Integrated Risk Management

Risk culture and vision

DFCC Bank PLC (the Bank) adopts a comprehensive and well-structured mechanism for assessing, quantifying, managing and reporting risk exposures which are material and relevant for its operations within a well-defined risk management framework. An articulated set of limits under the risk management framework explains the risk appetite of the Bank for all material and relevant risk categories and the risk capital position. Risk management is integrated with strategic, business and financial planning and customer/client transactions, so that business and risk management goals and responsibilities are aligned across the Organisation. Risk is managed in a systematic manner by focusing on a group basis as well as managing risk across the enterprise, individual business units, products, services, transactions, and across all geographic locations.

The following broad risk categories are in focus:

Risks covered under Pillar I of Basel regulations

• Credit risk
• Market risk including foreign currency risk, equity prices risk, and interest rate risk in the trading book
• Operational risk

Other risks covered under Pillar II of Basel regulations

• Business risk and strategic risk
• Liquidity risk
• Settlement risk in treasury and international operations
• Credit concentration risk
• Cyber-security risk
• Interest rate risk in the banking book
• Legal risk
• Compliance risk
• Reputational risk
• Country risk

Credit risk amounts to the highest quantum of quantifiable risk faced by the Bank based on the quantification techniques currently in use. DFCC Bank’s credit risk accounted for 89% of the total risk-weighted assets. Additionally, the Bank takes necessary measures to proactively manage operational and market risks as very important risk categories considered as Pillar I risks under the Basel regulations. Operational risk incidents may be either high frequency but low impact or with low frequency but high impact, yet all of them warrant being closely monitored and managed prudently.

The Bank’s general policies for risk management are outlined as follows:

• The Board of Directors’ responsibility for maintenance of a prudent integrated risk management function in the Bank.
• Communication of the risk policies to all relevant employees of the Bank.
• Structure of “Three Lines of Defence” in the Bank for management of risks which consists of the risk-assuming functions, independent risk management and compliance functions and the internal and external audit functions.
• Ensuring compliance with regulatory requirements and other laws underpinning the risk management and business operations of the Bank.
• Centralised integrated risk management function which is independent from the risk assuming functions.
• Ensuring internal expertise, capabilities for risk management, and ability to absorb unexpected losses when entering into new business and delivery channels, developing products, or adopting new strategies.
• An assessment of risk exposures on an incremental and portfolio basis when designing and redesigning new products and processes before implementation. Such analyses include among other areas, business opportunities, target customer requirements, core competencies of the Bank and the competitors and financial viability.
• Adoption of the principle of risk-based pricing.
• Ensuring that the Board approved target capital requirements, which are more stringent than the minimum regulatory capital requirements, are not compromised. For internal purposes, economic capital is quantified using Basel recommended guidelines in the Internal Capital Adequacy Assessment Process (ICAAP). A cushion of economic capital over and above the regulatory capital requirement is maintained to cover for stress losses or losses caused by unquantifiable risks such as strategic risk, liquidity and reputation risks (risk categories which are not in Pillar I of Basel guidelines). Under ICAAP, capital is monitored on a quarterly basis based on certain stress scenarios which are subject to regular review based on macro-level anticipated developments.
• Aligning risk management strategy to the Bank’s business strategy.
• Ensuring comprehensive, transparent, and objective risk disclosures to the Board, Corporate Management, regulators, shareholders, and other stakeholders.
• Continuous review of risk management framework and ICAAP to align with Basel recommendations and regulatory guidelines.
• Maintenance of internal prudential risk limits based on the risk appetite of the Bank wherever relevant, over and above the required regulatory limits.
• Ensuring a prudent risk management culture within the Bank.
• Periodic review of risk management policies and practices to be in line with the developments in regulations, business environment, internal environment and industry best practice.

A risk management culture has been created across the Bank that promotes its business objectives and an environment that enables Management to execute the business strategy in a more efficient and sustainable manner. The Board of Directors regularly reviews the risk profile of the Bank and its Group, and every business or function is included in developing a strong risk culture within the Bank. Further, the Bank ensures that, every employee has a clear understanding of his/her responsibilities in terms of risks undertaken in every step in their regular business activities. This has been inculcated mainly through the Code of Conduct, periodically conducted training programmes, clearly defined procedural manuals and integrated risk management function’s involvement as a review process in business operations.

Risk governance

Approach of “Three Lines of Defence”

DFCC Bank PLC advocates strong risk governance applied pragmatically and consistently with a strong emphasis on the concept of “Three Lines of Defence”. The governance structure encompasses accountability, responsibility, independence, reporting, communication and transparency, both internally and with our relevant external stakeholders.

The First Line of Defence involves management control at business level and adhering to relevant internal control mechanisms while discharging the responsibilities and accountability for day-to-day management of business operations. Independent risk monitoring, validation, policy review and compliance by the Integrated Risk Management Department (IRMD), the compliance function and periodic monitoring and oversight by the Board Integrated Risk Management Committee (BIRMC) constitute the Second Line of Defence. The Third Line of Defence is provided by the independent check and quality assurance of the internal and external audit functions.

Risk governance of the Bank includes setting and defining the risk appetite statement, risk limits, risk management functions, capital planning, risk management policies, risk infrastructure, Management Information Systems and analysis to monitor the Bank’s risk profile. The Bank exhibits an established risk management culture with effective risk management approaches, systems and controls. Policy manuals, internal controls, segregation of duties, clearly demarcated authority limits and internal audit form a part of key risk management tools. The Bank has developed a risk management framework covering risk governance, which includes, risk management structure comprising different subcommittees and clearly defined reporting lines ensuring risk management unit is functioning independently. The Chief Risk Officer (CRO), functions with direct access to the BIRMC.

