1. All banks licensed by the Central Bank of the UAE must ensure that Pillar 1 risks - credit, market, and operational risk - are mitigated by capital, in compliance with the capital adequacy framework articulated in the document Central Bank “Regulations re Capital Adequacy” issued under Notice 60/2017 and the supporting capital standards and guidance, articulated in the document Central Bank “Standards and Guidance re Capital Adequacy of Banks in the UAE”. Incompliance with the Standards, each bank is required to quantify all risks that are not covered, or not sufficiently covered by Pillar 1 capital, and determine the additional capital required to mitigate these risks. The capital required to cover these risks is referred to as Pillar 2 capital.

2. Each bank is required to have a process to assess its overall capital adequacy as a function of its risk profile and its strategy. Each bank is required to maintain appropriate capital levels in accordance with the Central Bank Standards on Pillar 2 capital. This process is termed the Internal Capital Adequacy Assessment Process (ICAAP).

3. As part of the Supervisory Review and Evaluation Process (SREP), the Central Bank analyses the capitalisation levels of banks among other information, referring to the results of the ICAAP with regard to the internal view of capital adequacy. If the evaluation concludes that the capital levels of the individual bank are not satisfactory, the Central Bank may require a bank to meet an adjusted Minimum Capital Adequacy ratio accordingly.

4. Consequently, Pillar 2 is both a bank internal process reported under the ICAAP, and the evaluation of each bank’s compete capital adequacy includes the ICAAP in its regulatory process - the SREP. First, it is the responsibility of each bank to ensure that its ICAAP is comprehensive and proportionate to the nature, scale, and complexity of its activities. Each bank bears the responsibility for the appropriate identification, estimation, and reporting of risks, and the corresponding the calibration of capital necessary to mitigate these risks. Second, the ICAAP is a critical reference for supervision and for the supervisory dialogue between banks and Central Bank.

Purpose

5. This Guidance presents minimum expected practices to be considered by each bank in order to undertake their ICAAP, covering the process, content, outcome, and usage. It clarifies the application of the Central Bank’s expectations regarding the requirements of the Central Bank ICAAP Standards. Note, that the Central Bank plans to issue separately detailed requirements relating to the Internal Liquidity Adequacy Assessment Process (ILAAP).

6. It also intends to support each bank in the identification, measurement, reporting, and mitigation of Pillar 2 risks. This Guidance does not prescribe specific methodologies but rather, it provides a framework, within which a bank should elaborate research, analyse, and draw conclusions relevant to the risk profiles of their books. Each bank remains fully responsible for the methodology and process supporting the ICAAP.

7. All methodologies employed by a bank for its ICAAP should be relevant to its business model, risk profile, to the geographies of its exposures, and, in particular, to the features of the UAE economy. The methodologies and processes employed by the bank in its ICAAP should be fully documented, transparent and replicable. Each bank should be in a position to justify their decisions and modelling choices with historical data and benchmarking across a range of practices, which will be subject to supervisory scrutiny. Models employed for the measurement of Pillar 2 risks should comply with the Central Bank Model Management Standards and Guidance.

8. The Central Bank may apply proportionality for smaller and less complex banks when evaluating the ICAAP. This does not mean that smaller or less complex banks are exempted from the reporting requirements or from undertaking a comprehensive assessment of the risks they face. Smaller banks have to perform the whole ICAAP and address the full reporting scope. In cases where a bank’s capabilities lead them to use simpler methodologies, a more conservative capital treatment may be appropriate. However, the Central Bank expects a more sophisticated risk management approach from large banks and/ or banks with complex risk profiles in the assessment of their Pillar 2 risks.

9. For the licensed operations of foreign banks in the UAE, when this document refers to the bank’s Board, it should be comprehended as the Managing Director and/ or the highest committee in the UAE operations of the bank in which the Managing Director has to be the Chairman.

10. This Guidance serves several purposes. It

11. It is important that the executive summary of the ICAAP document produced by each bank should explain the views of Senior Management and the Board on the suitability of the bank’s capital to cover the risks faced by the bank in light of its risk profile, its risk appetite and its future business plans. These views must be supported by key quantitative results including the current and expected capital position of the bank under various economic conditions including stressed circumstances. It should also provide a clear analysis of the drivers of capital consumption, including Pillar 1 and Pillar 2 risks and stress testing. The conclusion should be unambiguous, forward-looking and consider the uncertainty of the business and economic conditions.

