Basel II's structure is built upon three pillars. Under Pillar 1, minimum capital requirements are calculated based on explicit calculation rules in respect of credit, market and operational risks. However, in Pillar 2, other risks are to be identified and risk management processes and mitigation assessed from a wider perspective, to supplement the capital requirements calculated within the scope of Pillar 1. Pillar 2 involves a proactive assessment of unexpected losses and a methodology to set aside sufficient capital. Effectively, Pillar 2 is the creation of a wider, flexible and risk-sensitive system, and this imposes a major challenge on banks in meeting such requirements. In many respects it involves a new approach to risk assessment and risk management.

One of the cornerstones of the Basel II framework, which very specifically and tangibly affect banks, is the requirement that, within the scope of Pillar 2, they develop their own Internal Credit Adequacy Assessment Plan – ICAAP. This is a tool which ensures that the banks must possess risk capital which is commensurate with their selected risk profile and risk appetite, as well as appropriate governance and control functions, and business strategies. Essentially, an ICAAP is derived from a formal internal process whereby a bank estimates its capital requirements in relation to its risk profile, strategy, business plans, governance structures, internal risk management systems, dividend policies, etc. Consequently, the ICAAP process includes a strategic review of a bank's capital needs and as to how these capital requirements are to be funded, i.e. through internal profits, IPOS, Sukuks, right issues, other debt issues, etc.

It is essential that the ICAAP process involves an assessment of a bank capital needs beyond its minimum capital requirements. Accordingly, it assesses risk beyond the Pillar I risks and, therefore, addresses both additional Pillar I and Pillar II risks. Pillar 2 risks include financial and nonfinancial risks such as strategic, reputational, liquidity, concentrations, interest rate, etc. Consequently, ICAAP allows a bank to attribute and measure capital to cover the economic effects of all risk taking activities by aggregating Pillar 1 and Pillar 2 risks.

While SAMA has formulated these guidelines with which banks must comply within the scope of their internal capital adequacy assessment process, it is the banks themselves that are to select and design the manner in which these requirements are met. Consequently, SAMA will not prescribe any standard methodology but a set of minimum requirements with respect to the process and disclosure requirements.

The main purpose of the ICAAP is for the Bank's senior managers to proactively make a strategic assessment of its capital requirements considering its strategies, business plans, all risks, acquisitions, dividend policies. Further, the ICAAP also establishes the capital required for economic, regulatory and accounting purposes and helps identify planned sources of capital to meet these objectives. Also, an ICAAP benefits include greater corporate governance and improved risk assessment in banks, and thereby increases the stability of the financial system. It also help to maintain regulatory capital levels in accordance with its strategy, economic capital, risk profile, governance structures and internal risk management systems.

Another important purpose of the ICAAP document is for senior management to inform the Board of Directors and subsequently SAMA on the ongoing assessment of the bank's risk profile, risk appetite, strategic plan and capital adequacy. It also includes the documentation as to how the bank intends to manage these risks, and how much current and future capital is necessary for its future plan.

The ultimate end product of the ICAAP process is the ICAAP document. This section on reporting format and contents is to provide guidance to banks to describe in a logical format the main assumptions and results of the ICAAP process. Consequently, the ICAAP document should bring into one place an assessment of the capital requirements in relation to a bank's risk profile, strategies, business plans, major risks, acquisitions, governance and internal risk management systems, etc. It also must establish the capital required for economic, regulatory and accounting purposes and help identify planned sources of capital to meet its objectives. Further, all relevant assessments and information should be covered and documented in the ICAAP.

Specifically, the objectives of the ICAAP and the related entities of the bank that are included by it should be specified. The main results of the ICAAP effort may be presented in a tabular format indicating the major components of capital requirements, capital available, capital buffers and proposed funding plans. Furthermore, the adequacy of the governance and bank's internal control and risk management processes should be included.

It is also important to document the strategic position of the bank, its balance sheet strength, planned growth in the major assets based on its Business plans for the next 12 to 18 months indicating the likely consumption in capital for this growth by major category.

