icaap knowledge

Central Bank of the UAE – ICAAP guideline 1

Guidance for the application of Internal Capital Adequacy Assessment

Process (ICAAP)

Version 1.0


A. Preface This guidance is intended to outline the Central Bank of the UAE’s (CBUAE) Pillar 2 assessment

framework as initially mandated under the ‘Basel Accord’ (June 2006) and amended through the

‘Enhancements to the Basel II Framework’ (July 2009). In addition, the guidance is designed to be

compliant and consistent with the Basel III guidelines.

The ICAAP document has a dual purpose, both to inform the board and senior management of the

bank as well as the CBUAE of the on-going assessment of the bank’s risks, how the bank intends

to mitigate those risks and the impact on both internal and regulatory capital where relevant.

The purpose of the guidelines is to enhance the standard of the Internal Capital Adequacy Assessment

Process (ICAAP) for banks in the UAE, whilst recognising that an individual bank’s ICAAP should be

commensurate and relevant in relation to the risk profile of the institution concerned.

The revised Basel Accord establishes the following four guiding principles for Pillar 2:

1: Internal capital adequacy assessment process (ICAAP): Banks should have a process for

assessing their overall capital adequacy in relation to their risk profile and have a strategy for

maintaining adequate levels of capital.

2: Supervisory review and evaluation process (SREP): Supervisors should review and evaluate a

bank’s internal capital assessment and strategies for maintaining adequate capital, as well as their

ability to monitor and ensure compliance with the relevant prudential ratios. Appropriate supervisory

measures would be undertaken if the supervisor is not fully satisfied with the outcome of the process.

3: Capital above the minimum requirements: Supervisors should expect banks to operate above the

minimum regulatory capital ratios and should have the ability to require institutions to hold capital in

excess of the minimum.

4: Early intervention system: Supervisors should seek to intervene at an early stage to prevent

capital from falling below the minimum levels required to support the risks the institution is undertaking

and require remedial action to restore an adequate level of capital.


The information contained in the ICAAP should be sufficient for the CBUAE to gain an understanding

and make an informed judgment about the risk profile of the bank and the appropriate level of capital a

bank should hold.

Section B describes the principles and process underpinning the Supervisory Review and

Evaluation Process (SREP) in the UAE

Section C gives further guidance on CBUAE’s expectation for the ICAAP process

ICAAP reference manual: The Central Bank will also publish an ICAAP reference manual which

contains further guidance on aspects of the ICAAP process (this will be an informal guide and

does not reflect official policy of the CBUAE)

Material changes: If there is a material change to a bank’s ICAAP subsequent to its submission,

affecting the capital plan, stress testing programme or any other relevant matter related to the ICAAP,

the bank should formally notify the Central Bank’s Basel Unit at the Banking Supervision Department

immediately.

These guidelines supersede the requirements set out in section 6 ‘Pillar 2-Supervisory Review’ and

‘Annex 3: ICAAP suggested format’ contained in the CBUAE ‘Capital Adequacy Standards- the

Standardised Approach’ (November 2009).

The requirements set out in this guideline are effective as of the date of this circular.

These guidelines are applicable to all banks operating in the United Arab Emirates

All Banks must submit an ICAAP annually to the CBUAE no later than 15 April each year.

The ICAAP can be submitted as Word, PowerPoint or PDF file.


Table of Contents A. Preface ............................................................................................................................. 2

B. Pillar 2 & the ICAAP process in the UAE .......................................................................... 5

B.1 Executive Summary ....................................................................................... 5

B.2 Pillar 2 & the ICAAP process in the UAE ..................................................... 10

B.3 CBUAE Supervisory Review and Evaluation Process (SREP) Principles .... 11

B.4 CBUAE ICAAP Principles............................................................................. 11

C. ICAAP guidelines ............................................................................................................ 13

C.1 Executive Summary and conclusions .......................................................... 13

C.2 Overview of ICAAP process & the ‘USE’ test ............................................... 13

C.3 Business background and group structure ................................................... 14

C.4 Governance and risk management arrangements ....................................... 15

C.5 Risk appetite ................................................................................................ 16

C.6 Pillar 1 Risks and Calculation Methodologies .............................................. 16

C.7 Pillar 2 Risk Assessment.............................................................................. 17

C.8 Guidance on Pillar 2 Risk ............................................................................. 18

C.9 Capital planning ........................................................................................... 20

C.10 Stress and scenario testing ........................................................................ 22

C.11 Business Model Analysis (BMA) ................................................................ 25

C.12 Risk and diversification benefits ................................................................. 25

C.13 Ratings Risk ............................................................................................... 25

C.14 Islamic banks ............................................................................................. 26

D. Annexes ................................................................................................................................. I Annex 1: ICAAP: Mandatory disclosure form ................................................... I Annex 2: ICAAP projection tables (n.b. this table is for illustrative purposes only) II Annex 3: Capital planning summary .................................................................... III Annex 4: References The following are for reference purposes only .................. IV

Annex 5: Glossary ................................................................................................ V


B. Pillar 2 & the ICAAP process in the UAE

B.1 Executive Summary

The ICAAP as an internal process is a tool for better risk management and ensuring the bank

has sufficient capital to meet its current and future business plan and related risks. The ICAAP

should reflect the risk management approach embedded in the bank. Processes undertaken in

this regard should not be implemented merely to meet the regulatory requirements.

The minimum capital requirements (Pillar 1) contain restrictive or simplifying assumptions and hence a

bank should assess the total level of capital it requires as part of the Pillar 2 process on a forward

looking basis correspondent to its individual risk profile. The ICAAP should produce a level of capital

adequate to support the nature and level of risk facing an individual bank.

