanisms ensuring high-quality information used by management in making strategic decisions and in supervising the compliance of operational risk-taking units with bank policy principles, strategy and limits approved by the supervisory board and management.

---

Role of the Supervisory Board and Management

Recommendation 1:

The supervisory board oversees the compliance of the bank's risk-taking policy, including interest rate risk, with the bank's strategy and financial plan.
Accordingly, the supervisory board should receive periodic information from management presenting in a clear, concise and understandable manner the types and magnitude of interest rate risk to which the bank is exposed.

3.1 Bank Supervisory Board

The bank supervisory board performs its supervisory function by controlling the management of various types of banking risk, including interest rate risk. In the opinion of banking supervision, it is advisable that the supervisory board:

• approves the strategy and general policy principles of the bank including, inter alia, business profile, magnitude of acceptable risk, including interest rate risk ("risk appetite")⁶.
• oversees compliance by bank management with the acceptable risk profile of the bank resulting from the strategy, accepted by the supervisory board, including the magnitude of interest rate risk;
• oversees the effectiveness of the bank management process, taking into account the efficiency and accuracy of management-approved: organizational structure, lines of authority, scope of responsibility of key bank units, internal control systems;
• verifies whether management has allocated adequate technical resources (including specialized IT applications), specialized staff and other necessary means for effective risk management;

It is particularly important that supervisory board members have an understanding of the potential exposure of the bank's financial results and capital to losses from various types of risk, including interest rate risk. The magnitude of exposure of financial results and bank capital should be consistent with the strategy approved by the supervisory board. It is advisable that the supervisory board knows and understands financial concepts regarding risk measurement, through which management communicates the magnitude of the bank's interest rate risk, e.g., value at risk, gap concept, updated duration (duration)⁷, earnings at risk, etc. It is advisable that the supervisory board receives from bank management, with a frequency appropriate to the nature and size of the bank, synthetic reports on the bank's global exposure to risk, including interest rate risk, as well as data indicating the magnitude of probable loss that the bank may incur if interest rates change significantly (shock analyses, extreme condition tests).

⁶ The acceptable risk level may be expressed through a series of indicators such as, e.g., value at risk – for the trading portfolio, acceptable repricing gap magnitude or earnings at risk (banking portfolio). Indirectly, the magnitude of risk is reflected in the management-approved planned capital adequacy ratio, return on assets (ROA), return on equity (ROE), limits and key bank policy principles (e.g., regarding acceptable types of investments and products, maximum permissible position repricing period, maximum permissible balance sheet position maturity/payability period).
⁷ Also called the risk period analysis method (modified duration) or duration.

---

3.2 Bank Management

Recommendation 2:

The management is responsible for organizing an effective interest rate risk management process and overseeing its efficiency, introducing necessary corrections and improvements as needed. The sophistication of the risk management process should be commensurate with the magnitude of risk and the complexity of the bank's products.
The management should in particular ensure that written policies and procedures for interest rate risk management are implemented and updated in the bank. Operational interest rate risk management may be delegated to appropriate bank units. The management simultaneously bears responsibility for such a division of key tasks in the risk management process to avoid potential conflicts of interest. This particularly applies to ensuring the independence of measurement, monitoring and control functions from operational activities resulting in position-taking by the bank. Units performing control functions should submit reports on risk exposure directly to bank management.
The management is also responsible for aligning the bank's interest rate risk and its management process with the overall risk level accepted by the supervisory board, as well as for proper formalization and sophistication of this process.

The bank management and units and committees to which management has delegated decision-making powers play a fundamental role in the interest rate risk management process. The lack of clear management involvement in establishing the risk management strategy and overseeing the management process will be treated by the Banking Supervision Commission as a symptom of weak bank management and low rank.

In particular, the bank management is also responsible for:

• creating a transparent bank management structure ensuring clear determination of responsibility of individual organizational units and persons for risk management, including interest rate risk; this also includes the division of tasks in the interest rate risk area, which will help avoid conflicts of interest;
• appropriate interest rate risk limits and an effective mechanism for monitoring them, including notification of limit breaches;
• efficient operation of risk identification, monitoring and reporting systems;
• adequate position valuation standards and result assessment;
• effective operation of internal control mechanisms, including the internal audit function⁸

⁸ See Recommendation H of the Banking Supervision Commission concerning internal control in banks

---

• periodic reviews and assessment of the interest rate risk management process, including limit adequacy as well as risk measurement methods and assumptions adopted in these methods.

The bank management should clearly indicate persons, organizational units and/or committees responsible for implementing various elements of interest rate risk management, define reporting relationships and decision-making powers related to the preparation of risk management strategy, operational position management and functions for conducting measurement, control and reporting on interest rate risk. The Banking Supervion Commission expects that management will be able to demonstrate that all types of activities exposed to interest rate risk are covered by the risk management process.

Management is responsible for dividing the scope of duties in key areas of the risk management process, which will ensure avoidance of potential conflicts of interest. It is therefore desirable that organizational solutions be introduced in the bank minimizing the probability that persons conducting operational activities on behalf of the bank (e.g., granting loans, dealer activities), and thus creating positions involving the bank, could have an improper impact on key control mechanisms of the risk management process, including reporting limit breaches, preparing independent risk reporting for bank management, and performing accounting, settlement, etc. department functions. Internal control mechanisms should be appropriate to the size and structure of the bank and to the complexity of interest rate risk assumed by the bank. It is advisable that an independent unit responsible for designing and implementing measurement, monitoring and control functions of interest rate risk operates in large banks. Control functions performed by such a unit, such as independent supervision of limit compliance, are part of the overall internal control mechanism system.

Management should also ensure that employees responsible for measuring and monitoring interest rate risk and limit compliance thoroughly understand the interest rate risk to which the bank is exposed. Furthermore, management should ensure that IT, accounting and internal reporting systems enable measurement and timely preparation of interest rate risk reports. This is important in light of still encountered difficulties in banks, where accounting systems generally do not provide sufficient data on risk, for example information on repricing dates. Providing this type of information may require purchasing or creating from