Interest Rate Risk Management - Guideline (2019)

Note

Implementation date for DSIBs is January 1, 2020 and for non-DSIBs is January 1, 2021.

In 2016, the Basel Committee on Banking Supervision (BCBS) released its revised Interest rate risk in the banking book standard. This document updated the guidance issued in 2004 (Principles for the management and supervision of interest rate risk) to reflect changes in market and supervisory practices to be used by institutions for identifying, measuring, managing, monitoring and controlling interest rate risk in the banking book (IRRBB).

Interest rate risk is an important risk that can affect the safety and soundness of financial institutions. OSFI believes that a control framework that manages this risk to prudent levels is a fundamental component of sound banking practice. This guideline outlines OSFI's expectations regarding an institution's management of IRRBB. It applies to banks, bank holding companies, federally regulated trust and loan companies, collectively referred to as "institutions".

1. Introduction

IRRBB refers to the current or prospective risk to an institution's capital and earnings arising from adverse movements in interest rates that affect the institution's banking book positions. When interest rates change, the present value and timing of future cash flows change. Such changes will affect the underlying value of an institution's assets, liabilities and/or off-balance sheet items and, hence, its economic value. Changes in interest rates also affect an institution's earnings by altering interest rate-sensitive income and expenses, affecting its net interest income (NII).

Excessive IRRBB can pose a significant threat to an institution's current capital base and/or its future earnings if not managed appropriately.

Scope of Application

This guideline applies to all institutions on a consolidated basis. OSFI's application of this guideline will be commensurate with each institution's nature, size, business and complexity as well as its structure, economic significance and risk profile.

When reviewing an institution's compliance with this guideline, OSFI will consider the following criteria:

• The level of inherent IRRBB at the institution;
• The complexity of an institution's business lines, products and services; and
• The size of an institution, taking into consideration on and off-balance sheet exposures as well as income statement metrics (e.g. earnings) and potential organizational structural limitations due to an institution's size.

To the extent possible, OSFI will apply consistent expectations across institutions with similar characteristics based on the above criteria. OSFI will assess an institution's adherence to this guideline based on the principles set out below. OSFI recognises that there are a range of acceptable practices to effectively manage IRRBB.

Definitions

This guideline considers three main sub-types of IRRBB:

1. Gap risk - arises from the term structure of banking book^{Footnote 1} instruments, and describes the risk arising from the timing of instruments' rate changes. The extent of gap risk depends on whether changes to the term structure of interest rates occur consistently across the yield curve (parallel risk) or differentially by period (non-parallel risk).
2. Basis risk - describes the impact of relative changes in interest rates for financial instruments that have similar tenors but are priced using different interest rate indices.
3. Option risk - arises from option derivative positions or from optional elements embedded in an institution's assets, liabilities and/or off-balance sheet items, where the institution or its customer can alter the level and timing of their cash flows. Option risk can be further characterised into automatic option risk and behavioural option risk.

Each of these sub-types can change the price/value or earnings/costs of interest rate-sensitive assets, liabilities and/or off-balance sheet items in a way, or at a time, that can adversely affect an institution's financial condition.

Credit spread risk in the banking book

While the three sub-types listed above are directly linked to IRRBB, credit spread risk in the banking book (CSRBB) is a related risk that institutions need to monitor and assess as part of their interest rate risk management framework. CSRBB refers to any kind of asset/liability spread risk of credit-risky instruments that is not explained by IRRBB and by the expected credit/jump to default risk.

Economic value and earnings-based measures

While the economic value and earnings-based measures share certain characteristics, institutions primarily utilise the latter for IRRBB management, whereas economic value provides a suitable benchmark for comparability and capital adequacy. If an institution were to solely minimize its economic value risk by matching the repricing of its assets with liabilities beyond the short term, it could run the risk of earnings volatility. Likewise, management decisions to optimize short-term NII fluctuations could be structurally unviable when evaluated on a longer horizon. Consequently, OSFI acknowledges the importance of managing IRRBB through both economic value and earnings-based measures, as stated under OSFI Principle #4 below.

2. Overriding Principle of IRRBB

OSFI Principle #1 (BCBS Principle #1^{Footnote 2}): IRRBB is an important risk for all institutions that should be specifically identified, measured, monitored and controlled. In addition, institutions should monitor and assess CSRBB.

OSFI believes that IRRBB is a significant risk that arises from banking activities of all institutions. IRRBB arises due to interest rate variability over time, while the business of banking typically involves intermediation activity that produces exposures to both maturity mismatch (e.g., long-maturity assets funded by short-maturity liabilities) and rate mismatch (e.g., fixed rate loans funded by variable rate deposits). In addition, there are optionalities embedded in many of the common banking products (e.g., non-maturity deposits, term deposits, fixed rate loans and mortgage commitments) that may or may not be triggered as a result of changes in interest rates.

OSFI expects all institutions to be familiar with all potentially material elements of IRRBB, to actively identify their IRRBB exposures and to take appropriate steps to measure, monitor and control IRRBB.

Institutions should identify the interest rate risks inherent in their banking book products and activities undertaken, and ensure that these are subject to adequate procedures and controls. Significant hedging or risk management initiatives should be approved by appropriate committees before being implemented. Products and activities that are new to an institution should undergo a careful pre-acquisition review to ensure that the IRRBB characteristics and model risks are well understood and subject to a predetermined test phase before being fully rolled out. Prior to introducing a new product, hedging or risk-taking strategy, institutions should have in place appropriate operational procedures and risk control systems. The management of an institution's IRRBB should be integrated within its broader risk management framework and aligned with its business planning and budgeting activities.

In identifying, measuring, monitoring and controlling IRRBB, institutions should also ensure that, where appropriate, and taking into account the scope of application of this guideline, CSRBB is properly monitored and assessed^{Footnote 3}.

OSFI believes that the allocation of capital to risk is an integral component of sound IRRBB management. In the case of larger institutions^{Footnote 4}, OSFI expects that IRRBB management and IRRBB risk will be transferred to centre(s) of expertise, with risk capital and associated profit and loss being allocated and measured accordingly. As part of this centralization process, larger institutions should utilize an appropriate funds transfer pricing (FTP) mechanism to manage this transfer. Additionally, these institutions should have a Senior Management Committee to oversee this FTP process. The committee should include representatives from all major business lines as well as from the relevant control functions and treasury. Smaller institutions with low IRRBB profile may be able to incorporate simplified methods for FTP framework design and oversight.