The key element of the capital adequacy assessment process is the forward looking capital plan, in

which the bank determines the level of capital required (accounting for material risks and stress

events). The capital plan should be based on the forecast business plan of the bank. Another essential

component is embedding forward looking stress testing to determine if the bank has sufficient capital

to meet a severe but plausible stress scenario. The ICAAP should not be undertaken as a purely

regulatory exercise and if undertaken properly it can help a bank implement a range of risk

management tools and forward planning to manage and control future risk.

The Central Bank does not prescribe or recommend any particular model or underlying methodology

whether in relation to capital concept (e.g. ‘Pillar 1 plus’ versus ‘bottom-up’ etc.) or modelling of any

other aspect of the ICAAP.

The ICAAP should indicate:

Regulatory capital requirements on a current and forecast basis

Demand in capital due to business growth, market shock/stress and other risks

Available capital supply and capital raising options

The adequate level of capital to support the current and projected risk profile

Key principle: Proportionality

A fundamental concept under these guidelines is proportionality. The ICAAP should be relevant to the

complexity, size and risk profile of the entity concerned.

The ICAAP should also have due regard to the Pillar 1 approach undertaken by the bank i.e.

Standardised Approach for Credit Risk (CSA) or Internal Ratings Based Approach (IRB) for Credit Risk.

If a bank uses a more sophisticated approach/framework in relation to any aspect of the ICAAP

process, internal capital modelling or stress testing than indicated by these guidelines the CBUAE will

permit this. The critical issue will be for the bank to be transparent and demonstrate the relevance of

the approach taken in relation to the nature of their activities and risk profile.


There may be cases where branches of a foreign bank and smaller, less complicated local banks have

a different approach to some elements of the requirements outlined in this guideline. This may be

acceptable under the concept of proportionality so long as they are able to demonstrate the relevance

of their approach in the key aspects of the ICAAP such as risk management, identification of material

risks, capital planning and stress testing. The bank should indicate this clearly in the ICAAP document

and the reasons for any alternative approach.

Foreign banks may adhere to group policies/guidelines and may not conduct stress testing on a stand-

alone basis. The CBUAE has no objection to these alternative approaches so long as the reasons for

doing so are clearly articulated.

Pillar 2 Process

Pillar 2 is one of the three fundamental Pillars underpinning the Basel Accord. As per Circular 27/2009

regarding the implementation of Basel II in the UAE, all banks must have a process for assessing the

overall capital adequacy in relation to their risk profile and a strategy for maintaining adequate capital. A

thorough and comprehensive internal capital adequacy assessment process (ICAAP) is a vital

component of a robust risk management programme. This guidance is intended to assist banks in

better identifying and managing risks in the future and in appropriately capturing risks in their internal

assessments of capital adequacy.

As part of the Pillar 2 process the CBUAE will undertake a Supervisory Review and Evaluation Process

(SREP) in order to review a bank’s ICAAP assessment and provide feedback as relevant.

The suggested summary contents for an ICAAP are set out in the ICAAP reference manual

The key components of the ICAAP are as follows:

1. Senior management and board oversight

2. Relevance of the ICAAP in identifying all material risks and the aggregate capital requirement

3. Level of disclosure to the Central Bank

4. Specific Pillar 2 risks

5. Capital Planning and Capital Management Plan (CMP)

6. Stress testing

1: Senior management and board oversight

Oversight: The ICAAP report is an internal document; the ICAAP should be approved by the board of

directors or relevant risk/governance committee. There should be sufficient challenge by the board or

senior management on material issues (and the bank should evidence this). The bank should specify

the individual responsible for the ICAAP process (this may or may not be the CRO).


The board or relevant risk/governance committee bears final responsibility for the assessment and for

any corresponding disclosures. Any deviation from these guidelines should be disclosed and discussed

with the CBUAE. The Bank should specify who signed-off the ICAAP (in addition to the CRO who must

sign the mandatory disclosure form). The ICAAP should be submitted on an annual basis. The ICAAP

submission should include the mandatory disclosure form set out in the Annex.

Senior management and board understanding: It is imperative that the bank establishes a

programme to ensure all senior management and board members understand the purpose and nature

of the ICAAP report (especially in terms of capital planning). All senior management and board

members are expected to demonstrate an understanding of the ICAAP process and familiarity with the

content of the executive summary of the ICAAP guidelines by means of relevant training and or

workshops. The Central Bank will review and verify senior management and board understanding of

the ICAAP during the SREP review.

2: Relevance of the ICAAP in identifying all material risks and the aggregate capital requirement.

The Basel Accord acknowledges that Pillar 1 regulatory capital may not necessarily be sufficient to

cover all the risks a bank is facing. ICAAP is the process that enables a prudent bank to identify the

material risks it is facing and assess the capital impact.

The CBUAE considers that a key element of the ICAAP process is for a bank to identify, disclose and assess the capital impact of all material risks. Banks should carefully consider all risks affecting their business and derive their individual risk profile accordingly.

In order to assess whether or not a risk is to be deemed material, bank management has to obtain an

overview of the institution’s risks at regular intervals and on an event-driven basis. The risks are to be

identified at the level of the individual bank as a whole regardless of which organisational unit the risks

were caused.

For each material risk identified, the bank should provide an explanation of how the risk has been

assessed, the quantitative results (if relevant), and the additional capital set aside for these risks.

3: Level of disclosure to the Central Bank

The CBUAE will be basing the ICAAP review (or SREP) predominantly on the information contained in

the ICAAP. The information contained in the ICAAP should therefore be sufficient for the CBUAE to

gain an understanding and make an informed judgment about the risk profile of the bank and the

appropriate level of capital a bank should hold.

4: Specific Pillar 2 risks

Concentration risk

The CBUAE considers concentration risk a material Pillar 2 Risk in the UAE. Basel II is calibrated to

large diversified, internationally credit institutions. It is clear that a majority of banks in the UAE are

inherently more concentrated than large diversified international banks. In the context of Pillar 2 a bank

is required to assess and monitor sector, obligor and product concentrations. A bank may use its credit

portfolio models if relevant.


