Arion Bank faces various risks arising from its day-to-day operations. Managing risk is therefore a core activity within the Bank. The key to effective risk management is a process of ongoing identification of significant risk, quantification of risk exposure, action to limit risk and constant monitoring of risk.
The Board of Directors is ultimately responsible for the Bank’s risk management framework and ensuring that satisfactory risk policies and governance for controlling the Bank’s risk exposure are in place. The Board allocates risk management of subsidiaries to the relevant subsidiary. For the parent company (the Bank) the Board sets risk appetite, which is translated into exposure limits and targets monitored by the Bank’s Risk Management division.
The CEO is responsible for sustaining an effective risk management framework, processes and controls as well as maintaining a high level of risk awareness among the employees, making risk everyone’s business.
The Bank’s Risk Management division is headed by the Chief Risk Officer. It is independent and centralized and reports directly to the CEO. Further information on Risk Management division.
The Bank operates several committees to manage risk. The Board Audit and Risk Committee (BARC) is responsible for supervising the Bank’s risk management framework, risk appetite and internal capital adequacy assessment process (ICAAP). The Asset and Liability Committee (ALCO), chaired by the CEO or his deputy, is responsible for managing the asset-liability mismatch, liquidity risk, market risk and interest rate risk, and capital management. The Underwriting and Investment Committee (UIC) decides on underwriting and investments. The Bank has four credit committees: The Board Credit Committee (BCC) which decides on all major credit risk exposures; the Arion Credit Committee (ACC) which operates within limits specified as a fraction of the Bank’s capital; the Corporate Credit Committee (CCC) and the Retail Branch Committee (RBC) which operate within tighter credit granting limits. There are also five valuation committees whose role is to establish criteria for estimating collateral and also to inspect valuations of securities owned by the Bank.
The most significant risks the Bank is exposed to are credit risk, including concentration risk, liquidity risk, currency risk, interest rate risk, legal risk and operational risk. The Bank’s Pillar 3 Risk Disclosures 2015 report discusses risk factors and risk management in detail.
The Bank’s capital is intended to meet the risk of unexpected loss in its operations. The size of the Bank’s capital base should reflect the risk at any given time and any potential adverse future trends. Risk on the Bank’s balance sheet is assessed by calculating risk-weighted assets (RWA). The Bank uses standardized approach for calculating RWA.
The Bank’s capital base was ISK 195.7 billion at the end of 2015. Tier 1 capital accounted for ISK 189 billion of this total. In 2015 the Bank repaid two thirds of a subordinated loan from the Icelandic government, thereby reducing Tier 2 capital by ISK 20 billion. The Bank’s risk-weighted assets amounted to ISK 808 billion at the end of 2015, increasing by ISK 112 billion over the year. This increase can largely be attributed to a valuation increase of the holding in Bakkavor Group Ltd. and the corresponding increase in the foreign exchange imbalance. The effect of these items receded following the sale of the Bank's share in the company in January 2016. The Bank’s capital ratio at the end of 2015 was 24.2%.
Furthermore, the Bank carries out an Internal Capital Adequacy Assessment Process (ICAAP). ICAAP aims to ensure that the Bank has in place sufficient risk management processes and systems to identify, manage and measure the Bank’s total risk exposure. ICAAP is aimed at identifying and measuring the Group’s risk across all risk types, including those which are not provided for in the standardized approach under Pillar 1, and ensure that the Group has sufficient capital in accordance with its risk profile. The Financial Supervisory Authority (FME) supervises the Group, receives the Group’s internal estimation on capital adequacy and sets capital requirements for the Group as a whole following a Supervisory Review and Evaluation Process (SREP). The capital adequacy in respect of the FME's internal evaluation in addition to the mandatory 8% requirement under Pillar 1 is called an additional capital requirement under Pillar 2. The Group’s capital base meets the FME's SREP requirements. The Bank does not disclose the additional capital requirement under Pillar 2 owing to the uncertainty of the treatments of overlap of risk factors within Pillar 2 and capital buffers which come into effect in 2016.
