Integrated Risk Management
The goal of Risk management, which is essential for the sustainable development of any financial institution, is to identify, evaluate, monitor and control all the categories of risk to which the institution is subject. It involves an integrated series of controls and processes, covering credit, market, liquidity and capital risks, as well as operational risks, under the responsibility of the compliance department. Bank in Brazil is working continually to map these potential risks, adopting ongoing measures for their mitigation.
The appropriate level of risk for Bank in Brazil is defined by the Risk Credit Committee (RCC), always closely aligned with Bank Portugal. Daily risk control reports are produced, to ensure adequate indices of solvency, liquidity and provisioning.
The Risk Control team operates independently from the business areas, with autonomy in its processes of risk analysis, qualification, control and monitoring.
The internal rating method used by Bank in Brazil follows that used by all the units of the group, with attribution for client companies and operations, considering not only performance-related aspects, but also the size, operating sector and operating structure.
Basel III Accord
The rules imposed by the Basel III Accord aim to improve the ability of financial institutions to absorb shocks and grow in a sustained way. The Bank in Brazil acts in harmony with the Basel III Accord, and readily accommodates the necessary changes.
In terms of credit risk, Bank in Brazil follows the regulations established for the Standardised Approach. The method incorporated elements into the previous method - such as credit risk migration - which enable better adaptation of the requirement of capital to the characteristics of exposures, as well as expanding their nature, including in relation to off-balance accounts.
When it comes to operational risk, the Basic Indicator (BIA) is used, a method that calculates the minimum capital requirement, considering the average income obtained in all the business lines over a three-year period, with a Beta factor of 15%. To follow and control the market risk, the Bank expanded the guidelines to include exposures previously not contemplated.
At the end of the 2014 tax year, the Expanded Basel index (which includes the Banking portion) for Bank in Brazil was 15.7%, reflecting an adequate level of capital, given the current Bacen limit of 11%, in view of the risk levels to which it is exposedi
The credit risk is linked to potential losses due to a failure of the borrower or counterparty to comply - whether directly or indirectly - with the agreed terms of the financial operations. Besides financial assets, exposures in derivatives, endorsements, warranties, co-obligations and the like are also considered.
The method used by the entire Group, including Bank in Brazil, to define clients' internal rating, was developed usingStandard & Poor's Risk Solutions. It considers the individual characteristics of each client (sector and activity), taken to its maximum level of consolidation within a particular economic group, as well as the financial operation to be carried out. All the ratings attributed by the local team belonging to the credit department are approved in a joint Committee with the Director of Credit of Bank in Portugal.
For certain structured operations - Project Finance, Acquisition Finance and Commodity Finance, as well as those for which there are specific standards - the internal rating is attributed by the specific team of Group in Lisbon, based on the particular operating characteristics of each product.
The analysis, approval, application and establishment of limits of all the operations involving credit risk and counterparty occur in the scope of the Risk Credit Committee (RCC) with the participation of the Executive Director and of the credit department.
The goal of the Risk Control team, within this scope, is to mediate, monitor, and carry out continuous control of the positions and exposures, in line with pre-approved limits. This involves all the operations and risk factors to which Bank in Brazil is subject. All the operations are analysed regardless of their accounting classification. The risk exposures in question, and the positions in its own portfolio that define the tolerance limits, are formally established by specific Committees. The credit risk profile of Bank in Brazil is regularly monitored in light of the evolution of credit exposures, checking for any related losses, and renegotiating operations where necessary. Compliance with the approved credit limits and adaptation of the mechanisms associated with the credit line approvals are also the object of daily analyses. The profile of the banks' credit portfolio is also monitored through various evaluation tools, ascertaining the level of exposure by client/economic group, product, rating, economic sector, maturity and guarantee.
The market risk relates to the possibility of loss due to tax fluctuations, maturity mismatches, currencies, and indicators of active and passive portfolios. At Bank in Brazil, the risk is continually identified, evaluated, monitored and controlled. The reports created are sent to the Treasury, Directors, and risk control area in Lisbon.
The proposed risk limits are based on the analysis of relevant risks factors, the volatility of the market, the forecast growth of the activity, and the risk/return ratios considered adequate, according to the standards adopted by the Bank. Simulations of normal and adverse market situations are performed, defining the limits of position by specificrisk factor, stop losses and concentration. The aim is to outline a broad framework and give sufficient support for the senior management to decide on the appropriate limits for the given moment, and the Bank's policy and strategy.
These proposals are renewed at least once a year, discussed with the risk control area in Lisbon, and submitted for appreciation by the local Risk Credit Committee (RCC). They are subsequently submitted to the Global Risk Credit Committee in Lisbon.
Market risk management is done through daily monitoring of exposure levels, in line with the established limits, both for the local portfolio of Bank in Brazil and for its Cayman branch.
Considering the variation in the Bank's portfolio (P&L: Profit and Loss) for the period January to December 2014, the validations performed confirm that the current limits include - with considerable leeway - both the VaR and the results obtained. The performance indicates adherence to the model, with any extrapolations observed being within the forecast limit.