Interest Rate Risk in the Banking Book (IRRBB)

Interest rate risk in the banking book (IRRBB) refers to the risk of potential losses from balance sheet

and off-balance sheet exposures due to adverse changes in interest rates. The Basel committee

recognizes IRRBB as a significant risk that merits support from capital. As per the Basel

recommendations banks are required to:

Conduct an IRR stress test

Ascertain whether additional capital is required

The test should be based on a bank’s own internal measurements systems or IRR analysis. The bank

should asses if any additional capital is required.

Liquidity risk

The ICAAP is primarily focused on capital; in certain circumstances banks have the option to use

capital as a mitigant for liquidity risk. The bank should have robust measures for managing liquidity risk,

a high level overview of how this risk is managed is sufficient for the purposes of the ICAAP. The

CBUAE is enhancing its liquidity framework separately.

5: Capital Planning and Capital Management Plan (CMP)

The objective of capital planning is to ensure the bank can meet its minimum capital requirements at all

times. The bank must detail how it would manage its business and capital over the medium term (2 - 3

year period) whilst maintaining the minimum capital requirements and the financial projections should

be based on the business plan/strategy of the bank. The bank may also consider the impact of an

economic downturn on:

The bank’s capital resources and future earnings

The banks RWA (taking into account future changes to the balance sheet).

A Capital Management Plan should explain how the bank will continue to meet its minimum capital

requirements. The bank should provide a description of how capital is managed and the main

considerations involved in the bank’s capital planning.

The Capital Management Plan should include disclosure of the following:

Capital raising: to maintain an appropriate level of capital

The possibility of holding a capital buffer if required

Corrective measures: recourse to credible action which could reduce the need for capital

(lowering the capital requirement)

Identification of sources of additional capital if required

For local banks with foreign operations the CBUAE expects the capital planning to include the risks in

the foreign operations.


6: Stress testing

This is a vital tool and is a critical element of risk management. Stress testing is acknowledged by

regulators as a key regulatory tool and board and senior management involvement in the stress testing

programme is essential. All banks should consider the impact on their business when adverse

circumstances arise.

The bank must:

Implement a comprehensive stress testing programme/ framework

Undertake stress testing on a forward-looking basis

Have clearly documented policies and procedures to enable effective implementation of a stress

testing programme.

Ensure senior management take ownership and responsibility for the implementation of an

effective stress testing programme

The bank should provide a high level summary of the bank’s approach to stress testing. Banks are be

required to define a number of relevant idiosyncratic, market wide and combination (idiosyncratic and

market wide) stresses and disclose the results of these.

Capital buffer for stress testing:

A bank should decide whether a capital buffer is required for stress testing, the bank should have a

clear process in this regard which has been formally approved by relevant management/board

committee.

If a capital buffer is maintained the bank should indicate for what particular level of stress capital is kept

(where no capital buffer is maintained the bank will need to clearly indicate how it will meet its

regulatory capital requirements in the medium term with due regard to stressed economic conditions).

Mandatory CB UAE ICAAP disclosure form

All banks are required to submit the ‘mandatory ICAAP disclosure form’ which must be signed by the

CRO (the actual ICAAP should be signed off by the relevant risk/board committee as outlined above).

The disclosure form is set out in the annex.


B.2 Pillar 2 & the ICAAP process in the UAE

ICAAP Submission and CBUAE review process

The CBUAE reserves the right to set a higher minimum capital requirement for an individual bank as a

result of the SREP (Supervisory Review and Evaluation Process). Where relevant the Central Bank

may issue the bank with Supervisor Capital Guidance (SCG). The setting of a SCG would be to raise

the minimum regulatory capital requirement for an individual bank. The setting of a higher SCG is not

automatic and will be subject to internal review.

Step 1: Submission of the ICAAP

The process begins with the submission of the ICAAP document to the Central Bank of the UAE within

the relevant timeframe. The ICAAP should be signed by the board or relevant risk/other committee (the

CRO is required to sign-off the mandatory disclosure form set out in annex 1). The submission should

highlight key items in the ICAAP which warrant immediate CBUAE attention, such as a projected

shortfall in capital.

Step 2: Supervisory Review and Evaluation Process (SREP)

The CBUAE will perform a review and evaluation of the ICAAP. The scope and depth of a review will

depend on the size of the bank and quality of the ICAAP process, and may involve both on-site visits

and desk-based review work in order to better understand the ICAAP and seek further background

information and evidence where necessary.

Step 3: issuance of Recommended Action Plan (RAP)

The review team will discuss with the bank the key findings, observations and where relevant provide

recommendations. The Central Bank will issue a Recommended Action Plan (RAP) based on the

findings of the review. The bank must then set out a plan to implement the recommendations in a

suitable time frame for each recommendation.

Step 4: Issuance of Supervisory Capital Guidance

This is in line with the Basel Committee’s recommendations and international best practises and gives

meaning to the ICAAP process. The issuance of SCG will be phased in over time and more details will

follow as deemed necessary

Submission of

ICAAP

1

Recommended Action Plan (RAP)

Discuss findings & issue RAP

3

Supervisory Review and Evaluation

Process (SREP)

CBUAE review

2

Issue Supervisory

Capital Guidance CBUAE to set a bank

specific capital ratio

4


B.3 CBUAE Supervisory Review and Evaluation Process (SREP) Principles

In order to ensure a fair, consistent and relevant approach to the Supervisor Review Process in the

UAE, the CBUAE will implement the Pillar 2 SREP in line with the following principles:

Risk-based assessment: When considering the ICAAP the focus will be on material risks and

issues, and making comparisons with peer group banks where relevant.

Systemic risk: The Central Bank will also consider the size and importance of the bank within

the UAE’s financial system

Scope of review: The scope and depth of a review will depend on the size of the bank and

quality of the ICAAP document

Diversification: The Central Bank will only consider diversification benefits on a case-by-case

basis if the bank can demonstrate the relevance to their individual portfolio.

