RISK MANAGEMENT APPROACH

The Bank’s risk management is underpinned by a comprehensive, Integrated Risk Management Framework, which is constantly evolving and enhancing to remain relevant and most effective. The framework which is approved by the Board spells out the Bank’s approach to Risk Management. The framework sets out the process of identifying, measuring, monitoring and controlling the different types of risks and the risk governance structure in place. The main objectives of the framework are;

• To establish common principles, standards for the management and control of all risks and to inform behaviour across the Bank.

• Provide a shared framework and language to improve awareness of risk management processes among all stakeholders.

• To provide clear accountability and responsibility for Risk Management.

• To ensure consistency throughout the Bank in Risk Management.

• Define the Bank’s risk appetite and align its portfolios and business strategy accordingly.

• Optimize risk return decisions.

• Maintain/manage the Bank’s capital adequacy and liquidity position.

• Further strengthen governance, controls and accountability across the organization.

In addition to the main risks (viz. Credit Risk, Market Risk and Operational Risk), the Bank has considered several other risks which are material to it. These additional risk categories include, Liquidity Risk, Interest Rate Risk in the Banking Book, Underestimation of Credit Risk in Standardized Approach, Residual Credit Risk, Concentration Risk, Compliance Risk, Legal Risk, Strategic Risk, Governance Risk, Cross-border Risk, Settlement Risk, Reputational Risk, Model Risk and Group Risk.

The Bank's risk management framework is employed at all levels of the organization, and is instrumental in aligning the behaviour of individuals with the overall attitude to assuming and managing risk and ensuring that Bank’s risk profile is aligned to its risk appetite.

Risk Management at the Bank is underpinned by a set of key principles which serves as the foundation of the Bank’s risk management framework.

Risk Appetite & Strategy

Risk Appetite is defined as the quantum of risk the Bank is willing to assume in different areas of business in achieving its strategic objectives and ensuring maintenance of desired risk profile. The Risk Appetite framework and Risk Tolerance limits have been defined by the Board in consultation with the Senior Management of the Bank in line with the Bank’s overall business strategy, providing clear direction to the business units for on-going operations and risk management. The Risk Appetite framework and Risk Tolerance limits are reviewed and adjusted by the Board when required based on developments in the operating environment.

In the event the risk appetite threshold has been breached, risk management and business controls are implemented to bring the exposure level back within the accepted range. Risk appetite, thus, translates into operational measures such as limits or qualitative checkpoints for the dimensions of capital, earnings volatility and concentration risk etc. In order to effectively implement risk appetite, the Bank has defined quantitative indicators (e.g., capital adequacy level and risk limits) or qualitatively embedded same in the policies and procedures (e.g., underwriting criteria).

Capital Management

Effective capital management is fundamental to the sustainability of the Bank. As such, the Bank pro-actively manages its capital position, capital mix and capital allocation to meet the expectations of key stakeholders such as regulators, shareholders, investors and rating agencies. Capital helps protect individual banks from insolvency, thereby promoting safety and soundness in the overall banking system. The Bank’s approach to capital management is driven by strategic objectives and guided by the Basel principles.

BASEL lll Framework

The Central Bank of Sri Lanka (CBSL) issued guidelines this year on Capital Requirements Basel III requiring banks to comply with same from 1 July 2017. Basel III capital standards endeavour to strengthen the quantity and quality of capital in banks. The Bank is fully compliant with these requirements. Details of compliance under each pillar are discussed below.

Pillar I – Minimum Capital Requirement
The objective of minimum capital requirements under Pillar I of the Basel III framework is to ensure that banks hold sufficient capital for Credit, Market and Operational Risks. The Bank is currently using the Standardized Approach for minimum capital computation for Credit Risk, the Standardized Measurement Approach for minimum capital computation for Market Risk and Basic Indicator Approach for minimum capital computation for Operational Risk. The Bank continues to maintain capital well above the minimum requirement set by the CBSL.

Credit Risk - With the intention of eventually moving to Internal Rating Based approaches the Bank rolled out rating models with the assistance of CRISIL Risk and Infrastructure Solutions Limited, India in 2014. CBSL is yet to issue guidelines for banks on Advanced Approaches of capital computation under Credit Risk.

Market Risk - The Bank has already rolled out its VaR models and will consider moving to advanced approach of capital computation for Market Risk on receipt of guidelines from the regulator.

Operational Risk - The Bank had been computing capital requirements in parallel as per The Standardized Approach (TSA) and Alternative Standardized Approach (ASA). The Bank forwarded a formal application to the CBSL requesting to grant approval to move to ASA after analyzing both advanced approaches (TSA & ASA) in considering the cost saving against the currently used Basic Indicator Approach (BIA).

Pillar ll – Supervisory Review Process
Minimum regulatory capital requirements under Pillar l establishes regulatory capital thresholds that banks should meet. The Pillar II (Supervisory Review Process - SRP) requires banks to implement an internal process, called the Internal Capital Adequacy Assessment Process (ICAAP), for assessing capital adequacy in relation to the risk profiles as well as a strategy for maintaining capital levels. The Pillar ll also requires the supervisory authorities to subject all banks to an evaluation process/Supervisory Review Process (SRP), and to initiate such supervisory measures, as might be considered necessary. The Bank has in place an ICAAP and has adhered to same from January 2013. The ICAAP process has strengthened the risk management practices and capital planning process of the Bank.

The capital adequacy management framework serves to ensure that the Bank and its group entities are adequately capitalized in line with the risk profile, regulatory requirements and target ratios approved by the Board and to promote efficient use of capital to meet business requirements, strategic growth and shareholder return. The management framework further focuses on the financial ability of the Bank to absorb any potential losses that it might incur under varying market and economic conditions.

The Bank’s capital management objectives can be summarized as follows:

• Maintain sufficient capital to meet minimum regulatory capital requirements

• Hold sufficient capital to support the Banks’ risk appetite

• Allocate capital to businesses to support the Bank and its group companies strategic objectives

• Ensure that the Bank maintains capital in order to withstand the impact of potential stress events.

The Bank identified seventeen risks as material in line with the strategic plan. The choice is based on directions given by CBSL and self-assessment of most important risk categories which need a separate mention from an ICAAP perspective. The seventeen material risks identified are Credit Risk, Market Risk, Operational Risk, Concentration Risk, Interest Rate Risk in Banking Book, Liquidity Risk, Under-estimation of Credit Risk, Residual Risk, Strategic Risk, Reputational Risk, Legal Risk, Compliance Risk, Governance Risk, Model Risk, Settlement Risk, Group Risk and Cross-border Risk. These risk categories and their assessments are covered in detail in the ICAAP of the Bank.

The annual Capital Planning Process involves detailed planning of the strategic capital plan over at least a three-year horizon. The plan highlights the capital projections, capital requirements, levels of capital and capital mix to support the Bank’s business plan and strategic objectives. The Bank manages its capital structure and adjusts it accordingly in line with changes in local and global economic and market conditions and its overall risk appetite. Notwithstanding same, the projected capital plan is prepared considering mainly the organic growth, which assures adequate capital for the Bank for the next 3 years. The Bank and the Group would have the option to raise capital under normal and stressed scenarios by way of equity / capital infusion, issue of innovative perpetual debt instrument, issue of subordinated bonds or Hybrid capital instruments.