3. Governance and Risk Appetite^{Footnote 5}

OSFI Principle #2 (BCBS Principle #2): Institutions are responsible for oversight of the IRRBB management framework, and the institution's risk appetite for IRRBB. Monitoring and management of IRRBB should be undertaken by Senior Management or its delegates. Institutions should have an adequate IRRBB management framework, involving regular independent reviews and evaluations of the effectiveness of the system.

Risk management framework

Senior Management is responsible for understanding the nature and the level of the institution's IRRBB exposure as well as overall policies with respect to IRRBB. It should ensure that there is clear guidance regarding the acceptable level of IRRBB, given the institution's business strategies.

Accordingly, Senior Management is responsible for ensuring that the institution identifies, measures, monitors and controls IRRBB consistent with the approved strategies and policies. More specifically, Senior Management is responsible for setting:

• appropriate limits on IRRBB, including the definition of specific procedures and approvals necessary for exceptions, and ensuring compliance with those limits;
• adequate systems for measuring IRRBB;
• standards for measuring IRRBB, valuing positions and assessing performance, including procedures for updating interest rate shock and stress scenarios and key underlying assumptions driving the institution's IRRBB analysis;
• a comprehensive IRRBB reporting and review process; and
• effective internal controls and management information systems (MIS).

Senior Management should oversee the approval, implementation and review of IRRBB management policies, procedures and limits. Senior Management should receive and review regular reports (at least monthly) on the level and trend of the institution's IRRBB exposures. The reporting should be sufficiently detailed to allow Senior Management to understand and assess the performance of its delegates in monitoring and controlling IRRBB in compliance with approved policies. OSFI expects that such reviews will be carried out more frequently when the institution has significant IRRBB exposures or has positions in complex IRRBB instruments.

Senior Management should understand the implications of the institution's IRRBB strategies, including the potential linkages with and impact on market, liquidity, credit and operational risk. OSFI expects Senior Management members to have sufficient technical knowledge to question and challenge the reports, to be responsible for ensuring that delegated staff has the capability and skills to understand IRRBB, and to ensure that adequate resources are devoted to IRRBB management. OSFI believes that institutions should have an integrated view of IRRBB. As such, OSFI expects Senior Management to understand IRRBB management methodologies and to encourage discussion between the risk management control function(s) and position-taking operations.

Delegation

Senior Management may delegate the task for developing IRRBB policies and practices to expert individuals or to an asset and liability management committee (ALCO)^{Footnote 6}. In the case of an ALCO, it should meet at a minimum quarterly and include representatives from each major department connected to IRRBB.

Senior Management should clearly identify its delegates for managing IRRBB and, to avoid potential conflicts of interest, should strive for adequate separation of responsibilities in key elements of the risk management process. Institutions should have IRRBB identification, measurement, monitoring and control functions with clearly defined responsibilities. Risk Management (i.e. the second line of defence^{Footnote 7}) should provide sufficient independent oversight of the Treasury function and report IRRBB exposures directly to Senior Management or its delegates. The level of reporting should reflect the institution's nature, size, business, complexity and risk profile.

Delegates of Senior Management, who are responsible for managing IRRBB, should include individuals with clear lines of authority over the units responsible for establishing and managing positions. There should be a clear communication channel to convey the delegates' directives to these line units.

Senior Management should ensure that the institution's organisational structure enables its delegates to carry out their responsibilities, and facilitates effective decision-making and good governance. The risk management and strategic planning areas of the institution should also communicate regularly to facilitate evaluations of risk arising from future business.

OSFI also expects domestic systemically important banks (D-SIBs) to establish a committee to oversee asset liability management. Such committees would be responsible for managing and vetting the strategic direction of IRRBB (such as positions and policies) within the institution. To the extent that risk management personnel form part of this committee, they are expected to be an impartial observer(s) under normal operating conditions and thus not participate in tactical decisions regarding IRRBB position taking.

Internal controls

Institutions should have adequate internal controls to ensure the integrity of their IRRBB management process and compliance with institution policies. The internal controls should promote effective and efficient operations, reliable financial and regulatory reporting, and compliance with relevant laws and regulations.

With regard to IRRBB control policies and procedures, institutions should have appropriate approval processes, exposure limits, reviews and other mechanisms designed to provide a reasonable assurance that risk management objectives are being achieved.

In addition, institutions should have suitable routines for ongoing and independent evaluations and reviews of their internal control system and risk management processes. This includes certifying that personnel comply with established policies and procedures. Such reviews should address any recent significant changes that impact the effectiveness of controls (including changes in market conditions, personnel, technology and structures of compliance with exposure limits), and confirm that escalation procedures for any exceeded limits remain appropriate. All such evaluations and reviews should be conducted by individuals and/or units that are independent of the function they are assigned to review. When revisions or enhancements to internal controls are warranted, institutions should have internal review mechanisms in place to promote timely implementation.

OSFI expects institutions to maintain an adequate degree of impartial oversight over treasury operations. OSFI recognizes that treasury operations in a number of institutions report to finance or another independent control function. In those cases, the institution's management should consider establishing mitigating controls to maintain impartial oversight over treasury operations.

Institutions' IRRBB identification, measurement, monitoring and control processes should be reviewed by an independent auditing function (such as an internal or external auditor) on a regular basis. In such cases, reports written by internal/external auditors or other equivalent external parties (such as consultants) should be made available to OSFI upon request.

OSFI Principle #3 (BCBS Principle #3): An institution's risk appetite for IRRBB should be articulated in terms of the risk to both economic value and earnings. Institutions should implement policy limits that target maintaining IRRBB exposures consistent with their risk appetite.

Institutions should have clearly defined risk appetite statements^{Footnote 8} implemented through comprehensive risk appetite frameworks, i.e., policies and procedures for limiting and controlling IRRBB. The risk appetite framework should delineate delegated powers, lines of responsibility and accountability over IRRBB management decisions and should clearly define authorised instruments, hedging strategies and risk-taking opportunities. All IRRBB policies should be reviewed periodically (at least annually) and revised as needed.