Regulatory adjustments: Regulatory adjustments may be considered to reflect underlying

weakness or strengths in governance, oversight, risk management and controls.

B.4 CBUAE ICAAP Principles

Banks should observe and be mindful of the following principles in the design and implementation of

their ICAAP framework:

Key principle: Proportionality

A fundamental concept under these guidelines is proportionality. The ICAAP should be relevant to the

complexity, size and risk profile of the bank concerned. The ICAAP should also have due regard to the

Pillar 1 approach undertaken by the bank i.e. Standardised Approach (SA) or Internal Ratings Based

Approach (IRB) for Credit Risk.

CP 1: Every banking institution in the UAE must implement a process for assessing the

adequacy of its capital in relation to its risk profile (ICAAP).

This process is referred to as the Internal Capital Adequacy Assessment Process (ICAAP). The

CBUAE’s minimum requirements are set out in this document.

CP 2: The ICAAP should constitute an integral part of the risk management process of a bank

and not just be developed to comply with regulatory obligations.

The bank should ensure that the ICAAP forms an integral part of its risk management process. The

bank should articulate how the ICAAP is used in risk management processes and the ICAAP should

not be viewed as a task undertaken merely to meet regulatory requirements.


CP 3: The ICAAP should be risk-based, comprehensive and forward looking.

The ICAAP should be consistent with the risk profile and business model of the bank. The ICAAP

should capture all material risks and should cover Pillar 1 risks, risks not fully captured under Pillar 1,

Pillar 2 (non-Pillar 1) risks, and risk factors external to the bank (economic and business environment).

The ICAAP should be forward looking and factor in the bank’s strategic plans, the wider economic and

business cycle and other relevant scenarios. The institution should have an explicit, approved capital

plan. The bank should also set out a general contingency plan to deal with unexpected capital shortfalls

or events. Institutions should conduct appropriate stress testing taking into account jurisdiction specific

risks.

CP 4: The ICAAP is the responsibility of the bank and its Board of Directors and senior

management.

Each bank is responsible for its ICAAP and demonstrating how the ICAAP meets the relevant

supervisory standards. The responsibility for implementing the ICAAP is with the management body.

The ICAAP should be fully documented should be approved by the board of directors or relevant

risk/governance committee. There should be sufficient challenge by the board or senior management

on material issues.

CP 5: The ICAAP should be a comprehensive assessment of risks the bank is exposed to.

The bank has to identify risks on the basis of relevance and materiality. As a general rule, risks inherent

in the banking business, e.g. Credit Risk, Market Risk, Operational Risk, Credit Concentration Risk and

Liquidity Risk are to be considered material under any circumstances.

CP 6: The outcome of the ICAAP should provide a sound capital assessment.

The bank should identify the relevant amount of capital in relation to its business plan, strategies and

risk profile.

CP 7: The ICAAP should be actively used by the bank for risk management purposes.

CP 8: The ICAAP framework and capital policy should be disclosed and documented.

CP 9: The ICAAP should be subject to regular review.

The ICAAP should be reviewed at least annually and/or as often as circumstances dictate i.e. any

material change that may impact the capital position of the bank e.g. acquisitions, mergers, significant

changes to the business plan or strategy, the crystallisation of a material risk event etc.

CP 10: The ICAAP should be based on adequate measurement and assessment processes

Any new assessment techniques or revised measurement approaches are to be taken into

consideration with immediate effect on the ICAAP.

CP 11: The ICAAP should contain both quantitative and qualitative information.

CP 12: All business units and operations should be covered.


C. ICAAP guidelines The bank should complete and sign the mandatory disclosure form set out in the annex.

C.1 Executive Summary and conclusions

The purpose of the executive summary is to provide a summary of the ICAAP methodology and key

findings.

The overview should include:

The purpose of the report and summary of the ICAAP approach/ methodology

The key findings of the ICAAP in particular with respect to the Pillar 2 risk assessment, the

capital plan and stress testing

Other relevant matters

Senior management challenge of the ICAAP process

C.2 Overview of ICAAP process & the ‘USE’ test

ICAAP Role and responsibilities

A high level outline of the roles and responsibilities of relevant committees/individuals etc. with

reference to the ICAAP process (see relevant section of reference manual for example of ICAAP

process outline)

Status and use of ICAAP

Demonstrate how and to what extent the ICAAP process is embedded in the risk management

framework of the bank

Detail future refinements to the ICAAP process which may be of relevance

Challenge and adoption

Outline details of how the ICAAP has been challenged within the bank and how the ICAAP has been

tested or evaluated. Include information on the relevant testing and control processes applied to any

ICAAP models or calculations.

Detail the nature of the process and challenge undertaken by the bank (see relevant section of

reference manual). The CBUAE will ask for evidence of challenge (e.g. relevant meeting minutes, or

copies of presentations circulated to board/senior management) or may conduct interviews with

relevant members of senior management/board to ascertain their understanding and the nature of the

challenge performed.

Provide details of how the board and senior management reviewed and signed-off the ICAAP.


Reliance on third parties

If the bank engages with any third parties, such as external consultants or suppliers, while

implementing or enhancing the capital adequacy process, it must disclose the level of reliance on or the

use of those third parties. If the Internal Audit has reviewed the document and/or any processes, the

bank should provide a high level summary of any relevant reports or reviews.

ICAAP methodology

The ICAAP should also have due regard to the Pillar 1 approach undertaken by the bank i.e.

Standardised Approach (CSA) or Internal Ratings Based Approach (IRB) for Credit Risk. If a bank uses

a more sophisticated approach/framework in relation to any aspect of the ICAAP process, internal

capital modelling or stress testing then indicated by these guidelines the Central Bank will permit this.

The critical issue will be for the bank to be transparent and demonstrate the relevance of the approach

taken in relation to the nature of their activities and risk profile.

