GUIDELINES ON
“INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS (ICAAP)”
UNDERPILLAR -II OF NEW CAPITAL ACCORD BASEL –II
UTTARA BANK LIMITED
1
2
Preface
In 1988 the Basel Committee on Banking Supervision (BCBS) released a capital adequacy
measurement system commonly known as the Basel Accord or Basel-I which was the then
current International Standard framework for assessing Capital Adequacy of banks. Basel –I was
initially introduced to assess capital in relation to Credit Risk and was revised in 1999 taking into
account Market Risk. But in June’2001 the Basel Committee published a more comprehensive
new package on capital adequacy framework known as Basel-II. The new accord is based on the
following three mutually reinforcing pillars:
1. Pillar I : Minimum Capital Requirement
2. Pillar II: Supervisory Review Process
3. Pillar III : Market Discipline
Basel –II is more risk sensitive and comprehensive and its implementation requires improved risk
management. As a measure of improving risk management in banks in Bangladesh, Bangladesh
Bank has already introduced guidelines on managing core risk in banks. Meanwhile, Bangladesh
Bank has decided to implement Risk Based Capital Adequacy in Bangladesh from August’2011
as per Basel-II and accordingly Bangladesh Bank planned a roadmap vide BRDP circular No. 14
dated 30.12.2009 for implementation of the same . In the line of roadmap for starting Basel-II in
Bangladesh in the year 2010 Bangladesh Bank has issued guidelines on Risk Based Capital
Adequacy for banks vide BRPD circular No. 09 dated 31.12.2008. As per said circular all
schedule banks are reporting quarterly risk based capital adequacy to Bangladesh Bank on
quarterly basis under Pillar-I of Basel –II which covers only Credit Risk, Market Risk and
Operational Risk. This reporting will be continued upto 31.12.2009. In Banking business the
banks bear not only Credit Risk, Market Risk and Operational Risk but also residual risk,
country risk, concentration risk, reputation risk, liquidity risk, earning risk etc. To cover all of
risks inherent in banks Bangladesh Bank has ordered all the schedule banks to develop Internal
Capital Adequacy Assessment Process-ICAAP (Pillar II). Through this process banks will assess
adequate capital which compensate all risks in their business.
3
Executive Summary
Risk based capital adequacy for banks in line of Basel-II is going to start in Bangladesh from
2010. Meanwhile Bangladesh Bank has formed a guidelines on Risk Based adequacy for Banks
so that all schedule banks can be able to comply with international best practice and to make the
banks’ capital more risk sensitive as well as to build up the banking industry more shock
absorvent and stable.
The salient objectives of formulation of new capital measurement are to achieve greater
transparency and increase financial stability in institutions. The institutions themselves will take
the responsibility of designing a process for Internal Capital Adequacy Assessment. For this
purpose the banks themselves identify their risks in their business, assess their risk management
and their capital adequacy in commensurate with their business size and complexity of their
business.
The supervisory authority also has some requirements regarding adequate capital on the financial
institutions that will be complied by the financial institutions within the scope of their internal
capital adequacy assessment process. For this purpose all schedule banks and financial
institutions themselves are to select and design the manner in which these requirements are to be
met.
4
PILLAR -I Vs PILLAR- II – a comparative study:
Pillar I of Basel-II presents the calculation of the minimum capital requirement (MCR) for credit
risk, market risk and operational risk i.e. the banks consider only three risks in their business.
Present minimum capital requirement is 10% of the total risk weighted assets (RWA) of a bank
with core capital (tier-I) not less than 5% of RWA. Pillar I does not consider overall risks in the
banking business. It covers only a part of the overall risk. As a result minimum capital will not fit
for compensating the overall probable loss due to risk profile of the bank. On the other hand
second pillar of Basel-II – Supervisory Review Process (SRP) suggests that the banks have a
process for assessing overall capital adequacy in relation to their risk profile and strategy for
maintaining their capital at an adequate level. Here adequate capital means enough capital to
compensate all the risks in their business and to develop and practice better risk management
techniques in monitoring and managing their risks.
This process (SRP) considers three main areas of risks- a) Risks covered under minimum capital
requirement (MCR), (b) other risk which are not captured by MCR, (c) Risks factors external to
the banks arises from the regulatory, economic or business environment. The more risks involved
in business the more capital will be required. So banks should maintain adequate capital to cover
all losses due to overall risks inherent in banking business.