Policy limits

Policy limits should be appropriate to the nature, size, complexity and capital adequacy of the institution, as well as its ability to measure and manage its risks.

Policy limits should be consistent with the institution's overall approach for measuring IRRBB. Aggregate risk limits, clearly articulating the appropriate amount of IRRBB, should be applied on a consolidated basis and, as appropriate, at the level of individual affiliates. Limits may be associated with specific scenarios of changes in interest rates and/or term structures, such as an increase or decrease of a particular size or a change in shape, and for different currencies. The interest rate movements used in developing these limits should represent meaningful shock and stress situations, taking into account historical interest rate volatility and the time required by management to mitigate those risk exposures (i.e., reflective of the institution's prospective expectations of interest rate volatility and calibrated to historic utilization levels). Material fluctuations in volatility could result in breaches of the limits.

Depending on the nature of an institution's activities and business model, sub-limits may also be identified for individual business units, portfolios, instrument types or specific instruments. The granularity of risk limits should reflect the characteristics of the institution's holdings, including the various sources of the institution's IRRBB exposures. Institutions with significant exposures to gap risk or basis risk or having positions with explicit or embedded options should establish risk tolerances appropriate for these risks.

Senior Management should approve any major hedging or risk-taking initiatives in advance of implementation.^{Footnote 9} Institutions should develop a dedicated set of risk limits and triggers to monitor the evolution of hedging strategies involving derivatives, and to control mark-to-market risks in instruments that are accounted for at market value. Proposals to use new instrument types or new strategies (including hedging) should be assessed to verify activities are in line with the institution's overall risk appetite. Procedures should be established to identify, measure, monitor and control applicable risks.

Limits could be absolute in the sense that they should never be exceeded or they may be set so that, under specific circumstances, breaches of limits can be tolerated for a predetermined short period of time. There should be systems in place to promptly escalate any positions that exceed, or are likely to exceed, hard limits defined by Senior Management. There should be a clear policy on who will be informed, how the communication will take place and the actions to be taken in response to an exception.

4. Measurement, assumptions, systems integrity and model governance

OSFI Principle #4 (BCBS Principle #4): Measurement of IRRBB should be based on outcomes of both economic value and earnings-based measures, arising from a wide and appropriate range of interest rate shock and stress scenarios.

Economic value and earnings-based measures

Institutions' internal measurement systems (IMS) should capture all material sources of IRRBB and assess the effect of market changes on the scope of their activities. In addition to the impact of an interest rate shock on its economic value, an institution's policy approach should consider its ability to generate stable earnings sufficient to maintain its normal business operations.

For risk management purposes, institutions should pay attention to the complementary nature of economic value and earnings-based measures in their risk and internal capital assessments, in particular in terms of:

• outcomes: economic value measures compute a change in the net present value of the institution's assets, liabilities and off-balance sheet items subject to specific interest rate shock and stress scenarios, while earnings-based measures focus on changes to future profitability within a given time horizon eventually affecting future levels of an institution's own equity capital;
• assessment horizons: economic value measures reflect changes in value over the remaining life of the institution's assets, liabilities and off-balance sheet items (i.e., until all positions have run off), while earnings-based measures cover only the short to medium term, and therefore do not fully capture those risks that will continue to impact profit and loss accounts beyond the period of estimation; and
• future business/production: economic value measures consider the net present value of repricing cash flows of instruments on the institution's balance sheet or accounted for as an off-balance sheet item (i.e., a run-off view). Depending on an institution's nature, size, business, complexity and risk profile, earnings measures may, in addition to a run-off view, assume rollover of maturing items (i.e., a constant balance sheet view) and/or assess the scenario-consistent impact on the institution's future earnings inclusive of future business (i.e., a dynamic view).^{Footnote 10}

Interest rate shock and stress scenarios

Institutions' IMS for IRRBB should be able to calculate the impact on economic value and earnings of multiple scenarios, based on:

1. internally selected interest rate shock scenarios addressing the institution's risk profile, according to its Internal Capital Adequacy Assessment Process (ICAAP)^{Footnote 11};
2. historical, hypothetical, and forward looking interest rate stress scenarios, which tend to be more severe than shock scenarios;
3. the six prescribed interest rate shock scenarios set out in Annex 1; and
4. other ad hoc stress scenarios, as required by OSFI, or scenarios in line with OSFI's Macroprudential Stress Testing exercises.

Developing internal interest rate shock and stress scenarios

An institution's stress testing framework for IRRBB should be commensurate with its nature, size and complexity as well as business activities and overall risk profile. The framework should include clearly defined objectives, scenarios tailored to the institution's businesses and risks, well documented assumptions and sound methodologies. The framework will be used to assess the potential impact of the scenarios on the institution's financial condition, enable ongoing and effective review processes for stress tests and recommend actions based on the stress test results. IRRBB stress tests should play an important role in the communication of risks, both within the institution and externally with supervisors and the market through appropriate disclosures.

Roles and objectives

Institutions should measure their vulnerability to loss in value and/or reductions in short-term earnings under stressful market conditions – including the breakdown of key assumptions – and consider those results when establishing and reviewing their policies and limits for IRRBB.

The institution's stress testing framework for IRRBB should be part of its broader risk management and governance processes. This should feed into the decision-making process at the appropriate management level, including strategic decisions (e.g., business and capital planning decisions). In particular, IRRBB stress testing and sensitivity analysis should be considered in the ICAAP, requiring institutions to undertake rigorous, forward-looking stress testing that identifies events of severe changes in market conditions that could adversely impact the institution's capital or earnings.

Selection process for shock and stress scenarios

The identification of relevant shock and stress scenarios for IRRBB, the application of sound modelling approaches and the appropriate use of the stress testing results require collaboration. A stress-testing programme for IRRBB should consider the opinions of different experts within an institution (e.g., traders, the treasury department, the finance department, the ALCO, the risk management and risk control departments and/or the institution's economists).