Modelling freedom: The Central Bank does not prescribe or recommend any particular model or

methodology whether in relation to capital concept (e.g. Pillar 1 plus versus economic capital) or

modelling of any other aspect of the ICAAP (e.g. interest rate risk in the banking book, concentration

risk). Where banks use any particular model or approach for any aspect of the ICAAP they must be

transparent, explain the relevance of their approach and expect challenge from the Central Bank. Any

references to a specific model or methodology in the guidance or the reference manual are for

illustrative purposes and to act as a guide for banks but need not determine the approach undertaken

for an individual bank.

Caution must be applied when considering the use of Economic Capital (EC) models. The CB has no

objection but in general EC models are designed as a relevant measure of risk to be used for

- Pricing,

- Performance measurement.

The assumptions underlying these models typically hold under normal conditions, although useful

inputs into the ICAAP, they may have limitations under stressed conditions which the ICAAP must

consider.

C.3 Business background and group structure

This section should contain an overview of the business activities of the bank and an overview of the

structure/organisational details of the bank.


C.4 Governance and risk management arrangements

Governance and risk arrangements

Provide a high level summary of the governance arrangements of the bank. The following issues

should be considered:

1) Board and senior management oversight.

2) How the board and senior management define bank wide risk appetite

3) Ensure appropriate policies, controls and risk monitoring systems are effective

4) Identify and review the changes in risks arising from new products and activities

Organisation and reporting lines

Provide a high level summary of the organisational structure and reporting lines

Functions and responsibilities of the Board of Directors and Board committees

Provide a high level summary of the functions and responsibilities of the Board of directors, board

committees and other relevant committees

Risk management framework

The bank need only set these out at a high level and cross refer to the relevant policies, procedures

and limits where relevant;

Provide a summary of the bank’s approach to risk management, and the following issues should be

considered:

Organisation of the Risk function including powers, responsibilities and areas where

responsibility has been delegated.

How the bank identifies, measures, monitors and reports material risks

Details of relevant policies, procedures and limits (these do not need to be set out in detail in the

ICAAP, the document should simply cross refer to the relevant policies, procedures and limits

where relevant)

Risk Management Information Systems (MIS), issues to consider:

o How the bank disseminates regular, accurate and timely information on the bank’s

aggregate risk profile internally

o The nature, frequency and distribution on risk management information

Internal control and audit function in relation to risk management.

The function of Internal Audit with respect to reviewing risk management

Overview of any relevant internal/external audit reviews of risk management and conclusion of these

reports


C.5 Risk appetite

The bank’s risk appetite sets out the level of risk that the bank is willing to take in pursuit of its business

objectives.

Banks should summarise their risk appetite statement or equivalent. The bank need only set these out

at a high level or cross refer to the relevant policies, procedures and limits where relevant. Banks

should avoid generic statements such as ‘our risk tolerance is low’ and should set out the appetite in

quantitative terms where relevant.

C.6 Pillar 1 Risks and Calculation Methodologies

Pillar 1 risks considered in ICAAP

The table below sets out the projected Pillar 1 capital requirements, based on the internal approaches

for the next three years based on the base case balance sheet for the bank.

(AED million) Year 1 Year 2 Year 3

Credit risk

Market risk

Operational risk

Capital requirement

Risk Type & Disclosure Credit risk

Description of what the risk is and how it affects the bank

The Pillar 1 approach used

The internal assessment approach (ICAAP approach), e.g. credit portfolio model

Use of credit risk mitigation techniques for Pillar 1 and/or ICAAP purposes

Summary of the risk policy Market risk



The internal assessment approach (ICAAP approach), e.g. VaR model

Summary of the risk policy Operational risk



The internal assessment approach (ICAAP approach), e.g. loss data analysis

Summary of the risk policy


C.7 Pillar 2 Risk Assessment The CBUAE considers that a key element of the ICAAP process is for a bank to identify, disclose and

assess the capital impact of all material Pillar 2 risks in addition to Pillar 1 risks. Banks should carefully

consider all risks affecting their business. The CBUAE considers concentration risk as a key Pillar 2 risk

for all UAE based institutions.

Pillar 2 risks can be divided into three types:

Risks not fully captured by Pillar 1: These are risks inherent to Pillar 1 that are not fully captured by

the Pillar 1 process. An example of this is credit concentration risk; other examples include risks arising

from various risk mitigation and transfer techniques

Non-Pillar 1 Risks: These are risks that are not captured by Pillar 1 and include Interest Rate Risk in

the Banking Book Risk (IRRBB), strategic risk, liquidity risk, etc. The second category also includes the

potential for a reduction in aggregate risk exposure due to imperfect correlations between risk types.

Pillar 1 calculation does not allow for a cross-risk diversification benefit but under the Basel framework

supervisors are able to recognise diversification benefits under Pillar 2.

Qualitative risk factors This include a number of qualitative issues such as corporate governance, risk

management systems and controls, external factors such as the business cycle and the wider

economy.

The bank should disclose the following:

1: General -The Pillar 2 Risk framework

The bank’s approach to identifying material Pillar 2 Risks (how has the risk assessment been

arrived at?)

What are the material risks, including a definition of materiality used by the bank?

How is the bank’s risk profile going to change (over the reporting period)?

How has the capital requirement been determined for each material risk?

2: Summary table

The bank should disclose a summary of Pillar 2 Risks and capital impact (similar to the table below).

The material risks should be relevant to the bank, and the list below is illustrative.

Pillar 2 risks Capital required (AED 000s)

e.g. Credit Concentration risk

Interest rate risk in the banking book

Liquidity risk

Business risk

…………..

Total Pillar 2 add-on


3: Disclosure for each material Pillar 2 risk For each risk provide an explanation of how the risk has been assessed, the quantitative results and

relevant mitigating actions and/or controls. The following issues should be considered.