For legal purposes, different reports are created, such as:
• DDRR - Daily Statement of Risk, which presents to the regulatory body a daily summary of information on market risks by RWA (Risk Weight Asset) portion;
• DRM - Statement of Market Risk, which presents information relating to exposures to market risk factors mapped in the vertices defined by the Regulatory Body; and
• DLO - Statement of Operational Limits, which gives the portions of capital requirement.
The liquidity risk comes from the inability to provide funding to honour the commitment assumed, or to take advantage of significant market opportunities. Liquidity management is essential for the financial institution, due to fluctuations in its assets and liabilities, and the need to meet its day-to-day obligations.
The purpose of liquidity management is to quantify the risk and determine the level of tolerance to it, and not only to eliminating the liquidity risk per se.
The liquidity risk of funding includes:
• Business risks - arising from the daily funding and trading activities in normal market situations, arising from gaps, concentration of funding, and flows of off balance items; and
• Contingent risks - arising from external factors over which the institution has no control, such as volatility of the markets, political events, and other specific aspects of the market.
For the control and evaluation of exposure to liquidity risk, Bank in Brazil uses reports based on liquiditygaps, considering and analysing the detailed position of assets and liabilities of the entire funding portfolio and fund investment.
Each day, cash flow reports are drawn up, considering the flow of maturity of financial operations, the cash flow of expenses, the level of delay in the portfolios, and advancing receivables for a period of at least 90 consecutive days.
The local liquidity risks are discussed at regular meetings (ALCO and Liquidity Committee) among the members of the Board of Directors of Bank in Brazil and Bank in Portugal. The strategies of asset allocation are defined, considering the sources of funding in the short, medium and long terms, and the interest rate risk implicit to the operations. The limits are also established for the liquidity management and maintenance of minimum cash limits, the control parameters for the distribution of the funding portfolio, and the actions to be taken in relation to the liquidity contingency plan.
For legal purposes, different reports are created, such as:
• DRL - Statement of Liquidity Risk, which presents maturity mismatches between assets and liabilities in normal conditions of liquidation;
• LCR and NSFR - Liquidity Coverage Ratio and Net Stable Funding Ratio, the new indices introduced by the Basel III Accord, which guide the legal controls in relation to the liquidity Risks.
The Bank in Brazil, capital management is an ongoing process. It includes monitoring and control of the capital maintained by the Institution, assessing need for capital to offset the risks to which it is subject, and planning targets and needs for capital, in line with its strategic objectives. The work is conducted with an eye to the future, always seeking to anticipate possible changes in market conditions.
For monitoring capital risks, and to support the decisions of the senior management, the risk management area draws up:
• Identification and evaluation of the relevant risks to which Bank in Brasiz is exposed;
• Policies and strategies of capital management, duly documented, in order to establish mechanisms and procedures;
• A Capital Plan, with a minimum three-year duration, through simulations of severe events in extreme market conditions (stress tests); and
• Weekly management reports that show the simulated capital for the next 3 months.
In accordance with the new provisions of the Basel III Accord, Bank in Brazil monitors its future capital needs, and also considers hypotheses that would prompt capital contingency plan to be activated.
A Bacen Resolutions stipulates that all financial institutions in Brazil must have an operational risk management structure. Events related to operational risk include: internal and external fraud; labour demands and lack of occupational safety; inadequate practices related to clients, products and services; damage to the institution's own physical assets or those it uses; events that interrupt the activities of the institution; failures in the information technology systems; failures in the execution and adherence deadlines and management of the activities of the institution.
The Bank in Brazil carries out a daily series of processes and procedures to manage the operational risks associated with its business, following pre-defined institutional policy. It also has a contingency plan that is continually monitored, to ensure the continuity of activities and limit severe losses. These risks are therefore identified, evaluated, controlled and mitigated.
This control is closely monitored by the Management Committee and Board of Directors of Bank in Brazil, through reports drawn up by the area responsible, which also reports on the identification of any failures, and their timely correction. The specific area is also responsible for disseminating the Operational Risk Management Policy internally, and ensuring that all employees are aware of the importance of identifying and minimizing these risks.
To aid the monitoring of internal controls, a system was developed that describes all the internal activities of the employees, listed by competence and scope. On the date planned for the execution of the activity, the system automatically issues an alert to the respective employer and to the Compliance I Operational Risk Management Area, recording whether the task has been carried out. Activities not carried out are immediately reported to the employee's superior and the executive director of the department to which they belong. Based on the justification presented, they are also evaluated by the Compliance Department, which adopts the necessary administrative and/or correction measures.
The Board of Directors of Bank in Brazil is responsible for validating the Operational Risk Management Policy. This policy describes the internal structure, activities, and methodology adopted by the area to mitigate any operational risks identified, as well as any failures, and the corrective measures to be taken.
To ensure follow-up of the activities, weekly reports are delivered to the Management Committee, reporting any indicated failures, and the corrective and preventative actions adopted to mitigate the risks identified. Whenever failures occur that could be classified as medium or high risk, additional reports can be issued and sent to the executive director responsible, with a copy to the executive board of directors.
This culture of maintaining rigorous internal controls is disseminated among the employees as part of the routine activities. Each employee is aware of his or her responsibility to monitor operational risk. Employees are encouraged to report any questions, situations of risk, or suggestions for improvement to those responsible. This helps make the model more efficient when it comes to identifying, monitoring and mitigating the risks.