Index. Table 1 General requirements..5. Table 2 Scope of application Table 3 Supervisory capital structure Table 4 Capital adequacy...

Transcription

1 Basel 2 Pillar 3 Disclosure December 31 st, 2008

2 BASEL 2 THIRD PILLAR AS AT 30 JUNE 2008

3 Index Table 1 General requirements..5 Table 2 Scope of application...21 Table 3 Supervisory capital structure...24 Table 4 Capital adequacy...26 Reclassification of financial assets Table 5 Credit risk: general disclosures for all banks...32 Table 6 Credit risk: disclosures for portfolios treated under the standardized approach and specialized lending and equity exposures treated under IRB approaches...43 Table 7 Credit risk: disclosures for portfolios treated under IRB approaches...46 Table 8 Risk mitigation techniques...91 Table 9 Counterparty risk...95 Table 10 Securitization transactions Table 11 Market risks: disclosures for banks using the internal models approach (IMA) for position risk, foreign exchange risk and commodity risk Table 12 Operational risk Table 13 Equity exposures: disclosures for banking book positions Table 14 Interest rate risk on positions in the banking book Declaration by the Senior Manager in charge of drawing up Company Accounts..129 Glossario / Abbreviazioni.. 130

4 Notes: 1. All the amounts, if not differently specified, are expressed in Euro thousands; 2. Data are referred to the prudential scope of consolidation; BASEL 2 THIRD PILLAR AS OF DECEMBER 31 st, 2008

5 Table 1 General requirements Qualitative disclosure Credit risk Group risk management (principally credit, market and operational risk and combinations of these) is performed by Group Risk Management (the CRO s department), to which have been assigned the following functions: to optimise asset quality by minimising the cost of the relevant risks, in line with the risk/return objectives assigned to each business area; to define, in concert with the CFO function, the Group s risk appetite and to evaluate its capital adequacy; to ensure the strategic line and the definition of the Group risk managerial policies to set up a credit risk control system both at single counterparty (economic groups could be included) and significant clusters (e.g.: as geographical areas, economic sectors) level, monitoring the limits beforehand defined. to define and provide to the divisions and to the legal entities the valuation, managerial, monitoring a d communication criteria of the aforesaid risks and to ensure the consistency of the systems and control procedures both at Group and at single entity level; to create and spread a risk culture expanded to the whole Group, through the training, in cooperation with other Parent company departments; to support the business divisions to achieve their goals, contributing to products and to business development The Risk Committee, which is chaired by the CEO and comprises the Deputy CEOs, the Chief Risk Officer, the Chief Financial Officer and the Chief Strategic Officer, provides advice and proposals to governing bodies or risk decisiontaking bodies that (according to their responsibility and function) approve strategic guidelines, financial policy directives, Group policy and methodologies for the measurement of all types of risk. To ensure optimal risk management while devoting increasing attention to the needs of business, Risk Management structured around a Strategic Risk Management & Control department - which centralises Group-wide governance, control, management and overall risk reporting by defining methodologies, strategies, guidelines, general policy and that relating to interdivisional risk, in order to ensure a uniform and consistent approach to Group-wide topics plus three structures known as Divisional Risk Offices (DROs), which are responsible for controlling, managing and reporting risk at the Business Division level (i.e., Corporate / Private Banking, Retail and Market & Investment Banking (MIB)) by drawing up divisional guidelines, specific policies and coordinating, supporting and interfacing with the subsidiaries in its competence area. In order to enforce the independent capability to rule and to control the managerial and control processes of credit risks, it has been carried on with the adoption of the sectorial specialization to grant credit facilities to corporate customers, that has implied the creation of specific roles in the Parent company; furthermore, it has been established a specific function in the Parent company to manage the Restructuring assets and the recovery of loans. 1