12. More specifically, the executive summary of the ICAAP report should contain the following elements:

13. Appendix 3.4 lists further information and documentation that is required to accompany a bank’s ICAAP report.

14. Given the critical and major role of the ICAAP in banks’ sustainability and strategy, the Board of Directors is required to approve the ICAAP. The ICAAP should be subject to an effective decision-making process, by which the assumptions, projections, and conclusions are thoroughly discussed, analysed, and challenged at several levels in the organisation including (i) the relevant committees of subject matter experts, (ii) Senior Management, and (iii) the Board.

15. The Board has ultimate ownership and responsibility of the ICAAP. It is required to approve an ICAAP on a yearly basis. The Board is also expected to approve the ICAAP governance framework with a clear and transparent assignment of responsibilities, adhering to the segregation of functions, as described in Refer to Appendix 3.1. The governance framework should ensure that the ICAAP is an integral part of the bank’s management process and decision-making. The ICAAP governance framework should include a clear approach to the regular internal review and validation by the appropriate functions of the bank.

16. The policy framework should be approved by the Board. Senior Management has to implement the framework via effective procedures and systems. The framework must include measures reflected in the ICAAP report applied in day-to-day business and supported by suitable MIS at appropriate frequencies. A key aspect of this requirement is the “Use Test” principle covered in the next section. The risk framework has to be applied across the organisation.

Methodology

17. The ICAAP is an ongoing process. On an annual basis, every bank is required to submit a document outlining the outcome of the ICAAP to the Central Bank, usually referred to as its ICAAP document or report. The ICAAP supplements the Pillar 1 minimum regulatory capital requirements by (i) identifying risks that are not addressed or not fully addressed through Pillar 1 regulations, referred to as Pillar 2 risks, and (ii) determining a level of capital commensurate with the level of risk. The Central Bank requires each bank to adopt a Pillar 1 plus approach. According to this, the bank’s total capital requirements include the minimum Pillar 1 regulatory capital requirements, plus the capital required to cover Pillar 2 risks. As a result, the ICAAP should result in additional capital requirements specific to each bank’s business model.

18. Board and Senior Management are responsible to deliver a comprehensive, effective, and accurate assessment of capital adequacy. Each bank is consequently required to conduct an ICAAP supported by appropriate methods and procedures to ensure that adequate capital covers all material risks. Each bank should adopt progressively more sophisticated approaches in measuring risks to keep up with the business model evolvement, the risk profile, size of the bank, and appropriate market practice. The key objective is for each bank to be transparent and demonstrate the relevance of the approach taken in relation to the nature of their activities and risk profile to the Board and the Central Bank.

19. The frequency of reporting to the Board is expected to be at least quarterly, but, depending on the size, complexity, business model, risk types of the institution, and the market environment, reporting might need to be more frequent to ensure timely management actions. The quarterly reporting should comprise the internal calculation of the capital ratios (Pillar 1 and Pillar 2 under business-as-usual (BAU) and under stress scenarios), which includes determining the surplus/ shortfall of capital. Stress scenarios and internal forecasts only need to be updated on a quarterly basis, if required. Nevertheless, the ICAAP reporting to the Central Bank remains an annual exercise. However, if the quarterly results deviate significantly compared to the results of the ICAAP report as submitted to the Central Bank, then the bank should inform the Central Bank of the updated capital plan (including reasons for the deviations, capital ratios and mitigation actions).

20. The ICAAP should be supported by robust methodologies and data. All models used directly or indirectly in the ICAAP should follow the bank’s model management framework, in compliance with the Central Bank Standards and Guidance. The data employed in the ICAAP should be comprehensive, reliable, follow rigorous quality checks, and control mechanisms.

Scope

21. Each bank is expected to ensure the effectiveness and consistency of the ICAAP at each level, with a special focus on the group level for local banks. The ICAAP of these banks is expected to assess capital adequacy for the bank on a stand-alone basis, at regulatory consolidated level, and for the entities of the group. The ICAAP should primarily evaluate the capital requirement and capital adequacy of the bank at group level, following the regulatory consolidation. However, each bank should analyse whether additional risks arise from the group structure of the bank. The group structure must be analysed from different perspectives. To be able to effectively assess and maintain capital adequacy across entities, strategies, risk management processes, decision-making, methodologies, and assumptions applied should be coherent across the entire group. Identified additional risks may increase the capital requirement on group level accordingly.