The Bank will continue to be proactive in its efficient utilization of capital and will constantly monitor ongoing developments affecting regulatory capital requirements as well as related capital market developments. The Bank is also committed to ensure continuous healthy capital levels with an optimal capital mix to support the Bank’s and the Group's strategic agenda and simultaneously maximizes value to shareholders.

The Bank has in place a comprehensive Stress Testing Policy and Framework in line with the regulatory guidelines as well as international best practices. The policy describes the purpose of stress testing and governance structure and the methodology for formulating stress tests whilst the framework specifies in detail the Stress Testing program including the stress tests, frequencies, assumptions, tolerance limits and remedial action.

Stress tests are conducted on standalone and consolidated basis at various frequencies in line with the Board approved framework and details of those are reported to Board IRMC. The outcome of the stress testing process is monitored carefully and remedial actions are taken in case of breaches. Further, stress testing is used by the Bank as a tool to supplement other risk management approaches.

The Stress Tests carried out as at 31.12.2017 are given below.

Pillar lll – Disclosures

The Bank provides enhanced quantitative and qualitative disclosures in line with the Basel III requirements in the Annual Report, website and press to provide a meaningful picture of the extent and nature of various risks that the Bank is exposed to and the Banks’ risk management practices.

Governance and Oversight

The Bank’s Board of Directors has the overall responsibility for risk management and sets the tone at the top for the effective management of risks through its risk appetite. In discharging its governance responsibility, it operates through two key committees, namely the Integrated Risk Management Committee (IRMC) and the Board Audit Committee (BAC) which have been formed in compliance with the CBSL Direction No. 11 of 2007 on Corporate Governance.

Governance Model

The governance model aims to place accountability and ownership, whilst facilitating an appropriate level of independence and segregation of duties. The structure is premised on the three lines of defense and defines the lines of authority, roles and responsibilities to efficiently manage risk across the Bank.

Group Risk Management

The Group Risk Management Division is independent of the business units and reports directly to the Integrated Risk Management Committee. Each unit within the Risk Management Division contributes to the management of risk and co-ordinates across the business functions to guarantee that risk management is impeccably integrated into the Bank’s corporate culture.

Further a Loan Review unit was formed within the Group Risk Management Division to carry out Loan Review Mechanism (LRM) activities as prescribed by the regulator. Its responsibilities extend to identifying potential problematic loans/facilities (post approval/granting) and providing rational, objective and professional recommendations for remedial action for implementation by line management.

In order to make the pre-approval process independent and with a view to further strengthen same the Credit Review Division which handles the pre credit review/approvals beyond specific thresholds also came under the purview of the Group Risk Management Division.

RISK CULTURE

A strong risk culture is the fundamental tenet of Bank’s risk management and serves as the foundation upon which a strong risk management structure is built. Within the Bank, the key characteristics of a strong risk culture are identified as follows:

In the Bank a compliance culture is instilled where the Board, Senior Management and every employee is committed to adhere to the requirement of relevant laws, rules and regulatory guidelines. The Bank's commitment is clearly demonstrated through the establishment of strong policies and guidelines and ensuring that non-compliance risks are effectively managed. Such measures not only ensure adherence to regulations, but also protect the Bank’s integrity and reputation.

Risk Policies & Processes

CREDIT RISK

Credit risk is the risk of financial loss if a customer or counterparty fails to meet a payment obligation under a contract. It arises principally from direct lending, trade finance and leasing business, and also from offbalance sheet products such as letters of credit and guarantees. Credit Risk generates the largest regulatory capital requirement of the risks we incur. The Bank manages the Credit Risk in the entire portfolio as well as individual credits or transactions.

Objectives Of Credit Risk Management

The objectives of Credit Risk Management are:

• Ensure optimal risk-reward pay-off for the Bank and to maximize returns

• Maintain the quality of the portfolio by minimizing the non-performing loans and probable losses

• Maintain a well-diversified portfolio by prudently managing the risk in the asset portfolio to ensure that the risk of excessive concentration to any industry, sector or individual customer is minimized

• Ensure that exposures to any industry or customer are determined by the regulatory guidelines, clearly defined internal policies, debt service capability and balance sheet management guidelines

• Avoid all situations of conflict of interest and report all insider-related credits to appropriate bodies

Credit Policies

The Bank has a well-defined credit policy approved by the Board of Directors. It defines the

• Credit culture of the Bank

• Specify target markets for lending

• Specify prohibited lending which the Bank under no circumstances will entertain due to either the very high risks involved in such proposals and / or its negative social / ethical consideration

• Set acceptable risk parameters

• Set remedial and recovery actions

Structured and Standardized Credit Approval Process

Depending on the nature of the project / product standardized formats have been designed and evaluations are carried out by competent staff. There are clear guidelines set to ensure that;

• Credit is extended only to suitable and well-identified customers and never where there is any doubt as to their ethical standards and record, where the source of repayment is unknown or speculative nor where the purpose/destination of funds is undisclosed;

• Never to take a credit risk where ability of the customer to meet obligations is based on the most optimistic forecast of events;

• Risk considerations shall have priority over business and profit considerations;

• Ensure that the primary source of repayment for each credit is from an identifiable cash flow from the counterparty’s normal business operations or other financial arrangements; the realization of security remains a fallback option;

• Adopt a pricing mechanism that reflects variation in the risk profile of various exposures to ensure that higher risks are compensated by higher returns;

• The financial performance of borrowers is to be continuously monitored and frequently reviewed, as is the manner in which the borrower operates his accounts.

Delegation of Authorit

Final authority and responsibility for all activities that expose the Bank to credit risk rests with the Board of Directors and the Board of Directors has delegated approval authority to the CEO to re-delegate limits to the Credit Committees and the Business Lines. All approval limits are name specific and are based on the individual experience, facility type and collateral in order to ensure accountability and mitigate any judgmental errors.

• There are two Credit Committees representing the Business Lines and these Committees comprise senior officers of Business Lines and the Credit Review Division.

• The delegated authority limits are reviewed periodically and the Bank follows the ‘foureyes principle’ (i.e. minimum of two officers signing a credit proposal).

• Lending decisions are based on detailed credit evaluation carried out by Relationship Managers/ Credit Officers and reviewed/ approved by designated approving authority.

Internal Risk Ratings of Obligors

The Bank has an Internal Risk Rating system which runs on sophisticated work flow based software and hosts obligor risk rating, facility risk rating and retail score cards to suit the diverse client portfolios of the Bank. This move facilitates accurate quantification of credit risk, and also complies with Central Bank Direction No. 07 of 2011 on Integrated Risk Management.

The Bank has deployed varying models to gauge the default risk associated with Large Corporate, Mid Corporate, SME and Non-Banking Financial Institutes. All of these models are structured in a manner incorporating both quantitative and qualitative parameters to reflect the underlying probabilities of default.