Institutions should determine, by currency and across currencies, a range of potential interest rate movements against which they will measure their IRRBB exposures. Senior Management should ensure that risk is measured under a reasonable range of potential interest rate scenarios, including some containing severe stress elements. In developing the scenarios, institutions should consider a variety of factors, such as the shape and level of the current term structure of interest rates and the historical and implied volatility of interest rates. In low interest rate environments, institutions should also consider negative interest rate scenarios and the possibility of asymmetrical effects of negative interest rates on their different asset and liability profiles. Institutions should evaluate various scenarios regarding how low or negative interest rates impact behaviour, products, and hedging.

An institution should consider the nature and sources of its IRRBB exposures, the time required to reduce or unwind unfavourable IRRBB exposures, and its capability/willingness to withstand accounting losses in order to reposition its risk profile. An institution should select scenarios that provide meaningful estimates of risk and include a range of shocks that is sufficiently wide to allow Senior Management to understand the risk inherent in the institution's products and activities. When developing interest rate shock and stress scenarios for IRRBB, institutions should consider the following:

• The scenarios should be sufficiently wide-ranging to identify parallel and non-parallel gap risk, basis risk and option risk. In many cases, static interest rate shocks may be insufficient to assess IRRBB exposure adequately. Institutions should ensure that the scenarios are both severe and plausible, in light of the existing level of interest rates and the current interest rate cycle.
• Special consideration should be given to instruments or markets where concentrations exist, because those positions may be more difficult to liquidate or offset in a stressful market environment.
• Institutions should assess the possible interaction of IRRBB with its related risks such as liquidity and credit risk. The degree and type of assessment should reflect an institution's nature, size, business, complexity and risk profile.
• When assessing earnings risks, institutions should determine the effect of adverse changes in the spreads of new assets/liabilities replacing those assets/liabilities maturing within the time horizon of the forecast on their NII.
• Institutions with significant option risk, whether embedded or explicit, should include scenarios that capture the exercise of such options. For example, institutions that have products with sold caps or floors should include scenarios that assess how the risk positions would change should those caps or floors move into the money. Given that the market value of options also fluctuates with changes in the volatility of interest rates, institutions should develop interest rate assumptions to measure their IRRBB exposures to changes in interest rate volatilities.
• In building their interest rate shock and stress scenarios, institutions should specify the term structure of interest rates that will be incorporated and the basis relationship between yield curves, rate indices, etc. Institutions should also estimate how interest rates that are administered or managed by delegated expert individuals (e.g., prime rates or retail deposit rates, as opposed to those that are purely market-driven) might change. Institutions should document how these assumptions are derived.

In addition, forward-looking scenarios should incorporate:

• changes in portfolio composition due to factors under the control of the institution (e.g., the institution's acquisition and production plans) as well as external factors (e.g., changing competitive, legal or tax environments);
• new products where only limited historical data are available;
• new market information; and
• new emerging risks that are not necessarily covered by historical stress episodes.

Further, institutions should perform qualitative and quantitative reverse stress tests^{Footnote 12} in order to: (i) identify interest rate scenarios that could severely threaten an institution's capital and earnings; and (ii) reveal vulnerabilities arising from its hedging strategies and the potential behavioural reactions of its customers. Institutions should combine forward-looking scenarios with plausible rate shock periods (i.e., peer-to-peer lending erodes retail customer base as policy rates sharply change).

OSFI Principle #5 (BCBS Principle #5): In measuring IRRBB, institutions should fully understand key behavioural and modelling assumptions. The assumptions should be conceptually sound and documented and should be rigorously tested and aligned with the institution's business strategies.

Both economic value and earnings-based measures of IRRBB are significantly affected by a number of assumptions made for the purposes of risk quantification, namely:

• expectations for the exercise of interest rate options (explicit and embedded) by both the institution and its customers under specific interest rate shock and stress scenarios;
• treatment of balances and interest flows arising from non-maturity deposits (NMDs);
• treatment of own equity in economic value measures; and
• the implications of accounting practices for IRRBB.

Hence, when assessing its IRRBB exposures, an institution should make judgments and assumptions about how an instrument's actual maturity or repricing behaviour may vary from the instrument's contractual terms because of behavioural optionalities as rates change (i.e., the embedded optionality effect).

The degree of sophistication of IRRBB measurement techniques should be commensurate with the degree of risk inherent in the institution. Where institutions utilize models to measure and mitigate their IRRBB exposure, these models should be thoroughly vetted by an independent function.

Common products with behavioural optionalities

Common products with behavioural optionalities include:

1. Fixed rate loans subject to prepayment risk – Institutions should understand the nature of prepayment risk for their portfolios and make reasonable and prudent estimates of the expected prepayments. The assumptions underlying the estimates and where prepayment penalties or other contractual features materially affect the embedded optionality effect should be documented. There are several factors that are important determinants of the institution's estimate of the effect of each interest rate shock and stress scenario on the average prepayment speed. Specifically, an institution should assess the expected average prepayment speed under each scenario.
2. Fixed rate loan commitments – Institutions may sell options to retail customers (e.g., prospective mortgage buyers or renewers) whereby, for a limited period, the customers can choose to draw down a loan at a committed rate. Unlike loan commitments to corporates, where drawdowns strongly reflect characteristics of automatic interest rate options, mortgage commitments (i.e., pipelines) to retail customers are also impacted by other behavioural drivers.
3. Term deposits subject to early redemption risk – Institutions may attract deposits with a contractual maturity term or with step-up clauses that enable the depositor at different time periods to modify the speed of redemption. A classification scheme should be documented, whether a term deposit is deemed to be subject to redemption penalties or to other contractual features that preserve, or extend, the cash flow profile of the instrument^{Footnote 13}.
4. NMDs – Behavioural assumptions for deposits that have no specific repricing date are a material determinant of IRRBB exposures under the economic value and earnings-based measures. Institutions should document, monitor and regularly update key assumptions for NMD balances and behaviour used in their IMS. To determine the appropriate assumptions for its NMDs, an institution should analyse its depositor base in order to identify the proportion of core deposits (i.e., NMDs that are unlikely to reprice even under significant changes in the interest rate environment). Assumptions should vary according to depositor characteristics (e.g., retail/wholesale) and account characteristics (e.g., transactional/non-transactional).

