GUIDELINES ON

“INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS (ICAAP)”

UNDERPILLAR -II OF NEW CAPITAL ACCORD BASEL –II

UTTARA BANK LIMITED

1

2

Preface

In 1988 the Basel Committee on Banking Supervision (BCBS) released a capital adequacy

measurement system commonly known as the Basel Accord or Basel-I which was the then

current International Standard framework for assessing Capital Adequacy of banks. Basel –I was

initially introduced to assess capital in relation to Credit Risk and was revised in 1999 taking into

account Market Risk. But in June’2001 the Basel Committee published a more comprehensive

new package on capital adequacy framework known as Basel-II. The new accord is based on the

following three mutually reinforcing pillars:

1. Pillar I : Minimum Capital Requirement

2. Pillar II: Supervisory Review Process

3. Pillar III : Market Discipline

Basel –II is more risk sensitive and comprehensive and its implementation requires improved risk

management. As a measure of improving risk management in banks in Bangladesh, Bangladesh

Bank has already introduced guidelines on managing core risk in banks. Meanwhile, Bangladesh

Bank has decided to implement Risk Based Capital Adequacy in Bangladesh from August’2011

as per Basel-II and accordingly Bangladesh Bank planned a roadmap vide BRDP circular No. 14

dated 30.12.2009 for implementation of the same . In the line of roadmap for starting Basel-II in

Bangladesh in the year 2010 Bangladesh Bank has issued guidelines on Risk Based Capital

Adequacy for banks vide BRPD circular No. 09 dated 31.12.2008. As per said circular all

schedule banks are reporting quarterly risk based capital adequacy to Bangladesh Bank on

quarterly basis under Pillar-I of Basel –II which covers only Credit Risk, Market Risk and

Operational Risk. This reporting will be continued upto 31.12.2009. In Banking business the

banks bear not only Credit Risk, Market Risk and Operational Risk but also residual risk,

country risk, concentration risk, reputation risk, liquidity risk, earning risk etc. To cover all of

risks inherent in banks Bangladesh Bank has ordered all the schedule banks to develop Internal

Capital Adequacy Assessment Process-ICAAP (Pillar II). Through this process banks will assess

adequate capital which compensate all risks in their business.

3

Executive Summary

Risk based capital adequacy for banks in line of Basel-II is going to start in Bangladesh from

2010. Meanwhile Bangladesh Bank has formed a guidelines on Risk Based adequacy for Banks

so that all schedule banks can be able to comply with international best practice and to make the

banks’ capital more risk sensitive as well as to build up the banking industry more shock

absorvent and stable.

The salient objectives of formulation of new capital measurement are to achieve greater

transparency and increase financial stability in institutions. The institutions themselves will take

the responsibility of designing a process for Internal Capital Adequacy Assessment. For this

purpose the banks themselves identify their risks in their business, assess their risk management

and their capital adequacy in commensurate with their business size and complexity of their

business.

The supervisory authority also has some requirements regarding adequate capital on the financial

institutions that will be complied by the financial institutions within the scope of their internal

capital adequacy assessment process. For this purpose all schedule banks and financial

institutions themselves are to select and design the manner in which these requirements are to be

met.

4

PILLAR -I Vs PILLAR- II – a comparative study:

Pillar I of Basel-II presents the calculation of the minimum capital requirement (MCR) for credit

risk, market risk and operational risk i.e. the banks consider only three risks in their business.

Present minimum capital requirement is 10% of the total risk weighted assets (RWA) of a bank

with core capital (tier-I) not less than 5% of RWA. Pillar I does not consider overall risks in the

banking business. It covers only a part of the overall risk. As a result minimum capital will not fit

for compensating the overall probable loss due to risk profile of the bank. On the other hand

second pillar of Basel-II – Supervisory Review Process (SRP) suggests that the banks have a

process for assessing overall capital adequacy in relation to their risk profile and strategy for

maintaining their capital at an adequate level. Here adequate capital means enough capital to

compensate all the risks in their business and to develop and practice better risk management

techniques in monitoring and managing their risks.

This process (SRP) considers three main areas of risks- a) Risks covered under minimum capital

requirement (MCR), (b) other risk which are not captured by MCR, (c) Risks factors external to

the banks arises from the regulatory, economic or business environment. The more risks involved

in business the more capital will be required. So banks should maintain adequate capital to cover

all losses due to overall risks inherent in banking business.

