Understanding ICAAP for NBFCs

– Qasim Saif | Manager | finserv@vinodkothari.com

Systemic risk of NBFCs has been an issue for discussion, specifically in India as there have been some major NBFC failures, and the issue of inter-connectivity between NBFCs and the rest of the financial sector became clearly evident. The issue is not limited to India, an annual publication of the Financial Stability Board, called Global Monitoring Report on Non-banking Financial Intermediation has been drawing attention to the increasing relevance of non-banking financial intermediaries and the risk they pose on a global level.^[1]

In order to carry out the risk assessment, the banks are required to follow the Internal Capital Adequacy Assessment Process (ICAAP) as per Pillar II of the Basel II framework. However, with the increasing importance of non-banking financial institutions, the RBI has through its Revised Regulatory Framework for NBFCs (Revised Framework)^[2] have inserted the ICAAP requirements to the middle layer NBFCs too from October 2022.

Under the existing regulatory framework, the NBFCs are required to carry out stress testing of only securitisation exposures or pool of loans acquired from other institutions.

Our services and Assistance for ICAAP Implementation can be viewed here – https://vinodkothari.com/2022/09/services-and-assistance-for-icaap-implementation/

As this would be a new requirement for NBFCs, and the specific directions in this respect are still awaited, the literature and guidance in this respect is scarce. In this article we have tried to discuss in brief, the expectations of the regulator along with a probable approach for NBFCs towards the ICAAP.

Understanding ICAAP

Basel II, published in 2006, lays out a three-pillar approach to risk and capital management for banks:

Pillar 1 outlines the definitions, processes, and formulas to calculate minimum regulatory capital requirements. Pillar 3 mandates the disclosures that banks must make to provide investors and the public with full transparency.

Pillar 2, the focus of this article, describes the mandatory processes for both banks and regulators to fulfil the capital adequacy requirements. Banks have to conduct an ICAAP to demonstrate to the regulators that they have implemented methods and procedures to ensure adequate capital resources, with due attention to all material risk. 

In respect to ICAAP analysis by the NBFCs, the Para 3.2.1 (a) of Revised Framework, state that:

“NBFCs are required to make a thorough internal assessment of the need for capital, commensurate with the risks in their business. This internal assessment shall be on similar lines as ICAAP prescribed for commercial banks under Pillar 2 (Master Circular – Basel III Capital Regulations dated July 01, 2015). While Pillar 2 capital will not be insisted upon, NBFCs are required to make a realistic assessment of risks. Internal capital assessment shall factor in credit risk, market risk, operational risk and all other residual risks as per methodology to be determined internally. The methodology for internal assessment of capital shall be proportionate to the scale and complexity of operations as per their Board approved policy. The objective of ICAAP is to ensure availability of adequate capital to support all risks in business as also to encourage NBFCs to develop and use better internal risk management techniques for monitoring and managing their risks. This will facilitate an active dialogue between the supervisors and NBFCs on the assessment of risks and monitoring as well as mitigation of the same.”

Hence, the ICAAP for NBFCs can be guided by the Master Circular – Basel III Capital Regulations dated July 01, 2015^[3] (Basel III Circular) till specific directions in this respect are issued by RBI. Though the said Circular is not compulsorily required to be complied with, it may act as the most reliable source of guidance as to expectations of RBI from the NBFCs. The article is guided by the said circular.

Objective of ICAAP

The objective of ICAAP is clearly set out in the Basel III Circular, which state that:

“The main aspects to be addressed under the SRP^[4], and therefore, under the ICAAP, would include:

1. the risks that are not fully captured by the minimum capital ratio prescribed under Pillar 1;
2. the risks that are not at all taken into account by the Pillar 1; and
3. the factors external to the bank.

Since the capital adequacy ratio prescribed by the RBI under the Pillar 1 of the Framework is only the regulatory minimum level, addressing only the three specified risks (viz., credit, market and operational risks), holding additional capital might be necessary for banks, on account of both – the possibility of some under-estimation of risks under the Pillar 1 and the actual risk exposure of a bank vis-à-vis the quality of its risk management architecture.”

