ANNEX 2A

ICAAP REPORT RECOMMENDED STRUCTURE

Introduction

The purpose of the Internal Capital Adequacy Assessment Process (ICAAP) is to

inform the Board of the ongoing assessment of the banks risks, how the bank intends
to mitigate those risks and how much current and future capital is necessary having
considered other mitigating factors.

It is the responsibility of the institution to define and develop its ICAAP. The ICAAP
is codified in Article 123 of the CRD and implemented locally through Article 17C of
the Banking Act (the Act). Within an institutions internal governance framework, the
ICAAP is a process to ensure that the management body (both supervisory and
management functions):

adequately identifies, measures, aggregates and monitors the institutions risks;

ensures that the institution holds adequate internal capital in relation to the
institutions risk profile; and

uses sound risk management systems and develops them further.

The onus is on the institution to demonstrate that its ICAAP is comprehensive and
adequate to the nature of risks posed by its business activities and its operating
environment. The framework under which an institution should develop its ICAAP is
designed to be risk-based and emphasises the importance of capital planning, but also
the importance of management and other qualitative aspects of risk management.
When assessing their capital needs, all institutions should be able to take into account
the impact of economic cycles and sensitivity to other external risks and factors. For
larger and/or more complex institutions, this may mean developing an appropriately
detailed and rigorous stress and scenario testing framework.

Various methodologies may be utilised by institutions for assessing their risk

exposure and setting capital against it. At the same time, the introduction of the
ICAAP is not meant to suggest that existing methods, which have met the needs of
institutions over the years, may necessarily need to be replaced. However, all
institutions should have adequate processes in place.

The ICAAP should be embedded in the institutions business and organisational

processes, and not simply regarded as an add-on that permits the management body
(both supervisory and management functions) to indicate that supervisory
expectations have been met.

The MFSA recognises that there may be a fair degree of variation in the length and
format of ICAAP submissions since banks business and risk profiles differ and the
ICAAP document should be proportional to the size, nature and complexity of a

(i)
BR/12/2010.01
banks business. However, while the suggested format by the MFSA may be
considered to be convenient for some banks as on a general basis, it covers most of
the matters which typically would be the subject of review through the Supervisory
Review and Evaluation Process (SREP) which would be carried out by the MFSA.
Once an ICAAP has been drawn up, the MFSA stresses that in line with the
provisions of Article 17C of the Act, it should be subject to regular internal review
and such assessment of the ICAAP is to be conducted at least annually.

Where appropriate, technical information on risk measurement methodologies, capital

models and all other works carried out to validate the approach (e.g. Board papers and
minutes, internal or external reviews), could be contained in appendices.

1. EXECUTIVE SUMMARY

The purpose of the Executive Summary is to present an overview of the ICAAP

approaches and methodology, as well as of results and conclusions. The overview
would typically include:

the purpose of the report (for the purposes of this document report and ICAAP
are used interchangeably and shall be construed to have the same meaning) and
entity or entities covered therein;

the main findings of the ICAAP analysis:

o how much and what composition of internal capital the bank considers it
should hold as compared with its Pillar I calculation; and

o the adequacy of the banks risk management processes;

a summary of the financial position of the business, including the strategic

position of the bank, its balance sheet strength, and future profitability;

a brief description of the capital planning and dividend policy of the bank. In
this respect, the report should include forecasts of the capital needs and of the
regulatory Own Funds which must be in line with the banks business plan.
Moreover, it is expected that the possible sources of additional funds would be
set out, especially in the cases of contingent future adverse events;

commentary on the most material risks and the mitigation techniques

implemented, why the level of risk is acceptable or, if it is not, what mitigating
actions are planned;

commentary on any other major issues where further analysis and decisions are
required; and

who has carried out the assessment, how it has been challenged, and who has
approved it.