The risk rating model implemented facilitates both obligor and facility rating. Whilst obligor rating will indicate the expected probability of default (PD), the facility rating indicates the expected loss given default (LGD). Expected probability of default takes into account the characteristics of the obligor assessed via industry, business, management and financial risk silos, whilst facility rating takes into account the type of the facility, nature of the collateral and realizability. Using the expected probability of default and the loss given default calculated via obligor rating and facility rating models the system facilitates arriving at an expected loss for a specific credit.

Risk Scoring

The Bank deploys custom made scorecards to underwrite consumer assets. The scorecards take into account the customer demographics together with creditworthiness of individuals and disposable income in deciding the level of accommodation of credit. In addition to above, the Bank also carries out a prescreening of employers of salaried employees who seek consumer credit from the Bank in order to ensure that their level of income generation will not get interrupted in the foreseeable future. In this way the Bank acts more responsibly as such an approach would negate possibility of overspending by consumers based on uncertain future income.

Risk Pricing

The Bank also views pricing for risk as fundamental to Credit Risk Management. Thus steps have been taken to price the credit risk using more scientific methods. A risk based pricing model has been rolled out across the Bank .

Post Sanction Review and Monitoring Mechanism

Post sanction review and monitoring is carried out to ensure quality of credit is not compromised. Any deteriorating credits with emphasis on internal and external early warning signals are identified and such accounts are “Watch Listed”. The Watch Listed clients are monitored closely with quarterly reports submitted to the Credit Committees. Further, based on the Watch Lists the Bank assesses the Portfolio at Risk in the event, such accounts deteriorate further. Non-performing assets are identified at an early stage, enabling management to take action as appropriate.

Prudential Limits

The industry and portfolio limits are set by the Board of Directors on the recommendation of the Group Risk Management Department. Credit Risk Management monitors compliance with approved limits. Desired diversification is achieved by setting maximum exposure limits on

• Single / group obligor exposures - limits are more stringent than the limits set by the regulator and on a prudential basis, the off- balance sheet items are considered at face value instead of credit equivalent of such exposures

• Prudential Group exposures - considered based on the Bank’s exposure to a ‘Group of Related Parties' and is capped at 60% of the Bank’s Capital Base

• Substantial exposures – this is in compliance with the Banking Act Direction No 07 of 2011 on Integrated Risk Management Framework for Licensed Banks and the Bank has introduced a substantial exposure limit of 500% of the capital base of the Bank

• Industry/economic sector exposures - limits are imposed for lending to different sub- sectors in the economy. This is a control mechanism introduced recognizing that during various economic cycles, different sectors of the economy could face difficulties. At present the limit for a sub sector is set at 15%.

Portfolio Management

Credit portfolio management is an important function within the overall credit risk management function. Need for such critical and objective portfolio management emanates from the need to optimize the benefits associated with diversification. It also helps the Bank to identify and address potential adverse impact of concentration of exposures. The Bank has a well-structured portfolio management mechanism which evaluates exposures on the basis of industry concentration, rating quality, internally established pre specified early warning indicators apart from regulator imposed quantitative ceiling on the single borrower and aggregate exposure. The Bank’s internal single borrower and Group exposure limits are much stringent than those imposed by the regulator. Based on the feedback from the credit portfolio management, the credit origination criterion is amended prudently to insulate portfolios from further deterioration.

The portfolio management team also undertakes, apart from regular portfolio reviews, stress tests and scenario analysis when the external environment, both local and global, undergoes significant changes. Credit portfolio management envisages mitigating credit risks to a great extent by stipulating prudential risk limits on various risk parameters. As such, the Bank has established single borrower limit, limits for related party borrowings and aggregate limit for large exposures as prescribed by the regulators. Moreover the Bank has also established maximum limits to different industry segments. Such limits are clearly spelt out in the credit policy and the authority for permitting any deviations on an exceptional basis is also clearly documented. The Bank adopts a similar mechanism to assess the risks associated with off balance sheet exposures. As part of the credit portfolio management and monitoring procedures, the exposures in off balance sheet products such as FX Forwards, Guarantees and Letters of Credit are treated with utmost care.

KRIs supplement the overall portfolio management system, by providing a view of the credit risk of the portfolio as well as acting as an early warning system. Some of the KRIs monitored and reported to Board Integrated Risk Management Committee are given below;

Credit Risk Mitigation

The Bank adopts various mechanisms to mitigate the credit risk of the loan book.

• Ways out analysis - the primary source is established through a conservative evaluation of whether the borrower's realistic projected cash flows will be sufficient to repay their debts. This is further mitigated by a second way out in the event of unforeseen adverse circumstances and availability of collateral alone does not make an unacceptable proposal viable. Exemptions on collateral are allowed in the event the borrower demonstrates strong and reliable financial performance.

• Documentation of credit transactions with adequate terms, conditions and covenants in a comprehensive and legally enforceable basis.

• Obtaining of collateral in line with the Bank's policy and ensuring it is supported by enforceable documentation. Collateral policy differs from business line to business line according to the products offered.

  The main types of collateral taken by the Bank are

  • immovable property mortgages,

  • plant, machinery and equipment,

  • cash deposits,

  • mortgages on stocks and book debts and

  • corporate and personal guarantees.

It is the Bank's policy to be on a pari passu status with other lenders in terms of collateral cover. A decision to the contrary may be acceptable only where a non pari passu position is accepted due to unavailability of security as a result of the Bank being a late entrant to the relationship and is supported by strong financial position of the entity financed. Facilities under Product Programmes are governed by guidelines given in such individual programmes.

In instances where facilities are granted without collateral, the Bank ensures that its position will not be subordinated to other creditors’ interests. In such instances, the Bank generally requires either a negative pledge agreement not to encumber any assets without permission of the Bank or a pari passu clause, whereby the debtor will treat the Bank equally with respect to collateral with all current and future lenders.

The Bank has a panel of valuers who have been selected based on the criteria set out by the Central Bank of Sri Lanka. The Bank ensures that the valuations are carried out and reviewed as following.

• Facilities in NPL:

  • In respect of credit facilities granted against residential property which is occupied by the borrower for residential purposes – every 4 years

  • In respect of credit facilities granted for all other purposes – every 3 years

• Performing facilities:

  • Watch listed clients with working capital facilities - every 3 years

  • Other Clients with working capital facilities - every 5 years

No value is considered if valuations are not in line with the time frames set out as per the CBSL guidelines.

Impairment

The Bank has in place a detailed impairment policy which was approved by the Board of Directors. A credit risk provision for loan impairment is established if there is objective evidence that the Bank will be unable to collect all amounts due on loans and advances according to the original contractual terms.

Objective evidence that a loan is impaired includes observable data that comes to the attention of the Bank about the following loss events:

• Significant financial difficulty of the customer

• A breach of contract such as default of payment

• A breach of contract such as default of payment

• Where the Bank grants the customer a concession due to the customer experiencing financial difficulty

• It becomes probable that the customer will enter bankruptcy or other financial reorganization

• Observable data that suggests that there is a decrease in the estimated future cash flows from the loans, to name a few.