The regulatory capital is maintained against the risk weighted assets of the bank. The risk weights prescribed are based on the general experience of the regulators with respect to the respective asset classes. However, risks associated with the assets also depend on the credit underwriting qualities of the originator, the geography in which it operates etc. Hence, often the risk weights assigned as per the regulatory framework turn out to be unrealistic. The ICAAP bridges the gap, if the assets pose a higher risk, that reflects on the end result of the ICAAP process.

ICAAP is hence an analysis which helps the financial institution determine whether the regulatory capital maintained by them is enough to absorb relevant risk poised due to their operations.

The outcome of the ICAAP may be higher or lower than the regulatory capital requirements. The bank has to maintain higher of the two.

Principal Components of ICAAP

Broad principles of the ICAAP in accordance with the Basel III Circular can be enumerated as follows:

• The ICAAP should be forward looking in nature, and thus, should take into account the expected / estimated future developments such as strategic plans, macro-economic factors, etc.
• ICAAP to be a risk-based process – The chief consideration in ICAAP would be to address risk faced by the NBFC. ICAAP would be required to take care of both quantifiable and non-quantifiable risk. ICAAP document shall clearly indicate for which risks a quantitative measure is considered appropriate, and for which risks a qualitative measure is considered to be the correct approach.
• ICAAP to include stress tests and scenario analyses – Stress testing focuses on determining the risk posed to an entity in different stress scenarios and also assesses the entity’s capability to effectively deal with the same, primarily stress testing consist of
  • Sensitivity analysis – Also known as simulation analysis, it captures how target variable is affected by change in other variables
  • Scenario analysis – It is the process of estimating the expected values of the particular output considering different sets of inputs.
• Use of capital models for ICAAP –The Basel III Circular states that, RBI does not expect the use of complex and sophisticated econometric models for internal assessment of their capital requirements, and there is no RBI-mandated requirement for adopting such models however model should include:
  • Well documented model specifications, including the methodology / mechanics and the assumptions underpinning the working of the model;
  • The extent of reliance on the historical data in the model and the system of back testing to be carried out to assess the validity of the outputs of the model vis-àvis the actual outcomes;
  • A robust system for independent validation of the model inputs and outputs;
  • A system of stress testing the model to establish that the model remains valid even under extreme conditions / assumptions;
  • The level of confidence assigned to the model outputs and its linkage to the bank’s business strategy;
  • The adequacy of the requisite skills and resources within the entity to operate, maintain and develop the model.

What would be expected from NBFCs under ICAAP

In the Basel III Circular itself, RBI has “recognised that there is no one single approach for conducting the ICAAP and the market consensus in regard to the best practice for undertaking ICAAP is yet to emerge. The methodologies and techniques are still evolving particularly in regard to measurement of non-quantifiable risks, such as reputational and strategic risks. These guidelines, therefore, seek to provide only broad principles to be followed by banks in developing their ICAAP. “^[5]

Accordingly, ICAAP for an NBFC commensurate with their size, level of complexity, risk profile and scope of operations. All these measures are discussed in detail in the implementation segment in this article.

Ideally ICAAP should be undertaken at various levels:

1. Entity Level – Standalone entity
2. Consolidated basis – Entire group (may include only financial sector entities)

The consolidated analysis may be considered as a cumulation of the various entity level analysis, after duly factoring in the cross investments in the group.

Authority for Analysis

Ultimate responsibility for the ICAAP shall lie with the board. The board shall have the responsibility to define strategy and approach for ICAAP, at the same time monitor the same, making relevant changes as and when necessary.  The broad responsibilities of the board shall include:

• Setting up of the risk tolerance levels;
• Ensure that the senior management:
  • establishes a risk framework in order to assess and appropriately manage the various risk exposures;
  • develops a system to monitor the risk exposures and to relate them to the capital and reserve funds;
  • establishes a method to monitor the compliance with internal policies, particularly in regard to risk management;
  • effectively communicates all relevant policies and procedures;
• Adopt and support strong internal controls;
• Appropriate written policies and procedures should be put in place;
• Ensure that there is an appropriate strategic plan in place, which, as a minimum, shall duly outline
  • current and future capital needs;
  • anticipated capital expenditure; and
  • desired level of capital.