Governance structure for risk management at DFCC Bank PLC

Organisations structure for integrated risk management

The Integrated Risk Management Department (IRMD) is responsible for measuring and monitoring risk at operational levels on an ongoing basis to ensure compliance with the parameters set out by the Board/BIRMC and other Executive Committees for carrying out the overall risk management function in the Bank. It consists of separate units such as Risk Policy and Modelling, Credit Risk Management and Quality Assurance, Market Risk Monitoring, Operational Risk Management, Assets and Liability Management, Loan Review Mechanism, Risk Quantification, Information Systems Security Risk Monitoring, and Treasury Middle Office. IRMD is involved with product or business strategy development and entering into new business lines and gives input from the initial design stage throughout the process from a risk management perspective.

Key developments in risk management function during the period under review

Several significant initiatives were undertaken focusing continuously on regulatory developments and reassessing the Bank’s existing risk management policies, guidelines, and practices for necessary improvements. The improvements brought in by adopting the Basel III Regulatory Standards by the banks in Sri Lanka is crucial. In addition to these regulatory specifications, changes in business strategy, industry factors and international best practices were also considered in the improvement process. The following are the key initiatives during the period under review which led to further improvements in the overall integrated risk management function.

Prudential risk limits were reviewed in order to reflect the current risk appetite of the Bank by setting new limits wherever necessary. Internal limits were put in place to better manage the regulatory limits as trigger points, which are much stricter than the regulatory limits. Further, based on the current risk appetite and the business requirements, the Bank enhanced the exposure limit for lending to Maldives, which has been in place to manage the country concentration risk.

All the Board-approved risk management frameworks, charters, and TORs were reviewed during the period, especially considering the changes in new regulations and the Bank’s business model.

Periodic validation of the credit rating models was carried out during the year. The required calibrations/amendments were primarily identified based on the results of the model validation process and necessary adjustments were introduced for better discriminatory power.

Replacing the stand-alone credit rating models previously used, the Bank procured a credit rating system which facilitates to host the internal credit rating models of the bank. The new system is expected to bring in more operational efficiencies in credit rating workflow while facilitating the rating review mechanism. The Credit Rating System will maintain a central database with all the rating related information of the clients which eventually facilitates the Bank to move in to advance approaches in credit risk quantification in Basel framework.

Treasury Middle Office (TMO) which is functionally segregated from the Treasury Department, directly reports to the CRO and monitors the Treasury-related market risk limits. The process of voice recording testing of Treasury transactions was further improved during the year. A new Voice Record System was implemented which has facilitated smooth record and playback of voice calls of the Treasury.

Scenario analysis and simulations by the ALM unit to assess the expected behaviour of interest margins enabled ALCO to take proactive measures to manage the erosion of margins. Looking at the trends in the market rates, ALCO proactively changed the pricing methods, thus managing the net interest margins of the Bank.

IRMD continued to calculate loss ratios for key lending products using historical recovery data in support of impairment assessment under IFRS 9. As part of the risk management practices, the Bank computed the key credit risk quantification parameters such as Probability of Default (PD), Exposure at Default (ED), Loss Given Default (LGD) and the loss ratios which are defined and recommended under the Basel III and IFRS. The results indicated improvements in the credit risk rating process, rating models, recovery process and the collateral quality in the Bank.

The credit workflow ensures that every credit proposal except for centrally processed retail loans, is evaluated by an independent authority not connected to business lines, being either the Credit Risk Management Unit (CRMU) or the Quality Assurance Unit (QAU) of IRMD, based on the size of the accommodation and the approving authority. The credit workflow of the Bank was further improved during the year, taking business requirements and changes in market conditions into consideration.

To conform with the CBSL requirement of Loan Review Unit to be independent from the Credit Risk Management Unit, separate Loan Review Unit has been established. The unit has taken specific actions to increase the scope of the Loan Reviews and to obtain feedback from business units with regards to the improvements brought in to the post credit management that would contribute to the quality of the loan portfolio.

Having duly recognised the global trend on increasing threats on systems and information security, the Bank increased its focus on IT systems security under its operational risk management practices. The scope of the Information Systems Security Unit was further enhanced during the year under the Integrated Risk Management Department to proactively manage the information security risk of the Bank. The Operational Risk Management Committee oversees the effectiveness of security initiatives and directs the management of information security risks within the Bank.

Server network, business application security reviews, technology risk assessments, network and other device security reviews are being conducted internally on regular basis to ensure required attention is given for rectifying known vulnerabilities and security weaknesses in timely manner. Also, the unit involves in new system implementations from request for proposal (RFP) stage to Go-live confirmation and make sure new systems are compliant with industry security best practices. Further, the unit works with reputed external parties to ensure that critical and customer facing systems are appropriately secured.

Staff awareness programmes on operational risk were held for staff at various levels, from new recruits to Branch Managers. The Bank has developed a model for Risk and Control Self-Assessment, and Key Risk Indicators for operational risks across all major functions and departments, and continues to monitor closely their applicability, trends and effectiveness of the controls on a semi-annual basis.

Complying with the new regulatory directions related to SLFRS 9 implementation, Risk Management Department established a process for upgrading of credit facilities from a higher stage to a lower stage. The process is supported with a Board-approved policy where prior to upgrading, an independent verification is carried out on objective evidence of increased credit risk, in addition to the regulatory minimum requirements of satisfactory performing period.

Credit risk

Credit risk is the risk of loss to the Bank if a customer or counterparty fails to meet its financial obligations in accordance with agreed terms and conditions. It arises principally from on-balance sheet lending such as loans, leases, trade finance, and overdrafts as well as through off-balance sheet products such as guarantees and Letters of Credit. A deterioration of counterparty credit quality can lead to potential credit-related losses for a bank. Credit risk is the largest component of the quantified risk accounting for 89% of the total risk-weighted assets of DFCC Bank PLC.

The challenge of credit risk management is to maximise the risk adjusted rate of return by maintaining the credit risk exposure within acceptable levels. With the implementation of IFRS 9, a proactive approach will be adopted by Credit Risk Management Unit in monitoring credit risk parameters and indicators which include watch listing of customers through quantitative and qualitative indicators.