6 Responsibility for the organisational processes for the management of credit and market risk is vested in departments belonging to Organisation. Management of the Basel 2 project is vested with a dedicated project team, which reports directly to the Deputy CEO in charge of organisational and service functions, in co-leadership with the Strategic Risk Management & Control department. Credit risk concentration limits in respect of supervisory capital are subject to the Parent s opinion on large exposures. Relations between the Parent and Group entities carrying on credit business are governed by specific governance documents which attribute the same role of governance, support and control to the Parent, in the following areas: credit policies, by ensuring that credit principles are adopted and followed, as well as the common rules and for credit approvals, monitoring / management and recovery, within the local characteristics of each country of operation credit strategies, by ensuring that the Group s credit portfolio is appropriately structured to optimise value creation models, ensuring that Group credit risk assessment and measurement systems are consistent and uniform, in respect of each borrower and each portfolio credit concentration risk, by realising centralisation within the Parent of credit risk approvals vis-à-vis banks and sovereign states, and the similar process whereby large exposures are assessed, measured and controlled for the Group credit products, by providing guidelines for issuance and monitoring, and monitoring portfolio credit risk, by enabling the relevant governing bodies to be regularly and promptly informed of this aggregate aount for every Group entity. According with the role given to the Parent, specifically to the CRO s department, under Group governance, General Group Credit Policies instructions for the performance of credit business Group-wide have been issued to lay down the rules and principles that should guide, govern and make uniform the assessment and management of credit risk, in line with Group principles and best practice. The general rules are supplemented by specific rules governing credit business with certain counterparties (e.g., banks and sovereign states), process stages (e.g. classifying and managing risky positions or the recovery process and management of general provisions using the IBNR method) or industrial sectors (including the commercial real estate financing policy, which gives common standards and methods as well as specific parameters for business in the various regions in which the Group operates, and the bridge equity policy, which gives guidelines for equity finance and capital investment). The CRO s department within the Parent is also responsible for realising and utilising specific methodologies for the management and measurement of credit risk and, in cooperation with the Organisation department, which is responsible for the pertinent processes, their implementation in compliance with Basel 2 standards and Banca d Italia requirements. As noted above, credit risk is measured for individual counterparties and portfolios. For individual borrower risk the logic and tools supporting credit business are differentiated according to the type of customer. The assessment of a counterparty s creditworthiness, on examination of a loan application, begins with an analysis of the client s financials and the quality of its business (competitive positioning, corporate and organisational structure, etc., where the borrower is a corporate), regional and sectoral factors (corporate borrowers) and account conduct within the bank and the banking system (e.g., central risk bureau), in order to reach a rating, i.e., its PD out to a oneyear time horizon. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 2 AS OF DECEMBER 31 st, 2008