The Bank determines the allowances appropriate for each individually significant loan or advance on an individual basis if there is any objective evidence of a loss based on the above. Items considered when determining allowance amounts include

• The sustainability of the counterparty’s business plan/cash flows,

• Projected receipts and the expected payout should bankruptcy ensue,

• The realizable value of collateral and the timing of the expected cash flows.

A provision for impairment of loans is reported as a reduction of the carrying amount of loans on the balance sheet. Additions to provisions for loan impairment are made through impairment losses on loans and receivables in the income statement.

All exposures are assessed for impairment either individually or collectively. If there is objective evidence of incurred loss individually i.e. for exposures which are considered to be individually significant (exposures above LKR 50 million), the exposure should be measured for an impairment provision. If it is determined that no objective evidence of incurred loss exists for an individually assessed exposure, that exposure should be included in a group of exposures with similar credit risk characteristics that are collectively assessed for impairment.

If there is objective evidence that an impairment loss on loans and receivables carried at amortized cost has been incurred, the amount of the loss is measured as the difference between the loans’ carrying amount and the present value of estimated future cash flows discounted at

1. the loan’s original effective interest rate, if the loan bears a fixed interest rate, or

2. current effective interest rate, if the loan bears a variable interest rate.

The estimation of the recoverable amount of a collateralized exposure reflects the cash flows that may result from Liquidation of Collateral where foreclosure is considered the likely course of action. The time, costs and difficulties involved in obtaining repayment through collateral should be taken into account when determining the recoverable amount.

For the purposes of a collective evaluation of impairment, loans are grouped on the basis of similar credit risk characteristics. Corporate and SME loans are grouped based on product type, economic sector and on days in arrears. Retail Banking loans are grouped based on product type and number of days in arrears. Those characteristics are relevant to the estimation of historical loss experience for loans. Historical loss experience is adjusted on the basis of Probability of Default and Loss Given Default. The Bank also bases its analyses on economic factors and portfolio factors such as :-

• Macro Economic Factors such as

  • Interest rate stability

  • Unemployment rate

  • Inflation

  • GDP growth rate

  • Exchange Rate fluctuation

• Portfolio Factors such as

  • Rescheduled Loans as a % of total Loans

  • Average Age of the portfolio

  • Management's judgment on delinquencies of the borrowers

• Other Factors such as

  • Sovereign ratings assigned to Sri Lanka by local and international rating agencies

  • Global Economic Environment which has direct impact to the Sri Lankan economy

  • Borrower's ratings assigned by local and international rating agencies

The Bank may use the aforementioned factors as appropriate to adjust the impairment allowances. Allowances are evaluated separately at each reporting date with each portfolio.

Credit Risk Analytics

Product Concentration

The Bank’s portfolio continues to be concentrated in working capital financing facilities and Project Loans.

Business Line wise Composition

Business line wise composition of portfolio changed during the year in line with the long term strategy of the Bank.

Rated Portfolio Concentration

The Bank’s rated portfolio continues to be concentrated on “A” rated clients based on the internal rating models used by the Bank to rate Corporate and SME clients and the composition was within the risk appetite of the Bank set by the Board.

Credit Risk Concentrations

Single Name Concentration

• The Bank was in compliance with regulatory limits on Group and Single Borrower concentrations. The Bank was also in compliance with the internal limits set by the Board on Group and Single Borrower concentrations which are more stringent than those prescribed by the regulator.

• The substantial exposures of the Bank accounted for only 132% of the capital base and was well within the internal limit.

• The Bank’s portfolio concentrations were well within the risk appetite of the Bank set by the Board.

Sector Concentration

The Bank maintained a well-diversified portfolio and the portfolio was not over concentrated on a particular sector. The Bank was also in compliance with the minimum lending requirement of 10% to Agricultural sector. Bank measures the sector wise concentration risk using the Herfindhal-Hirschman Index and the trend indicated a reduction in concentration risk.

Geographical Concentration

Based on the economic activity highest concentration of domestic portfolio was in Western Province though the branch network is spread throughout the country. In line with Bank's strategy 96% of portfolio was concentrated locally.

NPL Analysis

Non-Performing Loans

The Bank’s NPL ratio was well below the industry ratio reflecting a better quality portfolio than most players in industry.

NPL and Regulatory (CBSL) Provisioning on Balance Sheet Exposures as at 31 December 2017

MARKET RISK

Market risk is the potential loss in both ‘On’ and ‘Off’-balance sheet positions arising from the movements in foreign exchange rates, interest rates, equity and commodity prices.

Objectives of Market Risk Management

The primary objective of Market Risk Management (MRM) is to ensure that Business units of the Bank optimize the risk-reward relationship within the Bank’s pre-defined risk appetite and avoid exposing the Bank to unacceptable losses.

Under a well-defined risk governance structure, the risks are identified, assessed, controlled and reported to ensure that the Bank operates within the allocated risk appetite levels. The Treasury activities are the key elements of Market Risk in the Bank, whilst other banking activities like deposit taking and lending activities forms a significant contribution over the same. The Treasury functions are segregated into three areas namely; Treasury Front Office, Market Risk Middle Office (MRMO) and Treasury Back Office where each unit has separate reporting lines to maintain independency. Treasury front office staff is guided by the Board approved Market and liquidity risk policies / limit framework and the Treasury Front Office Procedure guidelines. The procedure guideline provides the code of conduct for dealing room staff including the course of action to be taken in case of a violation of the rules and regulations stipulated therein.

Market Risk Governance Structure

Policies

Risk monitoring is guided by a well-defined policy framework and limit structure designed to suit the business model and the balance sheet structure reflecting the risk appetite of the Bank. The Board supported by Integrated Risk Management Committee (IRMC) approves the risk parameters as recommended by the Asset and Liability Committee (ALCO) and Market Risk Middle Office (MRMO)to facilitate the business needs.

The risk management policy framework covers the Market, Liquidity, Asset and Liability risk management guidelines on the procedure and techniques for assessing, managing, monitoring and reporting of risks related therein. The policy framework consists of the roles and responsibilities, procedures, risk measurement framework, risk monitoring, reporting and controls taking into account the rules and regulations and the best industry practice.

Processes

The key functions of Market Risk Management include Policy formulation, Risk Measurement methodologies, systems, control, reporting and communication. This will provide guidance on procedure for Market risk Management within the overall risk appetite of the Bank.

The Market Risk reports are circulated at a number of frequencies - daily, weekly, monthly and quarterly basis to Treasury, Senior Management, ALCO, IRMC and Board for decision making.

ALCO as the key Management Committee that regularly monitors the Market Risk exposures initiates appropriate actions to optimize the Risk exposures within the Risk appetite of the Bank.

The implementation of the Bank’s Market Risk Management policies, procedures and systems are delegated to the Head of Market Risk Management/Middle Office who reports to the Chief Risk Officer. Market and liquidity risks are addressed at ALCO on a monthly basis and at the IRMC level on a monthly/ quarterly basis.