Note: “Other” category includes “Education”, “Information Technology and Communication Services”, “Professional, Scientific and Technical Activities”, “Arts, Entertainment and Recreation” and “Lending to Ministry of Finance”

Note: Excludes Concessionary Staff Loans and Credit Card installment loans

Credit risk management process at DFCC Bank PLC

The Bank’s credit policies approved by the Board of Directors define the credit objectives, outlining the credit strategy to be adopted at the Bank. The policies are based on CBSL Directions on integrated risk management, Basel recommendations, business practices, and risk appetite of the Bank.

Credit risk management guidelines identify target markets and industry sectors, define risk tolerance limits and recommend control measures to manage concentration risk. Standardised formats and clearly documented processes and procedures ensure uniformity of practices across the Bank.

Credit risk culture		Credit risk management framework and credit policy Governance structure and specific organisational structure for credit risk management IRMD creates awareness of credit risk management through training programmes and experience sharing sessions
Credit approval process		Structured and standardised credit approval process as documented in the credit manual. The entire gamut of activities involving credit appraisal, documentation, funds disbursement, monitoring performance, restructuring and recovery procedures are described in detail in the manual which is reviewed annually Standardised appraisal formats have been designed for each product type and are being reviewed annually to be in line with the business needs Clearly defined credit workflow ensures segregation of duties among credit originators, independent review and approval authority Delegation of Lending Authority sets out approval limits based on a combination of risk levels, as defined by risk rating and security type, loan size, proposed tenure, borrower, and group exposure IRMD’s involvement in independent rating review of every credit proposal with the exception of centrally processed retail loans CRO is an observer of the Credit Committee and evaluates credit proposals from a risk perspective Risk-based pricing is practised at the Bank, any deviations being allowed only for funding through credit lines and where strong justification is made due to business development purposes
Control measures		Negative sectors and special clearance sectors are identified based on the country’s laws and regulations, the Bank’s corporate values and policies and level of risk exposure. Negative sectors are recognised as industry sectors to which lending is disallowed while special clearance sectors are industry sectors and credit products to which the Bank practices caution in lending Exposure limits on single borrower, group exposure, and advisory limits on industry sectors, large group borrowers and selected geographical regions are set by the Board of Directors on recommendation of IRMD
Credit risk management		Timely identification of problem credits through product-wise and concentration analysis in relation to industries, specific products and geographical locations such as branches/regions/provinces Industry reports/periodical economic analysis provide direction to lending units to identify profitable business sectors to grow the Group’s portfolio and to identify industry-related risk sources and their impact Evaluation of new products from a credit risk perspective Post sanction review of loans within a stipulated time frame is in place in accordance with Loan Review Policy to ensure credit quality is maintained. Separate Loan Review Unit is established independent of Credit Risk Management Unit Independent rating review by the Credit Risk Management Unit or the Quality Assurance Unit of IRMD ensures an assessment of credit quality at the time of credit origination and annual credit reviews Periodic validation of credit rating models and introducing necessary adjustments to the models for better discriminatory power, based on model validation results and existing macroeconomic outlook.
Credit risk monitoring and reporting		Analysis of total portfolio in terms of NP movement, product distribution, industry sectors, Top 20 borrower exposures, borrower rating distribution, branch-wise portfolio distribution, and collateral distribution is carried out periodically and reported to BIRMC Watch listing of clients with significant arrears and obtaining feedback from business units on recovery action taken to regularise arrears. Disseminating information to decision-makers on frequently watch-listed clients based on arrears exposures, frequent excess positions, restructured and extended facilities, rating downgrades monitored over a period of time, and crossovers to NP of watchlisted borrowers. Reporting to Board Credit Committee on Watch-listed borrowers with significantly large exposures demonstrating high rate of deterioration in credit quality Reporting quarterly to BIRMC on credit concentration risk positions with regard to regulatory limits such as single borrower and group exposure limits and internal advisory limits on industry sectors, large group borrowers, and selected geographical regions as well as exposure based on credit rating grades Reporting on top key risks to BIRMC and the Board Continuous contribution to effective financial reporting through loss ratio calculation, stage upgrades and involvement in Impairment Committee.
Credit risk mitigation		Borrower’s ability to pay is the primary source of recovery, whereas collateral acts as the secondary source in the event borrower’s cash inflow is impaired

Key credit risk measurement tools and reporting frequencies

The following credit risk measurement tools are being used in managing credit risk by the Bank and reported in the stipulated frequencies:

Credit risk measure/indicator		Frequency
Rating model validation results		Annually
Probability of default		Annually
LGD under Basel III and IFRS		Quarterly/Annually
Top and emerging risks under credit risk		Monthly
Credit portfolio analysis		Quarterly
Rating wise distribution across business segments		Quarterly
Summary of rating reviews including overridden ratings		Quarterly
Watch-listed clients		Monthly to the Senior Management and Quarterly to the Board
Summary of reviews done under Loan Reviews Mechanism		Quarterly

Dimensions for analysis and monitoring of credit concentration risk

Credit concentration risk measure/indicator		Frequency
Industry sector limits positions		Monthly/Quarterly
Top 20 borrower exposures		Quarterly
Top 20 borrower group exposures		Quarterly
Industry sector HHI*		Quarterly
Product distribution of the credit portfolio		Quarterly
Borrower distribution across rating grades		Quarterly
Collateral concentration		Quarterly

*The Herfindahl-Hirschman Index (HHI) is a measure of concentration, calculated by squaring the share of each sector and then summing up the resulting numbers

Market risk

Market risk is the possibility of losses arising from changes in the value of a financial instrument as a result of changes in market variables such as interest rates, exchange rates, equity prices, and commodity prices.

As a financial intermediary, the Bank is exposed primarily to the interest rate risk and as an authorised dealer, is exposed to exchange rate risk on foreign currency portfolio positions. Market risk could impact the Bank mainly in two ways: viz, loss of cash flows or loss of economic value. Market risk can be looked at in two dimensions; as traded market risk, which is associated with the trading book and non-traded market risk, which is associated with the banking book.