(ii)
BR/12/2010.01
2. BACKGROUND

This section should include all relevant information that would assist towards the best
possible understanding of the banks structure and current financial condition. The
information that should be depicted is the following:

a) group structure;

b) organisational structure, management team etc ;

c) various financial data for the last five years e.g. operating profit, profit after tax,
shareholders funds, total assets, loans and deposits, regulatory capital etc.
Commentary on the significant changes in the banks financial condition during
these years;

d) significant developments that have taken place during the past five years e.g.
acquisitions, changes in the share capital etc;

e) the main shareholders of the bank (that is shareholders owning more than 5% of
the share capital);

f) a comparison of the internal capital which is maintained against the risks that
are assumed with the minimum regulatory capital over the last years; and

g) conclusions that may be drawn from the analysis of the historical data which
may have implications for the banks future.

3. SUMMARY OF CURRENT AND PROJECTED FINANCIAL AND

CAPITAL POSITIONS

This section should analyse, among others, the following:

a) the current financial position of the bank or banking group (if relevant),
including any expected changes to the current business profile (e.g. acquisitions,
expansion abroad etc.);

b) the economic environment within which the bank operates, as well as any
possible expected changes;

c) the business plan of the bank. It is expected that adequate information regarding
all its business activities will be included;

d) the projected financial positions of the bank, which should be in line with its
business plans; and

e) the capital planning and the sources of funds that the bank can access. It is
expected that the bank will perform the necessary comparisons between the
capital available and the capital required to fulfil its business plans. The means
of covering the potential capital shortfalls should also be mentioned. It is to be

(iii)
BR/12/2010.01
 noted that the capital projections may provide the baseline against which
adverse scenarios might be compared.

4. CAPITAL ADEQUACY

This section may commence with a description of the banks risk appetite as defined
by its Board and used in the ICAAP. It is vital for the MFSA to understand whether
what is being presented in this section of the ICAAP represents the banks view of the
amount of capital required to meet minimum regulatory needs or whether what is
being presented is the amount of capital that a bank believes it needs to meet business
objectives. For instance, whether the capital required is based on a particular desired
credit rating (if relevant) or includes buffers for strategic purposes or to minimise the
chance of breaching regulatory requirements. Where economic capital models are
used this would include the confidence level, time horizon, and description of the
event to which the confidence level relates. Where scenario analyses or other means
are used, then some other description of how the severity of scenario has been chosen
would be included.

The section would then include a detailed review of the banks internal capital
adequacy.

The information provided would include:

Timing

o The effective date of the internal capital adequacy calculations together with
consideration of any events between this date and the date of submission which
would materially impact the level of estimated capital together with their
effects;

o Details of, and rationale for, the time period over which capital has been
assessed; and

o An identification of the major risks faced in each of the following categories.

Risks analysed

Pillar I risks o Credit Risk

o Market Risk
o Operational Risk
Risks not adequately o Residual Risk
covered by Pillar I o Securitisation
Pillar II risks o Interest Rate Risk in the Banking Book
o Concentration Risk
o Liquidity Risk
o Strategic Risk
o Reputation Risk
o Weaknesses in the risk mitigation techniques

(iv)
BR/12/2010.01
 o Underestimation of credit risk with the adoption
of the Standardised approach
o Other risks
Other risks o Business risk (including quality of earnings)
o General Strategy
o Economic and regulatory environment
o Stress testing

o For each risk type, an explanation regarding the methodology applied for its
monitoring and measurement and the quantitative results of that assessment;

o Where relevant, a comparison of that assessment with the results of the Pillar 1
calculations;

o A clear articulation of the banks risk appetite separately for each risk category
if this varies from the overall assessment; and

o Where relevant, an explanation of any other methods or other specific

techniques or arrangements apart from capital used to mitigate the risks e.g.
insurance, risk management or control structures.

Accordingly, some of the major risks a bank might face and therefore need to assess
as part of its ICAAP, are examined below. It should be stressed that this is not an
exhaustive analysis of bank risks. Furthermore, banks might classify certain risks
differently.