Four key principles of Supervisory Review Process (SRP):
1. Banks should have a process for assessing their overall capital adequacy in relation to
their risk profile and a strategy for maintaining their capital levels.
2. Supervisors should review and evaluate banks’ internal capital adequacy assessments and
strategies, as well as their ability to monitor and ensure their compliance with regulatory
capital ratios. Supervisors should take appropriate supervisory action if they are not
satisfied with the result of this process.
3. Supervisor should expect banks to operate above the minimum regulatory capital ratios
and should have the ability to require banks to hold capital in excess of the minimum.
4. Supervisors should seek to intervene at an early stage to prevent capital from falling
below the minimum levels required to support the risk characteristics of a particular bank
and should require rapid remedial action if capital is not maintained or restored.
5
Key components of SRP.
Review of the bank’s risk profile: The Central Bank will form a view of the bank’s overall risk profile as part of the ongoing risk-
based supervision with the purpose of assessing those risk and control factors that may result in
additional capital for the bank.
Review of the bank’s ICAAP:
The central bank will assess their ICAAP as part of the SRP. This review will include a
consideration of the assumptions, methodology, coverage and outcome of a bank’s CAAP, with a
view to ascertaining the adequacy and effectiveness of a bank’s CAAP.
Determination of the bank’s minimum CAR and/ or other supervisory measures:
The Central Bank will consider whether the bank’s minimum CAR remains appropriate or needs
to be changed by applying the assessment framework set out to the results and findings gathered
from the above reviews. The Central Bank may also require the bank to take other actions to
rectify any system or control deficiencies identified during the SRP.
Communication of SRP results to the bank :
After completion of the SRP, the Central Bank will discuss with the bank the results of his
assessment, including any areas of concerned which may lead to an increase in its minimum
CAR. The Central Bank explain in sufficient detail the factors which have led to his assessment
and recommend what actions the bank should take to address the concerns. If there is proposed
increase in the minimum CAR, the bank will be consulted before a decision is finalized.
Ongoing monitoring of the bank’s capital adequacy:
This is to monitor that the bank complies with the various regulatory capital standards and
requirements applicable to it on a continuing basis. The Central Bank will update the bank’s risk
profile regularly, taking into account its progress in addressing any supervisory concerns raised or
other events which may significantly affect the bank’s ability to monitor and ensure compliance
with the Banking Capital Rules.
6
ICAAP and SREP (SRP):
ICAAP & SREP are two major components of SRP- Second Pillar of Basel-II. The SREP is
reserved for the regulator, defines said institution’s regulatory review activities and may take
rather different forms depending on the jurisdiction- and, and as such, has limited influence on
bank’s risk management activities. The ICAAP, on the other hand, carries great importance for
banks since it assesses their capital adequacy levels based on their indigenous complexity and
risk exposures. The ICAAP is usually described as a process owned by the bank and reviewed by
the regulator as part of SREP. As a result banks usually focus on the ICAAP side in their
implementation of Pillar –II
Definition of ICCAP:
Means Internal Capital Adequacy Assessment Process by which a bank identifies and measures
the risks it faces and assesses how much capital is needed to support those risks in order to run
the sound banking business.
Why adequate capital need?
There are several reasons to hold a capital buffer above the regulatory minimum capital
requirement:
▪ Future capital needs for growth trend, availing investment opportunities, contingency in
dividend payout ratio.
▪ Being prepared for occasional losses.
▪ External rating goals market reputation strategic goals.
▪ Regulatory requirement in the time horizon in consideration of economy.
Key principles of ICAAP:
1. A bank must have a process for assessing its capital adequacy relative to its risk
profile
2. The ICAAP is the responsibility of banks. Banks are responsible for setting internal
capital targets that are consistent with their risk profile, operating environment, and
strategic and business plans.
3. Banks’ ICAAP and other policies supporting it should be formally documented, and
they should be reviewed at least annually, as often as is deemed necessary and approved by
the board and senior management.
4. The ICAAP should form an integral part of banks’ risk management processes so as to
7
enable the board and senior management to assess on and on going basis, the risks that are
inherent in their activities and material to their bank.
1. The ICAAP should capture all material risks that banks are exposed to.
2. Banks should have a documented process for assessing risks i.e. the ICAAP
should be the mixture of detailed calculation and estimates. The banks rely on
quantitative methods as well as qualitative assessment and management judgment
of inputs and outputs.