22. Capital transferability within the group should be assessed conservatively and cautiously, which should be considered in the ICAAP. Each bank should have a process to ensure capital transferability that addresses any restrictions on the management's ability to transfer or allocate capital into or out of the bank's subsidiaries (for example contractual, commercial, regulatory, or statutory/legal restrictions that may apply). The capital allocation or distribution and the approval process between the bank’s holding company (group/parent) and the subsidiaries in the banking group should be well defined. The analysis should also consider risks arising from structural foreign currency positions relating to assets, liabilities, and equity.

23. A bank that has domestic or foreign subsidiaries or branches is expected to evaluate the difference between the ICAAP determined for the bank (including its subsidiaries) and the ICAAP at solo level (without subsidiaries). Therefore, the bank should identify any potential and additional risks both at consolidated group level and at solo bank level. The analysis should also address international operations that have jurisdictional capital requirements or restrictions.

24. Additional risks may also arise from entities that are not consolidated under Pillar 1, e.g. investments in commercial subsidiaries, including Special Purpose Vehicles (SPV), and insurance companies. Each bank should evaluate whether the required Pillar 1 capital adequately covers all risks arising from those entities. The evaluation should consider all risk types, including credit risk, reputational risk, and step-in risk, etc. The analysis should not be limited to branches and subsidiaries but should also consider affiliates, if material. Such analysis should not be limited to local banks only, also foreign banks operating in the UAE should identify and analyse all their dependencies on parent companies through centralised risk management/ shared services etc.

Use Test

25. The ICAAP and the bank’s business strategy form a feedback process. While the ICAAP has to reflect the bank’s business strategy, and business decisions. The bank should implement a formal process to analyse whether the outcomes of the ICAAP influence the business strategy. Banks should determine which additional capital requirements under Pillar 1 and Pillar 2 in business as usual BAU and stress scenarios on the top of the minimum regulatory requirements would be adequate and whether the bank’s risk appetite is adequate or requires to be adjusted accordingly. The formal feedback process should also include links to the banks’ business decisions, risk management process (e.g. using the ICAAP methodologies, results in the approval process, limit setting, strategic processes, such as capital planning or budgeting, and performance measurement). For that purpose, the Board and Senior Management should lead and approve the assumptions, methodology, framework, and outcome of the ICAAP. The usage of the ICAAP within the organisation and its alignment with strategic decisions is referred to as the ‘Use Test’.

26. The ICAAP should have an interactive relationship with other key processes within the bank, including but not limited to, (i) business strategies, (ii) financial budgeting, (iii) risk management, (iv) risk appetite setting, and (v) stress tests. Metrics related to capital allocation and capital consumption should be included in the banks’ risk appetite. Conversely, the metrics pertaining to business management and to risk management should take into consideration the capital plan.

27. Conceptually, this circular process should be articulated according to the following illustration and guidance. Each bank should design its own iterative process:

28. The stakeholders should regularly interact with each other during the production of the ICAAP in order to (i) obtain consistent forward-looking capital projections, and (ii) use capital projections consistently in their own decision-making. The stakeholders should include, but not be limited to, the Board, Senior Management, the business lines, the risk management function, and the finance function.

29. Each bank should demonstrate its appropriate usage of the ICAAP via the production of thorough documentation, reporting covering the process, methodology, decision-making for capital allocation, and strategy. Each bank should document the overall ICAAP design, including key elements and the mechanism by which they interact with each other. Such components should include, but not be limited to, the business strategies, risk appetite statement, risk measurement methods, stress tests programme, and reporting across the Group.

30. Regular reporting should be constructed to measure and monitor Pillar 2 risks in addition to the annual ICAAP report exercise. Adequate metrics and associated limits should be designed in relation to the bank’s size and complexity.

31. The Central Bank shall evaluate evidence that the bank has embraced the process for business rather than regulatory reasons. Evidence should be provided that the management has, through the ICAAP, made the business more efficient or less risky.

32. Each bank should operate above the minimum capital requirements set by the Central Bank. Each bank should have a capital plan approved by the Board. The objective of capital planning is to ensure that:

33. The ICAAP should be designed as a tool to adequately support these objectives. Each bank’s management is expected to develop and maintain an appropriate strategy that ensure the level of capital and the process to estimate such level should be commensurate with the nature, scope, scale, size, complexity, and risks of each bank.

34. The ICAAP should be forward-looking taking into account both internal and external drivers over a period covering three (3) to five (5) years. The capital planning should take into account the bank’s business plan, its strategic development and the economic environment.

