Arion Bank faces various risks arising from its day-to-day operations as a financial institution. Managing risk and taking informed decisions is a crucial component of the Bank's activities and its responsibility towards society. Risk management is therefore a core activity within the Bank. The key to effective risk management is a process of ongoing identification of significant risk, quantification of risk exposure, action to limit risk and constant monitoring of risk.
The Board of Directors is ultimately responsible for the Bank’s risk management framework and ensuring that satisfactory risk policies and governance structure for controlling the Bank’s risk exposure are in place. Similarly, the risk management of subsidiaries is the responsibility of that subsidiary. For the parent company (the Bank) the Board sets the risk appetite, which is translated into exposure limits and targets monitored by the Bank’s Risk Management division.
The CEO is responsible for sustaining an effective risk management framework, processes and controls as well as maintaining a high level of risk awareness among the employees, making risk everyone’s business.
The Bank’s Risk Management division is headed by the Chief Risk Officer. It is independent and centralized and reports directly to the CEO. Further information on Risk Management.
The Bank operates several committees to manage risk. The Board Risk Committee (BRIC) is responsible for supervising the Bank’s risk management framework, risk appetite and internal capital adequacy assessment process (ICAAP) and internal liquidity adequacy assessment process (ILAAP). The Asset and Liability Committee (ALCO), chaired by the CEO or his deputy, is responsible for managing the asset-liability mismatch, liquidity risk, market risk and interest rate risk, market risk, interest rate risk and capital management. The Underwriting and Investment Committee (UIC) decides on underwriting and investments. The Bank has four credit committees: The Board Credit Committee (BCC) which decides on all major credit risk exposures; the Arion Credit Committee (ACC) which operates within limits specified as a fraction of the Bank’s capital; the Corporate Credit Committee (CCC) and the Retail Branch Committees (RBC) which operate within tighter credit granting limits. There are also five valuation committees whose role is to establish criteria for estimating collateral and also to inspect valuations of securities owned by the Bank. A Data Committee (DC) has been set up which serves as a central authority for all matters relating to data and data management. The Data Committee is responsible for the Bank’s policy regarding data and data management.
The most significant risks the Bank is exposed to are credit risk, including concentration risk, liquidity risk, currency risk, interest rate risk, legal risk and operational risk. The Bank’s Pillar 3 Risk Disclosures 2016 report discusses risk factors and risk management in detail.
Capital adequacy
The Bank’s capital is intended to meet the risk of unexpected loss in its operations. The size of the Bank’s capital base should reflect the risk at any given time and any potential adverse future trends. Risk on the Bank’s balance sheet is assessed by calculating risk-weighted assets (RWA). The Bank uses a standardized approach for calculating RWA which is generally designed to be more cautious than methods based on internal assessment.
The Bank’s capital base was ISK 204.4 billion at the end of 2016. CET1 accounted for ISK 199.7 billion of this total. In 2016 the Bank fully repaid the subordinated loan from the Icelandic government, thereby reducing Tier 2 capital by ISK 9.6 billion. The Bank’s risk-weighted assets amounted to ISK 753.3 billion at the end of 2016, decreasing by ISK 54.6 billion over the year. The main factor behind this decrease is the Group’s sale of its holding in Bakkavör Group at the beginning of 2016. In the third quarter the proceeds from the sale were paid out of the Bank's subsidiary BG12, which reduced the Group's capital base by lowering minority interest in the company's capital. At the end of 2015, the Group’s interest in Visa Inc. was deducted from the capital base and the majority of the position was disbursed during the year.
In September 2016 the Icelandic parliament, the Althing, approved amendments to the Financial Undertakings Act No. 161/2002. This included the second phase of implementing the European Union’s capital requirement directive, CRDIV/CRR. Although the directive had yet to be implemented in full at the end of 2016, the Bank bases its calculation of capital on this directive. With other factors remaining unchanged, the new rules result in an increase in the Bank's risk-weighted assets, partly due to higher risk-weights in respect of loans in serious default and the appearance of a new risk factor relating to the adjustment of the loan value of derivatives. According to the law general provisions are now included under Tier 2 as expected loss is not used to reduce risk-weights at financial institutions which apply the standard method.
The Bank’s capital ratio at the end of 2016 was 27.1%.
In addition, the Bank also carries out an Internal Capital Adequacy Assessment Process, ICAAP. ICAAP aims to ensure that the Bank has in place sufficient risk management processes and systems to identify, manage and measure the Bank’s total risk exposure. ICAAP is designed to identify and measure the Group’s risk across all risk types, including those which are not provided for in the standardized approach under Pillar 1, and to ensure that the Group has sufficient capital in accordance with its risk profile. The Financial Supervisory Authority (FME) supervises the Group, receives the Group’s internal estimate of capital adequacy and sets capital requirements for the Group as a whole following a Supervisory Review and Evaluation Process (SREP). The capital adequacy in respect of the FME's internal evaluation in addition to the mandatory 8% requirement under Pillar 1 is called an additional capital requirement under Pillar 2. The additional capital requirement under Pillar 2, based on financial information at the end of 2015, was 4.3% of risk-weighted assets.