Modelling assumptions^{Footnote 14} should be conceptually sound and reasonable, and consistent with historical experience. They should also take into consideration the nature, size, business, complexity and risk profile of an institution. Institutions should carefully consider how the exercise of the behavioural optionality will vary not only under the interest rate shock and stress scenario but also across other dimensions. For instance, considerations may include:

In addition, institutions with positions denominated in different currencies can expose themselves to IRRBB in each of those currencies. Since yield curves vary from currency to currency, institutions should assess exposures in each currency and have sufficient controls to manage the risk in each of those currencies independently. Institutions with material multicurrency exposures may choose to include, in their IMS, methods to aggregate their IRRBB in different currencies using assumptions about the correlation between interest rates in different currencies. OSFI may exercise discretion in terms of allowing or restricting methods to aggregate institutions' IRRBB in different currencies. For example, OSFI may request that institutions report exposures in different currencies either without or with different assumptions about the correlation between interest rates.

Further, institutions should consider the materiality of the impact of behavioural optionalities within floating rate loans. For instance, the behaviour of prepayments arising from embedded caps and floors could impact the institutions' economic value of equity.

Institutions should be able to test the appropriateness of key behavioural assumptions, and all changes to the assumptions of key parameters should be documented. Institutions should periodically perform sensitivity analyses for key assumptions to monitor their impact on measured IRRBB. Sensitivity analyses should be performed with reference to both economic value and earnings-based measures.

The most significant assumptions underlying the system should be documented and clearly understood by Senior Management. Documentation should also include descriptions on how those assumptions could potentially affect the institution's hedging strategies.

As market conditions, competitive environments and strategies change over time, the institution should review significant measurement assumptions at least annually and more frequently during rapidly changing market conditions. For example, if the competitive market has changed such that consumers now have lower transaction costs available to them for refinancing their residential mortgages, prepayments may become more sensitive to smaller reductions in interest rates. Institutions are expected to undertake full reviews of their IRRBB measurement models consistent with OSFI's guideline E-23 Enterprise-Wide Model Risk Management for Deposit-Taking Institutions. The frequency and the nature of these reviews depends on various factors, such as complexity of the institution and size of IRRBB exposures, market changes, and complexity of innovation with respect to measuring IRRBB.

OSFI Principle #6 (BCBS Principle #6): Measurement systems and models used for IRRBB should be based on accurate data, and subject to appropriate documentation, testing and controls to give assurance on the accuracy of calculations. Models used to measure IRRBB should be comprehensive and covered by governance processes for model risk management, including a validation function that is independent of the development process.

Measurement systems and data integrity

Accurate and timely measurement of IRRBB is necessary for effective risk management and control. An institution's risk measurement system should be able to identify and quantify the major sources of IRRBB exposure. The mix of an institution's business lines and the risk characteristics of its activities should guide management's selection of the most appropriate form of measurement system.

Institutions should not rely on a single measure of risk, given that risk management systems tend to vary in how they capture the components of IRRBB. Instead, institutions should use a variety of methodologies to quantify their IRRBB exposures under both the economic value and earnings-based measures, ranging from simple calculations based on static simulations using current holdings to more sophisticated dynamic modelling techniques that reflect potential future business activities.

An institution's MIS should allow it to retrieve accurate IRRBB information in a timely manner. The MIS should capture interest rate risk data on all the institution's material IRRBB exposures. There should be sufficient documentation of the major data sources used in the institution's risk measurement process.

Data inputs should be automated as much as possible to reduce operational errors. Data mapping should be periodically reviewed and tested against an approved model version. An institution should monitor the type of data extracts and set appropriate controls.

Where cash flows are slotted into different time buckets (e.g., for gap analyses) or assigned to different vertex points to reflect the different tenors of the interest rate curve, the slotting criteria should be stable over time to allow for a meaningful comparison of risk figures over different periods.

Institutions' IMS should be able to compute economic value and earnings-based measures of IRRBB, as well as other measures of IRRBB prescribed by OSFI based on the interest rate shock and stress scenarios set defined. It should also be sufficiently flexible to incorporate supervisory-imposed constraints^{Footnote 15} on institutions' internal risk parameter estimates.

Model governance process

The validation of IRRBB measurement methods and assessment of corresponding model risk should be included in a formal policy process that should be reviewed and approved by Senior Management. The policy should specify the management roles and designate who is responsible for the development, implementation and use of models^{Footnote 16}. In addition, the model oversight responsibilities as well as policies including the development of initial and ongoing validation procedures, evaluation of results, approval, version control, exception, escalation, modification and decommission processes need to be specified and integrated within the governance processes for model risk management.

An effective validation framework should include three core elements:

• evaluation of conceptual/methodological soundness, including developmental evidence;
• ongoing model monitoring, including process verification and benchmarking; and
• outcomes analysis, including backtesting of key internal parameters (e.g., stability of deposits, prepayments, early redemptions, pricing of instruments).

In addressing the expected initial and ongoing validation activities, the policy should establish a hierarchical process for determining model risk soundness based on both quantitative and qualitative dimensions such as size, impact, past performance and familiarity with the modelling technique employed.

Model risk management for IRRBB measures should follow a holistic approach that begins with motivation, development and implementation by model owners and users. Prior to receiving authorisation for usage, the process for determining model inputs, assumptions, modelling methodologies and outputs should be reviewed and validated independently of the development of IRRBB models. The review and validation results and any recommendations on model usage should be presented to and approved by Senior Management. Upon approval, the model should be subject to ongoing review, process verification and validation at a frequency that is consistent with the level of model risk appetite determined and approved by the institution.

The ongoing validation process should, where appropriate, establish a set of exception trigger events that obligate the model reviewers to notify Senior Management or its delegates in a timely fashion, in order to determine corrective actions and/or restrictions on model usage. Clear version control authorisations should be designated, where appropriate, to model owners. With the passage of time, an approved model may be modified or decommissioned. Institutions should articulate policies for model transition, including change and version control authorisations and documentation.

IRRBB models might include those developed by third-party vendors. Model inputs or assumptions may also be sourced from related modelling processes or sub-models (both in-house and vendor-sourced) and should be included in the validation process. Institutions should document and explain model specification choices as part of the validation process.