Analytics

MRMO uses a range of techniques to measure the risk exposures arising from Treasury/general banking activities. In accordance with the economic and regulatory requirements, we measure, monitor and control the Bank’s exposures to market risk, given the size, complexity and risk profile of the Bank.

Prudential internal limits have been defined for exchange rate risks, interest rate risk and Price risks for close monitoring of exposures including various techniques such as Mark to Market, sensitivity analysis, Value at Risk (VaR) calculations and Stress testing. The exposure limits are linked to the Bank’s capital base/ balance sheet size/profitability as appropriate to ensure adequate and efficient capital allocation and planning.

Foreign Exchange Risk

Foreign exchange risk is the risk of losses arising through holding of assets and liabilities in foreign currency and due to the movements in foreign exchange rates against the base currency. The Bank is exposed to foreign exchange risk when it's on and off balance sheet assets and liabilities are not equal in a given currency or when the timing and certainty of the inflows and outflows differ.

The Bank monitors the daily foreign exchange (FX) open positions to ensure that the Bank is operating within the regulatory limit on Net Open Position as depicted in the graph. Apart from the regulatory limit, the Bank has set internal prudential forex limits consisting of daily forex turnover limit, daylight position limit, forex gap limits, stress testing limits, sensitivity analysis, Swap funding limit and stop loss limits to closely monitor and mitigate foreign exchange risk.

The below table shows the Bank’s consolidated Foreign Exchange position and the exposure held against the Bank’s capital base which is managed well within the regulatory limit of 30%.

Value at Risk (VaR)

VaR is a quantitative measure of the potential loss in value due to market movements which is expected for a defined period of time and a confidence level. The Bank’s Foreign exchange trading portfolio is subject to VaR measurement under historical simulation method on a daily basis. As prescribed by the Basel guidelines we calculate the VaR, using 99% confidence level for a one day holding period.

Value at Risk (VaR) on Forex Trading Portfolio

Historical approach, 1 day holding period

Stress Testing on DBU Net Open Position

Stress testing on Forex NOP under different magnitudes of shocks are performed to assess the impact on profitability as given below.

The Bank's Foreign Currency DBU Net Open Position and Stress Test Results as at 31.12.2017.

Sensitivity Analysis

Daily sensitivity analysis is carried out on major foreign currency Net Open Positions (NOP) giving positive and negative shocks to the spot rates to determine the impact of exchange rate movements by way of profit or loss to the Bank’s income statement.

Exchange Rate Sensitivity of Major Foreign Currency Net Open Positions as at 31 December 2017.

Interest Rate Risk (IRR) is the exposure of an institution's financial condition to adverse movements in interest rates. Changes in interest rates also affect the underlying value of the banking institution's assets, liabilities and off-balance sheet instruments, as the present value of future cash flows (and in some cases the cash flows themselves) change when interest rates change. Interest rate risk inherits various components; Re-pricing risk, basis risk, yield curve risk, option risk and price risk.

In order to manage the IRR, Bank has separated the balance sheet into trading and banking books. While the assets in the trading book (held for trading) are held primarily for generating profit through short term differences in prices/yields, the banking book (available for sale: AFS, held to maturity and loans and receivables) comprises assets and liabilities, which are contracted basically for steady income generation and are generally held till maturity. Thus, while the price risk is the prime concern of banks in the trading book, earnings or economic value changes are the main focus of the banking book.

The Bank’s trading portfolio mainly comprises securities (Treasury Bills/Bonds), and is monitored daily against the portfolio size limit, duration limit, maturity mismatch limit and mark to market limits. Portfolios are subject to VaR (Value at Risk) and PVBP analysis to analyze the impact on fluctuations in interest rates which are being closely monitored to take advantage of the market movements.

Value at Risk (VaR) on Treasury Bills/Bonds Trading and Available for Sale (AFS) Portfolio

Historical approach, 1 day holding period

The IRRBB arises mainly through non-trading asset and liabilities such as loans and advances, which is measured and managed through price sensitivity /duration/ NII and variance analysis, and the interest rate sensitivity gap analysis.

The Bank monitors the interest rate sensitivity of assets and liabilities using re-pricing gap report (Disclosure note No. 56.2 (C)).

The price sensitivity (Economic value perspective) of the Balance Sheet is managed within the risk parameters whilst maximizing the market potential on interest sensitive assets and liabilities.

Duration Analysis

PV01 Analysis

Modified Duration & Price Sensitivity of Local Currency Assets and Liabilities

As at 31 December 2017

The Equity price risk arises due to adverse movement in the value of the individual stock price or of the corresponding equity index. Bank does not engage in equity trading at present but the investments held in the AFS portfolio are subject to mark to market valuation.

Equity Position Risk Measurements

LKR 000'

Commodity price risk arises due to volatilities in the commodity exposure of the Bank. The Bank was exposed to the Gold Buffer stock of the underlying product “Raththaran Ithurum” which was fully disposed during the year 2017.

When undertaking foreign exchange dealing and trading with interbank counterparties and corporates, two general types of risks arise.

• Pre-settlement Risk - Refers to the counterpart becoming insolvent prior to the settlement date of transaction. The exposure comes by way of banks’ inability to find an alternate party to deal on same rates (interest or exchange) due to market changes.

• Settlement Risk - Relates to the event where the counterpart to the deal is unable to honour settlement obligations (either in local currency or foreign currency) to the bank after having taken possession of funds paid by the bank in settlement.

The Bank set individual counterpart limits to mitigate such risk. These limits are set through critically assessing the financial standing, balance sheet size and other risk parameters of such counterparts.

LIQUIDITY RISK

Liquidity risk is the risk that the Bank is unable to meet its financial obligations in a timely manner without incurring unacceptable losses. Financial obligations include liabilities to depositors, payments due under derivative contracts, settlement of securities borrowings and repurchase transactions, lending and investment commitments.

Effective liquidity risk management is essential to maintain the confidence of depositors and counterparties as well as to ensure that the Bank’s core businesses continue to generate revenue, even under stressed conditions.

Objective of Liquidity Risk Management

The objective of our liquidity framework is to ensure that all anticipated funding commitments can be met when due and allow us to withstand liquidity stresses whilst maintaining our business profile. It is designed to be adaptable to changing business models, markets and regulations. The Bank continues to focus on liability generation, which will be a necessary pre-condition for significant asset growth.

Policy Framework

The Bank maintains well-articulated liquidity risk management policies and procedures, which drive the level of liquidity risk exposures and determine the business size and maturities which ensure that it has at all times sufficient liquidity to meet its financial obligations at a fair market price. Also the Bank monitors key liquidity metrics on a regular basis, both on local currency and foreign currency balance sheets and prudential limits are set to better manage the liquidity profile of the Bank.