On 1 March 2016 the FME reached a decision on capital buffers which will apply in 2016. They will total 8.5% when they have been fully implemented on 1 March 2017 for systemically important institutions, which Arion Bank is categorized as. There are four capital buffers, (i) a capital conservation buffer, (ii) a systemic risk buffer (restricted to the domestic part of the RWA), (iii) a systemically important institution buffer, and (iv) a countercyclical capital buffer. The capital buffers are designed to ensure that the Bank maintains a minimum level of capital despite severe shocks. The Bank assesses the impact of such shocks by regularly performing stress tests.
Credit riskCredit risk is defined as the current or prospective risk to earnings and capital arising from the failure of an obligor to discharge an obligation at the stipulated time or otherwise to perform as agreed. Loans to customers and credit institutions are by far the largest source of credit risk.
Strong and improving mortgage portfolioMortgages are a core product for Arion Bank. The mortgage portfolio represents 37% of the total loan portfolio at the end of the year, up from 12% since the end of 2010. The key to the growth of the mortgage portfolio was the acquisition of a mortgage portfolio from Kaupthing in 2011 and the settlement of the Drómi bond in 2013, coupled with strong organic growth via new mortgage lending. The Bank has been at the forefront of the mortgage market, offering for example, non-indexed mortgages in ISK. At the end of 2015 non-indexed mortgage loans represented 27% of the mortgage portfolio, the remainder being CPI-linked loans
The quality of the mortgage portfolio has been steadily improving with lower average loan-to-value and a reduction in default rates. Higher default rates among loans in the Drómi transaction did, however, raise the average mortgage default rate in 2013. The main reasons for lower default rate in 2015 were the improving economic climate, restructuring and better loan collection rates.
Well diversified loan portfolio
Loans to customers are well diversified. Loans to individuals represent 48% of total loans to customers, of which 83% are due to mortgages. The corporate portfolio is mainly in three sectors: real estate and construction, fishing and wholesale and retail trade, which represent 29%, 21% and 15% of the corporate portfolio respectively. Although sector diversification is good, some single name concentration remains.
Single name concentration decreasingAt the end of 2015 the Bank had one exposure to a group of related parties (a financial institution) that exceeded 10% of the capital base (so-called large exposures), compared with two large exposures at the end of 2014. As seen in the following diagram, the sum of large exposures (excluding loans to financial institutions) has fallen sharply since 2011 when it was 87% of the capital base. The sum of related exposures exceeding 2.5% of the capital base has increase from the previous year – from 99% at the end of 2015, compared with 88% at the end of 2014.
Collateral coverage of loans to customers
Mortgages over residential properties and charges over commercial real estates are the most common types of collateral obtained by the Bank, representing 74% of total collateral. Fishing vessels and other fixed and current assets, such as cash and securities, are also used to secure loans. The Bank places emphasis on collateral maintenance, valuation and central storage of collateral information. At the end of 2015 loans to customers (gross value ISK 680,350 million) are secured by collateral valued at ISK 582,774 million, giving a collateral coverage ratio of 86%, but as shown in the following diagram this ratio varies between different sectors.
Loan book quality is steadily improvingThe Bank defines Problem loans as loans that are more than 90 days past due and loans that are past due but individually impaired. The ratio of problem loans has steadily decreased since its peak in 2010 mostly due to the progress made in problem loan restructuring and the resolution of the legal uncertainty surrounding FX loans. Approximately half of problem loans are 90 days past due but are not impaired due to sufficient collateral.
Collateral securing problem loans
Operational riskOperational risk is the risk of direct or indirect loss resulting from inadequate or failed internal processes, human and system error, or from external events that affect the Bank's operations. Reputational risk, IT risk and legal risk are considered subcategories of operational risk.
Each business unit within the Bank is responsible for taking and managing its own operational risk. The Bank’s Operational Risk department is responsible for developing and maintaining tools for identifying, measuring, monitoring and controlling operational risk.