Further, the results of major stress tests on capital requirements and capital supply for additional risks deterioration in the economic environment, recessionary periods, or other economic/political downturns are important aspects to be covered.

A description of the bank's specific objectives is desirable. In this regard, the differing purposes that capital serves: shareholder returns, rating objectives for the bank as a whole or for certain securities being issued, avoidance of regulatory intervention, protection against uncertain events, depositor protection, working capital, capital held for strategic acquisitions, etc.

This section would be the major elements of a bank's strategic and operational plans. It would include the present financial position of the bank and expected changes to the current business profile, the environment in which it expects to operate, its projected business plans (by appropriate lines of business), projected financial position, and future planned sources of capital.

Major aspects to be considered is formulating a business plan and the bank's strategies and initiative including aspects such as the political, economic, legal, components, etc. of the environment their likely profile and impact over the planning period of the Bank. This may consider aspects such as oil prices, legislation related to the Bank, i.e. foreign investments, consumer banking, capital markets, mortgages, leasing and installment companies, etc.

The starting balance sheet and the date over which the assessment is carried out should be disclosed.

The projected balance sheet should clearly indicate the major lines of business which are going to be inspected by the Bank's strategic initiatives, environmental changes and assumption over the planning period and the impact on capital requirements by major lines of business.

Also included would be the projected financial position, the projected capital available and projected capital resource requirements based on expected plans. These might then provide a baseline against which adverse scenarios might be compared.

This section should include the following:

Disclosure of various types of Capital

Timing of the ICAAP

Generally, the ICAAP is prepared on an annual basis as at the end of each calendar year, i.e. 31 December 2008 (and is due in SAMA as at 31 January of the following year). However, should there be any variation to this timing, additional details will need to be provided. This will include the reasons for the effective date of the ICAAP. Other information to be provided will also include an analysis and consideration for any events between the effective date and the date of submission which could materially impact the ICAAP and the rationale for the time period over which ICAAP has been assessed.

Risk Covered in the ICAAP

Current Methodology

A description of how models and assessments for each of the major risks have been approached and the main assumptions made.

For instance, banks may choose to base their ICAAP on the results of Pillar 1 risks calculation with additional risks (e.g. concentration risk, interest rate risk in the banking book, etc.) assessed separately and added to Pillar 1. Alternatively, a bank may decide to base their ICAAP on internal models for all risks, including those covered under Pillar 1 (i.e. Credit, Market and Operational Risks) as additional risks.

The description would make clear which risks are covered by which modeling calculation or approach. This would include details of the models, methodology and process used to calculate risks in each of the categories identified and reason for choosing the models and method used in each case.

Future Approach and Methodology

Banks may provide a summary on the future models and methodologies being considered and developed including their strengths and weaknesses.

Internal Models: Pillar 1 and ICAAP comparisons

Should the internal models vary from any regulatory models approved for pillar 1 purposes, this section would provide a detailed comparison explaining both the methodological and parameterization differences between the internal models and the regulatory models and how those affect the capital measures for ICAAP purposes.

Details of any restrictions on the management's ability to transfer capital during stressed conditions into or out of the business(es) covered. These restrictions, for example, may include contractual, commercial, regulatory or statutory nature. A statutory restriction could be, for example, a restriction on the maximum dividend that could be declared and paid. A regulatory restriction could be the minimum regulatory capital ratio acceptable to SAMA.

This area should demonstrate the extent to which capital management is embedded within the bank's operational and strategic planning. This would include the extent and use of ICAAP results and recommendation in the strategic, operational and capital planning process. Important elements of ICAAP including growth and profitability targets, scenario analysis, and stress testing may be used in setting of business plans, management policy, dividend policy and in pricing decisions.

This could also include a statement of the actual operating philosophy and strategy on capital management and how this links to the ICAAP submitted.