Process

The responsibility for the Liquidity risk management of the Bank rests with the ALCO. Bank’s Treasury/ALM units are responsible for executing the day-to-day liquidity management of the Bank within the parameters set by ALCO. Key liquidity measures are managed and monitored on a daily, weekly or monthly basis to ensure that the Bank meets the regulatory (Liquid Asset Ratio, Statutory Reserve Requirement and Liquidity Coverage Ratio) as well as the internal limits whilst meeting the customer demands without incurring unacceptable losses.

In this context, MRMO circulates Reports on Open exposure levels, Liquidity risk exposures, ALM and liquidity risk assessment to the Management/Board on a regular basis.

The Bank is equipped with a comprehensive Liquidity Contingency Funding Plan (LCFP) linked to the Business Continuity Plan, which is in line with the regulatory guidelines. The LCFP clearly defines the responsibilities of the Liquidity Management Team, Internal/external liquidity risk trigger points, stage for plan invocation/de-activation and the action plans to be exercised to ensure that all stakeholders of the Bank are safeguarded. We have also entered into reciprocal liquidity funding agreements with identified counterpart banks to ensure stability.

Liquidity measurement could be measured through Stock approach or Flow approach. Under the stock approach liquidity is measured in terms of key ratios which portray the liquidity stored in the balance sheet. In the flow approach a statement of maturities of assets and liabilities is prepared placing all cash flows in time bands according to the residual time to maturity. Separate gap limits are set for the local currency and foreign currency maturity mismatch reports based on the size and the nature of the Bank’s balance sheet.

Bank uses several internal prudential measures to manage its liquidity position, whilst meeting the regulatory limit. Certain limits are set for key liquidity measures, above the regulatory limit to give early warnings signals of tightening liquidity positions of the Bank. Factors such as market liquidity, exposure to interbank market, movement on loans and advances, deposit mix will be regularly monitored to identify any impending liquidity strain on the Bank.

Selected KRIs are highlighted below which provide a view of the Liquidity Risk indicators where regulatory/internal limits are set and monitored at pre-defined intervals, which provide early warning signals on liquidity position of the Bank. The bank has set more stringent internal limits for statutory Liquid Asset Ratio and Liquidity Coverage Ratio as an early warning signal to monitor impending liquidity stress situations.

The Bank’s funding diversification depicts the optimum level of sources of funds by primarily depending on customer deposits whilst maintaining the sensitivity towards the top depositors.

The key ratios under the stock approach which are regulatory requirements include the Statutory Liquid Asset Ratio and Liquidity Coverage Ratio.

Maturity Gap Analysis for Local Currency Denominated Assets and Liabilities - as at 31.12.2017

LKR '000

Liquidity Gap Analysis of Foreign Currency Denominated Assets and Liabilities

The Gap Analysis of Foreign Currency denominated assets and liabilities provides the cash flow obligations which assist in managing the foreign exchange liquidity in a prudential manner.

Maturity Gap Analysis for Foreign Currency Denominated Assets and Liabilities - as at 31.12.2017

OPERATIONAL RISK

Operational risk arises due to inadequate or lack of controls over critical activities, failure of systems and procedures or due to external factors. It is no longer appropriate to permit the management of operational risks only to the individual departments as it is likely to occur in all activities of business and may lead to both financial and non-financial losses. There must be a systematic approach in institutions to successfully embed operational risk management within a robust governance framework in order to reap benefits ranging from easier compliance and reporting to stronger financial performance.

Operational Risk is managed through a consistent framework Group-wide as defined in the operational risk policies, enabling to determine the operational risk profile for the Bank and the Group.

The objectives of development and implementation of Operational Risk policies include:

Risk Policy and Strategy: The Board is responsible for ensuring that senior management takes steps to identify measure, monitor and control all risks encountered by the Bank according to the laid down policies/ Operational risk framework. The Bank’s policy on treating Operational Risk and the Risk Framework are approved by the Board of Directors and reviewed annually.

Risk Identification: Risks that have the potential to impact the Bank are identified through analysis of internal factors, such as key control lapses and external factors such as environmental threats.

Risk Assessment: Once identified, the potential impact of the risks to the Bank is quantified using the operational risk grading matrix as defined in the policy. Risks are assigned risk grades (High, Medium and Low) based on the assessment of the likelihood and impact of the risks.

Risk Reporting: Periodic reports are prepared detailing out the risks faced by the Bank ensuring timely escalation mechanisms.

Risk Management and Monitoring: Actions to mitigate or control identified risks are prioritized based on the assessed impact. Appropriate action plans are established to mitigate, avoid, accept or transfer the risks to fall within the Bank’s risk appetite as decided by the Senior Management. This involves periodic re-assessment of risk grades to capture changes in environment that may increase or decrease potential impact of the risks.

Transfer Strategies

Insurance Policies – Comprehensive policies have been obtained to cover operational lapses which may occur as a result of events such as errors and omissions, physical loss of securities, frauds and natural disasters.

Outsourcing - The Bank is concerned and committed to ensuring that the outsourced parties continue to uphold and extend a high standard of customer care and service excellence. Hence, due diligence tests are routinely carried out to assess the performance of these outsourced parties through a sub-committee established to monitor outsource activities for the Bank.

Mitigate Strategies

Contingency Plan - In order to cover the risks of crisis that threaten the safety of staff, customers and service providers, the security of assets, the continuity of operations and confidence in the Bank’s reputation, the Bank’s Business Continuity Management Policy requires that a full set of up to date and exercised plans be in place encompassing a minimum of Crisis Management Plan (CMP), Business Continuity Plan (BCP) and IT Disaster Recovery Plan (IT DRP) amongst other relevant plans.

Operational risk management practices have been automated with the implementation of the NDB Operational Risk Management System (NORMS). The users report incidents instantaneously assigning owners for mitigation with defined target dates, carryout Risk and Control Self Assessments, and monitoring of Key Risk Indicators.

Operational Risk Management is an integral part of the Bank’s daily activities and managed with the oversight of Board and Senior Management. This end to end process ensures operational risks are effectively managed from the time they are identified to the time the risks are mitigated to fall within the risk appetite of the Bank. It is the responsibility of everyone in the Bank. As a consequence, measures aimed at controlling operational risk are introduced throughout the organization in the following distinguished levels:

• Individual level

• Management control

• Assessments carried out by specialist units such as Internal/Group Audit or Compliance

• Assessments carried out by external parties (External Auditors and Supervisory Authorities)

Self-reporting of incidents, risks and losses is encouraged within the Bank. All self-identified and assessed risks that have been reported to Operational Risk will not qualify as an audit finding. This arrangement has resulted in an increase of event reporting over the years.

The function of KRI is to allow the early detection of operational risks before actual failure occurs. It is an early warning indicator of risks, and not losses.

Regular KRI monitoring assist business line managers by providing them;

• A quantitative, verifiable risk measurement

• A regular assessment of the improvements or deteriorations in the risk profile and the control and the prevention environment which require particular attention or action plan.

The annual RCSA exercise is typically undertaken to comply with risk assessments which requires a firm-wide, self-analysis of operational risks. RCSA requires the documentation of risks, identifying the levels of risk (derived from an estimate of frequency and impact), and controls associated with each process conducted by the organization. Controls and mitigants that adequately counteract the risks are introduced thereby minimizing the impact and incidence of losses.

