70.Unmanaged risk and excessive concentrations are an important cause of major problems in banks. A bank must aggregate all similar direct and indirect exposures regardless of where the exposures have been booked. A risk concentration is any single exposure or group of similar exposures (e.g. to the same borrower or counterparty, including protection providers, geographic area, industry or other risk factors) with the potential to produce (i) losses large enough (relative to a bank’s earnings, capital, total assets or overall risk level) to threaten a bank’s creditworthiness or ability to maintain its core operations or (ii) a change in a bank’s risk profile. Risk concentrations must be analysed on both a bank legal entity and consolidated basis, as an unmanaged concentration at a subsidiary bank may appear immaterial at the consolidated level, but can nonetheless threaten the viability of the subsidiary. A change in the concentration risk is identified as a significant change.

71.Risk concentrations must be viewed in the context of a single or a set of closely related risk-drivers that may have different impacts on a bank. These concentrations must be integrated when assessing a bank’s overall risk exposure. A bank must consider concentrations that are based on common or correlated risk factors that reflect more subtle or more situation-specific factors than traditional concentrations, such as correlations between market, credit risks and liquidity risk.

72.The growth of market-based intermediation has increased the possibility that different areas of a bank are exposed to a common set of products, risk factors or counterparties. This has created new challenges for risk aggregation and concentration management. Through its risk management processes and MIS, a bank must be able to identify and aggregate similar risk exposures across the firm, including across legal entities, asset types (e.g. loans, derivatives and structured products), risk areas (e.g. the trading book) and geographic regions. The typical situations in which risk concentrations can arise include:

1. i.Exposures to a single counterparty, borrower or group of connected counterparties or borrowers;
2. ii.Industry or economic sectors, including exposures to both regulated and nonregulated financial institutions such as hedge funds and private equity firms;
3. iii.Geographical regions;
4. iv.Exposures arising from credit risk mitigation techniques, including exposure to similar collateral types or to a single or closely related credit protection provider;
5. v.Trading exposures;
6. vi.Exposures to counterparties (e.g. hedge funds and hedge counterparties) through the execution or processing of transactions (either product or service);
7. vii.Assets that are held in the banking book or trading book, such as loans, derivatives and structured products; and
8. viii.Off-balance sheet exposures, including guarantees, liquidity lines and other commitments.

73.Risk concentrations can also arise through a combination of exposures across these broad categories. A bank must have an understanding of its firm-wide risk concentrations resulting from similar exposures across its different business lines.

74.While risk concentrations often arise due to direct exposures to borrowers and obligors, a bank may also incur a concentration to a particular asset type indirectly through investments backed by such assets (e.g. collateralised debt obligations – CDOs), as well as exposure to protection providers guaranteeing the performance of the specific asset type (e.g. monoline insurers). A bank must have in place adequate, systematic procedures for identifying high correlation between the creditworthiness of a protection provider and the obligors of the underlying exposures due to their performance being dependent on common factors beyond systematic risk (i.e. “wrong way risk”).

75.Procedures must be in place to communicate risk concentrations to the board of directors and senior management in a manner that clearly indicates where in the organisation each segment of a risk concentration resides. A bank must have credible risk mitigation strategies in place that have senior management approval. This may include altering business strategies, reducing limits or increasing minimum capital requirements in line with the desired risk profile. While it implements risk mitigation strategies, the bank must be aware of possible concentrations that might arise because of employing risk mitigation techniques.

76.Banks must employ a number of techniques, as appropriate, to measure risk concentrations. These techniques include shocks to various risk factors; use of business level and firm-wide scenarios; and the use of integrated stress testing and economic capital models. The Central Bank will use the reference model to challenge the credit concentration risk. The reference model is based on Herfindahl-Hirschman index (HHI), therefore the Central Bank requires all the banks to calculate and report the credit concentration risk using Herfindahl-Hirschman Index (HHI) methodology (single name and sector concentration) to be part of ICAAP document irrespective of the approach chosen by the bank. Identified concentrations must be measured in a number of ways, including for example, consideration of gross versus net exposures, use of notional amounts, and analysis of exposures with and without counterparty hedges. A bank must establish internal position limits for concentrations to which it may be exposed. When conducting periodic stress tests, a bank must incorporate all major risk concentrations and identify and respond to potential changes in market conditions that could adversely have an impact on their performance and capital adequacy.

77.The assessment of such risks under a bank’s ICAAP and the supervisory review process must not be a mechanical process, but one in which each bank determines, depending on its business model, its own specific vulnerabilities. Every bank must discuss these vulnerabilities with the Central Bank. An appropriate level of capital for risk concentrations must be incorporated in a bank’s ICAAP, as well as in Pillar 2 assessments.

78.A bank must have in place effective internal policies, systems and controls to identify, measure, monitor, manage, control and mitigate its risk concentrations in a timely manner. Not only must normal market conditions be considered, but also the potential build-up of concentrations under stressed market conditions, economic downturns and periods of general market illiquidity. In addition, the bank must assess scenarios that consider possible concentrations arising from contractual and non-contractual contingent claims. The scenarios must also combine the potential build-up of pipeline exposures together with the loss of market liquidity and a significant decline in asset values. The Central Bank will use its own benchmarking to determine if banks estimation of additional capital requirements is sufficient.