The primary tools used by the Bank to measure operational risk are:
- Loss Data Collection
- Risk and Control Self-Assessment
- Key Risk Indicators
Loss data is collected, analyzed and recorded by Operational Risk as well as data which could have resulted in a loss. Serious events are analyzed more thoroughly to find a root cause and to devise ways of reducing the likelihood of such events reoccurring. The total amount of loss events in 2015 was ISK 619 million and the number of events was 2,471. The increase in the number of events can be attributed to changes in the way loss data are collected, with more factors being taken into account now. The increase in the amount of the category “Clients, products and business practices” is predominately due to a fine imposed on Arion Bank hf. in conjunction with a December 2014 settlement concerning changes to the way in which interchange fees, which card companies pay to the banks, are decided and the awarding of customer loyalty points.
Key risk indicators are regularly monitored and these can indicate when risk is increasing and exceeding the risk appetite. Reporting to the senior management is based on factors such as loss data, the results of RCSA and key risk indicators.
The management of IT and data security is the responsibility of the Security Officer. With the number of channels to interact with customers greater than ever before and rapid technological developments, the potential for risk relating to data and IT security has increased. In order to respond to these changes the Bank has strengthened its efforts in managing data and IT security. IT security is a method of ensuring confidentiality, integrity or availability of data.
The Bank uses the standardized approach to calculate the capital requirement for operational risk. The capital requirement for operational risk in 2015 was ISK 6,515 million.
Market risk is the risk that price changes and interest rate changes will affect the value and cash flow from the Bank’s financial instruments. The main types of market risk are interest rate risk, equity price risk and foreign exchange risk.
Interest rate risk is primarily related to the fact that in part of the balance sheet there is a mismatch between interest-bearing assets and liabilities and a gap in interest-fixing periods. Generally the value of the Bank’s fixed-interest assets is higher than the value of liabilities with the same interest-fixing period as the Bank is primarily funded by deposits. An increase in market interest rates would therefore have a negative effect on the Bank’s earnings. The majority of risk stems from the portfolio of CPI-indexed mortgages at fixed interest which were originally issued between 2004 and 2006. The risk is largely hedged because the portfolio is partly funded by structured covered bonds at fixed interest. The Bank has reduced this risk by issuing new covered bonds and by offering its customers loans with variable interest rates. Moreover the loan principal adjustment carried out in 2015 in relation to the Government’s relief program also helped to reduce the risk.
The main equity price risk is related to the Bank’s holdings in unlisted equity, which the Bank acquired during the process of restructuring companies following the 2008 economic crisis. The risk has decreased recently as the Bank has divested its shareholdings in these companies. The Group’s position in associate companies at the end of 2015 reflects the realized sale value of Bakkavor Group Ltd., and following this sale at the beginning of 2016 the position in associate companies will be minimal.
The position in equities in the trading book has steadily increased due to higher turnovers and activities on the market. Risk Management closely monitors risk and ensures that positions are kept within limits and that collateral is in place.
Foreign exchange risk is the risk that movements in the exchange rate of the Icelandic króna could have a negative impact on the Bank's earnings. The Group’s currency imbalance at the end of 2015 was ISK 32.1 billion. This position reflects the Bank’s proceeds from the sale of its holding in Bakkavor, and the imbalance decreased again following the sale at the beginning of 2016. Arion Bank’s currency imbalance has been stable since the early part of 2012. The Bank uses derivatives to hedge against foreign exchange risk.
The net position of the Bank’s indexed assets and liabilities was 95.0 billion at the end of 2015. The indexation imbalance increased in 2013, primarily as a result of the Bank’s takeover of loans in connection with the Drómi bond. The increase in 2014 is largely due to the payment of structured covered bonds, but this is counterbalanced by the regular issue of new indexed covered bonds. The Bank’s inflation loans and borrowings have increased largely at the same rate in 2015 but in other respects derivatives are the main factor behind the increase in the net position during the year.
Liquidity riskLiquidity risk is defined as the risk that the Bank, though solvent, either does not have sufficient financial resources available to meet its liabilities when they fall due or can secure them only at excessive cost.
The Bank also carries out an Internal Liquidity Adequacy Assessment Process, or ILAAP. This is designed to ensure that the Bank has sufficient liquidity and that appropriate plans, policies, methods and systems are in place to analyze, manage and monitor liquidity risk.
The FME and the Central Bank of Iceland monitor the Bank’s compliance with requirements and obligations in respect of liquidity risk.
Liquidity and liquidity risk are discussed in more detail here.