In an increasingly complex digital society where interconnected systems and innovative digital services define the operating standards for organizations, effectively managing cyber risks is proving to be a complex challenge. The fast paced adoption of technology, associated risks and the constant probing of financially motivated cyber adversaries to find weaknesses to exploit and gain a foothold within the digital infrastructure of financial institutions has become the new norm.

Understanding this challenge, the Bank strives to invest in updating its digital defenses to meet the challenges of the evolving cyber threat landscape. The Bank has continued to collaborate with financial sector threat intelligence provider and engage third parties to review information technology implementations and IT operational practices to identify improvements.

Business Continuity Management

The Banks’ Business Continuity Management (BCM) Policy requires that a full set of up to date and exercised plans be in place encompassing a minimum of a Crisis Management Plan (CMP), Business Continuity Plan (BCP) and IT Disaster Recovery Plan (IT DRP). This BCM Framework is designed to comply with the requirements of the Central Bank of Sri Lanka and is approved by the Board of Directors.

These plans are drawn upon integrating Enterprise Risk Management (ERM) Framework with effective Business Impact Analysis (BIA) processes and methodologies which anticipate all forms of threats, crisis and disasters that are inherent in the ever changing Business Environment.

These plans are tested biannually at the Banks’ fully equipped Disaster Recovery Site to ensure capability and resilience to business disruption.

The Governance of Business Continuity Management is steered through the Crisis Management Team comprising of senior management and coordinated by the Bank's Business Continuity Manager.

Insurance Cover in Operational Risk Management

The Bank has a comprehensive insurance policy as a key measure to mitigate aspects of operational risks. This falls within the framework of risk mitigation and control which in turn is an integral component of the risk management framework of the Bank. This Policy will be reviewed and further enhanced on an on-going basis. The Bank has engaged an insurance broker to source terms, evaluate and add value using their expertise.

Description of Coverage

General Risks

Buildings and their contents, including IT equipment, are insured at their replacement value. Liability policies are arranged separately which includes Professional Indemnity, Directors & Officers Liability & Public Liability which are covered by respective insurance policies where levels of cover are insured for having assessed the likely exposure of the bank to such areas of risks.

Theft/Fraud

These risks are included in the “Bankers’ Indemnity Insurance Policy” that insures all the Bank’s financial activities around the country. Fraudulent actions by an employee or by a third party acting on its own or with the aid of an employee with the intent to obtain illicit personal gain or through malice are covered.

Professional Liability

The consequences of any legal action against staff or managers as a result of their professional activity are insured under the Bank’s Professional Indemnity Policy.

Computer Crime

The adverse consequences surfacing while using computer systems and software are covered by the Banks Computer Crime Insurance Policy. The policy covers fraudulent input and modification via computer systems, electronic computer programs, electronic data and media, computer viruses, electronic and telefacsimile communications, electronic transmissions, electronic securities and voice incinerated transfers.

Operational Losses

The Bank's operational losses relating to low frequency, high severity events such as physical loss, fraud, natural disasters, liabilities to third parties, errors and omissions etc are covered by a comprehensive portfolio of insurance policies.

OTHER RISKS

Strategic Risk

Strategic Risk is the most fundamental of business risks and at its very basic, can be defined as the current and prospective risk to earnings and viability arising from,

• Adverse changes in business environment with respect to the economy, political landscape, regulations, technology, actions of competitors

• Adverse business decisions

• Improper implementation of decisions

• Lack of responsiveness to changes in the business environment

Strategic risk for a bank can manifest itself through lack of well-defined long-term strategy but more importantly because of failure to appropriately communicate and implement the strategy or due to unforeseen changes in the socio-political, economic or business environment. Drawing of appropriate response plans to tweak the strategy to suit the changes in the business environment is essential to management of strategic risk.

This year a new strategic plan was formulated by the Board for the Bank to become one of the largest Banks in Sri Lanka by 2020. The strategic plans are drawn at various level of granularity e.g. a branch level strategy will detail the growth targets at branch level whereas a department level strategy will feature the achievement metrics at that level. The implementation of strategy is checked through monthly meetings where variances from the growth targets are analyzed and corrective actions recommended.

The Strategic Plan is also linked to individual employee performance through a goal setting process and periodic performance reviews are carried out to motivate employees and create a performance culture to ensure that business goals and objectives are achieved, thus mitigating strategic risk.

Cross-Border Risk

Cross-border risk is the risk that the Bank will be unable to obtain payments from its customers or third parties on their contractual obligations as a result of certain actions taken by foreign governments, mainly relating to convertibility and transferability of foreign currency and geo-political factors.

Correspondent Banking Unit is responsible for Bank’s cross-border exposures and management of exposure limits. Crossborder assets comprise loans and advances, interest-bearing deposits with other banks, trade and other bills, acceptances, Foreign Exchange contracts, investment securities and formal commitments where the counterparty is resident in a country other than where the assets are recorded. Cross-border exposure also includes the assets owned by the Bank/ Group that are held in a given country.

The Bank has a Board approved policy/ limits based on external ratings of countries for routine banking transactions with tenors less than one year. In the event the Bank decides to make any long term investments/ lending (tenor over 1 year) off shore, the Bank undertakes a detailed due diligence covering the following key areas:-

• Country Ratings

• Economic Indicators and Outlook

• Political Risk

• Exchange Rate Risk (convertibility/ transferability)

• Banking/Financial sector

The business lines and back offices manage the exposures within these limits and policies. Countries designated as higher risk are subject to increased central monitoring. Cross-border exposure limits are allocated to countries in which the Bank does have an acceptable risk appetite and one-off limits may be allocated based on business needs, with ultimate recourse to the borrower.

Legal risk is understood more from its consequences, which is incurrence of penalties, fines and sometimes loss of reputation due to the institution being on the other side of law. Legal risk may vary from institution to institution depending on the manner in which it conducts its business and the documentation it follows and is closely related to compliance and regulatory risk.

Legal risk in the Bank can manifest itself through,

• Business not being conducted in accordance with applicable laws

• Inadequate legal documentation of securities and collateral accepted for credit risk mitigation

• Legal repercussions of lacuna in documents, forms, advertisements

• Other modes of conduct and communication adopted by the Bank

• Intellectual property not being adequately protected.

Legal risk is owned and managed by the Legal Department and the Legal Department is assisted by third party lawyers as and when necessary to obtain an independent opinion. Specific risks relating to legal risk are reported on a monthly basis to the Board.

Very closely related with reputational and legal/regulatory risk, compliance risk is defined as the risk of legal or regulatory sanctions, material financial loss, or loss to reputation and integrity an institution may suffer as a result of its failure to comply with laws, regulations, rules, related self-regulatory organizational standards, and codes of conduct applicable to its business activities. Bank is compliant with all CBSL regulations.

The Bank has a well laid out Board approved Compliance Charter, which defines the fundamental principles, roles and responsibilities of the compliance function within the organization as well as its relationship with the business and operational functions, senior management and the Board of Directors.