3. The ICAAP should take into account banks’ strategic plans and how they relate to
macro-economic factors. Banks should develop an internal strategy for
maintaining capital levels which can incorporate factors such as loan growth
expectations, future sources and uses of funds and dividend policy and any
procyclical variation of minimum regulatory capital requirement.
Banks should also have board approved policies specially capital plan which states
their objectives and time horizon for achieving those objectives and in broad terms
the capital planning process and the responsibilities for that process. The plan should
also lay out how banks will comply with capital requirements in the future, any
relevant limits related to capital and a general contingency plan for dealing with
divergences and unexpected events e.g. raising additional capital, restricting business,
or using risk mitigation techniques.
Combined objectives of Pillar II and ICAAP:
8
The ICAAP is process to ensure that the management body (both supervisory and
management functions):
● adequately identify, measure, aggregate and monitor the institution’s risks.
● hold adequate ( more that MCR) internal capital to cover all material risks the
institution inherent in its business.
● use sound risk management systems and develop them further
It is the responsibility of the institution to define and develop its ICAAP.
●The capital adequacy is monitored in boarder terms than only covering the minimum
capital requirements as defined pillar I ( credit, market and operational risks).
● The aim of the Pillar II is to enhance the link between and institution’s risk profile, its
risk management and risk mitigation systems and its capital. Institution should
themselves develop sound risk management processes that adequately identify, measure,
aggregate and monitor the institution’s risks.
● Institutions are expected to have an adequate assessment process that encompasses all
the key elements of capital planning and management and generates an adequate amount
of capital to set against those risks.
● Institutions should develop and manage their risk management processes ; the ICAAP
belongs to the institution and supervisor should not dictate how it is applied.
Ten requirements that sought by the Supervisory Authority in
respect of ICAAP
● Every institution must have an ICAAP relative to its risk profile.
● The ICAAP is the responsibility of the institution.
● The ICAAP’s design should be fully specific, the institution’s capital
policy should be fully documented and the management body should
take responsibility for the ICAAP.
● The ICAAP should form an integral part of the management process
and decision making culture of the institution.
● The ICAAP should be reviewed regularly.
● The ICAAP should be risk-based.
● The ICAAP should be comprehensive/complete/full/widespread
● The ICAAP should be forward looking and take into consideration the
firm’s own plans and conceivable external changes.
● The ICAAP should be based on adequate measurement and
assessment process.
● The ICAAP should produce a reasonable outcome.
9
Key features of ICAAP:
ICCAP lies at the core of the four key principles of the Supervisory Review identified
the Basel Committee. Basel –II has delineated five main features of ICAAP discussed as
below:
Senior Management Oversight
Basel –II has entrusted bank’s Board of Directors and Senior Management with the
responsibility of putting in place an ICAAP appropriate to its risk profile and the business
plan and analysis of bank’s current and future capital needs.
Sound Capital Assessment
Sound Capital Assessment requires ICAAP design to be comprehensive and provide for
identification, quantification, and reporting of all the material risks faced by the bank.
The bank should establish internal capityal adequacy goals and have a process for
internal control, review and audits.
Comprehensive Capital Assessment
ICAAP must address all material risks faced by the bank. ICAAP extends beyond the
Pillar I as it covers all of the following risk:
A) Inherent risks captured under MCR
1. Credit Risk- arises from direct exposures to counterparties.
2. Market risk- arising from adverse movements in bond prices, securities
or commodity prices or foreign exchange risk in the trading book.
3. Operational Risk- lack of systems, problems in controlling, absence of
quality in employees.
10
B) Inherent risk not captured under MCR.
1. Residual Risk: Risk arises from error in the documents and error in
valuation in a loan proposal
2. Interest Rate Risk- resulting from adverse movement in interest rates.
3. Liquidity Risk-crisis (shortfall) and problem (excess) of liquidity both are
risk of liquidity.
4. Strategic Risk- arising from changes in the business environment, and
from adverse business decisions improper implementation of decisions or
lack of responsiveness to industry, economy or technological changes.
5. Reputation Risk-negative publicity regarding an institution’s business
practices, whether true or not, reduces the level of confidence of public.
6. Country Risk - refers to potential losses that may be generated by an
event that occurs in a specific country where the event can be controlled by
that country.