35. The multi-year capital forecast should be assessed and calibrated through two perspectives:

36. Both perspectives should be function of the bank’s business plan. In addition, the second perspective should incorporate a more granular, specific, and accurate measurement of risks. Both perspectives should take into account the current, expected economic environment, and consider the occurrence of stressed events.

37. If the bank identifies a shortfall in capital pertaining to either Pillar 1 or Pillar 2. It is expected to consider measures to maintain adequate capitalisation, reverse the trend, review its strategy, and risk appetite.

38. For each internal stress test scenario for capital planning purposes, each bank is expected to consider credible, quantifiable management actions that the bank could practically take to mitigate any capital impact of stress scenarios. Such mitigating actions for ICAAP stress scenarios may differ from actions related to recovery planning. The timing and execution of these management actions should be supported by appropriate trigger points of the bank’s capital position, which may be informed by their internal risk appetite for capital adequacy. When the bank’s capital ratios fall below its internal risk appetite, it is expected that the bank is able to execute the necessary measures, i.e. the bank should explain how the capital adequacy would be ensured/ restored (e.g. via a capital contingency plan). In assessing the effectiveness of a management action, each bank should also consider the perceived reputational impact (e.g. as viewed by the market, customers, government etc.) on taking such an action in a stress. The results should be disclosed in the ICAAP report with and without those management actions that have been approved by the bank’s Board.

39. If the bank plans the increase of its capital base (e.g. capital issuances, rights issues, reduction in the equity, etc.), the bank may consider the capital increase in its capital planning. The bank should only consider capital increases that have obtained Senior Management approval and form part of the bank’s official capital plan and that have been discussed with the Central Bank. A bank that considers capital increases in it capital planning has to perform an additional stress test scenario to analyse the impact if the capital increase does not materialise.

40. The following elements should be included in the ICAAP report or related appendix:

41. Banks are required to fulfill internal risk appetite requirements in the bank’s self-assessment of Pillar 1 and Pillar 2 minimum regulatory capital requirements. Banks should fulfill the minimum capital requirements plus capital buffer requirements under business as usual (BAU) conditions. Under stress testing (ST) banks should fulfill the minimum capital requirements without the requirement to meet buffer requirements.

42. The capital planning should not be limited to risk-based capital ratios but should also consider the leverage ratio of the bank. Bank should analyse and consider unaccounted foreseeable events in the capital plan, e.g. regulatory changes like the revised standardised approaches for credit, market and operational risk.

43. As a part of its risk management practices, each bank is responsible for implementing a regular process to identify, measure, report, monitor, and mitigate risks. Such risk management process should be used as direct input into the calibration of capital demand to cover both Pillar 1 and Pillar 2 risks. The framework supporting the estimation of capital consumption for each risk type should approved by Senior Management and the Board.

44. All risks identified as material risks are expected to be addressed in the ICAAP. Risk materiality should depend on each bank’s business model and risk profile. The scope of such risk identification should cover the entire group, including all branches and subsidiaries of the bank. The Central Bank considers credit concentration risk and interest rate risk in the banking book (IRRBB) as defined in this Guidance, as material risks. Given the growing risk universe outside of traditional Pillar 1 risks, each bank must define, update, and review the applicable ICAAP risks on a continuous basis (e.g. quarterly).

45. The identification of risks should distinguish between direct risks and indirect risks. Direct risks are explicit and commonly identifiable risks, such as the credit risk associated with facility underwriting. Indirect risks are arising as second order consequences of direct risks and unforeseen events. For instance, an increase in fraud and cyber-attacks as a consequence of an economic downturn or a pandemic during which employees are forced to work from home. Other examples are the credit risk arising from derivatives during periods of high market volatility or the increase in credit risk resulting from a drop in collateral values following a real estate market crash.

46. The identification of risks should be supported by a regular and structured process. An inventory of risks should be recorded for each business activity and each portfolio on a regular basis. In addition to the regular updates (i.e. at least quarterly), it is expected to adjust the inventory whenever it no longer reflects the risks that are material, e.g. because a new product has been introduced or certain business activities have been expanded. This should support the production of ICAAP from one year to the next.

47. The measurement of risk should be transparent, documented, and supported by subject-matter experts throughout the bank. Each expert function should contribute to its area of expertise, in such way that the ICAAP is a reflection of a collective work substantiated by thorough analysis. Each dedicated risk team should provide a comprehensive assessment of the risk drivers and materiality of the risk they manage.