Characteristics: Risk characteristics and how the risk might affect the bank;

Methodology: In assessing/quantifying risk

Crystallisation: Likelihood of crystallisation of risk (net of controls) where possible

Capital impact: Whether the capital held under Pillar 1 in respect of that risk is sufficient and if

additional capital will be held with respect to the individual risk concerned

C.8 Guidance on Pillar 2 Risk

1: Concentration Risk (CR)

Issue: The CBUAE considers concentration risk a material Pillar 2 Risk in the UAE. Concentration risk

is predominantly a subset of credit risk. Concentration Risk is a fairly broad term that references to an

exposure with the potential to produce losses large enough to amplify bank’s losses by increasing its

exposure to credit risk.

Types of Concentration risk: Large exposures and high correlation between exposures could

increase the amount of losses for a bank, and can arise from the following:

Lending to particular geographical regions/jurisdictions

Large exposures

Specific products

Lending to particular industry or economic sectors

Trading exposures/market risk

Basel II Calibration: In the context of Pillar 2 a bank is required to assess and monitor sector,

geographic and product concentrations. Basel II is calibrated to large diversified, internationally credit

institutions.

Methodology approach: The Central Bank does not specify any particular methodology. A bank may

use credit portfolio modelling where appropriate but the relevance and methodology of the approach

taken should be disclosed.

Information disclosure: In its analysis the bank may disclose the following with respect to

concentration risk:

An outline of key concentration risks the bank is exposed to, for example product type, large exposure,

geography, sectoral exposure etc.

Summary of relevant concentration risk policies and limits

The level of additional capital set aside to cover these risks

See further guidance in the ICAAP reference manual


2: Interest Rate Risk in the Banking Book.

Interest rate risk in the banking book (IRRBB) refers to the risk of potential losses from balance sheet

and off-balance sheet exposures due to adverse changes in interest rates.

In the context of Pillar 2 IRR refers to the banking book as interest rate risk in the trading book is

captured by the Pillar 1 market risk calculations. The approach undertaken for this risk should be

commensurate with the size and complexity of the bank.

Banks should consider the relevance of the 15 principles set out in ‘Principles for the Management and

Supervision of Interest Rate Risk, BCBS (July 2004) in particular Principle 12 ‘banks must hold capital

with the level of interest rate risk they take’.

Requirements and Information disclosure

The Basel committee recognizes IRRBB as a significant risk that merits support from capital. As per the

Basel standards banks are recommended to:

Evaluate and manage IRR: a bank shall implement systems to evaluate and manage risks

arising from potential changes in interest rate (in terms of the banking book)

Conduct an IRR stress test: (recommended to model at least a 200 basis point shock)

Interest income models: as an alternative to interest shock models a bank may use interest

income models.

Required capital: asses if any additional capital for stress testing is required. In instances where the

economic value of an institution declines by more than 20% under stressed conditions the bank should

consider setting aside additional capital for this purpose

In this regard the bank should disclose in the ICAAP:

The methodology and approach used in calculating IRRBB

Results of the analysis

The level of capital maintained, if any.

3: Liquidity Risk

The bank should set out at a high level how this risk is managed and assessed and define if additional

capital is required. A bank has the option to set a capital buffer as a mitigant if relevant.


C.9 Capital planning Capital summary and financial projections The bank should disclose at a minimum a summary of following financial projections:

Table Forecast period Details Reference 1 Capital adequacy

summary

2-3 year projection (2 year historical data should also be included for comparative purposes)

The capital adequacy summarises the capital position of the bank on a forward looking basis. The Pillar 1 + Pillar 2 charge should also be expressed as percentage of Pillar 1 (e.g. 120%) The Pillar 1 + Pillar 2+Stress test charge should also be expressed as percentage of Pillar 1 (e.g. 125%)

ICAAP reference manual

2 P&L 2-3 year projection (2 year historical data should also be included for comparative purposes)

It is likely that the bank will use data from bank’s business plan to populate the projections. The bank should also disclose a summary of the key assumptions and key developments over the forecast period (e.g. level of business growth, penetration into new product lines etc.)


3 Balance sheet 2-3 year projection (2 year historical data should also be included for comparative purposes)

It is likely that the bank will use data from bank’s business plan to populate the projections. The bank should also disclose a summary of the key assumptions and key developments over the forecast period (e.g. level of business growth, penetration into new product lines etc.)


The projected capital adequacy summary table is set out in the annex. All Banks should include this

table or equivalent in the ICAAP document.

The tables setting examples of the above for all the aforementioned projections are set out in the

ICAAP reference manual.

Historic Disclosure

Provide a summary of historic capital base, aggregate RWAs and CAR ratio for a minimum of five years

or more if data is available (as per the table highlighted in the annex)

Capital Planning: Objective

Capital planning and stress testing are interrelated topics and a bank should approach these

two elements of the ICAAP in a holistic manner. The base case capital plan can be used as the

base case for stress testing.

The objective of capital planning is to ensure the bank can meet its minimum capital requirements at all

times, hence it may be prudent for a bank to keep capital for a reasonably severe economic recession.

The bank must detail how it would manage its business and capital whilst maintaining the minimum

capital requirements.

An economic downturn would impact both

The bank’s capital resources and future earnings

The bank’s RWA (taking into account future changes to the balance sheet).


Capital planning and stress testing are related, a bank need not explicitly consider an economic

downturn or other types of scenario in its formal capital plan if this is considered in the scenario and

stress testing analysis.

The CBUAE disclosure requirements The bank should summarise the capital management plan and relevant management actions (see

guidance below). The level of information should be sufficient for the Central Bank to gain an

understanding of:

(A) The capital management plan. The plan should include the following (to maintain minimum capital

requirements)

(B) Contingency buffer

(C) Relevant management actions

(D) Access to additional capital

Process used to identify capital requirements in a stressed scenario

A fundamental feature of any Pillar 2 assessment is that it is forward-looking in nature. We would

expect banks to assess the adequacy of capital (by projecting their capital requirements and available

capital) for at least 2-3 years.