Institutions that purchase IRRBB models should ensure there is adequate documentation of their use of those models, including any specific customisation. If vendors provide input for market data, behavioural assumptions or model settings, the institution should have a process in place to determine if those inputs are reasonable for its business and the risk characteristics of its activities.

Internal audit should review the risk management system and the model risk management process as part of its annual risk assessment and audit plans. The audit activity should not duplicate model risk management processes, but should review its integrity and effectiveness.

OSFI Principle #7 (BCBS Principle #7): Measurement outcomes of IRRBB and hedging strategies should be reported to Senior Management or its delegates on a regular basis, at relevant levels of aggregation (by consolidation level and currency).

The reporting of risk measures to the Senior Management or its delegates should occur on a frequent basis consistent with the timing of ALCO meetings. Such reporting should compare current IRRBB exposures with policy limits as well as past IRRBB forecasts or risk estimates with actual results (i.e. earnings) to inform potential modelling shortcomings. Reporting should also include the results of the periodic model reviews and audits on a similar frequency. Portfolios that may be subject to significant mark-to-market movements should be clearly identified within the institution's MIS and subject to oversight in line with any other portfolios exposed to market risk.

The types of reports prepared for the Senior Management will vary based on the institution's portfolio composition but they should include at least the following:

• summaries of the institution's aggregate IRRBB exposures, and explanatory text that highlights the assets, liabilities, cash flows, and strategies (including hedging program activities) that are driving the level and direction of IRRBB;
• reports demonstrating the institution's compliance with policies and limits;
• key modelling assumptions such as NMD characteristics, prepayments on fixed rate loans and currency aggregation;
• results of stress tests, including assessment of sensitivity to key assumptions and parameters; and
• summaries of the reviews of IRRBB policies, procedures and adequacy of the measurement systems, including any findings of internal and external auditors and/or other equivalent external parties (such as consultants).

Reports detailing the institution's IRRBB exposures should be provided to the institution's Senior Management on a timely basis and reviewed regularly. The IRRBB reports should provide aggregate information as well as sufficient supporting detail to enable Senior Management to assess the sensitivity of the institution to changes in market conditions, with particular reference to portfolios that may potentially be subject to significant mark-to-market movements. Senior Management should review the institution's IRRBB management policies and procedures in light of the reports, to ensure that they remain appropriate and sound. Senior Management should also ensure that analysis and risk management activities related to IRRBB are conducted by competent staff with technical knowledge and experience, consistent with the nature and scope of the institution's activities.

5. Public Disclosure

OSFI Principle #8 (BCBS Principle #8): Information on the level of IRRBB exposure and practices for measuring and controlling IRRBB should be disclosed to the public on a regular basis.

The level of IRRBB exposure should be measured and disclosed on an annual basis. Disclosure of IRRBB information should be commensurate with the nature, size and complexity of the institution. Institutions should publicly disclose:

• Their risk management objectives and policies, including the nature of IRRBB and key assumptions. This includes assumptions regarding loan prepayments and behaviour of non-maturity deposits, and frequency of IRRBB measurement.

• The increase (decline) in earnings or economic value (or relevant measure used by management) for upward and downward rate shocks according to management's method for measuring IRRBB, broken down by currency (as relevant). Examples of the type of upward and downward rates shocks are outlined below.

  Sensitivity (pre-tax)^{Footnote 17} of:

  1. Net interest income and economic value to parallel shifts in the yield curve of 10, 25, 100 and 200 basis points, the latter metric additionally as a percentage of capital,

  2. Net interest income and economic value to three non-parallel shifts in the yield curve to which the institution is vulnerable, and

  3. Net interest income and economic value to, for example, key interest rates or other variables to which the institution is vulnerable.

6. Capital adequacy and outlier test

OSFI Principle #9 (BCBS Principle #9): Capital adequacy for IRRBB should be specifically considered as part of the Internal Capital Adequacy Assessment Process and approved by Senior Management, in line with the institution's risk appetite on IRRBB.

Institutions are responsible for evaluating the level of capital that they should hold, and for ensuring that this is sufficient to cover IRRBB and its related risks. The contribution of IRRBB to the overall internal capital assessment should be based on the institution's IMS outputs, taking account of key assumptions and risk limits. The overall level of capital should be commensurate with both the institution's actual measured level of risk (including for IRRBB) and its risk appetite, and be duly documented in its ICAAP report.

Institutions should not only rely on supervisory assessments of capital adequacy for IRRBB, but should also develop their own methodologies for capital allocation, based on their risk appetite. In determining the appropriate level of capital, institutions should consider both the amount and the quality of capital needed.

Capital adequacy for IRBBB should be considered in relation to the risks to economic value, given that such risks are embedded in the institution's assets, liabilities and off-balance sheet items. Given the possibility that future earnings may be lower than expected, institutions should consider capital buffers to address any risks to future earnings.

Capital adequacy assessments for IRRBB should factor in:

• the size and tenor of internal limits on IRRBB exposures, and whether these limits are reached at the point of capital calculation;
• the effectiveness and expected cost of hedging open positions that are intended to take advantage of internal expectations of the future level of interest rates;
• the sensitivity of the internal measures of IRRBB to key modelling assumptions;
• the impact of shock and stress scenarios on positions priced off different interest rate indices (basis risk);
• the impact on economic value and NII of mismatched positions in different currencies;
• the impact of embedded losses;
• the distribution of capital relative to risks across legal entities that form part of a capital consolidation group, in addition to the adequacy of overall capital on a consolidated basis;
• the drivers of the underlying risk; and
• the circumstances under which the risk might crystallise.

The outcomes of the capital adequacy for IRRBB should be considered in an institution's ICAAP and flow through to assessments of capital associated with business lines.

OSFI Principle #10 (BCBS Principle #11): OSFI will regularly assess institutions' IRRBB and the effectiveness of the approaches that institutions use to identify, measure, monitor and control IRRBB.

