Stress Testing Instructions for Banks Operating in Jordan No. 1/2016

15779/2/23 06-03-1438 AH 06-12-2016 AD Stress Testing Instructions for the Banks Operating in Jordan No. 1/2016 Issued by the Central Bank of Jordan pursuant to the provisions of Article (99 / b) of the Banks Law No. 28 of 2000 and its amendments

2 Contents Introduction ........................................................................................................................3 First: Objectives of Stress Testing Second: Governance of Stress Testing ......................................................................................5 Third: Designing Stress Tests....................................................................................................8 Fourth: Measures of the Central Bank of Jordan .....................................................................11 Fifth: Reviewing the Stress Tests and Periodicity of Running them.......................................12 Sixth: General Provisions ........................................................................................................12

3 Introduction Stress Testing is considered an important tool used by banks to measure their ability to withstand shocks and high risks that they might face. These tests aim at evaluating the financial position of the bank under severe, yet possible, scenarios. These test have a future outlook in evaluating risks using methodologies that go beyond the statistical tools which are based on historical data. They also help the board of directors and the senior executive management understand the bank’s situations during crises. Stress tests are also considered a key element in risk management process. However, these tests cannot alone signal all possible vulnerabilities in the bank. They instead work within an integrated policy for managing risks to enhance the safety and soundness of banks and strengthen the financial system as a whole. The Central Bank of Jordan (CBJ) has released the Stress Testing Instructions No. (46/ 2009) on 30-09-2009. Since then, this issue has witnessed significant developments, especially after the last global financial crisis. In the year 2009, the Basel Committee for Banking Supervision (BCBS) issued the Principles for Sound Stress Testing Practices and Supervision. The BCBS issued the Peer Review of Supervisory Authorities’ Implementation of Stress Testing Principles in 2012. Moreover, the International Monetary Fund (IMF) has been developing comprehensive methodologies for conducting stress testing. In addition, the supervisory authorities in the world countries and relevant international institutions started stressing the need to take into account the application of these principles. In light of these developments, the issuance of these instructions by the CBJ came into act in order to keep pace with the latest developments in this issue and in line with best international practices in this regard.

4 First: Stress Testing Objectives Stress testing is used to achieve the following goals:

1. Determining and controlling the major risks: Stress tests are considered a key element in risk management processes for all levels at the bank for the purpose of identifying the risks that the bank faces, the concentration of these risks, and their possible impacts. In this regard, this tool is considered a major quantitative tool for understanding the bank’s risk profile and the ability of the bank to withstand various types of shocks.
2. Helping the capital planning process: The stress tests form an important part of the capital planning process through Internal Capital Adequacy Assessment Process (ICAAP). These tests provide tools for assessing the adequacy of the internal capital of a bank to confront all risks that have financial impact, as well as any possible financial shocks. These tests also help the bank to estimate the size of future capital that must be available in the coming years.
3. Helping liquidity management: the stress tests form an important part of identifying, measuring, and controlling liquidity risks in order to assess the bank’s liquidity and the adequacy of liquidity shocks mitigating tools.
4. Stress tests are considered complementary tools, but not substitutes, for other risk management tools like Value at Risk and economic capita that are based on historical data and statistical relationships.
5. The stress tests provide detailed data about the bank’s exposure to risks, bank’s business model, and bank’s risk profile. Besides, they provide a comprehensive analysis for vulnerabilities at the bank.
6. Enhancing the confidence of the general public in the stability of the banking sector through publishing stress testing results on the banking sector’s level as a whole in order to reassure the citizens that the sector is capable of withstanding shocks and high risks.

5 Second: Governance of Stress Testing

1. Stress tests must be a key part of risk governance and risk management culture of the bank in order to enhance the ability of the bank to identify and control risks. This includes the use of these tests in managing credit risks, managing investment portfolios risks, and managing the risks that are related to some activities of the bank or the business strategy of the bank as a whole. The results of the tests must also be used in decision making on the appropriate managerial level including the strategic decisions of the board of Directors and the senior executive management.
2. The role of the board of directors and the senior executive management. 2-1 The role of the board of directors:

• The board of directors must ensure the existence of an effective framework for stress tests to evaluate the ability of the bank to withstand shocks and confront high risks. In this regard, the stress testing program at the bank will be the ultimate responsibility of the board of directors.
• The board of directors must verify that the risk management department conducts the stress tests on a periodic basis. The board of directors must have a major role in setting the assumptions and the scenarios used, analyzing the stress testing results, and approving the measures to be implemented based on the stress testing outcomes. 2-2 The role of the senior executive management.
• Executing and monitoring the stress testing program and in line with the methodology adopted by the board of directors in this regard.
• Ensuring the availability of a qualified staff at the risk management department to conduct the stress testing and that the department does possess the appropriate tools and means for the tests.