The ALCO oversees the management of both the traded and the non-traded market risks. The Treasury manages the foreign exchange risk with permitted hedging mechanisms. Trends in relevant local as well as international markets are analysed and reported by IRMD and the Treasury to ALCO and BIRMC. The market risks are controlled through various limits. These limits are stipulated by the Investment Policy, TMO Policy, Treasury Manual, and Overall Limits System of the Bank. Interest rate sensitivity analysis (Modified duration analysis), Value-at-Risk (VAR), simulation and scenario analysis, stress testing and marking-to-market of the positions are used as quantification tools for the purpose risk monitoring and management of market risks.

Treasury Middle Office (TMO) is segregated from the Treasury Front Office (TFO) and Treasury Back Office (TBO) and reports to the CRO. The role of the TMO includes the day-to-day operational function of monitoring and controlling risks assumed in the TFO based on clearly defined limits and controls. Being independent of the dealers, the TMO provides an objective view on front office activities and monitors the limits. TMO has the authority to escalate limit excesses as per delegation of authority to the relevant hierarchy.

Treasury implemented a new system in 2018. The new system has enhanced TMO’s capability to report crucial data with better accuracy and on real time basis. The strengthened Treasury and market risk management practices contribute positively to the overall risk rating of the Bank and efficiency in the overall Treasury operations. TBO which reports to the Chief Financial Officer is responsible for accounting, processing settlement and valuations of all Treasury products, and transactions. The Treasury transaction-related information is independently submitted by TBO to relevant authorities.

Interest rate risk

Interest rate risk can be termed as the risk of loss in the net interest income (earnings perspective) or the net worth (economic value perspective) due to adverse changes in the market interest rates. Interest rate risk can consist of –

• Repricing risk, which arises from the inherent mismatch between the Bank’s assets and liability resulting in repricing timing differences
• Basis risk, which arises from the imperfect correlation between different yield and cost benchmarks attached to repricing of assets and liabilities
• Yield curve risk, which arises from shifts in the yield curve that have a negative impact on the Bank’s earnings or asset values

The Bank manages its interest rate risks primarily through asset liability repricing gap analysis, which distributes interest rate sensitive asset and liability positions into several maturity buckets. Board defined limits are in place for interest rate gaps and positions, which are monitored on a periodic basis to ensure compliance to the prescribed limits.

The Asset and Liability Management (ALM) Unit routinely assesses the Bank’s asset and liability profile in terms of interest rate risk and the trends in costs and yields are reported to ALCO for necessary realignment in the asset and liability structure and the pricing mechanism. ALM performed a number of scenario analysis and simulations on the effect of interest rate changes to the Bank’s interest income during the year, to facilitate pricing decisions taken at ALCO.

Foreign exchange rate risk

Foreign exchange rate risk can be termed as possibility of adverse impact to the Group’s capital or earnings due to fluctuations in the market exchange rates. This risk arises due to holding of assets or liabilities in foreign currencies. Net Open Position (NOP) on foreign currency indicates the level of net foreign currency exposure that has been assumed by the Bank at a point of time. This figure represents the unhedged position of the Bank in all foreign currencies. The Bank accrues foreign currency exposure through purchase and sale of foreign currency from customers in its commercial banking and international trade business and through borrowing and lending in foreign currency.

The Bank manages the foreign exchange risk using a set of tools which includes limits for net unhedged exposures, hedging through forward contracts and hedging through creating offsetting foreign currency assets or liabilities. TMO monitors the end of the day NOP as calculated by the TBO and the NOP movement in relation to the spot movement. TMO also conducts VAR for daily forex Position and the NOP. Stress testing is also performed on a daily basis and reported by TMO. The daily inter bank foreign currency transactions are monitored for consistency with preset limits and any excesses are reported to the Management and to BIRMC.

DFCC Bank PLC has obtained approval from the Central Bank of Sri Lanka for its foreign currency borrowings and credit lines as per regulatory requirements. The unhedged foreign currency exposure of the Bank is closely monitored and necessary steps are taken to hedge in accordance with the market volatilities. In October 2013, the Bank issued a foreign currency international bond of USD 100 Mn with an original maturity of five years, which matured in October 2018. The Bank actively managed the exchange rate arising from a minor part of this transaction where a majority was hedged with the Central Bank. During the year the Bank put in place a plan after evaluating the options available for the repayment of the foreign currency bond which was settled successfully in October 2018.

Indirect exposures to commodity prices risk – Gold prices

The Bank’s pawning portfolio amounted to LKR 3,620 Mn as at 31 December 2019, which is less than 1% of total assets. The Market Risk Management Unit (MRMU) manages the risk emanating from Gold through constant analysis of the international and local market prices and adjusting the Bank’s preferred Loan to Value (LTV) ratio. MRMU also conducts stress testing for the Gold portfolio by forecasting adverse Loss Given Default and PD rates. Stress results are reported to Senior Management via ALCO and BIRMC.

Equity prices risk

Equity prices risk is the risk of losses in the marked-to-market equity portfolio, due to the decline in the market prices. The direct exposure to the equity price risk by the Bank arises from the equity portfolios classified as fair valued through profit and loss and other comprehensive income. Indirect exposure to equity price risk arises through the margin lending portfolio of the Bank in the event of crystallisation of margin borrower’s credit risk. The Investment Committee of the Bank is responsible for managing equity portfolio in line with the policies and the guidelines as set out by the Board and the BIRMC. Allocation of limits for equities taken as collateral for loans and margin trading activities of customers and for the Bank’s investment/trading portfolio forms part of the tools for managing the equity portfolio. Rigorous appraisal, proper market timing and close monitoring of the portfolio performance in relation to the market performance facilitate the management of the equity portfolio within the framework of investment strategy and the risk policy.