In order to facilitate understanding of the capital requirements over the medium term the bank should

take the following steps:

1) Take the base case scenario: projections of key financial data (from the business plan)

2) Apply relevant stresses and analyse the effect on the base case (projections prior to any

management actions)

3) Identification of the capital requirement


4) Outline relevant management actions

Capital management plan: should explain how the bank will continue to meet its minimum capital

requirement. The bank should provide a description of how capital is managed and the main

considerations involved in the bank’s capital planning, a ‘Capital Management Plan’ should be included

to describe the assumed management action and allows us to assess the credibility and impact

Contingency buffer

The bank should explain if it holds a buffer to absorb losses to meet the higher capital requirements

during adverse external circumstances after allowing for realistic management actions. It may be

prudent for a bank to calculate how it will maintain the minimum capital level in stressed conditions.

Relevant management actions

Outline corrective measures: recourse to credible action which could reduce the need for capital

(lowering the capital requirement).

Access to additional capital

Identification of sources of additional capital if required

The CBUAE will provide further guidance on the interaction between capital buffers under Pillar

2 and the Basel III buffers (pro-cyclical capital buffer and the contingency capital buffer) as

required

C.10 Stress and scenario testing

Overview

The recent financial crisis highlighted material failures in banks’ approach to stress testing. The period

of relative stability in financial markets prior to the crisis led to banks underestimating or not fully

considering the impact of severe shocks. The nature of stress testing undertaken by banks was found

wanting and the impact and nature of feedback effects and other factors which amplified the initial

shocks in the financial system was also underestimated. Stress testing is now acknowledged by

regulators as a key regulatory tool and board and senior management involvement in the stress

testing programme is essential.

Stress testing describes a range of techniques used by banks to gauge their potential vulnerability to

exceptional but plausible events.

Stress testing is an important risk management tool that is used by banks as part of their internal risk

management. Stress testing alerts bank management to adverse unexpected outcomes related to a

variety of risks and provides an indication of how much capital might be needed to absorb losses

should large shocks occur. While stress tests can provide an indication of the appropriate level of

capital necessary to endure deteriorating economic conditions, a bank may employ other actions in

order to help mitigate increasing levels of risk. Stress testing is a tool that supplements other risk

management approaches and measures.


Stress testing

Bank’s own stress tests: Banks will be required to define a number of relevant idiosyncratic, market

wide and combination (idiosyncratic and market wide) stresses and disclose the results of these.

The bank should:

Undertake stress testing on a forward-looking basis.

Have clearly documented policies and procedures to enable effective implementation of a stress

testing programme

Ensure senior management take ownership and responsibility for the implementation of an

effective stress testing programme

Stress testing principles The CBUAE considers that banks should have a comprehensive stress

testing programme/ framework and should be mindful of the principles below:

Stress testing should form an integral part of the overall governance and risk management

culture of the bank

Senior management should take an active interest in the development in and operation of stress

testing

Stress testing should be forward-looking

Stress tests should measure the impact on regulatory capital

The nature of the stress testing programme/framework should be commensurate to the nature,

size and complexity of the bank

Banks may find it useful to consider the principles outlines in the BIS ‘Principles for sound stress

testing practices and supervision’ (May 2009).


Capital add-on for stress testing:

Banks do not necessarily need to set aside capital as a result of stress testing; this is entirely at the

discretion of the bank’s management.

Whilst this is not mandatory a bank will have to demonstrate that it has sufficient capital to meet its

capital requirements in the medium term and this may include a buffer for a downturn scenario. If a

bank does not set aside a buffer it must be clear why this is the case. The CB will review the

assumptions and challenge the bank accordingly.

In the future this issue may be linked to the maintenance of a capital contingency buffer and a

countercyclical capital buffer under Basel 3. These issues will need to be clarified over time.

Stress testing framework:

Provide a high level summary of the bank’s approach to stress testing. Including a description of the

following:

1) The nature and objectives

2) Governance and oversight

3) Senior management involvement

4) The use of stress testing results within the institutions (e.g. setting risk appetite, limit setting

etc.)

5) Weaknesses/limitations in the process (in particular to enable senior management/board to

understand the limitations of the process.

Disclosure requirements for each stress/scenario conducted

1) Nature of the stress test conducted

2) Key assumptions/metrics underlying each stress test

3) Summary table

4) Summary of results of stress testing including the impact of the capital position of the bank and

any relevant management actions

Foreign branches/smaller local banks: Foreign branches are not necessarily required to have a

stand-alone stress testing methodology, and the approach taken may be part of the group stress test

but banks must explain the relevance of the approach.

Smaller local banks should undertake a stress testing approach in relation the size and nature of the

banks activities

An Excel version of the summary tables should also be submitted to the CBUAE electronically

to [email protected]

.

mailto:[email protected]


C.11 Business Model Analysis (BMA)

We require a bank to analyse their business model and articulate any material weaknesses in the

model. This will enable the bank and the CBUAE to understand the nature of the business model and

the inherent risks. The BMA is a useful tool for increasing awareness of the vulnerability of a business

model. The exercise should be proportionate to the size, nature and complexity of the bank.

We require the bank to:

Explicitly identify and assess the scenarios that renders a business unviable

Analyse the likelihood of those scenarios occurring

Performed at least annually in conjunction with the ICAAP process

Consider Reverse Stress Testing as part of this analysis

For example, a bank with a large real estate portfolio may identify a significant drop in real estate prices

would impact the viability of their business model. Another bank may be reliant on deposits from a

handful of large depositors, and the withdrawal of deposits from one of these parties would lead to a

significant liquidity shortfall for the bank and would impact the viability of their business model.

The scenarios would vary from bank to bank and depend on the underlying business model and

structure of the bank.