6

• Ensuring the availability of a suitable number of possible scenarios that are related to the business of the bank, given that these scenarios are well￾understood and documented.
• Using the results of the stress tests in setting and identifying the bank’s risk appetite statement, and in planning for capital and liquidity.

3. Policies, Internal Measures, and Documentation: The stress tests must be constrained by internal policies and procedures approved by the board of directors.1 They must also be documented appropriately. The documentation process must include the following: a. Types and details of stress tests and the scenarios used, as well as the main goal for each type of the tests. b. The reasons for selecting the tests, and the role and opinion of the bank’s experts in this selection. c. Evaluating the primary assumptions on which the stress tests have been based at least on annual basis or in light of the variable external circumstances and documenting the results of the evaluation process. d. Periodicity of executing the stress testing at the bank that might vary by the type of tests and their driver. e. The details of the methodologies adopted in determining the scenarios and the calculations used in obtaining the results. f. Corrective measures that will be taken on the basis of the goal, type, and results of the tests, besides evaluating the feasibility of these measures in case stress scenarios materialize.
4. Suitable Infrastructure:

1 Regarding the branches of foreign banks operating in the kingdom, the internal policies and measures are approved by the regional director.

7 4-1 The bank must have an infrastructure that is suitable and helpful for conducting the stress tests precisely and comprehensively, and that includes at least the following: qualified staff, sufficient database in terms of precision and comprehensiveness, and suitable management information systems (MIS). The bank must provide sufficient resources to maintain and develop the infrastructure to enable the bank to update the methodologies on a periodic basis so that it can carry out new scenarios when needed. The infrastructure must be also flexible enough to allow for conducting stress tests on a specific activity level or on the bank level as a whole. 4-2 The information systems used by the bank must suite the size, nature, degree of complexity, and risk structure of the bank. 4-3 The bank must have an appropriate mechanism for providing periodical reports about the stress tests and their results to the senior executive management and the board of directors in the suitable time. 4-4 Despite that the process of designing and executing stress testing is considered an internal process, the bank might seek outsourcing to implement some operations like designing the program, and reviewing and verifying the methodologies. In this case, the bank must determine the activities that need to be executed in a clear and a documented manner. It must also be able to understand and evaluate the outcomes of the outsourced tasks and ensure that all of the tasks accomplished by the outsourced parties are within the overall framework of the risk management at the bank. Moreover, it must take necessary measures to ensure maintaining the banking secrecy in line with the laws and legislations in force.

8 Third: Designing Stress Tests

1. The design of stress testing program, the use of forms and methodologies to determine their impact on the bank, and learning from the results all require the cooperation between experts and the people in charge of such duties in the bank. In this regard, risk management department must set a suitable dialogue format among the various related parties in order to obtain their views and opinions regarding the possible shocks and stressful situations so that it can then identify the assumptions and scenarios suitable for the internal and external risks that the bank might be exposed to. All concerned parties in the bank, such as economic analysts, officials of risk management, research and studies, credit facilities, treasury, and finance departments must participate in this dialogue.
2. The stress testing program must include both quantitative and qualitative methods2 to improve the comprehensiveness of these tests and make them supportive and complementary to the patterns and approaches of risk management used in the bank. The tests must range from simple sensitivity tests that are based on the change(s) in a single risk factor to scenarios that are based on statistical methods which take into consideration the relationships among the drivers of systemic risks in times of crises.
3. Banks must take into consideration two types of tests within their stress testing programs, which are sensitivity analysis and scenario analysis.