Residual credit risk

While banks use credit risk mitigation (CRM) techniques to reduce their credit risk,
these techniques give rise to other risks that may render the overall risk reduction less
effective. These additional risks are legal risk, documentation risk and liquidity risk
and are of supervisory concern. The Commission will expect banks to have in place
appropriate written CRM policies and procedures in order to control these residual
risks. Banks may be required to submit these policies and procedures to the MFSA
and must regularly review their appropriateness, effectiveness and operation.

Credit concentration risk

A risk concentration is any single exposure or group of related exposures with the
potential to produce losses large enough to threaten a banks health or ability to
maintain its core operations. Risk concentrations are arguably the single most
important cause of major problems in banks. Credit risk concentration arises in both
direct exposures to obligors and may also occur through exposure to protection
providers such as guarantors. Such concentrations are not addressed in the Pillar 1
capital charge for credit risk. Banks should have in place effective internal policies,
systems and controls to identify measure, monitor, and control their credit risk
concentrations. They should explicitly consider the extent of their credit risk
concentrations in their assessment of capital adequacy under Pillar 2. These policies

(v)
BR/12/2010.01
should cover the different forms of credit risk concentrations to which a bank may be
exposed.

Credit risk concentrations include:

 A significant exposure to an individual counterparty or group of counterparties.

Banks might also establish an aggregate limit for the management and control
of all of its large exposures as a group;

 Credit exposures to counterparties in the same economic sector or geographic

region;

 Credit exposures to counterparties whose financial performance is dependent on

the same activity or commodity; and

 Indirect credit exposures arising from a banks CRM activities (e.g. exposure to
a single collateral type or to credit protection provided by a single counterparty).

A banks framework for managing credit risk concentrations should be clearly

documented and should include a definition of the credit risk concentrations relevant
to the bank and how these concentrations and their corresponding limits are
calculated. Limits should be defined in relation to a banks capital.

A banks management should conduct periodic stress tests of its major credit risk
concentrations and review the results of those tests to identify and respond to potential
changes in market conditions that could adversely impact the banks performance. A
bank should ensure that, in respect of credit risk concentrations, it complies with the
Basel Committee document Principles for the Management of Credit Risk (September
2000) and the more detailed guidance in the Appendix to that paper. (While the
MFSA has never actually issued a Banking Rule endorsing this Basel Committee
document, it expects banks to take account of it as part of its culture to foster the
adoption of international best practice guidelines by banks.)

The MFSA will assess the extent to which a bank considers its credit risk
concentrations in its ICAAP and how they are managed. Such assessments should
include reviews of the results of any stress tests carried out either locally or at the
group level. The MFSA will review the banks assessment and consider what action is
necessary where the risks arising from a banks credit risk concentrations are not
considered to be adequately addressed in the ICAAP.

Counterparty credit risk

Counterparty credit risk or CCR is the risk that the counterparty to a transaction could
default before the final settlement of the transactions cash flows. As CCR represents
a form of credit risk, in assessing it, banks are required to meet Basel II standards
regarding approaches to stress testing, residual risks associated with CRM
techniques, and credit concentrations, as specified in the paragraphs above.

Banks must have counterparty credit risk management policies, processes and systems
that are conceptually sound and implemented with integrity relative to the

(vi)
BR/12/2010.01
sophistication and complexity of a firms holdings of exposures that give rise to CCR.
A sound counterparty credit risk management framework shall include the
identification, measurement, management, approval and internal reporting of CCR.

Banks risk management policies must take account of the market, liquidity, legal and
operational risks that can be associated with CCR and, to the extent practicable,
interrelationships among those risks. Banks must not undertake business with a
counterparty without assessing its creditworthiness and must take due account of both
settlement and pre-settlement credit risk. These risks must be managed as
comprehensively as practicable at the counterparty level (aggregating counterparty
exposures with other credit exposures) and at the bank-wide level.