Under the Financial Undertakings Act No. 161/2002 the Bank must meet a combined capital buffer requirement, which is designed to ensure that the Bank maintains a minimum level of capital despite severe shocks. The FME has decided on the level of capital buffer in accordance with a proposal from the Financial Stability Council and it has defined Arion Bank as a systemically important institution in Iceland. The combined capital buffer requirement will be 8.75% at the end of November 2017, when the buffers have been introduced in full according to the current schedule. However, the systemic risk buffer and countercyclical capital buffer only apply to domestic risk exposures and based on the current structure of risk-weighted assets the corresponding combined buffer for the Bank will be 8.4%. The FME’s formal recognition of the set capital buffers in foreign states means that the corresponding requirements will apply to those risk-weighted assets calculated in respect of exposures in those countries and this will increase the requirement. The other capital buffers are the capital conservation buffer and the systemically important institution buffer.
The Group’s capital base meets the total capital requirement in respect of Pillar 1, Pillar 2R, and capital buffers which account for 20.7% of risk-weighted assets. The Bank also sets itself an additional management buffer, which is 1.5% of risk-weighted assets. The FME can also set a capital target (Pillar 2G) on top of Pillar 1, Pillar 2R and capital buffers on the basis of the results of stress tests.
CREDIT RISK
Credit risk is defined as the current or prospective risk to earnings and capital arising from the failure of an obligor to discharge an obligation at the stipulated time or otherwise to perform as agreed. Loans to customers and credit institutions are by far the largest source of credit risk.
Strong and improving mortgage portfolio
Mortgages are a core product for Arion Bank. The mortgage portfolio represents 38% of the total loan portfolio at the end of the year, up from 12% since the end of 2010. The key to the growth of the mortgage portfolio was the acquisition of a mortgage portfolio from Kaupthing in 2011 and the acquisition of retail loan portfolios, coupled with strong organic growth via new mortgage lending. The Bank has been at the forefront of the mortgage market, offering, for example, non-indexed mortgages in ISK. At the end of 2016 non-indexed mortgage loans represented 26% of the mortgage portfolio, the remainder being CPI-linked loans.
The quality of the mortgage portfolio has been steadily improving with lower average loan-to-value and a reduction in default rates. The main reasons for lower default rate in recent years have been the improving economic climate, restructuring and better loan collection rates.
At the end of 2016 76% of the mortgages, by value, had loan-to-value below 80% , compared with 69% at the end of 2015. The great majority of mortgage property is located in the Greater Reykjavík area or 72% of the portfolio value.
Well diversified loan portfolio
Loans to customers are well diversified. Loans to individuals represent 47% of total loans to customers, of which 84% are due to mortgages. The corporate portfolio is mainly in three sectors: real estate and construction, fishing and wholesale and retail trade, which represent 31%, 20% and 14% of the corporate portfolio respectively. Although sector diversification is good, some single name concentration remains.
Single name concentration decreasing
At the end of 2016 the Bank had no single exposure to a group of related parties that exceeded 10% of the Bank's capital base (so-called large exposures), compared with one at the end of 2015. As seen in the following diagram, the sum of large exposures has fallen sharply since 2011 when it was 87% of the capital base. The sum of related exposures, excluding loans to financial institutions, exceeding 2.5% of the capital base has decreased from the previous year – was 92% at the end of 2016, compared with 99% at the end of 2015.
Collateral coverage of loans to customers
Mortgages over residential properties and charges over commercial real estates are the most common types of collateral obtained by the Bank, representing 75% of total collateral. Fishing vessels and other fixed and current assets, such as cash and securities, are also used to secure loans. The Bank places emphasis on collateral maintenance, valuation and central storage of collateral information. At the end of 2016 loans to customers (gross value ISK 712,422 million) are secured by collateral valued at ISK 630,500 million, giving a collateral coverage ratio of 89%, but as shown in the following diagram this ratio varies between different sectors.
Loan book quality is steadily improving
The Bank defines Problem loans as loans that are more than 90 days past due and loans that are past due but individually impaired. The ratio of problem loans has steadily decreased since its peak in 2010 mostly due to the progress made in problem loan restructuring and the resolution of the legal uncertainty surrounding FX loans. Approximately half of problem loans are 90 days past due but are not impaired due to sufficient collateral.