Assessment

Taking into account an institution's size and complexity at the time of assessment, OSFI will:

• collect sufficient information from institutions to assess their IRRBB exposure^{Footnote 18}.
• regularly evaluate the adequacy, integrity and effectiveness of an institution's IRRBB management framework and assess whether its practices comply with the stated objectives and risk tolerances set by Senior Management, and with its expectations as set out in Principles 1 to 7.
• evaluate whether an institution's IMS provides a sufficient basis for identifying and measuring IRRBB, taking note particularly of the key assumptions that affect the measurement of IRRBB. OSFI may request and evaluate information about significant model or policy changes that have occurred between its regular reviews and may concentrate its efforts on reviewing the most material models and policies.
• review regularly the outputs from the institution's IMS, including the institution's IRRBB exposures (both economic value and earnings-based measures) based on the internal calculations using at least the prescribed interest rate shock scenarios specified in Annex 1, as well as any additional interest rate shock and stress scenarios it determines should be assessed. OSFI may also form its evaluation of an institution's IMS by applying supervisory estimates which has developed and will also review the information disclosed by institutions under Principle 8.

When reviewing the institution's IRRBB exposures and forming conclusions about the quality of the institution's IRRBB management, OSFI will consider:

• the complexity and level of risk posed by the institution's assets, liabilities and off-balance sheet activities;
• the adequacy and effectiveness of oversight by the institution's Senior Management;
• an institution's knowledge and ability to identify and manage the sources of IRRBB;
• the adequacy of internal validation of IRRBB measures, including sensitivity analysis and backtesting, in particular where changes in key modelling parameters have occurred;
• the adequacy of internal monitoring and of the institution's MIS;
• the effectiveness of risk limits and controls that set tolerances on economic value and earnings;
• the effectiveness of the institution's IRRBB stress testing programme;
• the adequacy and frequency of the internal review and audit of the IRRBB management process, including independent model validation and oversight of model risk;
• the adequacy and effectiveness of IRRBB management practices as evidenced by past and projected financial performance;
• the effectiveness of hedging strategies used by the institution to control IRRBB; and
• the appropriateness of the level of IRRBB (including embedded losses) in relation to the institution's capital, earnings and risk management systems.

OSFI will assess the adequacy of an institution's capital relative to its IRRBB exposures (against expectations set out in Principle 9) to determine whether the institution requires more detailed examination and should potentially be subject to additional capital requirements and/or other mitigation actions. This assessment may exceed the capital prescription from the outlier/materiality test set out in Principle 11.

OSFI's evaluation could be undertaken both on a standalone basis and by making comparisons with peer institutions. In particular, OSFI may compare the key behavioural and strategic assumptions being made by institution to determine whether they can be justified with regard to the economic environment and business model. OSFI will ensure that both information and the review process is comparable and consistent across institutions.

OSFI Principle #11 (BCBS Principle #12): Institutions identified as outliers are considered as potentially having undue IRRBB. When a review of an institution's IRRBB exposure reveals inadequate management or excessive risk relative to capital, earnings or general risk profile, OSFI will require mitigation actions and/or additional capital.

Outlier Test

The outlier/materiality test compares an institution's maximum ∆EVE (economic value of equity), under the six prescribed interest rate shock scenarios set out in Annex 1, with 15% of its Tier 1 capital.

If deemed necessary, OSFI could also implement additional outlier/materiality tests that use a different capital measures instead of Tier 1 (e.g. CET1) or capture the institution's IRRBB relative to earnings. For example, an institution could be considered to have potentially undue IRRBB relative to earnings if its shocked ΔNII was such that the institution would not have sufficient income to maintain its normal business operations.

Institutions are expected to hold adequate capital for the risks they undertake. With regard to IRRBB, OSFI will evaluate whether the institutions have adequate capital and earnings that are commensurate with its level of short-term and long-term IRRBB exposures, as well as the risk those exposures may pose to its future financial performance. The following factors will be considered by OSFI:

• The ΔEVE under a variety of shocked and stressed interest rate scenarios. Where an institution's EVE is significantly sensitive to interest rate shocks and stresses, OSFI will evaluate the impact on its capital levels arising from financial instruments held at market value, and potential impact should banking book positions held at historical cost become subject to market valuation. Throughout the assessment, OSFI will consider the impact of key assumptions on the ΔEVE calculated, including those related to the inclusion/exclusion of commercial margins, the institution's actual equity allocation profile, the stability of NMDs and prepayment optionality.
• The strength and stability of the earnings stream and the level of income needed to generate and maintain normal business operations. A high level of IRRBB exposure is one that could, under a plausible range of market scenarios, result in the institution reporting losses or curtailing normal dividend distribution and business operations. In such cases, senior management should ensure that the institution has sufficient capital to withstand the adverse impact of such events until it can implement mitigating actions such as reducing exposures or increasing capital.

When OSFI concludes that an institution's management of IRRBB is inadequate, OSFI will require the institution to take one or more of the following actions:

• reduce its IRRBB exposures (e.g., by hedging);
• raise additional capital;
• set constraints on the internal risk parameters used by an institution; and/or
• improve its risk management framework.

The reduction in IRRBB and/or the expected higher level of capital should be achieved within a specified time frame, to be established taking into consideration prevailing financial and economic conditions, as well as the causes of the IRRBB exposure exceeding the supervisory threshold and its structural nature.

Annex 1. The standardized interest rate shock scenarios

Institutions should apply six prescribed interest rate shock scenarios to capture parallel and non-parallel gap risks for EVE and two prescribed interest rate shock scenarios for NII. These scenarios are applied to IRRBB exposures in each currency for which the institution has material positions. In order to accommodate heterogeneous economic environments across jurisdictions, the six shock scenarios reflect currency-specific absolute shocks as specified in Table 1 below. For the purposes of capturing the local rate environment, an historical time series ranging from 2000 to 2015 for various maturities was used to derive each scenario for a given currency.

Under this approach, IRRBB is measured by means of the following six scenarios:

1. parallel shock up;
2. parallel shock down;
3. steepener shock (short rates down and long rates up);
4. flattener shock (short rates up and long rates down);
5. short rates shock up; and
6. short rates shock down.