A banks board of directors and senior management must be actively involved in the
CCR control process and must regard this as an essential aspect of the business to
which adequate resources need to be devoted. Reports prepared on a firms exposures
to CCR must be reviewed by a level of management with sufficient seniority and
authority to enforce both reductions of positions taken by individual credit managers
or traders and reductions in the firms overall CCR exposure.

The measurement of CCR must include monitoring daily and intra-day usage of credit
lines. The bank must measure current exposure gross and net of collateral held where
such measures are appropriate and meaningful (e.g. OTC derivatives, margin lending,
etc.). Banks must take account of large or concentrated positions, including
concentrations by groups of related counterparties, by industry, by market, customer
investment strategies, etc.

Banks must have a process in place for ensuring compliance with a documented set of
internal policies, controls and procedures covering CCR management.

Interest rate risk on the banking book

The MFSA will require banks not holding capital commensurate with their level of
interest rate risk to reduce their risk, to hold a specific and appropriate amount of
capital or some combination of the two. Further guidance on interest rate risk in the
banking book may be found in BR/12.

Operational risk

Gross income, used in Pillar 1 under the Basic Indicator and Standardised Approaches
for operational risk, is only a proxy for the scale of operational risk exposure of a
bank and can, in some cases (e.g. for banks with low margins or profitability)
underestimate the need for capital held against potential losses arising from
operational risk. Drawing on the Basel Committee document on Sound Practices for
the Management and Supervision of Operational Risk (February 2003), the ICAAP
should include consideration of whether the capital requirement generated by the
Pillar 1 calculation for operational risk gives a realistic picture of the banks
operational risk exposure.

(vii)
BR/12/2010.01

Credit risk

A bank may be aware of particular circumstances that it believes would lead the
Standardised Approaches to credit risk under Pillar 1 to give rise to an
underestimation of credit risk. An example is where certain banks have adopted the
practice of giving indicative credit facilities to clients on an uncommitted basis. Such
clients are often significant corporate customers. Commercially a bank may not
realistically be able to walk away from that relationship and the credit risk of such
uncommitted facilities needs to be recognised. It is important to estimate the
realistic exposure to the potential borrower (not just the contractual exposure) and
reflect that as a credit risk against which there should be a capital charge. As with
operational risk, the ICAAP should include consideration of whether the capital
requirement generated by the Pillar 1 calculation gives a realistic picture of the banks
credit risk exposure.

Reputational Risk

Reputational risk (to banks and to the jurisdictions from where they operate) is one of
the most important risks in international finance centres. The Authority will expect
banks to have assessed the reputational risk contained in their high risk accounts and
relationships and to have used a proxy (which might be the number or proportion of
high risk accounts or relationships a bank has on its books) to generate a capital
charge for reputational risk and/or provide evidence of measures in place to mitigate
that reputational risk. An example of such measures could be robust and clear
customer acceptance procedures and implemented processes with no blind spots
with respect to names of underlying principals (for example the inappropriate use of
pooled accounts). A robust customer risk-profiling regime would be a prerequisite.

Liquidity Risk

Liquidity risk is the risk that a bank is unable to fund increases in assets and meet
obligations as they come due. Managing this risk is not only crucial to the ongoing
viability of a bank; it also transcends the individual bank since a liquidity shortfall at a
single bank can have system-wide repercussions. For this reason the analysis of
liquidity requires bank management not only to measure the liquidity position of the
bank on an ongoing basis but also to examine how funding requirements are likely to
evolve under various scenarios, including adverse conditions. As with managing other
risks, sound liquidity risk management involves setting a strategy for the bank,
ensuring effective board and senior management oversight, as well as operating under
a sound process for measuring, monitoring and controlling liquidity risk.

Strategic/Business Risk

Strategic and business risks are the impact on capital arising from adverse business
decisions, improper implementation of those decisions, or a lack of responsiveness to
political, fiscal, regulatory, economic, cultural, market or industry changes. Banks
should constantly review and assess the compatibility of their strategic goals to the
prevailing environment in which they have material operations. There will be both
quantitative and qualitative dimensions to the resources needed to carry out business

(viii)
BR/12/2010.01
strategies but these will include effective communication channels, efficient operating
systems, reliable delivery networks, and good quality management and staff.