Four key principles of Supervisory Review Process (SRP):

1. Banks should have a process for assessing their overall capital adequacy in relation to

their risk profile and a strategy for maintaining their capital levels.

2. Supervisors should review and evaluate banks’ internal capital adequacy assessments and

strategies, as well as their ability to monitor and ensure their compliance with regulatory

capital ratios. Supervisors should take appropriate supervisory action if they are not

satisfied with the result of this process.

3. Supervisor should expect banks to operate above the minimum regulatory capital ratios

and should have the ability to require banks to hold capital in excess of the minimum.

4. Supervisors should seek to intervene at an early stage to prevent capital from falling

below the minimum levels required to support the risk characteristics of a particular bank

and should require rapid remedial action if capital is not maintained or restored.

5

Key components of SRP.

Review of the bank’s risk profile: The Central Bank will form a view of the bank’s overall risk profile as part of the ongoing risk-

based supervision with the purpose of assessing those risk and control factors that may result in

additional capital for the bank.

Review of the bank’s ICAAP:

The central bank will assess their ICAAP as part of the SRP. This review will include a

consideration of the assumptions, methodology, coverage and outcome of a bank’s CAAP, with a

view to ascertaining the adequacy and effectiveness of a bank’s CAAP.

Determination of the bank’s minimum CAR and/ or other supervisory measures:

The Central Bank will consider whether the bank’s minimum CAR remains appropriate or needs

to be changed by applying the assessment framework set out to the results and findings gathered

from the above reviews. The Central Bank may also require the bank to take other actions to

rectify any system or control deficiencies identified during the SRP.

Communication of SRP results to the bank :

After completion of the SRP, the Central Bank will discuss with the bank the results of his

assessment, including any areas of concerned which may lead to an increase in its minimum

CAR. The Central Bank explain in sufficient detail the factors which have led to his assessment

and recommend what actions the bank should take to address the concerns. If there is proposed

increase in the minimum CAR, the bank will be consulted before a decision is finalized.

Ongoing monitoring of the bank’s capital adequacy:

This is to monitor that the bank complies with the various regulatory capital standards and

requirements applicable to it on a continuing basis. The Central Bank will update the bank’s risk

profile regularly, taking into account its progress in addressing any supervisory concerns raised or

other events which may significantly affect the bank’s ability to monitor and ensure compliance

with the Banking Capital Rules.

6

ICAAP and SREP (SRP):

ICAAP & SREP are two major components of SRP- Second Pillar of Basel-II. The SREP is

reserved for the regulator, defines said institution’s regulatory review activities and may take

rather different forms depending on the jurisdiction- and, and as such, has limited influence on

bank’s risk management activities. The ICAAP, on the other hand, carries great importance for

banks since it assesses their capital adequacy levels based on their indigenous complexity and

risk exposures. The ICAAP is usually described as a process owned by the bank and reviewed by

the regulator as part of SREP. As a result banks usually focus on the ICAAP side in their

implementation of Pillar –II

Definition of ICCAP:

Means Internal Capital Adequacy Assessment Process by which a bank identifies and measures

the risks it faces and assesses how much capital is needed to support those risks in order to run

the sound banking business.

Why adequate capital need?

There are several reasons to hold a capital buffer above the regulatory minimum capital

requirement:

▪ Future capital needs for growth trend, availing investment opportunities, contingency in

dividend payout ratio.

▪ Being prepared for occasional losses.

▪ External rating goals market reputation strategic goals.

▪ Regulatory requirement in the time horizon in consideration of economy.

Key principles of ICAAP:

1. A bank must have a process for assessing its capital adequacy relative to its risk

profile

2. The ICAAP is the responsibility of banks. Banks are responsible for setting internal

capital targets that are consistent with their risk profile, operating environment, and

strategic and business plans.

3. Banks’ ICAAP and other policies supporting it should be formally documented, and

they should be reviewed at least annually, as often as is deemed necessary and approved by

the board and senior management.

4. The ICAAP should form an integral part of banks’ risk management processes so as to

7

enable the board and senior management to assess on and on going basis, the risks that are

inherent in their activities and material to their bank.

1. The ICAAP should capture all material risks that banks are exposed to.

2. Banks should have a documented process for assessing risks i.e. the ICAAP

should be the mixture of detailed calculation and estimates. The banks rely on

quantitative methods as well as qualitative assessment and management judgment

of inputs and outputs.