2 The aim of including the qualitative dimension in the tests is to ensure that the banks have conducted the required tests and the additional tests that it might assume and then reflected their impact properly. This is done through clarifying the types of risks that the bank faces and that were included in the tests, presenting a brief of the methodology used in implementing the tests, providing a detailed explanation of the most important reasons that led to the decline in capital adequacy or liquidity, if any, and explaining the approach of taking the results of the tests into consideration and including them into the bank’s future tasks.

9 3-1Sensitivity Analysis Tests 3.1.1 Sensitivity analysis tests are used to measure the impact of movements in the risk factors (drivers) – on a single basis– on the financial position of the bank. Such factors include the increase in the non- performing loans ratio, the changes in interest rates, the changes in exchange rates, and the changes in stock prices. Usually, the source of shock (the source that this type of shock results from) is not determined in these tests. Besides, the relationships and interlinks among various risk factors are not taken into consideration in these tests. These tests aim at determining the degree of sensitivity of the bank’s financial position to a single risk￾factor and evaluating the ability of the bank to confront this factor. 3.1.2 The bank must determine the relevant risk drivers that are possible to affect the bank, particularly those related to macroeconomic variables like interest rates and exchange rates, credit- related risks such as the increase in the non- performing loans ratio and the increase in the probability of default, financial risk drivers such as the increase in the volatility of financial markets, and operational risk divers such as internal fraud, natural disasters, a robbery on the bank and the collapse of the communication systems ... etc. 3.1.3 The bank must conduct stress testing of the risk drivers that were determined using various degrees of severity3 . The determination of the degree of severity shall depend on the historical data and previous experiences on the bank’s level or the economy in general, supported by reasonable assumptions. 3.1.4 The bank must conduct the sensitivity analysis tests on several levels in the bank. This shall include conducting some tests for single exposures, exposures on portfolio level, on the level of the business lines, or on the level of the bank as a whole.

3 For example, the bank might conduct tests to determine the impact of the decline in stock prices by 40%, 60% and 90% or the impact of the increase in interest rates by 100, 200 and 300 basis points.

10 3.1.5 The sensitivity analysis tests that the banks must conduct include credit risks, credit concentration risks, market risks, operations risks, and liquidity risks. The CBJ will annually provide the banks with the sensitivity analysis tests that must be conducted taking into consideration the developments of risks on the domestic, regional, and global levels. The new tests might include different levels of severity compared to those of previous tests. The update might also include changing the tests partially or totally in case of the realization of significant economic or financial developments. 3-2Scenario Tests These tests aim at evaluating the effect of scenarios that might have low probability of occurrence but their impact on the financial position of the bank might be substantial in case they materialize. Scenario tests include in general two types of tests: First: Tests built on historical events that happened either in Jordan or in the world countries (examples include: the Jordanian Dinar crisis 1988-1989, the global financial crisis). Second: Hypothetical tests that might possibly occur (examples include: a sharp decline in the gross domestic product rate, a rise in unemployment, an increase/ a decrease in interest rates). In general, the hypothetical tests include the occurrence of substantial changes in the macroeconomic variables that might have negative impacts on the bank’s positions like the increase in the non- performing loans ratios and, hence, the decline in the bank’s profitability that might impact its solvency. In addition, the hypothetical tests could possibly include factors that may affect the bank’s liquidity sharply. The main macroeconomic variables that could be used in building the hypothetical tests are:

11 a. The decrease in the growth rate of gross domestic product (economic growth rate). b. The increase in the unemployment rates. c. The increase/ decrease in inflation rates. d. The increase/ decrease in interest rates. e. The decline in stock prices. f. The increase/ decrease in oil prices in the world markets. The CBJ will annually provide the banks with the scenario tests that must be conducted taking into consideration the developments of risks on the domestic, regional, and global levels. The new tests might include different levels of severity compared to those of previous tests. The update might also include changing the tests partially or totally in case of the realization of significant economic or financial developments. Fourth: Measures of the Central Bank of Jordan

1. In case the tests results showed that there is a vulnerability in the bank’s capital or liquidity, the CBJ will then request the bank to provide it (the CBJ) with the measures that it plans to take to enhance its capital or liquidity.
2. These measures that the bank plans to take on the basis of the stress testing results must be consistent with the severity of the impact of the tests, the general framework of risk management, and the risk hedging policy.
3. In case the CBJ was not convinced with the sufficiency of the measures that the bank plans to take, it shall have the right to take any measure necessary to enhance the bank’s capital or liquidity including imposing restrictions on the distribution of bank’s profits.