Methodology and Assumptions

A description of how assessments for each of the major risks have been approached
and the main assumptions made.

a) Minimum capital requirement approach (Pillar I + approach)

Banks may choose to base their ICAAP on the results of the Pillar I calculation with
additional risks (e.g. concentration risk, interest rate risk in the banking book etc.)
assessed separately and added to Pillar I.

The description here should indicate clearly which risks are covered by which
modelling or calculation approach. This would include details of the methodology and
process used to calculate risks in each of the categories identified and reason for
choosing the method used in each case.

b) Internal model design (structured or advanced methodology)

Alternatively, banks may decide to base their ICAAP on internal models for all risks,
including those covered under Pillar I (i.e. Credit, Market and Operational Risks).
Where the bank uses an internal model for the quantification of its risks, this section
would explain for each of those models:

o the key assumptions and parameters within the capital modelling work and
background information on the derivation of any key assumptions;

o how parameters have been chosen, including the historical period used and the
calibration process;

o the limitations of the model;

o the sensitivity of the model to changes in those key assumptions or parameters

chosen; and

o the validation work undertaken to ensure the continuing adequacy of the model.

Economic and regulatory capital

In this section, the bank should set out its explanations for any differences between
the internal economic models and the regulatory models (if any) approved by the
MFSA. The explanations should refer to the parameters used, the assumptions made
and how these affect the capital measures.

In addition, it is expected that a comparison between the calculated internal capital

and the minimum required regulatory capital for Pillar I risks is provided. In this
respect, the MFSA expects the bank to comment upon the composition and the
adequacy of the capital maintained.

(ix)
BR/12/2010.01
The MFSA expects that these explanations will be provided, on a sufficiently sound
basis to show the differences at the level of all risk categories under Pillar I, that is,
credit risk, market risk and operational risk.

It is noted that this information is expected from banks that apply advanced methods
for the calculation of capital requirements.

Stress and scenario tests applied

The MFSA places special importance on the performance of stress tests or scenario
analyses which have been used by credit institutions. Consequently, it expects a
detailed and relevant exposition which should provide the following:

details of all stress tests and simulations carried out by the bank to capture risks
not well estimated by the banks internal capital model (e.g. non-linear
products, concentrations, illiquidity and gapping of prices, shifts in correlations
in a crisis period);

details of the quantitative results of stress tests and scenario analyses the bank
carried out and the confidence levels and key assumptions behind those
analyses, including, the distribution of outcomes obtained for the main
individual risk factors;

details of the range of combined adverse scenarios which have been applied, the
reasons for choosing such scenarios and the resulting capital requirements; and

details of any corrective measures including risk mitigation and/or capital

allocations.

Capital transferability

Details of any restrictions on the managements ability to transfer capital into or out
of the business(es) covered, for example, contractual, commercial, regulatory or
statutory restrictions that apply. Statutory restrictions could be limited to the
maximum dividend that could be declared and paid following certain actions to
maximise distributable reserves, through for example, crystallising unrealised gains,
the ability for capital transfer within a group (if applicable) and the minimum
regulatory restrictions and contractual reserves that should be maintained.

Assessment of qualitative factors

The MFSA expects to receive information in relation to the internal processes that the
bank uses to monitor and control the various risks. This information is expected to
cover issues such as the banks system of internal controls, its organisational
structure, its internal governance etc.

(x)
BR/12/2010.01
5. CAPITAL PLANNING

This section would explain how a bank would be affected by an economic recession
or downswings in the business or market relevant to its activities. The MFSA places
particular importance on a banks ability to manage its business and capital so as to
survive a recession whilst meeting minimum regulatory standards. The analysis would
include financial projections (including capital projections) based on the expected
(basic) scenario as well as on possible adverse scenarios covering three to five years
based on business plans and projected capital adequacy ratio calculations.