Liquidity risk

Liquidity risk is the risk of not having sufficient funds to meet financial obligations on time and in full, at a reasonable cost. Liquidity risk arises from mismatched maturities of assets and liabilities. The Bank has a well set out framework for liquidity risk management and contingency funding plan. The liquidity risk management process includes regular analysis and monitoring of the liquidity position by ALCO and maintenance of market accessibility. Regular cash flow forecasts, liquidity ratios and maturity gap analysis are used as analytical tools by the ALCO. Any negative mismatches up to the immediate three months revealed through cash flow gap statements are matched against cash availability either through incremental deposits or committed lines of credit. Whilst meeting the regulatory requirements relating to liquidity, for internal monitoring purposes, the Bank takes into consideration the liquidity of each eligible instrument relating to the market at a given point in time as well as undrawn commitments to borrowers when stress testing its liquidity position.

The maintenance of a strong credit rating and reputation in the market enables the Bank to access domestic wholesale funds. For short-term liquidity support the Bank also has access to the money market at competitive rates. In line with the long-term project financing business, the Bank focuses on long-term funding through dedicated credit lines while its growing share of commercial banking business focuses on Current Accounts and Savings Accounts (CASA) and Term Deposits as the key source of funding for its lending. The structure and procedures for Asset and Liability Management at the Bank have been clearly set out in the Board approved ALCO Charter, which is reviewed on an annual basis.

The CBSL Direction No. 07 of 2011 specifies that liquidity can be measured through stock or flow approaches. Under the stock approach, liquidity is measured in terms of key ratios which portray the liquidity in the balance sheet. Under the flow approach banks should prepare a statement of maturities of assets and liabilities placing all cash inflows and outflows in the time bands according to their residual time to maturity in major currencies. The Bank has adopted both methods in combination to assess liquidity risk.

Operational risk

Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people, systems, and external events. It covers a wide area ranging from losses arising from fraudulent activities, unauthorised trade or account activities, human errors, omissions, inefficiencies in reporting, technology failures or from external events such as natural disasters, terrorism, theft, or even political instability. The objective of the Bank is to manage, control and mitigate operational risk in a cost effective manner consistent with the Bank’s risk appetite. The Bank has ensured an escalated level of rigour in operational risk management approaches for sensitive areas of its operations.

The Operational Risk Management Committee (ORMC) oversees and directs the management of operational risk of the Bank at an operational level with facilitation from the Operational Risk Management Unit (ORMU) of the IRMD. Active representation of the relevant departments and units of the Bank has been ensured in the process of operational risk management through the Operational Risk Coordination Officers (ORCOs).

Segregation of duties with demarcated authority limits, internal and external audit, strict monitoring facilitated by the technology platform and back-up facilities for information are the fundamental tools of operational risk management. Audit findings of high risk nature and management responses are forwarded to the Board’s Audit Subcommittee for their examination. Effective internal control systems, supervision by the Board, Senior Management and the line managers form part of the First Line of Defence for operational risk management at the Bank. The Bank demands application of high level of technical skills, professionalism and ethical conduct from its staff and these serve as insulators for many operational risk factors.

The following are other key aspects of the operational risk management process at DFCC Bank PLC:

• Monitoring of Risk and Control Self Assessment (RCSA) and Key Risk Indicators (KRIs) for the functions under defined threshold limits using a “Traffic Light” system
• Maintaining internal operational risk incident reporting system and carrying out an independent analysis of the incidents by IRMD to recognise necessary improvements in the systems, processes, and procedures
• Trend analysis on operational risk incidents and review at the ORMC
• Review of downtime of the critical systems and assessment of the reasons. The risk and business impact is evaluated. Rectification measures are introduced whenever the tolerance levels are compromised
• Review of HR attrition and exit interview comments in detail including a trend analysis with the involvement of the IRMD. The key findings of the analysis are evaluated at the ORMC in an operational risk perspective
• Establishment of the Bank’s complaint management process under the Board Approved Complaints Management Policy. IRMD analyses the complaints received to identify any systemic issues and reports to ORMC
• Conduct product and process reviews in order to identify the operational risks and recommend changes to the products and related processes
• Evaluate the operational risks associated with any new product developments
• Maintaining an external loss database in order to take proactive action to mitigate operational risks that may arise from the external environment
• Assist in the Business Continuity Planning and Disaster Recovery (DR) processes and review the results of DR drills conducted in the Bank to provide recommendations for future improvements
• Conduct Fraud Risk Management Committee meetings periodically in order to identify potential fraud risks that might impact the Bank and to take timely remedial actions

Operational risk reporting
Risk identification		Risk assessment		Risk monitoring and controlling
Risk and Control Self-Assessments (RCSA) Operational risk incident analysis (internal and external) Risk analysis of products/services Analysis of customer complaints		Evaluation of risks against the controls through RCSA Key Risk Indicators (KRIs) Incident assessment and escalation (internal and external) Stress testing		Action plans based on incident analysis, RCSA and KRI Insurance Business Continuity Plan and periodic testing
Culture and awareness
Policies and guidelines

Operational risk losses

The Bank has improved its operational risk incident reporting system overtime by creating an increased level of awareness among the employees with regard to operational risks and the importance of incident reporting. A total of 135 incidents have been reported in 2019. The Bank has in place a well streamlined process of reporting and employees are continuously encouraged via training to report incidents as and when they happen. The Operational Risk Coordination Officers (ORCO) are also expected to send a monthly report to the Operational Risk Management Unit regarding operational risk related incidents if any taken place at their respective branches or departments. The operational risk incidents reported in 2019 based on the event type are categorised below:

The majority of the incidents reported were as a result of a failure in the execution, delivery and process management, and they included near misses and no losses. However, the actual losses resulting from the operational risk events have been very marginal and there have been no significant losses incurred as a result of the existing stringent controls that are in place.

Risk and Control Self Assessments (RCSA) and Key Risk Indicators (KRIs) process of the Bank

Monitoring of Risk and Control Self Assessments (RCSA) and Key Risk Indicators (KRIs) in key functions of the Bank, was further strengthened during the year as a measure to allow the early detection of operational risks before actual failure occurs.