12 Fifth: Reviewing the Stress Tests and Periodicity of Running them The internal audit department is responsible for reviewing and evaluating the stress testing framework at least once a year, and for reporting the results of the review and evaluation to the board of directors. The review and evaluation process shall include the following:

1. The operational framework for the stress tests at the bank. The aim is to determine the efficiency and effectiveness of this framework and the need to modify any of its parts. The review process shall cover the following: a. The efficiency of the program in achieving its goals. b. The assumptions that were used in building the stress tests. c. The realism of the tests that were implemented. d. The systems applications used in the preparation of tests. e. The supervision of management. f. The quality of data and management information systems (MIS). g. Documentation.
2. Ensuring that the procedures of updating the stress testing methodologies are clearly documented and executed as determined.
3. Evaluating the validity of calculation operations in the stress tests and the precision of data used in the templates. Sixth: General Provisions The bank must consider the following:
4. Ensuring that the stress tests must encompass scenarios ranging from the lowest impact to the highest impact, including the scenarios that might determine the bank’s solvency and ability to continue in business. This should be done in order to identify the inherent and

13 uncovered risks and take into consideration the degree of impact of possible scenarios on the financial position of the bank, either through the size of the expected loss and/ or their effect on the reputation of the bank. 2. Using the stress tests results in developing emergency plans to deal with the various risks; activating the use of the risk- mitigating tools like hedging, settlement of items within the balance sheet, and the accepted collaterals; and, at the same time, evaluating the effectiveness of using these tools during the tight financial and economic circumstances. 3. Developing methodologies to measure the impact of reputational risks expressed by other risks like credit, market, and liquidity risks through including some scenarios that are related to the reputational risks in stress tests. 4. Using the stress tests results to identify, monitor, and control concentration risks. To do this correctly, the selected scenarios must be on the bank’s level as a whole and on the level of certain lines of the business of the bank. They must cover on- balance- sheet and off￾balance- sheet assets. Besides, the possible changes in the market circumstances that might adversely impact the bank’s exposure to concentration risks must be taken into consideration in these tests. 5. Making sure that the tests cover all the complex financial products as needed. In addition, care must be taken to avoid what happened in the last financial crisis, which is the banks’ evaluation of the risks of the financial products depending only on external credit ratings, or on the historical data for similar financial products, as these are not sufficient and do not include all the risks related to the complex financial products in the case of severe crises. 6. Considering that the stress tests shall include scenarios to evaluate the size and impact of the off- balance sheet assets on other types of risks, especially credit, market, and liquidity risks, and their effect on the bank’s solvency and liquidity.

14 7. The Central Bank of Jordan will review the framework of the stress tests that the banks conduct regularly and comprehensively to ensure the extent to which the banks commit to the standards and criteria set forth in these instructions, especially regarding the role of the board of directors and senior executive management in these tests; the bank's ability to integrate these tests in its risk governance and risk management processes; and the extent to which these results are used in making decisions at various managerial levels in the bank, including strategic decisions. This is to be performed with the aim of promoting and stimulating risk management at banks. 8. The Central Bank of Jordan will evaluate the compliance of the banks with the best practices in stress testing, including the instructions issued by the external supervisory authorities for the banks that have presence outside Jordan. 9. The tests used must be appropriate to the degree of risk appetite that the bank has set for itself so that the scenarios selected by the bank commensurate with the size, nature, and complexity of the bank's business as well as the risks associated with the bank. 10. The Central Bank of Jordan shall have the right to ask the banks from time to time to run stress tests for certain financial products, or to conduct tests to assess vulnerabilities on the financial system as a whole. 11. The results of the stress tests must be taken into account in developing recovery plans for the bank that are considered a part of the business continuity plan. These plans are used in managing the risks of any bank, both internal and external. Their importance lies in being a tool that helps the bank to continue in business after severe events and in mitigating the impact of the adverse events on the bank. 12. These instructions shall be in force as of the date hereof and any contradictions to them are cancelled. Governor

15 Dr. Ziad Fariz