48. The estimation of the capital consumption associated with each risk should be based upon clear methodologies designed appropriately for each risk type. Each bank should identify the owner of such methodology either within the team responsible to manage risks or with a centralised team responsible for aggregating risk information and to construct the ICAAP. Ultimately, the process to identify, measure risks, and estimate the associated capital consumption should be approved by Senior Management and the Board.

49. In the case of vendor models, this includes the expectation that such models are not expected to be imported mechanistically, but rather they are expected to be fully understood by the bank and well suited for, and tailored to, its business and its risk profile.

50. The identification of risks should result in distinct types:

51. Each bank should not develop separate methodologies for risk measurement, if those are not employed for risk management. The Use Test assumes that the method and conclusion of the ICAAP should be coherent with the bank’s internal practices.

52. To ensure an adequate assessment of high quality, each bank should establish, and implement an effective data quality framework, to deploy adequate processes, and control mechanisms to ensure the quality of data. The data quality framework should ensure reliable risk information that supports sound decision-making, covers all relevant risk data, and data quality dimensions.

53. The next sections contain explanations and expectations on certain risk types (e.g. Business Model Analysis (BMA) and strategic risk, Interest Rate Risk in the Banking Book, and Credit concentration risk).

103. Stress test helps to improve the bank’s understanding of the vulnerabilities that it faces under exceptional, but plausible events, and provide the bank with an indication of how much capital might be needed to absorb losses if such events occur, which supplements other risk management approaches and measures. These events can be financial, operational, legal, or relate to any other risk that may have an economic impact on the bank. The results derived from stress tests can also assist the bank in determining the appropriate appetite for different types of risks and in estimating the amount of capital that should be set aside to cover them.

104. Each bank is required to implement a stress testing framework to address both the needs of the ICAAP and broader risk management. Stress tests and the stress test outcome analysis should not be confined to the ICAAP. It should be designed to support decision-making across the bank as explained in this section.

105. Each bank should perform an in-depth review of its potential vulnerabilities, capturing all material risks on a bank-wide basis that result from its business model and operating environment in the context of adverse events, stressed macroeconomic (e.g. economic cycle risk), and financial conditions.

106. As part of the ICAAP exercise, each bank should carry out integrated, regular, rigorous, and forward-looking stress tests that are appropriate to the nature of the bank’s business model and major sources of risk. The frequency should be annually and more frequently, when necessary, depending on the individual circumstances.

107. The Central Bank may challenge the key assumptions and their continuing relevance to ensure that there is sufficient capital to withstand the impact of possible adverse events and/ or changes in market conditions.

Governance

108. The Board is responsible for the effective implementation of the stress tests framework through appropriate delegation to Senior Management and subject-matter experts across the bank. This framework should be supported by robust governance, processes, methods, and systems with associated policies and procedures approved by the Board. The Board is not only responsible for the stress testing policies, but also for oversight of the stress testing execution. It is also responsible for the potential measures to mitigate stress scenario outcomes and the key decisions and actions taken based on the stress testing results, such as the consideration of stress testing outcomes in strategy and capital planning.

109. The stakeholders involved in a particular stress testing framework depend on the type of stress tests. The scenario design, quantification of impact and the identification of mitigating actions will involve a range of subject matter experts across the bank. Stress test-related activities are not the sole responsibility of the team in charge of preparing the ICAAP or in charge of the stress testing programme. Rather, the execution of stress tests is a collective exercise, whereby numerous stakeholders contribute to the design, measurement, reporting and analysis of stress tests. Stakeholders should include Senior Management and the Board.

Types of stress test exercises

110. Each bank is required to establish several distinct forms of stress test exercises as described hereunder, however for the purposes of an ICAAP the minimum expectation is to conduct internal enterprise-wide stress tests and portfolio-level stress tests. Regulatory stress tests are not acceptable as the only form of internal stress tests:

111. The frequency of stress test exercises should depend on their type, scope, depth, and on the wider economic context. Each bank should execute enterprise-wide stress tests based on a set of scenarios regularly at least quarterly is recommend. Each bank should execute portfolio-level stress tests more frequently depending on the needs of risk management and the business functions. Market risk stress tests in particular may have to be performed more frequently.

112. The capital impact results of these stress tests should be analysed, compared, incorporated, and presented in the ICAAP. One or several internal enterprise-wide stress test outcomes should be explicitly incorporated in the capital planning, and presented accordingly in the ICAAP capital planning section. The results from all types of stress tests exercise should be employed by Senior Management and the Board to assess the suitability of the bank’s capital.