RCSA requires self-evaluation of operational risk exposures of processes in the Bank by respective departments semi-annually. Each department will assess the risks based on impact and likelihood of occurrence, while controls are assessed based on control design and control performance. The results are evaluated at ORMC for additional controls or mitigants in order to minimise risk exposure to the Bank.

Regular KRI monitoring, assists business line managers by providing them with a quantitative, verifiable risk measurement which will be evaluated against the thresholds. A summary of KRIs is presented to ORMC based on a traffic light system.

Insurance as a risk mitigant

Insurance policies are obtained to transfer the risk of low frequency and high severity losses which may occur as a result of events such as fire, theft/frauds, natural disasters, errors and omissions. Insurance plays a key role as an operational risk mitigant in banking context due to the financial impact that any single event could trigger.

Insurance policies in force covering losses arising from undermentioned assets/processes include –

• Cash and cash equivalents
• Pawned articles
• Premises and other fixed assets
• Public liability
• Employee infidelity
• Negligence
• Personal accidents and workmen’s compensation

The Insurance Unit of the Bank reviews the adequacy and effectiveness of insurance covers on an annual basis and carries out comprehensive discussions with insurance companies on any revisions required at the time of renewal of the insurance covers.

Outsourcing of business functions

Outsourcing takes place when the Bank uses another party to perform non-core banking functions that would traditionally have been undertaken by the Bank itself. As a result, the Bank will be benefited in focusing on its core banking activities while having the non-core functions being taken up by outside experts.

The Bank has outsourced some business functions under its outsourcing policy after evaluating whether the services are suitable for outsourcing based on an assessment of the risks involved. Further, undertaking due diligence tests on the companies concerned such as credibility and ability of the owners, BCP arrangements, technical and skilled manpower capability and financial strength. Cash transportation, archival of documents, certain IT operations, security services, and selected recovery functions are some of the outsourced activities of the Bank. The Bank is concerned and committed in ensuring that the outsourced parties continue to uphold and extend the high standard of customer care and service excellence.

A comprehensive report on outsourced activities is periodically submitted to the CBSL for their review while adhering to Banking Direction on Outsourcing of Business Operations.

Key operational risk measurement tools and reporting frequencies

Operational Risk Measure/Indicator		Frequency
Operational risk incidents reported during the period (External and internal)		Quarterly
Risk and control self assessments and key risk indicators		Semi-annually
Status and reports of any BCP/DR activities undertaken		As required
Customer complaints during the period		Quarterly
System and ATM downtime reports		Quarterly

Management of Information Systems Security (ISS) risk under IRMD

Management of Information Systems Security (ISS) risk under IRMD Information security risk management (ISRM) is the process of managing the risks associated with the use of information technology and evaluate risks to the confidentiality, integrity and availability (CIA) of Bank’s information assets.

Main objectives of ISRM is to ensure compliance with regulatory and contractual requirements while adopting industry security best practices and align information security risk management with corporate risk management objectives.

ISRM is an ongoing process of identifying, assessing, and responding to security risks. To manage risks effectively, Bank has adopted international security standard requirements such as ISO 27001:2013 and PCI-DSS while being compliant with Central Bank’s Baseline Security Standard (BSS) and Payment related mobile application security guidelines.

Bank considers its customer information as a priceless asset and keeps on improving its data governance processes factoring current cyber security threats and security best practices.

During last year, the Bank undertook an initiative to improve the security of digital data by adopting a new data classification framework with the support from an external information security consultancy firm and completed the deployment for all business units. Further, the same process is being deployed to the branch network within 2020.

Bank extended it’s early detection capability to secondary data center by implementing an AI based malicious traffic analysis solution which improved the overall process of security event and incident detection. Also, to improve the quality of the existing information security program, Bank invested on a new computer based interactive training module for cyber security which supports enhancing cyber security knowledge of Bank employees and helps them to adopt best practices when functioning business as usual.

Bank’s current ISRM strategy focuses on following activities:

• Establish and manage the Information Security Management System (ISMS) based on ISO 27001:2013 and PCI Data Security Standards.
• Development of information security policies, procedures and guidelines according to information security standards.
• Identification of security risks related to the Bank’s information assets and propose security controls to maintain residual risks at acceptable levels.
• Management of information security incidents and periodic information security risk assessments.
• Set and monitor information security KPIs and report the status of the indicators to the Operational Risk Management Committee
• Perform trend analysis on information security incidents and reporting, which are regularly reviewed at the ORMC and the BIRMC.
• Conduct internal vulnerability assessment and penetration testing covering IT infrastructure on defined time intervals to ensure known vulnerabilities are properly managed.
• Ensure adequate information security awareness is given to staff members to follow security best practices and detect and report information security events and incidents.

The established information security management system provides a systematic approach to managing sensitive company information by covering all aspects including people, processes, technology and information systems.

Reputational risk

Reputational risk is the risk of losing public trust or tarnishing of the Bank’s image in the public eye. It could arise from environmental, social, regulatory, or operational risk factors. Events that could lead to reputational risk are closely monitored, utilising an early warning system that includes inputs from frontline staff, media reports, and internal and external market survey results. Though all policies and standards relating to the conduct of the Bank’s business have been promulgated through internal communication and training, a specific policy was established to take action in case of an event which hinders the reputation. The Bank has zero tolerance for knowingly engaging in any business, activity, or association where foreseeable reputational damage has not been considered and mitigated. While there is a level of risk in every aspect of business activity, appropriate consideration of potential harm to the Bank’s good name is a part of all business decisions. The complaint management process and the whistle blowing process of the Bank include a set of key tools to recognise and manage reputational risk. Based on the operational risk incidents, any risks which could lead to reputational damage are presented to the Board and suitable measures are taken by the Bank to mitigate and control such risks.