For that purpose, the severity of the recession would typically be one that occurs only
once in a 25 year period. The time horizon would be from the present day to at least
the deepest part of the recession. Moreover, the key macroeconomic factors on which
the various scenarios are based and the reasons for choosing them are expected to be
laid out.

Typical scenarios would include:

how an economic downturn would affect

o the bank's capital resources and future earnings; and

o the banks capital requirement taking into account future changes in its
projected balance sheet;

in both cases above, it would be expected that these projections showed

separately the effects of management actions to change the bank's business
strategy and the implementation of contingency plans;

projections of the future capital requirement would include the effect of changes
in the credit quality of the bank's credit risk counterparties (including possible
migration in their ratings during a recession) and the banks capital and its credit
risk capital requirement (note that this scenario stress test is a requirement for
banks with an IRB permission); and

an assessment by the bank of any other capital planning actions to enable it to

continue to meet its regulatory capital requirements throughout a recession such
as new capital injections from related companies or new share issues.

This section would also explain which key macroeconomic factors are being stressed,
and how those have been identified as drivers of the bank's earnings. The bank would
also explain how the macroeconomic factors affect the key parameters of the internal
model (and for credit risk, the regulatory model) by demonstrating for instance how
the relationship between the two has been established.

Management Actions

This section would expand on the management actions assumed in deriving the
ICAAP, in particular:

(xi)
BR/12/2010.01
 the quantitative impact of management actions sensitivity testing of key
management actions and revised ICAAP figures with management actions
excluded; and

evidence of management actions implemented in the past during similar periods

of economic stress.

It is to be noted that where a bank has an IRB permission, then this section may set
out management actions which mitigate the additional capital suggested by the
mandatory credit rating migration stress test. Alternatively, such actions might be set
out in a separate capital management plan or otherwise approved by senior
management or Board as actions the bank is committed to realistically take in such
circumstances.

6. LIQUIDITY PLANNING

This section would summarise how liquidity risk is managed (as distinct from any
capital set aside to cover losses incurred in a liquidity stress). In particular, it would
set out the key assumptions and conclusions from stress testing of cash flows
undertaken to manage the risk. It would generally be helpful for the ICAAP to include
as appendices the following, where relevant:

asset-liability committee (ALCO) papers and samples of management

information used day-to-day in Treasury departments: daily cash flow forecasts,
weekly, monthly etc;

liquidity and funding policy documentation (solo and group);

internal Audit reports relating to Treasury departments;

an organisation chart that covers liquidity and funding risk management

delegated authorities and reporting lines within the bank;

limit breach, policy documentation;

securitisation documentation detailing how the programmes function;

liquidity stress testing documentation;

an explanation of intra-group liquidity arrangements (if any/applicable),

especially if operating in several countries;

number, scale and timeline of commitments whether formal or informal

towards:

o off-balance sheet financing vehicles

o market counterparties (including margin or collateral obligations) or

(xii)
BR/12/2010.01
 o towards clients;

analysis of liquidity demands and sources of liquidity (ie funding risk and
market liquidity risk affecting assets) by name and considering strategic and
tactical management of the risk; and

quantified contingency funding plans.

Whilst capital is an imperfect mitigant (i.e. is not a preventative measure) for liquidity
risk, there may well be a capital cost of a liquidity stress. Banks should therefore
consider here or in the previous section such scenarios as a ratings downgrade or other
event which might increase their cost of funding and therefore absorb capital reserves.

While this section should also take into consideration the provisions and requirements
of the MFSAs Banking Rule BR/05 on Liquidity, it should be recognised that might
need to be reviewed in the near future in the light of the adoption by the Authority of
the forthcoming CEBS guidelines on Liquidity Risk Management in its BR/05.