The calibration of the interest rate shock size is provided in Table 1. The data below is based on historical time series from 2000 to 2015:

Given Table 1, the instantaneous shocks to the risk-free rate for parallel, short and long, for each currency, the following parameterisations of the six interest rate shock scenarios should be applied:

1. Parallel shock for currency c: a constant parallel shock up or down across all time buckets.

   $\Delta R_{\mathrm{parallel,c}}\left(t_k\right)=\pm \overline{R}{ }_{\mathrm{parallel,c}}$

2. Short rate shock for currency c: shock up or down that is greatest at the shortest tenor midpoint. That shock, through the shaping scalar $S_{\mathrm{short}}\left(t_k\right)=\left(e^{\frac{-t_k}{x}}\right)$ , where x=4, diminishes towards zero at the tenor of the longest point in the term structure.^{Footnote 19 Footnote 20}

   $\Delta R_{\mathrm{short,c}}\left(t_k\right)=\pm \overline{R}{ }_{\mathrm{short,c}}·S_{\mathrm{short}}\left(t_k\right)=\pm \overline{R}{ }_{\mathrm{short,c}}·e^{\frac{-t_k}{x}}$

3. Long rate shock for currency c (note: this is used only in the rotational shocks): Here the shock is greatest at the longest tenor midpoint and is related to the short scaling factor as:

   $S_{\mathrm{long}}\left(t_k\right)=1-S_{\mathrm{short}}\left(t_k\right).$

   $∆R_{\mathrm{long,c}}\left(t_k\right)=\pm {\overline{R}}_{\mathrm{long,c}}·S_{\mathrm{long}}\left(t_k\right)=\pm {\overline{R}}_{\mathrm{long,c}}·\left(1-e^{\frac{-t_k}{x}}\right)$

4. Rotation shocks for currency c: involving rotations to the term structure (i.e., steepeners and flatteners) of the interest rates whereby both the long and short rates are shocked and the shift in interest rates at each tenor midpoint is obtained by applying the following formulas to those shocks:

   $∆R_{\mathrm{steepener,c}}\left(t_k\right)=-0.65·|∆R_{\mathrm{short,c}}(t_k\left)\right|+0.9·|∆R_{\mathrm{long,c}}(t_k\left)\right|$ .

   $∆R_{\mathrm{flattener,c}}\left(t_k\right)=+0.8·|∆R_{\mathrm{short,c}}(t_k\left)\right|-0.6·|∆R_{\mathrm{long,c}}(t_k\left)\right|$ .

OSFI may, as required, set floors for the post-shock interest rates under the six interest rate shock scenarios, provided the floors are not greater than zero.

Examples

Short rate shock: Assume that the institution uses the standardised framework^{Footnote 21} with K=19 time bands and with t_K=25 years (the midpoint (in time) of the longest tenor bucket K), and where t_k is the midpoint (in time) for bucket k. In the standardised framework, if k=10 with t_k=3.5 years, the scalar adjustment for the short shock would be $S_{\mathrm{short}}\left(t_k\right)=\left(e^{\frac{\mathrm{-3,5}}{4}}\right)=0.417$ . Institutions would multiply this by the value of the short rate shock to obtain the amount to be added to or subtracted from the yield curve at that tenor point. If the short rate shock was +100 bp, the increase in the yield curve at t_k=3.5 years would be 41.7 bp.

Steepener: Assume the same point on the yield curve as above, t_k=3.5 years. If the absolute value of the short rate shock was 100 bp and the absolute value of the long rate shock was 100 bp (as for the Japanese yen), the change in the yield curve at t_k=3.5 years would be the sum of the effect of the short rate shock plus the effect of the long rate shock in basis points: −0.65 · 100bp · 0.417 + 0.9 · 100bp · (1−0.417) = +25.4bp.

Flattener: The corresponding change in the yield curve for the shocks in the example above at t_k=3.5 years would be: +0.8 · 100bp · 0.417 − 0.6 · 100bp · (1−0.417) = −1.6bp.

Derivation of the interest rate shocks in Table 1

In order to derive the shocks described in Table 1, the following general steps are taken:

Step 1. Generate a 16-year time series of daily average interest rates for each currency c. The average daily interest rates from the year 2000 (3 January 2000) to 2015 (31 December 2015) are contained in Table 2. The average local percentile of the rate series is determined by calculating the average rate across all daily rates in time buckets 3m, 6m, 1Y, 2Y, 5Y, 7Y, 10Y, 15Y and 20Y.

Step 2. The global shock parameter is prescribed based on the weighted average of the currency-specific shock parameters: ${\overline{\alpha }}_i$ . The shock parameter for scenario i is a weighted average of the α_i,c,h across all currencies and defined as α_i. The following baseline global parameters are obtained:

Applying the α_i from Table 3 to the average long-term rates from Table 2 results in the revised interest rate shocks by currency for parallel, short and long segments of the yield curve in Table 4.

However, the proposed interest rate shock calibration can lead to unrealistically low interest rate shocks for some currencies and to unrealistically high interest rate shocks for others. In order to ensure a minimum level of prudence and a level playing field, a floor of 100 bp and variable caps (denoted as $∆{\overline{R}}_j$ ) are set for the scenarios concerned, those caps being 500 bp for the short-term, 400 bp for the parallel and 300 bp for the long-term interest rate shock scenario. OSFI may, applying national discretion, set a higher floor under the local interest rate shock scenarios for CAD currency.

The change in the risk-free interest rate for shock scenario j and currency c can be defined as:

${\overline{R}}_{\mathrm{j,c}}=\max \left\{100,\min \left\{\Delta \tilde{R}{ }_{\mathrm{j,c}}, \Delta \overline{R}{ }_j\right\}\right\}$ ^{Footnote 22}

where $∆{\overline{R}}_j=\left\{400,500,300\right\}$ , for j=parallel, short and long, respectively.

Applying the caps and floors to the shocks described in Table 4 results in the final set of interest rate shocks by currency that is shown in Table 1.^{Footnote 23}

Recalibrations over time

The Basel Committee acknowledges that global shock sizes (in Table 3) of different currencies should reflect local conditions in a timely manner. For this reason, the Committee will review the calibration of the interest rate shock sizes (e.g., every five years).

OSFI will look to update Tables 1, 2, and 4 on a periodic basis, reflecting changes from other jurisdictions and/or CAD currency rates. Once updated, institutions will have one year to phase in new scenarios. Should the extent of the rate scenarios change materially, OSFI may review the outlier test threshold.

For currencies not covered above, where an institution has a material position, the institution may estimate shocks using a methodology that is consistent with the one described in this annex.