The board may also be required to define the role that ICAAP would play in the decision-making function of the Company.

Implementation

Though RBI is not expected to ask for complex statistical analysis, RBI would expect a certain degree of sophistication adopted in the ICAAP in regard to risk measurement and management to be commensurate with the nature, scope, scale and the degree of complexity in the business operations.

The entity would itself be required to identify, whether its operations are simple, moderately complex or complex and accordingly decide as to which approach would be best suited for them. For most NBFCs, the operations are way simpler compared to that of banks, hence we can safely consider that all NBFCs (except for a few very large ones) can use a simple approach. However, complex approach would not be of any relevance to NBFCs.

Illustratively, the composition of ICAAP based on classification of operation would be as follows:

Contents of ICAAP Document

On perusal of the Basel III Circular, it can be inferred that the approach of RBI is more focussed on the qualitative approach, the quantitative analysis is required to assist the qualitative analysis. Hence, actual working and computations would only play a supportive role to the documentation side of the ICAAP. A policy, ICAAP document/report shall play a major role.

The broad contents of the ICAAP Document shall be as follows:

• Background – This section would cover the relevant organisational and historical financial data
• Summary of current and projected financial and capital positions – This section would explain the present financial position and expected changes to the current business profile
• Capital Adequacy –
  • Risk Appetite
  • Where economic capital models are used for internal capital assessment, the confidence level, time horizon, and description of the event to which the confidence level relates, should also be enumerated
  • The information provided would include the following elements:
    • details of, and rationale for, the time period
    • Risks analysed
    • Methodology and assumptions
    • Capital transferability – In case of conglomerate
• Key sensitivities and future scenarios – This section would explain how a bank would be affected by an economic recession or downswings in the business cycle or markets relevant to its activities.
• Aggregation and diversification –
  • This section would describe how the results of the various separate risk assessments are brought together and an overall view taken on capital adequacy.
  • At a technical level, this would require some method to be used to combine the various risks using some appropriate quantitative techniques. A
  • Ast the broader level, the overall reasonableness of the detailed quantification approaches might be compared with the results of an analysis of capital planning and a view taken by senior management as to the overall level of capital that is considered appropriate
• Testing and adoption of the ICAAP– This section would describe the extent of challenging and testing that the ICAAP has been subjected to. It would thus include the testing and control processes applied to the ICAAP models and calculations
• Use of the ICAAP – This section would contain information to demonstrate the extent to which the concept of capital management is embedded within the decision-making process. For instance, use of ICAAP in setting pricing and charges and the level and nature of future business, could be an indicator in this regard

Conclusion

The adequacy of a NBFC’s capital is a function of its risk profile. NBFCs shall, therefore, set their capital targets which are consistent with their risk profile and operating environment. Further, an NBFC shall have in place a sound ICAAP, which shall include all material risk exposures of the NBFC. There are some types of risks (such as reputation risk and strategic risk) which are usually not quantifiable; for such risks, the focus of the ICAAP should be more on qualitative assessment, risk management and mitigation than on quantification of such risks.

NBFCs’ ICAAP document shall clearly indicate for which risks a quantitative measure is considered warranted, and for which risks a qualitative measure is considered to be the correct approach.

---

^[1] See an article by Vinod Kothari, tilted Shadow Banking in India – Creating an Opportunity out of a Crisis, at http://vinodkothari.com/2020/01/shadow-banking-in-india/

^[2] RBI Circular on Scale Based Regulation (SBR): A Revised Regulatory Framework for NBFCs, dated October 22, 2021 <https://www.rbi.org.in/scripts/FS_Notification.aspx?Id=12179&fn=14&Mode=0>

^[3] https://rbidocs.rbi.org.in/rdocs/notification/PDFs/58BS09C403D06BC14726AB61783180628D39.PDF

^[4] Supervisory Review Process

^[5] Para 10.5

Presentation on ICAAP for NBFCs