A bank should detail any anticipated future refinements within the ICAAP (highlighting those aspects which are work-in-progress) and provide any other information that will help SAMA review a bank's ICAAP.

The Internal Liquidity Adequacy Assessment Process (ILAAP) is defined as “the processes for the identification, measurement, management and monitoring of liquidity implemented by the bank pursuant to SAMA liquidity risk management regulations”. It thus contains all the qualitative and quantitative information necessary to underpin the risk appetite, including the description of the systems, processes and methodology to measure and manage liquidity and funding risks.

These ILAAP guidelines shall only serve as a starting point in supervisory dialogues with banks. Therefore, they should not be understood as comprehensively covering all aspects necessary to implement a sound, effective and comprehensive ILAAP. It is the responsibility of the bank to ensure that its ILAAP is sound, effective and comprehensive duly taking into account the nature, scale and complexity of its activities.

This section is for introductory text describing the following: 

This section should present a description of the bank's specific objectives relating to liquidity, such as shareholder returns, rating objectives for the bank as a whole or for certain securities being issued, avoidance of regulatory intervention, protection against uncertain events, depositor protection, working liquidity and liquidity held for strategic acquisitions etc., along with sufficient liquidity resources to cover the nature and level of the liquidity risk to which it is or might be exposed, the risk that the bank cannot meet its liabilities as they fall due, and the risk that its liquidity resources might in the future fall below the level, or differ from the quality and funding profile from those considered as appropriate by SAMA.

This section should, at minimum, cover the following:

In this section, banks should provide details of any restrictions on the management's ability to transfer liquidity during stressed conditions into or out of the businesses covered. These restrictions, for example, may include contractual, commercial, regulatory or statutory nature. A regulatory restriction could be the minimum liquidity ratio acceptable to SAMA.

In this section, banks should demonstrate the extent to which liquidity management is embedded within the bank's operational and strategic planning. This would include the extent and use of ILAAP results and recommendations in the ongoing reviews and assessment of liquidity, day to day decision making, Contingency Funding Plan (CFP) and overall strategic, operational and liquidity planning process.

Important elements of ILAAP including growth and profitability targets, scenario analysis, and stress-testing may be used in setting of business plans, management policy and in pricing decisions. This could also include a statement of the actual operating philosophy and strategy on liquidity management and how this links to the ILAAP submitted.

A bank should detail any anticipated future refinements within the ILAAP, highlighting those aspects which are work-in-progress, and provide any other information that will help SAMA review a bank's ILAAP.

Under the Supervisory Review Process, SAMA will initially review the Pillar 1 stress-testing requirement for LCR and NSFR. SAMA will also assess stress-testing under Pillar 2 with specific reference to detailed Contingency Funding Plan (CFP). Some of the scenarios which can be used are:

Stress testing has become a standard risk management tool for financial institutions. It is being increasingly used as a component of their risk identification and risk management processes. The recent global financial crisis and their impact on financial institutions in many jurisdictions have also highlighted the importance of rigorous stress testing .

SAMA’s review of the Internal Capital Adequacy Assessment Plans(ICAAPs) of Saudi banks has indicated that they have started conducting stress tests but the choice of scenarios and their severity vary from bank to bank. SAMA expects banks to adopt robust techniques and scenarios in line with the best practices to further strengthen their stress testing programs. These Rules are being issued to guide banks in this direction.

Stress tests are conducted by using a set of quantitative techniques to assess the vulnerability of individual financial institutions as well as the financial systems to exceptional but plausible events. The exceptional but plausible events can be defined either against a specific historical scenario or against a hypothetical scenario based on the analysis of past volatility and correlations or by use of other methods. The impact of such events on the profitability and capital adequacy of a financial institution is estimated to assess its capacity to absorb potential losses. The ultimate objective of stress testing is to enable a bank or financial institution to adopt countermeasures that reduce either the probability or the impact of a plausible event to preserve its solvency.

