Supervisory Assessment Framework

Corrected copy OFFICE OF THE DEPUTY GOVERNOR FINANCIAL SUPERVISION SECTOR MEMORANDUM NO. M-2020- 005 To : ALL BSP-SUPERVISED FINANCIAL INSTITUTIONS Subject : Supervisory Assessment Framework The Monetary Board, in its Resolution No. 327 dated 27 February 2020 approved the adoption of the Bangko Sentral ng Pilipinas’ (BSP) Supervisory Assessment Framework (SAFr) set out in the attached document. The SAFr will be used in assessing BSP-supervised financial institutions. It will replace the various rating systems currently employed by the BSP, including the CAMELS and ROCA rating systems effective 1 July 2020. For information and guidance. CHUCHI G. FONACIER Deputy Governor __5__ March 2020 Att: a/s A. Mabini St., Malate 1004 Manila, Philippines • (632) 7087701 • www.bsp.gov.ph • [email protected]

BSP SUPERVISORY ASSESSMENT FRAMEWORK I. Introduction The Supervisory Assessment Framework (SAFr) is the Bangko Sentral ng Pilipinas’ (BSP) risk-based supervisory framework. It aims to facilitate robust, dynamic and forward- looking assessments of BSP-supervised financial institutions (BSFIs). It explicitly links the systemic importance and risk profile of a BSFI to the crafting of supervisory plans for each supervised institution such that: (i) supervisory attention continues to be proportionately focused on financial institutions that are of greater impact and higher risk; and (ii) prompt and calibrated enforcement actions are deployed to reinforce prudent risk-taking behavior. The principles, concepts and processes of the SAFr apply to all BSFIs, regardless of size and risk profile.1 It also facilitates the conduct of consolidated supervision, where impact and risks are viewed on a group-wide basis. II. Elements of the SAFr The SAFr incorporates three major elements: (a) the BSFI’s impact to the financial system, (b) the BSFI’s risk profile, and (c) supervisory intensity. The first element reflects the impact of the BSFI on the financial system in the event of its failure. The second reflects the BSFI’s ability to withstand adverse conditions, as represented by its “Composite Rating.” The last element is supervisory intensity, which considers both the BSFI’s impact and its risk profile in determining the appropriate supervisory actions. A BSFI with higher impact and risk will necessarily require a higher degree of supervisory intensity. A. Impact Assessment The assessment of impact captures the systemic importance of a BSFI. It involves evaluating the potential impact of the institution in the event of distress, such as doubts about solvency, prolonged business disruption, or major conduct of business problems. The assessment of a BSFI’s impact aims to enhance the BSP’s practice of risk-based supervision by calibrating its supervisory focus and the allocation of its resources. A BSFI’s impact is assessed as Low, Moderate, Above Average or High. B. Risk Assessment The assessment of risk renders a judgment on the resilience of the BSFI to adverse business and economic conditions. It reflects the BSP’s evaluation of the safety and soundness of the BSFI after considering: (a) how effectively inherent risks emanating from significant activities are managed and controlled; and (b) how strongly capital, earnings, liquidity and governance support the institution’s overall net risk. 1 Initially, the SAFr shall only apply to banks.

Overall Net Risk In assessing a BSFI’s risk profile, the BSP will focus on its significant business activities, which represent its key risk drivers. A significant activity can be (a) a line of business (in which case, a business model, e.g., retail or commercial banking), (b) an institution- wide process (e.g., asset liability management, management of bank-wide risk such as information technology (IT) and money laundering/terrorist financing (ML/TF) risk), and/or (c) a business arm (e.g., subsidiaries). Significant activities are assessed in terms of the risks that they attract. The risk categories are summarized below: Risk Type Factors that give rise to the risk of material loss Assessed by significant activity Credit risk Arises from a counterparty’s failure to meet the terms of any contract with the BSFI or otherwise perform as agreed Market risk Arises from adverse movements in factors that affect the market value of both on- and off-balance sheet instruments, products, and transactions in an institution's overall portfolio Operational risk Arises from inadequate or failed internal processes, people and systems, or from external events; includes legal risk, but excludes strategic and reputational risk Market conduct risk Arises from actions or activities that are unethical and detrimental to the welfare customers and/or market counterparties, or activities that undermine the integrity of the market Assessed across the BSFI Liquidity risk Arises from BSFl's inability to meet its obligations when they become due without incurring unacceptable losses or costs; includes the inability to manage unplanned decreases or changes in funding sources Interest rate risk in the banking Arises from adverse movements in interest rates that book affect a bank's/quasi-bank's banking book positions Information technology risk Arises from adverse outcome, damage, loss, violation, failure or disruption associated with the use of or reliance on IT platforms, network and systems Money laundering/terrorist Arises from a covered person’s failure to prevent itself financing risk from being used as a money laundering site and conduit for the proceeds of unlawful activities as well as financing the act of terrorism A net risk rating shall be assigned to each risk category, which pertains to the residual risk after considering the mitigating effect of risk management. The rating will be Low, Moderate, Above Average or High.