Collateral securing problem loans
Operational risk
Operational risk is the risk of direct or indirect loss resulting from inadequate or failed internal processes, human and system error, or from external events that affect the Bank's operations. Reputational risk, IT risk and legal risk are considered subcategories of operational risk.
Each business unit within the Bank is responsible for taking and managing its own operational risk. The Bank’s Operational Risk department is responsible for developing and maintaining tools for identifying, measuring, monitoring and controlling operational risk.
The primary tools used by the Bank to analyze and measure operational risk are:
- Loss Data
- Risk and Control Self-Assessment
- Key risk indicator
Employees must report any deviations in operations. Deviations refer to things that go wrong during operations and which are connected to services to customers, the products offered by the Bank, how we carry perform our tasks or our business practices. Deviations can cause the Bank direct financial damage (loss data) but may also cause indirect damage or damage the Bank's reputation. Information on deviations is used to assess the Bank’s capital requirement for operational risk under ICAAP and as a basis for taking corrective action.
The Bank performs a risk and control self-assessment (RCSA) in order to identify risks, both inherent and residual, and the results are used to make operational improvements which fit the Bank’s risk appetite. The Operational Risk department follows up on the planned actions.
Key risk indicators are regularly monitored and these can indicate when risk is increasing and exceeding the risk appetite. Reporting to the senior management is based on factors such as loss data, the results of RCSA and key risk indicators.
The management of IT and data security is the responsibility of the Security Officer. With the number of channels to interact with customers greater than ever before and rapid technological developments, the potential for risk relating to data and IT security has increased. In order to respond to these changes the Bank has strengthened its efforts in managing data and IT security. IT security is a method of ensuring the confidentiality, integrity or availability of data.
The Bank uses the standardized approach to calculate the capital requirement for operational risk. The capital requirement for operational risk in 2016 was ISK 6,919 million.
Market risk
Market risk is the risk that price changes and interest rate changes will affect the value and cash flow from the Bank’s financial instruments. The main types of market risk are interest rate risk, equity price risk and foreign exchange risk.
Interest rate risk is primarily related to the fact that in part of the balance sheet there is a mismatch between interest-bearing assets and liabilities and a gap in interest-fixing periods. Generally the value of the Bank’s fixed-interest assets is higher than the value of liabilities with the same interest-fixing period as the Bank is primarily funded with deposits. An increase in market interest rates would therefore have a negative effect on the Bank’s earnings. The majority of risk stems from the portfolio of CPI-indexed mortgages at fixed interest which were originally issued between 2004 and 2006. The risk is largely hedged because the portfolio is partly funded by structured covered bonds at fixed interest. The Bank has reduced this risk by issuing new covered bonds and by offering its customers loans with variable interest rates. Moreover the loan principal adjustment carried out in 2015 and 2016 in relation to the government’s mortgage relief program also helped to reduce the risk.
The Bank has managed to substantially reduce equity price risk through a structured sale timetable for the assets acquired by the Bank during the process of restructuring companies following the 2008 economic crisis. At the beginning of 2016 the Bank’s holding in Bakkavör Group Ltd. was sold, bringing the Bank’s position in associate companies to a negligible level. The Bank’s position in listed and private equity has also decreased during the year following further asset divestment and the listing of Skeljungur hf. on Nasdaq Iceland.
The position in equities in the proprietary trading book and in respect of derivatives hedges has steadily increased due to higher turnovers and activities on the market. Risk Management closely monitors the associated risks and ensures that positions are kept within limits and that collateral is in place.
Foreign exchange risk is the risk that movements in the exchange rate of the Icelandic króna could have a negative impact on the Bank's earnings. The Group’s currency imbalance at the end of 2016 was ISK 4.8 billion and it has steadily decreased in recent years. The Bank uses derivatives to hedge against foreign exchange risk.
The net position of the Bank’s indexed assets and liabilities was ISK 116.0 billion at the end of 2016. The indexation imbalance increased in 2014 due to the payment of structured covered bonds, but this is counterbalanced by the regular issue of new statutory indexed covered bonds. The growth of indexed loans in 2016 was in excess of the increase in indexed bond series and this largely explains the increase in the net position of indexed financial instruments. Part of this increase is a result of recognizing income due to fair value adjustment of the Bank’s mortgage portfolio.
Liquidity risk
Liquidity risk is defined as the risk that the Group, though solvent, either does not have sufficient financial resources available to meet its liabilities when they fall due or can secure them only at excessive cost.
The Bank also carries out an Internal Liquidity Adequacy Assessment Process, or ILAAP. This process is designed to ensure that the Bank has sufficient liquidity and that appropriate plans, policies, methods and systems are in place to analyze, manage and monitor liquidity risk.
The FME and the Central Bank of Iceland monitor the Bank’s compliance with requirements and obligations in respect of liquidity risk.
Liquidity and liquidity risk are discussed in more detail here.