Scenarios

113. Stress test scenarios should be designed to capture the risks and potential losses appropriately, in coherence with the characteristics of each bank’s risk profile and portfolio. The scope of these scenarios should cover all the risks identified as part of the identification process documented in the ICAAP. At a minimum, the scope of risks should cover strategic risk, credit risk, market risk, counterparty risk, operational risk, liquidity risk, IRRBB, credit concentration risk, funding risk, reputational risk, and climate risk.

114. Stress scenarios should lead to a reliable measurement of loss under extreme but plausible events. Such scenarios are essential tool to support risk quantification in providing impact on Pillar 1 and Pillar 2. Consequently, the scenario design should be supported by a clear choice of risk factors and associated shocks. Several types of design are commonly employed:

115. Each bank is expected to continuously monitor and identify new threats, vulnerabilities and changes in the environment to assess whether its stress testing scenarios remain appropriate at least quarterly and, if not, adapt them to the new circumstances. The impact of the scenarios is expected to be updated regularly (e.g. quarterly). In case of any material changes, the bank is expected to assess their potential impact on its capital adequacy over the course of the year.

116. If the bank forecasts the increase of its capital base (e.g. capital issuances, rights issues, reduction in the equity, etc.) and the capital planning reflects the proposed changes, the bank must perform an additional stress scenario. In these additional stress scenarios the bank should analyse the impact under the assumption that the capital increase does not materialise. The impact analysis should include management actions and formal trigger points.

Methodology

117. The process of stress tests should be supported by robust and documented methodologies. All models employed in the quantification of stress results should comply with the requirements presented in the Central Bank Model Management Standards and Guidance.

118. For the measurement of capital under stress, each bank should employ a dedicated financial model to forecast their financial statements under several economic conditions. Such projection should be constructed over a minimum of three (3) years, in coherence with the most recent capital plan and with the Central Bank regulatory exercise.

119. Stress scenarios may be derived from stochastic models or historical events, and can be developed with varying degrees of precision, depth, and severity, particularly the impact on asset quality, profitability, and capital adequacy. Each bank should consider three (3) to five (5) scenarios (each scenario can have multiple severity levels (i.e. Low, medium, and high). Although it is expected to consider the supervisory stress tests (“stress test exercise of the Financial Stability Department (FSD)”) as one scenario, it is the bank’s responsibility to define scenarios and sensitivities in the manner that best addresses its situation and to translate them into risk, loss, and capital figures.

Use Test

120. Stress tests should support decision-making throughout the bank effectively. Stress tests should be embedded in banks’ business decision-making and risk management process at several levels of the organisation. Senior Management and the Board should lead and approve all assumptions, the methodology framework and authorise the use of stress test results.

121. Stress tests do not stop with the production of results. Risk mitigations should always be considered in light of the stress severity and likelihood. If no action is deemed necessary, this should be documented and clearly justified.

Reverse Stress Test

122. In addition to normal stress testing, each bank is expected to conduct reverse stress tests. Reverse stress tests start with the identification of a pre-defined outcome where the bank’s business model becomes non-viable (e.g. through insolvency), or it breaches supervisory compliance minima, e.g. by breaching minimum capital requirements (i.e. the bank will breach the regulatory capital buffer and minimum capital requirements). The next step is to assess which scenarios and shocks lead to that identified outcome. Finally, the objective is to assess whether the likelihood of occurrence is realistic and the impact warrants mitigating actions. If a bank considers mitigation strategies, e.g. hedging strategies, the bank should consider if such strategies would be viable. For example, a market that is stressed at a financial system level may be characterised by a lack of market liquidity and increased counterparty credit risk.

123. Effective reverse stress testing is a challenging exercise that requires the involvement of all material risk areas across the bank’s subject matter experts, Senior Management, and the Board.

124. Each bank should conduct a reverse stress test at least once a year. A well-designed reverse stress test should also include enough diagnostic information to allow the identification of the sources of potential failure. This enables proactive risk management actions and implementation of an appropriate strategy for refined risk monitoring, prevention, and mitigation. The reverse stress test requires each bank to consider scenarios beyond normal business forecasts and aids identification of events linked to contagion with potential systemic implications. Reverse stress testing has important quantitative and qualitative uses, through informing Senior Management of vulnerabilities, and supporting measures to avoid them. (Please refer to Appendix 3.3).

Submission of the ICAAP report

125. The annual ICAAP report should be submitted to the Central Bank on or before the submission dates addressed in Table 1.