Business risk

Business risk is the risk of deterioration in earnings due to the loss of market share, changes in the cost structure and adverse changes in industry or macroeconomic conditions. The Bank’s medium-term strategic plan and annual business plan form a strategic road map for sustainable growth. Continuous competitor and customer analysis and monitoring of the macroeconomic environment enables the Bank to formulate its strategies for growth and business risk management. Processes such as Planning, ALM, IT and Product Development in collaboration with business functions facilitate the management of business risk through recognition, measurement, and implementation of tasks. Business risk relating to customers is assessed in the credit rating process and is priced accordingly.

Legal risk

Legal risk arises from unenforceable transactions in a court of law or the failure to successfully defend legal action instituted against the Bank. Legal risk management commences from prior analysis, and a thorough understanding of, and adherence to related legislation by the staff. Necessary precautions are taken at the design stage of transactions to minimise legal risk exposure.

In the event of a legal risk factor, the Legal Unit of the Bank takes immediate action to address and mitigate these risks. External legal advice is obtained or counsel retained when required.

Compliance risk

Compliance from a banking perspective can be defined as acting in accordance of a law, rule, regulation or a standard. Basel Committee on Banking Supervision in 2005 defines “compliance risk” as “the risk of legal or regulatory sanctions, material financial loss, or loss to reputation a bank may suffer as a result of its failure to comply with laws, regulations, rules related self regulatory organisation standards, and Codes of Conduct applicable to its banking activities”.

Bank’s governing principles on compliance are to: Ensure compliance starts from top, to emphasise standards of honesty and integrity and hold itself to high standards when carrying on business, at all times strive to observe the spirit as well as the letter of the law. Further it sets compliance as an integral part of the Bank’s business activities and part of the culture of the Organisation and at all times will be observing proper standards of market conduct, managing conflicts of interest, treating customers fairly, and ensuring the suitability of customer advice.

Bank’s Board of Directors is responsible for overseeing the management of the Bank’s compliance risk. Towards this; Board has delegated its powers to the Board Integrated Risk Management Committee which takes appropriate action to establish a permanent, independent and effective compliance function in the Bank, ensure that compliance issues are resolved effectively and expeditiously by Senior Management of the Bank with the assistance of the compliance function and assess the extent to which the Bank is managing its compliance risk effectively.

The Bank’s Corporate/Senior Management is responsible for the effective management of the Bank’s compliance risk and an independent robust compliance culture has been established within the Bank with processes and work flows designed with the required checks and balances to facilitate compliance. The compliance function works closely with the business and operational units to ensure consistent management of compliance risk.

Scope of the Compliance Function encompasses legislative enactments; rules, regulations, directions, determinations, operating instructions, circulars issued by regulators; Bank’s internal policies, circulars, guidelines; Industry best practices and standards issued by professional bodies; and International regulations. In order to manage the compliance risk of the Bank, Compliance Function on a proactive basis, identifies, documents and assesses the compliance risks associated with the Bank’s business activities, including the development of new products and business practices. It has set in place, a Compliance Programme based on a risk-based approach to be carried out under a set of scheduled activities annually, that consists of, compliance testing, branch visits, verification of returns, developing and reviewing compliance KRIs and methodologies, ensuring of timely submission of regulatory returns, clarifications of regulatory circulars, reporting to Board and/or Subcommittee and educating staff on compliance matters, conducting Bank wide compliance training. It also manages and ensures information accuracy of the Data submitted to the Credit Information Bureau of Sri Lanka.

One of the critical functions of the compliance is to manage and assess the Bank’s Anti-money Laundering and Counter Financing Terrorism compliance, so as to ensure the compliance to international recommendations of the Financial Action Task Force as well as domestic legislative enactments. Board of Directors, Senior Management and all staff take serious note on the AML/CFT compliance and on-going basis develop, review and improve policies, procedures, systems towards minimising the AML risk and thereby avoid reputation risk.

Business continuity management

The Business Continuity Plan (BCP) of the Bank ensures timely recovery of critical operations that are required to meet stakeholder needs based on identified disruptions categorised into various severity levels. BCP has been designed to minimise risk to human and other resources and to enable the resumption of critical operations within reasonable time frames specified according to Recovery Time Objectives (RTOs) with minimum disruption to customer services and payment and settlement systems. The Disaster Recovery (DR) site, which is located in a suburb of Colombo is used for periodic testing drills. These DR drills are subject to independent validation by the Internal Audit Department. A report on the effectiveness of the drill is submitted to the BIRMC/Board and also to the Central Bank with the observations. Learnings and improvements to disaster recovery activities are discussed and implemented through the ORMC and BIRMC. Training is carried out to ensure that employees are fully aware of their role within the BCP.

Stress testing of key risks

DFCC Bank PLC has been conducting stress testing on a regular basis. The Bank has in place, a comprehensive Stress Testing Policy and Framework, which is in line with the regulatory guidelines as well as international best practices. The Policy describes the purpose of stress testing and governance structure and the methodology for formulating stress tests, whilst the framework specifies in detail the Stress Testing Programme including the stress tests, frequencies, assumptions, tolerance limits and remedial action.

Stress testing and scenario analysis have played a major role in the Bank’s risk mitigation efforts. Stress testing has provided a dynamic platform to assess, “What If” scenarios and to provide the Bank with an assessment on areas to improve. The Bank covers a wide range of stress tests that checks the resilience of the Bank’s capital, liquidity, profitability, etc.

The outcome of stress testing process is monitored carefully and remedial actions taken and used by the Bank as a tool to supplement other risk management approaches.