3. The ICAAP should take into account banks’ strategic plans and how they relate to

macro-economic factors. Banks should develop an internal strategy for

maintaining capital levels which can incorporate factors such as loan growth

expectations, future sources and uses of funds and dividend policy and any

procyclical variation of minimum regulatory capital requirement.

Banks should also have board approved policies specially capital plan which states

their objectives and time horizon for achieving those objectives and in broad terms

the capital planning process and the responsibilities for that process. The plan should

also lay out how banks will comply with capital requirements in the future, any

relevant limits related to capital and a general contingency plan for dealing with

divergences and unexpected events e.g. raising additional capital, restricting business,

or using risk mitigation techniques.

Combined objectives of Pillar II and ICAAP:

8

The ICAAP is process to ensure that the management body (both supervisory and

management functions):

● adequately identify, measure, aggregate and monitor the institution’s risks.

● hold adequate ( more that MCR) internal capital to cover all material risks the

institution inherent in its business.

● use sound risk management systems and develop them further

It is the responsibility of the institution to define and develop its ICAAP.

●The capital adequacy is monitored in boarder terms than only covering the minimum

capital requirements as defined pillar I ( credit, market and operational risks).

● The aim of the Pillar II is to enhance the link between and institution’s risk profile, its

risk management and risk mitigation systems and its capital. Institution should

themselves develop sound risk management processes that adequately identify, measure,

aggregate and monitor the institution’s risks.

● Institutions are expected to have an adequate assessment process that encompasses all

the key elements of capital planning and management and generates an adequate amount

of capital to set against those risks.

● Institutions should develop and manage their risk management processes ; the ICAAP

belongs to the institution and supervisor should not dictate how it is applied.

Ten requirements that sought by the Supervisory Authority in

respect of ICAAP

● Every institution must have an ICAAP relative to its risk profile.

● The ICAAP is the responsibility of the institution.

● The ICAAP’s design should be fully specific, the institution’s capital

policy should be fully documented and the management body should

take responsibility for the ICAAP.

● The ICAAP should form an integral part of the management process

and decision making culture of the institution.

● The ICAAP should be reviewed regularly.

● The ICAAP should be risk-based.

● The ICAAP should be comprehensive/complete/full/widespread

● The ICAAP should be forward looking and take into consideration the

firm’s own plans and conceivable external changes.

● The ICAAP should be based on adequate measurement and

assessment process.

● The ICAAP should produce a reasonable outcome.

9

Key features of ICAAP:

ICCAP lies at the core of the four key principles of the Supervisory Review identified

the Basel Committee. Basel –II has delineated five main features of ICAAP discussed as

below:

Senior Management Oversight

Basel –II has entrusted bank’s Board of Directors and Senior Management with the

responsibility of putting in place an ICAAP appropriate to its risk profile and the business

plan and analysis of bank’s current and future capital needs.

Sound Capital Assessment

Sound Capital Assessment requires ICAAP design to be comprehensive and provide for

identification, quantification, and reporting of all the material risks faced by the bank.

The bank should establish internal capityal adequacy goals and have a process for

internal control, review and audits.

Comprehensive Capital Assessment

ICAAP must address all material risks faced by the bank. ICAAP extends beyond the

Pillar I as it covers all of the following risk:

A) Inherent risks captured under MCR

1. Credit Risk- arises from direct exposures to counterparties.

2. Market risk- arising from adverse movements in bond prices, securities

or commodity prices or foreign exchange risk in the trading book.

3. Operational Risk- lack of systems, problems in controlling, absence of

quality in employees.

10

B) Inherent risk not captured under MCR.

1. Residual Risk: Risk arises from error in the documents and error in

valuation in a loan proposal

2. Interest Rate Risk- resulting from adverse movement in interest rates.

3. Liquidity Risk-crisis (shortfall) and problem (excess) of liquidity both are

risk of liquidity.

4. Strategic Risk- arising from changes in the business environment, and

from adverse business decisions improper implementation of decisions or

lack of responsiveness to industry, economy or technological changes.

5. Reputation Risk-negative publicity regarding an institution’s business

practices, whether true or not, reduces the level of confidence of public.

6. Country Risk - refers to potential losses that may be generated by an

event that occurs in a specific country where the event can be controlled by

that country.