Model Risk

Board has put in place a risk model validation policy to mitigate model risk of the Bank. Bank completed third party validation of risk models during the year in line with the Board approved policy.

Settlement Risk

Settlement Risk refers to the risk arising on account of failed trades with counterparty banks in the foreign currency transactions. Settlement Risk arises from possible losses when the Bank is in a foreign exchange transaction pays the currency it sold but does not receive the currency it bought. Forward Contract settlement failures can arise from counterparty default, operational problems, and other factors. Settlement risk exists for any traded product. Currently, the Bank has a procedure for regular monitoring of limit utilization, failed trades & excess monitoring. Settlement Risk is currently controlled by way of prudent allocation and monitoring of counterparty limits including Maximum Daily Delivery Risks (MDDR) limits for counterparts.

Governance Risk

Corporate governance is understood as the system by which the Bank is directed and controlled. The Board of Directors is responsible for the governance of the Bank. The responsibilities of the Board include setting out the Bank’s strategic aims, providing leadership to operationalize same, supervising the management of the business and reporting to shareholders on their stewardship.

Bank’s Corporate Governance framework has been developed with the objective of balancing the attainment of corporate objectives of the Bank whilst at the same time aligning corporate behaviours with the expectations of society and being accountable to its shareholders.

Please refer the Corporate Governance Report found in this annual report for more details on the Bank’s Corporate Governance framework.

Reputational Risk

Reputational risk is risk of indirect loss (current or prospective) arising from one or multiple stakeholders’ adverse experience while dealing with the institution or which resulted in an adverse perception of the

institution. It can also be understood as the potential that negative publicity regarding the Bank’s business practices, whether true or not, will cause a decline in customer base, costly litigation or revenue reduction. The Bank is of the view that reputational risk can be triggered by a risk event in any or all of the above risk categories hitherto described.

Reputational risk management and mitigation aspects are embedded in the Bank’s policies and procedures, training programs, the Business Continuity Plan and through the Audit and Board Risk Management Committees.

The Bank monitors its reputational risk profile through a set of early warning indicators based on the reputational risk drivers and the factors within the reputational risk scorecard ensure that the overall reputational risk profile remains acceptable. The risk mitigation and control processes for reputational risk are designed to consider appropriate response actions to address the risks identified. A Customer Complaint Handling Process has been established under which the customers have a range of options through which they can forward their grievances to the Bank, by way of letters, using our public help line that is manned on a 24 hour basis, through the Bank web-site or social media.

Group Risk

The Bank together with its subsidiaries, in the process of financial intermediation are confronted with various kinds of financial and non-financial risks such as credit, interest rate, foreign exchange rate, liquidity, equity price, commodity price, legal, regulatory, reputational, operational, etc. These risks are highly interdependent and events that affect one area of risk can have consequences on a range of other risk categories. Thus, considerable importance is given to improve the ability to identify, measure, monitor and control the overall level of risks undertaken.

Aggregating the risks of Group Companies remains a challenge due to their diverse business models and risk profiles. The Group Companies are engaged in investment banking, capital market activities, unit trust management and property management activities. However, the Bank believes the ‘Group Risk’ is greatly mitigated as;

• NDB’s capital at risk is limited to the amount invested in these companies in the form of equity, at the time the companies were incorporated.

• There is representation by NDB’s Directors/Key Management Personnel on the Boards of Directors/Board Audit, Risk and Compliance Committees of its subsidiaries, thereby ensuring full and sufficient knowledge of subsidiaries’ operations and risk profiles.

• Due to the governance structure mandated by the laws governing banking and limited liability companies, all inter-company transactions are at arms-length and full disclosure of such transactions is made.

• Natural mitigation from the fact that the Bank is the holding company and owns the largest balance sheet in the group.

• NDB Securities Limited and NDB Wealth Management Limited being licensed stock brokers and Unit Trust Managers are regulated by the SEC.

• Risk Reporting framework by group companies to Centralized Group Risk Management of NDB/IRMC/Board for review/corrective action.

Each Group Company remains responsible for the management of risks, including associated controls and on-going monitoring processes. Risks identified by Group companies are reported to Group Risk Management department on a monthly basis through appropriate risk indicators (using a Risk Dashboard) and management information for review and escalation. Top risks and associated mitigants are also highlighted. The main risk categories being reviewed are as follows:-

• Investment/Credit Risk

• Operational Risk

• Market Risk

• Liquidity Risk

• Interest Rate Risk

• Concentration Risk

• Regulatory/Compliance Risk

• Legal/Reputational Risk

• Strategic Risk

• Any other risks relevant to the specific line of business of the Group Company

All Group Companies are required to have relevant policies and limits for monitoring purposes and to ensure that risks are within acceptable levels/ in line with risk appetite. All risk related policies of the Group companies are vetted by Group Risk Management department to ensure compliance with the Regulatory requirements and internal policies applicable to the Bank. Furthermore, the Operational Risk Management Unit within the Group Risk Management department conducts Risk and Control Self Assessments for the Group companies and this process facilitates informed decision-making by providing management with an overall view of operational risks within a business process.

FUTURE OF RISK MANAGEMENT

The Bank's risk management capabilities have progressed encouragingly towards best in class, and will continue to be strengthened and enhanced to create value and be a competitive advantage to support the Group’s aspirations.

BASEL III - PILLAR III MARKET DISCIPLINE DISCLOSURES

Commencing from 01 July 2017, all Licensed banks are required to compute capital ratios based on the Basel III guidelines issued by the Central Bank of Sri Lanka. As per the Basel III guidelines, it is required to disclose Pillar III Market discipline disclosure requirements laid out in the Banking Act Direction No. 01 of 2016.

Pillar III Market Discipline disclosures of the Bank and the Group for the year ended 31 December 2017 are given below.

1. Regulatory Requirements on Capital and Liquidity

1.(a) Key Regulatory Ratios - Capital and Liquidity

As per the above reported ratios for Capital, the Bank and the Group comply with the minimum requirements for capital ratios as of 01 January 2018.

1.(b) Basel III Computation of Capital Ratios

1.(c) Basel III Computation of Liquidity Coverage Ratio - All Currency Liquidity Requirement

1.(d) Main Features of Regulatory Capital Instruments - Bank and Group

2. Risk Weighted Assets (RWA)

2.(a) Summary discussion on adequacy/meeting current and future capital requirements.
Please refer page 138 for the Capital Management section.

2.(b) Credit Risk under Standardized Approach - Credit Risk Exposures and Credit Risk Mitigation (CRM) Effects

2.(b) Credit Risk under Standardized Approach - Credit Risk Exposures and Credit Risk Mitigation (CRM) Effects (Contd.)

Note -
(i) NPAs - As per Banking Act Direction on classification of loans and advances, income recognition and provisioning.
(ii) RWA Density - Total RWA / Exposures post CCF and CRM

2.(c) Credit Risk under Standardized Approach: Exposures by Asset Classes and Risk Weights