Separate ratings (Strong, Acceptable, Inadequate or Weak) for compliance and internal audit are assigned to capture the extent of their effectiveness. The net risk assessments and the assessments of the compliance and internal audit functions are taken together in order to come up with an assessment of the BSFI’s overall net risk. This will either be Low, Moderate, Above Average or High. Institutional Level Support The BSFI’s risk buffers or institutional level support consist of capital, earnings, liquidity and governance. They are assessed as Strong, Acceptable, Inadequate or Weak. Earnings, capital and liquidity are sources of financial strength of the BSFI, and underpin its safety and soundness. Earnings is assessed on the basis of its quality and sustainability to support daily operations and provide for capital accretion, while capital is evaluated based on its quality and adequacy to support the BSFI’s current and prospective risk profiles under both normal and stressed conditions. The effectiveness of the BSFI’s capital management processes for maintaining adequate capital relative to the risks across all significant activities is also considered in the assessment. In the case of foreign bank branches (FBBs), their viability is assessed through the ability and willingness of their head office and parent company to support Philippine operations. Liquidity strength, on the other hand, is determined based on the ability of the BSFI to withstand shocks to its liquidity position. Lastly, the effectiveness of the BSFI’s board and management in providing stewardship, oversight and governance is assessed. Strategic and reputational risks, as well as parental support and oversight in the case of FBBs, are likewise evaluated. Composite Rating The assessments of overall net risk and institutional level support are combined to determine the Composite Rating of the BSFI. The Composite Rating of the BSFI represents a judgment of the resilience of the BSFI to adverse business and economic conditions. The composite risk rating ranges from 1 to 4, with BSFIs rated 4 being those that are deemed most resilient to adverse events. In principle, between two BSFIs with the same overall net risk, the BSFI with the better institutional level support rating would be more able to withstand shocks and therefore would merit a stronger composite rating. The table below summarizes the risk areas, independent assessment functions, and the institutional support components that are rated under the SAFr and the corresponding ranges of ratings accorded to each component: Risk Area/Component Rating Credit Risk Liquidity Risk Interest Rate Risk in the Banking Book Net Risk: Low, Moderate, Above Market Risk Average, High Operational Risk

Risk Area/Component Rating Technology Risk Money Laundering and Terrorist Financing Risk Market Conduct Risk Compliance Strong, Acceptable, Inadequate, Weak Internal Audit Overall Net RIsk Low, Moderate, Above Average, High Institutional Level Support Rating Earnings Capital Strong, Acceptable, Inadequate, Weak Liquidity Governance Overall Support Strong, Acceptable, Inadequate, Weak COMPOSITE RATING 4, 3, 2, 1 The descriptions of the composite ratings are as follows: Composite Description Rating 4 The BSFI is robust. Risks are well managed across the organization. There are no imminent threats to its safety and soundness. It has ample buffers and can withstand most adverse events. 3 The BSFI is stable. Risks are adequately managed across the organization. Supervisory concerns are within the ability of the board and management to address. The BSFI’s buffers will enable it to withstand most adverse events. 2 The BSFI is vulnerable. Risks are not well managed in the organization. Supervisory concerns are not immediately given attention. The BSFI has minimal buffers and the occurrence of an adverse event is likely to pose a threat to its safety and soundness. 1 The BSFI is distressed. Risks are beyond the capability of the board and management to address. The BSFI’s inherent risks pose a threat to its safety and soundness. It is not likely to withstand adverse events. C. Supervisory Intensity Supervisory intensity refers to the depth of supervisory attention required for and applied to the BSFI. On the other hand, depth of supervisory attention is defined by the supervisory activities that may be undertaken by the BSP with respect to the BSFI. The determination of supervisory intensity is anchored on the BSFI’s impact on the financial system and risk profile as represented by the Composite Rating.

The main supervisory activities that shall be employed by the BSP are as follows: Supervisory Activities Particulars Requirement for Additional Reports Additional reports may be required from the BSFI to facilitate further monitoring by the BSP of emerging or key supervisory concerns, and/or in aid of industry- wide studies or surveillance. Meetings with Pertinent Meetings with the Board/Senior Management, Stakeholders Independent Directors, Internal Auditor/Audit Committee, External Auditor and Home Regulator (for branches of foreign banks) may be conducted. On-site Examination On-site reviews may take the form of overseeing, regular examination, special examination, or thematic review. Periodic Risk Assessment A BSFI’s risk assessment is updated based on regular monitoring and the results of the conduct of supervisory activities.