7. AGGREGATION AND DIVERSIFICATION

The processes of risk assessment and stress testing combined with assessments of the
impact of risks and the probability of them occurring will enable banks to begin to
assign specific quantitative measures to particular risks. These quantitative
assessments should help the management of banks to determine the relative
importance of the risks facing the bank. This, in turn, will assist bank management to
decide whether to allocate additional capital (and, if so, how much capital) or to
establish, enhance or maintain other mitigants to address those risks. Other mitigants
might be specific procedures, controls or insurance programmes. Where a bank
decides to allocate additional capital as a mitigant against particular risks, these
additional capital sums should be aggregated to provide an additional capital
requirement under Pillar II. This would be added to the minimum capital figure
derived from Pillar I to give the banks overall capital charge.

This section would describe how the results of the various separate risk assessments
are brought together and an overall view taken on capital adequacy. At a technical
level, this therefore requires some method to be used to combine risks using
quantitative techniques. At the broader level, the overall rationality of the detailed
quantification approaches might be compared with the results of an analysis of capital
planning (see section 5) and a view taken by senior management as to the overall
level of capital that is appropriate.

Dealing with the technical aggregation, this would describe:

i) any allowance made for diversification, including any assumed

correlations within risks and between risks and how such correlations
have been assessed, including in stressed conditions;

(xiii)
BR/12/2010.01
 ii) the justification for any credit for diversification benefits between legal
entities, and the justification for the free movement of capital between
them in times of financial stress; and

iii) the impact of diversification benefits with management actions excluded.

It might be helpful to set out revised ICAAP figures with all correlations
set to 1 i.e., no diversification; and similar figures with all correlations
set to 0 i.e. assuming all risks are independent.

As regards the overall assessment, this would describe how the bank has arrived
at its overall assessment of the capital it needs, taking into account such matters
as:

i) the inherent uncertainty in any modelling approach;

ii) weaknesses in the banks risk management procedures, systems or

controls;

iii) the differences between regulatory capital and internal capital; and

iv) the differing purposes that capital serves: shareholder returns, rating
objectives for the bank as a whole or certain debt instruments the bank has
issued, avoidance of regulatory intervention, protection against uncertain
events, depositor protection, working capital, capital held for strategic
acquisitions etc.

8. CHALLENGE AND ADOPTION OF THE ICAAP

This section would describe the extent of challenge and testing of the ICAAP. It
would include the testing and control processes applied to the ICAAP models or
calculations, and the senior management or board review and sign-off procedures. It
might be helpful if a copy were attached of any relevant report to senior management
or the board and their response.

Details of the reliance placed on any external suppliers would also be detailed here
e.g. for generating economic scenarios.

In addition, a copy of any report obtained from an external reviewer or internal audit
would also be included.

9. USE OF THE ICAAP WITHIN THE BANK

This would demonstrate the extent to which capital management is embedded within
the bank including the extent and use of capital modelling or scenario analysis and
stress testing within the bank's capital management policy, e.g. in setting pricing and
charges and the level and nature of future business.

(xiv)
BR/12/2010.01
This would also include a statement of the actual operating philosophy on capital
management and how this links to the ICAAP submitted. For instance, differences in
risk appetite used in the ICAAP as compared to that used for business decisions might
be discussed.

Finally, it would be helpful if the bank could detail any anticipated future refinements
within the ICAAP (highlighting those aspects which are work-in-progress) and
provide any other information that you believe will help us review your ICAAP. The
MFSA will assess the ICAAP to establish whether the amount of capital identified by
the ICAAP is sufficient to support the risks faced by the bank.

The MFSA will review the corporate governance framework around the ICAAP and
will pay particular attention to Board and senior management oversight and
involvement, as well as responses to any issues raised by the MFSA during the
review. It will also consider the extent to which the internal capital assessment is used
routinely within the bank for decision making purposes.

The MFSA places particular importance on the integration of the ICAAP within the
banks decision making process. Therefore, it is expected that banks disclose the
methods of utilising the results of their internal models, of the various stress tests etc.
in the decision making process e.g. during the determination of their pricing policy, in
the course of evaluating investment options etc.

(xv)
BR/12/2010.01