126. All documents have to be submitted to the respective Central Bank reviewer by softcopy (submitted in word or pdf format), sending a copy to bsed.basel@cbuae.gov.ae.

127. The submission dates below as per Notice 2940/2022 differentiate between (i) national banks and foreign bank and (ii) size and importance of the banks: (Table 1)

Table 1 - Submission date for ICAAP Report

Approval of the ICAAP report:

128. The ICAAP report should be approved by:

129. The bank’s internal control structure is essential to the capital assessment process. Effective control of the internal capital adequacy assessment process should include an independent review and the involvement of both internal audit and external audit (refer to Appendix 3.1). Senior Management has a responsibility to ensure that the bank establishes a system for assessing the full scope of its risks, develops a system to relate risk to the bank’s capital level, and establishes a method for monitoring compliance with internal policies.

130. Internal Audit should perform an audit on the bank’s ICAAP report annually. The report has to be submitted no later than three (3) months after the submission of the ICAAP report to the bank’s reviewer and in copy to bsed.basel@cbuae.gov.ae.

131. Internal control functions should perform regular reviews of the risk management process to make sure its coherence, validity, and rationality. The review of the ICAAP should cover the following:

132. In addition, the review should cover the integrity and validity of regulatory data submitted to the Central Bank during the course of the year relating to Pillar 1 capital requirements, which should address, but not be limited to the following:

133. The role and validity of internal control functions are also important and should be verified with regard to other topics. For example:

Question 1: What defines independent validation?

Answer: Independent validation can be performed by an independent function of the bank. However, in some instances an external validation/ review is required. For large banks, external validations are strongly encouraged, if not explicitly required.

Question 2: What are sustainable business model criteria?

Answer: Sustainable business models may be defined in different ways. For the purpose of this guidance, a bank will be considered to have a sustainable business model if it meets all the following criteria:

Question 3: What is the definition of model?

Answer: A quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into quantitative estimates.

Question 4: Who should be the owner of ICAAP, Finance or Risk Management?

Answer: Multiple committees and working groups have to be involved in the ICAAP. However, Risk Management should have the ultimate responsibility for the final ICAAP outcome report, the ICAAP being in substance a risk evaluation process. The Board must approve the ICAAP, its outcomes, and the proposed mitigation actions.

Question 5: The bank uses multi-period ST scenarios over three years. Which reporting year (Y1/2/3) shall be reported in the Pillar 2 template in Appendix 2 – ICAAP: Executive summary table (Table 3)?

Answer: Banks using multi-period stress scenarios should include the most severe period of the most severe stress test results (reverse stress scenarios not considered). All other banks that perform a simpler point in time or 1-period stress scenario should include the most severe ST results (reverse stress scenarios not considered). In addition, the evaluation of Pillar 2 risks and stress test impact as of the reporting date is mandatory for all banks.

Question 6: Does the bank have to present the capital contingency plan as part of ICAAP report?, If the bank plans to inject capital, is it required to have two capital plans, one with and a second plan without capital injection?

Answer:

Question 7: What is the ICAAP submission timeframe and can an extension be granted?

Answer: The ICAAP submission should comply with the schedule specified in Section VIII - ICAAP Submission and Approval. An extension of the ICAAP report submission date will only be granted in exceptional cases, by the bank’s Central Bank reviewer.

Question 8: Can banks implement the IRB methodology in full (i.e. A-IRB) while reporting credit risk under the ICAAP, and is it mandatory?

Answer: The bank should apply whichever approach is deemed appropriate for their size and complexity, as the ICAAP is an internal process. The evaluation of whether the Pillar 1 capital is adequate for the bank's risk is mandatory. The F-IRB approach is an accepted approach. With the implementation of IFRS9 banks have a PD for every exposure, which may be used to calculate the F-IRB capital. It is, however, not mandatory to fully implement the F-IRB approach. Comparing regulatory capital requirements with those determined using the F-IRB does indicate to what extent regulatory Pillar 1 capital requirements may be insufficient. The comparison between the F-IRB approach and the regulatory standardised approach for credit risk has to be performed on an asset class level and the greater capital requirement should be applied in the ICAAP.

The F-IRB should follow the floor on the PD of 0.03% and apply a fixed 45% LGD. The bank may consider certain eligible collateral to reduce the LGD accordingly. The bank shall not use own estimations of the LGD under the F-IRB.

Question 9: Is it required to calculate a capital charge against the financial risks from climate change in the ICAAP? Is any calculation methodology prescribed for this?