7. Earning Risk- current income may develop less favorably than expected.
8.Concentration Risk- exposures concentrated on a limited number of
customers, a certain sector or geographic area.
Monitoring and Reporting
This involves stabilizing a formal monitoring and reporting mechanism which provides the senior management with the necessary information on the risk profile, trends and capital requirement.
Internal Control Review
This involves putting in place an appropriate mechanism of internal control and external audits for ensuring the reasonableness of ICAAP and the accuracy of the data.
Mechanisms for materialization of ICAAP
In order to make the Internal Capital Adequacy Assessment Process (ICAAP) realistic the following approaches/ mechanisms may be exercised:
Controlling by internal audit
11
Monitoring and Reporting
Banks face several challenges in implementing the reporting and monitoring processes,
procedures and systems. These challenges include identifying the granularity level for
each risk type, deciding on the appropriate monitoring procedures and systems for each
risk, reporting templates, frequency of reporting.
A fully automated reporting framework with specific generation schedule and predefined
reports covering risk identification, assessment, quantification, aggregation and allocation
holds the answer to the stringent reporting requirements of ICAAP.
Risk Identification
It is the bank’s responsibility to identify all the material risks faced by the bank. Risk
identification requires a thorough analysis of the bank’s activities, it’s business units,
regulatory and market environment, historical scenarios etc.
Bank should put in place an automated process for identification of risks at the pre-
determined frequency. Risks are identified for entity, line of business, geography,
product, process and resources.
Risk Quantification
One of the key challenges banks face is in the quantification of risks models need to be
appropriate for the bank based on the materiality of identified risks. Since credit, market
and operational risk comprise the most material risks; banks should focus on
sophisticated modeling solution for assessment of these risks.
Currently there are no established standard models for liquidity risk, reputation risk, and
strategic risk. However many banks practice keeping a arbitrary capital cushion for these
risks. Though there are no specific models or procedures for quantification of risks, the
banks are keeping practice some assumptions, scenarios, historical data, etc for
hypothetical quantification of risks.
12
Risk quantification procedures, approaches and models in some cases (yet to be
practiced) are discussed as under:
Risks Sub-category of
Risks
Risk
Standard
Procedures, approaches and
models
Credit Risk Credit Risk
Country Risk
Concentration
Risk
Residual Risk
Interest Rate
Risk in the
banking book
∙Very High
∙ Medium
∙ High
∙ Medium
∙ Low
∙ Standardized counterparty
classes, credit rating, risk weights
∙ Internal rating based models,
counterparty credit rating and
credit scoring, expected losses
(PD,LGD,EAD)
∙ CreditVar, simulations
Market Risk ● Equity Risk in
Trading Book
● Interest Rate Risk
in Trading Book
● Foreign Exchange
Risk
∙ High
∙ Medium
∙ Low
∙ Stress Testing, scenarios
analysis
∙ Value at Risk (VaR)
Operational
Risk
Low ∙ Self assessment
∙ Statistical methods ( external
and internal database)
Liquidity Risk Low ∙ GAP analysis
∙ Stress Testing
∙ Deposits etc. modeling, different
simulations, scenarios statistical
model
13
∙ ALM ( Asset-Liability
Management) analysis
Strategic Risk Medium ∙ Self Assessment
∙ Scenario analysis
Reputation
Risk
Low ∙ Self Assessment
Economic Capital Allocation
Calculation of economic capital is an element that is meant to link risk management and
capital management. Economic capital is defined as the minimum level of capital
necessary to cover potential losses that can arise in a bank’s activities.
The economic capital calculation process should enable identification of material risk,
quantification of risks and transposition of risk measures to economic capital allocated to
specific risks/ portfolios. As part of this process banks should also identify potential risks
that may materialize in the future and take into consideration.
Reconciliation of ICAAP and Pillar I
Banks not only need to compute the economic capital for various risks under ICAAP but
are also required to reconcile it with the regulatory capital requirement. This process
requires computing, comparing and explaining the differences between the two. This is a
challenging task for banks and involves thorough comparison of the bank’s internal
models and assumptions in relation to regulatory model and its assumptions to enable the
bank to attribute differences between the two to specific factors.
14
Background
This section covers the relevant organizational structure-small or medium or large, business lines-size of assets, nature of business, volume of transaction, historical data for the bank
15