Branches of foreign banks may not be able to perform BMA on a stand-alone basis but aspects of the

requirements may be relevant.

C.12 Risk and diversification benefits

Diversification benefits, if relevant, are likely to be an integral to the overall approach and assessment

undertaken by the bank in determining its capital requirements (as part of the Pillar 2 assessment). In

principle inter-risk diversification will be accepted as long as a bank can demonstrate the relevance and

robustness of their approach.

C.13 Ratings Risk

If the bank is externally rated provide a summary of recent ratings and the name of the rating agency

(for a period of three years).

Rating reports should be made available to the CBUAE on request.


C.14 Islamic banks

ICAAP process: Islamic banks should follow the same disciplines as conventional banks. The revised

ICAAP guidelines are applicable to all firms including Islamic financial institutions.

Capital assessment: How much capital a risk would absorb were it to materialise. All banks must have

a process for assessing the overall capital adequacy in relation to their risk profile and a strategy for

maintaining appropriate levels of capital. A thorough and comprehensive internal capital adequacy

assessment process (ICAAP) is a vital component of a strong risk management programme.

Flexible approach: The CBUAE’s Pillar 2 and ICAAP regime is sufficiently flexible to capture risks of

individual institutions depending on their business models and other idiosyncratic risks. This is equally

true for both Islamic and conventional banks.

Islamic Banking ‘Windows’1

For non standalone Islamic banks that provide Islamic banking services:

Summary of Islamic banking services and products offered

RWAs for Islamic banking activities

Islamic customer deposits

Please also refer to the ‘Islamic Capital Guidelines’ to ascertain if the bank meets the disclosure

reporting thresholds

1 Islamic banking windows: conventional banks which also offer Islamic financial services or products

Central Bank of the UAE – ICAAP guideline I

D. Annexes

Annex 1: ICAAP: Mandatory disclosure form

All banks are required to disclose the following information as a separate cover sheet when submitting the ICAAP document to the Central Bank:

Bank XXXX

Date 20XX

Relevant contact point and contact details

Scope of ICAAP (entities included)

I (_________) CRO have reviewed the ICAAP and confirm that :

(a) We have identified all material risks and allocated capital accordingly

[tick box if completed]

(b) Set out a 2-3 year forward looking capital plan based on the strategic/ financial plan of the bank


(c) have implemented a 2-3 year forward looking stress test and measured the impact on the capital position of the bank


(d) The ICAAP has been signed off by: [relevant board/ committee details]

(e) The ICAAP [has/will be] challenged by the board and the nature of the challenge will be communicated to the Central Bank


CRO signature [date]

Central Bank of the UAE – ICAAP guideline II

Annex 2: ICAAP projection tables (n.b. this table is for illustrative purposes only)

Central Bank of the UAE – ICAAP guideline III

Annex 3: Capital planning summary

FY

1

Amount

Capital Planning Summary of XYZ Bank for the Year XXXX

RATIO

65

RATIOEstimated Regulatory

capital requirement

Estimated Regulatory

Capital

2

Financial Year +1 Financial Year + 3Financial Year + 2

3 4

5 6 7 8 9 10


capital requirement


Capital

1098

Financial Year+2 Financial Year+3

7


CapitalRATIO


capital requirement


CapitalRATIO


capital requirement


CapitalRATIO


capital requirement

FY+3

2 3 4

……

Amount Amount

Regulatory Capital under Stress Scenarios

ORDINARY PLANNING

FY+1 FY+2

1

2

3

4

5

Financial Year +1

1.2 Tier 2

1.1 Tier 1

1. Expected period-end regulatory capital according to planning

2 3 4

RATIOEstimated Regulatory

capital requirement


Capital

1.Total Alternative sources of capital

ALTERNATIVE SOURCES OF CAPITAL

1

2

3

4

…

Amount

Central Bank of the UAE – ICAAP guideline IV

Annex 4: References The following are for reference purposes only

Basel II, Pillar 2

& Basel III

CEBS - Guidelines on Supervisory Review Process, January 2006

BIS ‘Basel II: International Convergence of Capital Measurement and Capital Standards: A Revised Framework – Comprehensive

Version’, June 2006.

BIS ‘Enhancements to the Basel II framework’, July 2009

BIS, ‘Basel III: A global regulatory framework for more resilient banks and banking systems’, December 2010

BIS ‘Basel III: International framework for liquidity risk measurement, standards and monitoring’, December 2010

Stress testing BIS, ‘Principles for sound stress testing and supervision, May 2009

Liquidity BIS, ‘Basel III: International framework for liquidity risk measurement, standards and monitoring’, December 2010

Other BIS, ‘Range of practices and issues in economic capital frameworks’, March 2009

Central Bank of the UAE – ICAAP guideline V

Annex 5: Glossary

The following abbreviations are used in this guideline

AD Abu Dhabi

BIS Bank of International Settlements

BB Banking Book

CBUAE Central Bank of United Arab Emirates

CEBS Committee for European Banking Supervisors (now EBA European Banking Authority)

CDS Credit Default Spread

DXB Dubai

GCC Gulf Cooperation Council

ICAAP Internal Capital Adequacy Assessment Process

LGD Loss Given Default

PD Probability of Default

RST Reverse Stress Test

RWA Risk Weighted Assets

SREP Supervisory Review and Evaluation Process

SRP Supervisory Review Process

TB Trading Book

UAE

SCG

IRRBB

BMA

United Arab Emirates

Supervisory Capital Guidance

Interest Rate Risk in the Banking Book

Business Model Analysis

Central Bank of the UAE – ICAAP guideline VI

For further information please contact:

Ali Ravalia, Banking Supervision Department [email protected]

Wolfgang Gerken, Banking Supervision Department [email protected]

Or

[email protected]




icaap knowledge

Documents

adequate capital

icaap document

capital plan

uae icaap guideline

banks icaap subsequent

individual banks icaap

central bank

overall capital adequacy