7. Earning Risk- current income may develop less favorably than expected.

8.Concentration Risk- exposures concentrated on a limited number of

customers, a certain sector or geographic area.

Monitoring and Reporting

This involves stabilizing a formal monitoring and reporting mechanism which provides the senior management with the necessary information on the risk profile, trends and capital requirement.

Internal Control Review

This involves putting in place an appropriate mechanism of internal control and external audits for ensuring the reasonableness of ICAAP and the accuracy of the data.

Mechanisms for materialization of ICAAP

In order to make the Internal Capital Adequacy Assessment Process (ICAAP) realistic the following approaches/ mechanisms may be exercised:

Controlling by internal audit

11

Monitoring and Reporting

Banks face several challenges in implementing the reporting and monitoring processes,

procedures and systems. These challenges include identifying the granularity level for

each risk type, deciding on the appropriate monitoring procedures and systems for each

risk, reporting templates, frequency of reporting.

A fully automated reporting framework with specific generation schedule and predefined

reports covering risk identification, assessment, quantification, aggregation and allocation

holds the answer to the stringent reporting requirements of ICAAP.

Risk Identification

It is the bank’s responsibility to identify all the material risks faced by the bank. Risk

identification requires a thorough analysis of the bank’s activities, it’s business units,

regulatory and market environment, historical scenarios etc.

Bank should put in place an automated process for identification of risks at the pre-

determined frequency. Risks are identified for entity, line of business, geography,

product, process and resources.

Risk Quantification

One of the key challenges banks face is in the quantification of risks models need to be

appropriate for the bank based on the materiality of identified risks. Since credit, market

and operational risk comprise the most material risks; banks should focus on

sophisticated modeling solution for assessment of these risks.

Currently there are no established standard models for liquidity risk, reputation risk, and

strategic risk. However many banks practice keeping a arbitrary capital cushion for these

risks. Though there are no specific models or procedures for quantification of risks, the

banks are keeping practice some assumptions, scenarios, historical data, etc for

hypothetical quantification of risks.

12

Risk quantification procedures, approaches and models in some cases (yet to be

practiced) are discussed as under:

Risks Sub-category of

Risks

Risk

Standard

Procedures, approaches and

models

Credit Risk Credit Risk

Country Risk

Concentration

Risk

Residual Risk

Interest Rate

Risk in the

banking book

∙Very High

∙ Medium

∙ High

∙ Medium

∙ Low

∙ Standardized counterparty

classes, credit rating, risk weights

∙ Internal rating based models,

counterparty credit rating and

credit scoring, expected losses

(PD,LGD,EAD)

∙ CreditVar, simulations

Market Risk ● Equity Risk in

Trading Book

● Interest Rate Risk

in Trading Book

● Foreign Exchange

Risk

∙ High

∙ Medium

∙ Low

∙ Stress Testing, scenarios

analysis

∙ Value at Risk (VaR)

Operational

Risk

Low ∙ Self assessment

∙ Statistical methods ( external

and internal database)

Liquidity Risk Low ∙ GAP analysis

∙ Stress Testing

∙ Deposits etc. modeling, different

simulations, scenarios statistical

model

13

∙ ALM ( Asset-Liability

Management) analysis

Strategic Risk Medium ∙ Self Assessment

∙ Scenario analysis

Reputation

Risk

Low ∙ Self Assessment

Economic Capital Allocation

Calculation of economic capital is an element that is meant to link risk management and

capital management. Economic capital is defined as the minimum level of capital

necessary to cover potential losses that can arise in a bank’s activities.

The economic capital calculation process should enable identification of material risk,

quantification of risks and transposition of risk measures to economic capital allocated to

specific risks/ portfolios. As part of this process banks should also identify potential risks

that may materialize in the future and take into consideration.

Reconciliation of ICAAP and Pillar I

Banks not only need to compute the economic capital for various risks under ICAAP but

are also required to reconcile it with the regulatory capital requirement. This process

requires computing, comparing and explaining the differences between the two. This is a

challenging task for banks and involves thorough comparison of the bank’s internal

models and assumptions in relation to regulatory model and its assumptions to enable the

bank to attribute differences between the two to specific factors.

14

Background

This section covers the relevant organizational structure-small or medium or large, business lines-size of assets, nature of business, volume of transaction, historical data for the bank

15