The objective of these Rules is to require banks to adopt robust stress testing techniques and use stress tests as a tool of risk management. The results of stress tests should facilitate the management in making well-informed and timely decisions on strategic planning, risk management and capital planning.

The Rules shall be applicable to all locally incorporated banks licensed and operating in Saudi Arabia. Banks may include their subsidiaries and associates in the scope of stress tests conducted by them if the risks faced by such subsidiaries/associates are material and have bearing on the solvency of the bank. Furthermore, the branches of foreign banks operating in Saudi Arabia are also required to adopt these Rules for conducting stress tests if the size of their total assets is more than 0.5% of total assets of the Saudi Banking System. However, such branches of foreign banks may apply these Rules with such modifications as may be considered expedient keeping in view the size and complexity of their business activities.

SAMA may extend the application of these Rules to any other institution or category of institutions, which are under its supervisory jurisdiction, as may be deemed fit by it from time to time.

These Rules sets out the minimum thresholds to be complied with by banks. However, banks can adopt more sophisticated techniques and scenarios beyond the minimum thresholds specified in these Rules. *In addition, banks would continue to take into account the guidance on stress testing provided by SAMA through its circulars on Basel-II implementation.

*Suggest to provide the circulars on Basel-II implementation. We need to ensure if this is relevant?

These Rules shall come into force with immediate effect. Banks are expected to create appropriate organizational structure and deploy required resources for designing and developing their stress testing frameworks in line with these Rules. Banks are also required to put in place a robust stress testing framework, which fully meets the requirements of these Rules, by 30 June 2012. Furthermore, the information required under Section 10 of these Rules shall be submitted to SAMA starting from the half-year ending 30 June 2012 and for each calendar half- year thereafter, within three months of the end of each half-year.

The Basel Committee on Banking Supervision (BCBS) has issued “Principles for Sound Stress Testing Practices and Supervision” in May 2009. SAMA has circulated these Principles to banks for compliance vide its Circular of 2^nd August 2009. In addition to the requirements of these Rules, banks are also required to take into account the guidance provided in the aforesaid Principles and any other related documents of BCBS in designing, developing and implementing their stress testing programs. In case of any inconsistency in the requirements of these Rules and the BCBS Principles, they should approach SAMA for further guidance.

As part of their stress testing frameworks, banks shall also specify the methodologies and techniques to be used, choice of scenarios, coverage of risks, procedures for compiling and communicating results, thresholds and options for taking remedial actions, and the process for compliance of regulatory reporting requirements. Detailed requirements in this regard are set out in the ensuing parts of these Rules.

Sensitivity Analysis measures the change in the value of portfolio for shocks of various degrees to a single risk factor or a small number of closely related risk factors while the underlying relationships among the risk factors are not evaluated For example, the shock might be a parallel shift in the yield curve. In sensitivity analysis, the impact of the shock on the dependent variable i.e. capital is generally estimated.

Scenario Analysis measures the change in value of portfolio due to simultaneous moves in a number of risk factors. Scenarios can be designed to encompass both movements in a group of risk factors and the changes in the underlying relationships between these variables (for example correlations and volatilities). Banks may use either the historical scenarios (a backward looking approach) or the hypothetical scenarios (a forward-looking approach) as part of their stress testing frameworks. However, they should be aware of the limitations of each of these scenarios. For example, the historical scenario may become less relevant over time due to the rapid changes in market conditions and external operating environment. On the other hand, the hypothetical scenario may be more relevant and flexible but involves more judgment and may not be backed by empirical evidence.

Banks may also use financial models in analyzing the relationships between different risk factors. However, they should exercise due care in selection of the financial or statistical models. The choice of model should take into account, inter alia, the availability of data, nature and composition of the bank’s portfolio, and its risk profile.

Reverse stress testing is used to identify and assess the stress scenarios most likely to cause a bank’s current business plan to become unviable. A reverse stress test starts with a specified outcome that challenges the viability of the bank. The analysis would then work backward (reverse engineered) to identify a scenario or combination of scenarios that could bring about such a specified outcome. The ultimate objective of reverse stress testing is to enable the banks to fully explore the vulnerabilities of their current business plan, take decisions that better integrate business and capital planning, and improve their contingency planning.