The details of stress tests carried out by the Bank as at 31 December 2019 are given below:

Risk area and methodologies adopted		Results
Credit and concentration risk
Impact of increase in the Non-Performing Assets (NPAs) Impact to the Bank due to fall in value of collaterals of NPA Sector concentration, concentration of credit ratings, concentration of products, concentration of borrowers such as the top 10 clients Capital Adequacy Ratios (CAR) was stressed to see if the ratio falls below the regulatory level Additional capital was computed for all extreme concentration risks and was reported to Senior Management		The CAR remained above the minimum regulatory limit even under stressed conditions
Market risk
Stress testing and VAR calculations of currency exposure Stress testing and VAR calculations for equity portfolio Change of interest rates and its effect on Bank’s profitability and capital		VAR on currency exposure and equity portfolio were within the Bank’s acceptable risk matrices Change of interest rates did not affect the Capital of the Bank significantly
Operational risk
Stress on Bank’s Capital against increase of possible operational losses		No significant effect on capital and is well within the Bank’s risk absorption capability
Liquidity risk
Stress on liquidity due to settlement risk, decline in collections, and bulk deposit redemption Stress on liquid assets ratio due to run on liabilities Erosion of deposits due to sudden reputation risk and associated liquidity risks		Liquid asset ratio was maintained above 20% at low level of shock while slightly falls below at medium level of shock. At high level of shock the ratio can fall below 20%, which is extreme and highly unlikely
Multifactor stress testing
Combined stress of all risks		Except for the worst case scenario, the regulatory capital was not breached. The worst case scenario is an extreme scenario where all types of risks will emerge under extreme conditions at the same time

The findings of the Bank’s stress testing activities are an input into several processes including capital computation under Internal Capital Adequacy Assessment Process (ICAAP), strategic planning and risk management among others. As an integral part of ICAAP under Pillar II, stress testing is used to evaluate the sensitivity of the current and forward risk profile relative to the stress levels which are defined as low, moderate and high in the Stress Testing Policy. The resultant impact on the capital through these stress tests is carefully analysed and the BIRMC conducts regular reviews of the stress testing outcomes including the major assumptions that underpin them.

As it provides a broader view of all risks borne by the Bank in relation to its Risk tolerance and strategy in a hypothetical stress situation, stress testing has become an effective communication tool to Senior Management, Risk owners and risk managers as well as supervisors and regulators. The results of the stress testing are reported to the BIRMC and the Board on a quarterly basis for appropriate and proactive decision-making.

Risk capital position and financial flexibility

The Bank adopts a proactive approach to ensure satisfactory risk capital level throughout its operations. In line with its historical practice and the capital targets, the Bank aims to maintain its risk capital position above the regulatory minimum requirements for Tier I and total capital under Basel guidelines.

As at 31 December 2019, DFCC Bank PLC maintained a healthy risk capital position of 11.342% Tier I capital ratio and 15.810% total capital ratio based on the Basel III regulatory guidelines. This demonstrates a cushion of about 2.8% and 3.3%, respectively, for Tier I and total capital over the minimum regulatory requirements.

Capital adequacy measures the adequacy of the Bank’s aggregate capital in relation to the risk it assumes. The capital adequacy of the Bank has been computed under the following approaches of the Basel regulations which are currently effective in the local banking industry:

• Standardised approach for credit risk
• Standardised approach for market risk
• Basic Indicator approach for operational risk

The graph below shows the Bank’s capital allocation and available capital buffer as at 31 December 2019, based on the quantified risk as per the applicable regulatory guidelines. Out of the regulatory risk capital (total capital) available as at 31 December, capital allocation for credit risk is 70.6% of the total capital while the available capital buffer is 20.9%.

Capital adequacy management

BASEL III is the new global regulatory standard on managing capital and liquidity of banks which is currently in effect. With the introduction of BASEL III from mid 2017, the capital requirements of banks have increased with an aim to raise the quality, quantity, consistency and transparency of capital base and improve the loss absorbing capacity.

Additionally, the Pillar II (Supervisory Review Process – SRP) under the Basel regulations requires banks to implement an internal process, called the Internal Capital Adequacy Assessment Process (ICAAP), for assessing capital adequacy in relation to the risk profiles as well as a strategy for maintaining capital levels. The Bank has in place an ICAAP, which has strengthened the risk management practices and capital planning process. It focuses on formulating a mechanism to assess the Bank’s capital requirements covering all relevant risks and stress conditions in a futuristic perspective in line with the level of assumed risk exposures through its business operations. The ICAAP formulates the Bank’s capital targets, capital management objectives and capital augmentation plans.

The ICAAP of DFCC Bank PLC demonstrates that the Bank has implemented methods and procedures to capture all material risks and adequate capital is available to cover such risks. This document integrates Pillar I and Pillar II processes of the Bank wherein Pillar I deals with regulatory capital, primarily covering credit, market and operational risks whilst Pillar II deals with economic capital involving all other types of risks.

As per the direction issued by CBSL, under supervisory review of Basel III, CBSL encourages banks to enhance their risk management framework and manage emerging risks in a more proactive manner. This is to ensure that the Bank maintains adequate capital buffer in case of a crisis while more importance has been placed on Pillar II and ICAAP. The Bank uses a mix of quantitative and qualitative assessment methods to measure Pillar II risks. A quantitative assessment approach is used for concentration risk, liquidity risk, and interest rate risk whilst qualitative approaches are used to assess the risks such as reputational risk and strategic risk.

The Senior Management team is closely involved in formulating risk strategy and governance, thereby considering the Bank’s capital planning objectives under the strategic planning process. Capital forecasting for the next three years covering envisaged business projections is considered in the budgeting process. This forward-looking capital planning helps the Bank to be ready with additional capital requirements in the future. It integrates strategic plans and risk management plans with the capital plan in a meaningful manner with inputs from Senior Management, Management Committees, Board Committees and the Board.

The Banking Act Direction No. 01 of 2016 introduced capital requirements under Basel III for Licensed Commercial Banks, commencing from 1 July 2017 with specified timelines to increase minimum capital ratios to be fully implemented by 1 January 2019. The capital forecast performed under the ICAAP process has indicated the ability of the Bank to maintain a comfortable level of capital cushion in the next few years, while proposing suitable capital augmentation plans. As recommended by Bank’s ICAAP to enhance Tier I capital, the Bank during 2019 raised LKR 2.8 Bn equity capital through a right issue.