Answer: The bank should understand risks related to climate change and their impact on the sustainability of the bank and the risks of its business strategy. Banks should develop adequate methodologies to quantify the risk with models sophistication depending on size and business model. Stress tests and scenario analysis should be explored. Banks should consider assessing their green asset ratio (GAR) which measures a bank's “green assets” as a share of its total assets as an initial tool. The risk identification process should determine whether the risk arising from climate change is a material capital risk for the bank.

Question 10: How commercial / non-commercial subsidiaries have be treated as part of the ICAAP exercise? And how to treat investments in insurance subsidiaries?

Answer: One of the key components of the ICAAP is to determine whether the capital requirement under the Standardised Approach is adequately reflecting the risk. Additional risks arising from investment in subsidiaries should be addressed and assessed in the ICAAP. The bank should consider any subsidiary including commercial, non-commercial, and insurance subsidiaries.

Question 11: The ICAAP has to be performed on consolidated level. Is it an additional requirement to perform the ICAAP also at solo level or should the ICAAP also have a solo-level analysis?

Answer: The ICAAP needs to address additional risks that are not covered (or not fully covered) under Pillar 1. The ICAAP is expected to assess capital adequacy for the bank on a stand-alone basis, at regulatory consolidated level, and for the entities of the group. The ICAAP should evaluate the capital requirement and capital adequacy of the bank at group level, following the regulatory consolidation. However, each bank should analyse whether additional risks arise from the group structure of the bank. The ICAAP guidance lays out the importance to consider the group structure when evaluating the banks' capital adequacy, in Section IV "ICAAP Methodology, Scope and Use Test”. The bank should be in a position to report, measure and manage risks arising from its subsidiaries, branches, group entities and from the consolidation process. The ICAAP should reflect the results of the bank’s analysis. Consequently, the analysis should consider all relevant levels of the group structure (consolidated, solo, entity level, and including significant affiliate investments). Additional risks may have to be addressed as a specific additional capital add-on.

Question 12: Does the bank require a separate capital plan approved by the Board, or is it sufficient to have the approved ICAAP that includes the capital plan?

Answer: The capital management policy and the ICAAP complement each other. The policy sets the framework and the capital management plan describes the capital management strategy and the steps to achieve it in compliance with the policy. The capital management plan can be a separate document. However, the ICAAP report should display the full picture, including an overview of the capital management policy and the capital management plan related to the ICAAP outcomes.

Question 13: If a bank reports regulatory operational risk capital requirements using the BIA, can the Standardised Approach be used to quantify the potential additional operational risk charge under Pillar 2 if the capital requirement is higher under the SA compared to the BIA?

Answer: The ICAAP is an internal process and the bank must determine the most adequate methodology to quantify the extent to which regulatory capital requirements for operational risk fail to adequately address the true extent of its potential operational risk losses.

Question 14: Can the bank use the market risk stress test template as shared for Central Bank Econometric Stress test exercise in its ICAAP?

Answer: The bank should determine the most adequate approach to quantify its risks. The quantification methodology should obtain internal approval. The methodology needs to be explained, validated and reasoned in detail as part of the methodology development and continuous model monitoring process.

Question 15: Does the Internal Audit (IA) review required under Section IX - Internal Control Review contradict the requirement in Appendix 3.4, which requires banks to disclose the Internal Audit findings in the ICAAP report?

Answer: The Central Bank is of the opinion that IA is not suffering a conflict of interest by reviewing a bank’s ICAAP and by disclosing its general findings and findings specific to the ICAAP in the ICAAP report. IA is involved twofold in the ICAAP report:

The ICAAP report shall contain the most recent (available) audit findings, their status, and actions taken. (Note, that in the Capital Standards, para 13 under Introduction and Scope requires an annual review of the capital framework.)

Question 16: Why does the Standard/ Guidance not address any specifics related to Islamic banking?

Answer: The ICAAP is an internal process and the bank should determine the most adequate methodology to quantify risks arising for Islamic banks in general and Islamic banking products specifically.

Question 17: Being a branch of an international bank, is a third party validation required, as this is already conducted at the parent company/ group level covering risk frameworks, systems and models?

Answer: Branches and subsidiaries of foreign banks are required to validate the risk valuation methodologies deployed in their UAE operations. If the branch or subsidiary is applying head office methodologies, these should nevertheless be validated on branch or subsidiary level. In addition, the branch or subsidiary has to have a full understanding of the applied methodologies as it cannot fully rely on the head office.