Banks are required to reverse stress test their business plan to failure i.e. the point at which the bank becomes unable to carry out its business activities due to the lack of market confidence. While doing this, they must identify a range of adverse circumstances which would cause their business plan to become unviable and assess the likelihood that such events could crystallize. In case the reverse stress testing reveal a risk of business failure that is inconsistent with the bank’s risk appetite or tolerance, it must take effective remedial measures to prevent or mitigate that risk. Banks should also document the entire process of reverse stress testing as a part of their stress testing framework.

The results of stress tests and their interpretation is influenced by the underlying assumptions of stress testing. Therefore, banks should clearly outline the assumption made in drawing-up the list of relevant risk factors, determining the magnitude of shocks and the development of scenarios.

Market risk arises when the value of on- and off-balance sheet positions of a bank is adversely affected by movements in market rates or prices such as interest rates, foreign exchange rates, equity prices, credit spreads and/or commodity prices resulting m a loss to earnings and capital of the bank. Banks should conduct stress tests to test the resilience of their on- and off-balance sheet positions that are vulnerable to changes in market rates or prices in stressed situations. The stress tests for market risk may be conducted for the following risk factors:

Operational risk is the risk of loss resulting from both internal and external operational events including e.g. technology failures, business disruption and system failures, breaches in internal controls, frauds, or other operational problems that may result in unexpected losses for the bank. The banks should systematically track and record frequency, severity and other information on operational loss events to provide a meaningful information for assessing the bank’s exposure to operational risk and developing a policy to mitigate / control that risk.

Banks should develop stress scenarios for operational risk stress tests based on the data of their past operational loss events and using professional judgment. The assumptions for operational risk stress tests would be different from those used in credit and market risk stress tests, and should be based on historical and plausible hypothetical operational loss events. A plausible stress scenario may assume a major business disruption or system failure (e.g. due to hardware or software failure or telecommunication problems) and assesses the effects of such disruptions /failures on the earnings and capital of the bank. Any additional capital requirements emanating from the outcome of operational risk stress tests should be taken into account in the capital planning process.

The risks and scenarios mentioned above are for the guidance of banks and this list may not be exhaustive. Banks are encouraged to identify any other risks and vulnerabilities related to their business and develop appropriate scenarios to stress those risks. They should identify the sources of risks using the guidance provided in these Rules and their own experiences, and then narrow down the list to significant risks potentially having material impact on their business and financial condition. Focusing on the material risks would enable banks to conduct the stress testing exercise in a meaningful way.

Salient features of the stress testing framework adopted by the bank should be described in this section. This would include, inter alia, a description of the organizational structure for conducting stress tests, composition of the stress testing team and their responsibilities, nature and frequency of stress tests, coverage of the portfolio, etc.

A description of the methodologies and techniques used for conducting stress tests should be provided in this section. This should be done in the light of guidance provided under Section 5 of the Rules.

A description of the stress testing scenarios and the underlying assumptions made by the bank for conducting stress tests should be provided in this section. This should be done, inter alia, in the light of guidance provided under Section 6 of the Rules.

The major risk factors identified by the bank based on the assessment of its portfolio and the inherent vulnerabilities should be described in this section. It may also be elaborated as to why the identified risks are considered relevant for the bank and why the other significant risks generally faced by banks are not considered relevant by the bank. This should be done, inter alia, in the light of guidance provided under Section 6 & 7 of the Rules.

A confirmation to the effect that the results of the stress tests have been communicated to the board of directors, relevant board and management committees, senior management, and relevant business areas of the bank should be provided.

Remedial action(s), if any, already taken by the bank to address potential risks and vulnerabilities identified by the stress testing results may be described in this section. Any planned remedial action(s) along with the expected timeline for their completion may also be described.