7 Borrower creditworthiness is reviewed annually on the basis of new information acquired during the year. The borrower is assessed within its industrial group or conglomerate, where relevant, thus considering the maximum exposure of the UniCredit Group towards the client s group. Monitoring is in two stages, which use different tools and information sources: daily checks for anomalies are based on information arising from the ongoing client relationship; systematic oversight uses automated systems to promptly identify positions with symptoms of deterioration in risk terms and manage the account accordingly. Systematic oversight, which is monthly, centres on account conduct management, which uses all internal and external information to produce a credit score; this indicates the riskiness of each monitored borrower and is obtained using a statistical function which filters all the available information through a set of variables which have been shown to be significant as indicators of a future default, twelve months in advance. The tools and the processes used for loan approval and monitoring, without prejudice to the general principles mentioned below, are adapted according to the customer segment to ensure maximum effectiveness. This set of data produces an internal rating, which takes into account both quantitative and qualitative information as well as the account conduct information seen in the scoring described above. The internal rating, i.e., the borrower s risk level, is used to calculate the lending authority required to approve loans to the borrower. The discretion of credit officers and committees becomes progressively smaller, the higher the borrower risk, when required to approve a facility of a certain amount. The organisational model includes a Rating Desk and a Rating Committee for large exposures, which is independent of the approval function, and responsible for the management of any changes to the automatic rating produced by the model using overrides. The above mentioned rating models are used to calculate the supervisory capital requirement according to the First Pillar regulation, but they represent above all a basic component of the decision and governance processes. In detail the areas where these internal rating systems are mainly used are: the credit processes, through the different steps of approval / reviewing, monitoring and recovery of loan; the provision policies, both for the performing and non performing loans; the capital management and allocation, that is to say the measurement, management and allocation process; the strategic planning, the budgeting and forecast, for the quantification of RWA, to the P&L net writedowns and of the Balance-Sheet risk assets; the consolidated /divisional / regional / single entity reporting for the top management. Several entities have initiated projects aiming to bring their credit processes into line with the above Group best practice. Group entities are required to seek the Group CRO s department s opinion before granting or reviewing lines of credit to individual borrowers or groups, whenever they exceed certain amounts, which have been appropriately modulated on the basis of objective parameters, also with reference to the obligation to comply with the counterparty limit to the concentration of risk that has to be measured with the supervisory capital. Besides the methodologies summarized in the rating systems, the function risk management uses portfolio models enabled to calculate value-at-risk (VaR) measures tor each subsidiary of the group, for the divisions in which the subsidiaries are managed, for each other aggregation aimed to reporting and monitoring of credit risk. These models supply economic capital measures reallocated to single counterparties included in the analyzed portfolios and they are the basis of risk adjusted performance measures 3

8 The economic capital measures (Credit VaR) are also a basic input for the preparation and use of credit strategies, analysis of credit limits and risk concentration. The economic capital calculation engine is also used for stress testing analysis on credit portfolio, starting from macroeconomic variables that influence the different segments as country, segment, size, etc. The Group CRO s department monitors the credit risk portfolio systematically and produces both regular and one-off reports covering the Group, with the aim of analysing the main components of credit risk and monitoring changes over time, in order to detect signs of deterioration in a timely manner and undertake suitable corrective action. The performance of the credit portfolio is analysed with reference to its main drivers such as growth and risk indicators - customer segments, industrial sectors and the performance of credits in default and the relevant coverage. Group-wide monitoring and reporting of the portfolio is achieved in close cooperation with Divisional Risk Officers DROs who report on and monitor their respective divisional credit risk, implementing specific monitoring and reporting tasks on the exposures subjected to credit risk Besides the reports dedicated to credit risk, it has been periodically made a brief report about the Group exposure with the different risks (e.g.: credit, market, operational, business) that is brought to the attention of the Top Management and the Risk Committee. According to Basel II provisions - Second Pillar credit strategies on the whole Group credit portfolios is one of the advanced instruments of credit risk management. There are three objectives when credit strategy is formulated: to define the optimal make-up of credit portfolios minimizing the overall credit risk impact, starting from an shared risk appetite in line with the Group s capital allocation and value creation criteria and framework to provide support to the responsible functions and Divisions in the Parent and Group entities when the latter take measures to optimise the portfolio make-up through strategic plans and business initiatives to provide a set of guidelines and support when drawing up business and credit budgets, in line with the Group s strategic vision. The arrangement of credit strategies is done synthesizing the risk analysis made top-down with the portfolio view of the business functions, through a strict cooperation among the centralized and divisional Risk Management Departments. Credit strategies are implemented by using all available credit risk measures especially the credit VaR model, which enables correct and prudent management of portfolio risk, using advanced methodologies and tools. Parallely a set of qualitative information coming from divisional structures, taking into account the different territorial characteristics, are incorporate and transformed in input variables for the credit portfolio optimization models. More generally, as part of credit strategy these applications are subjected to vulnerability analysis and used to support Capital Adequacy, through the check and management of credit risk stress testing referred to (Pillar I and Pillar II). Portfolio risk management pays special attention to credit concentration in light of its importance within total assets. This risk, according to the Basel 2 definition, consists of exposure to any counterparty or industrial group with the potential to generate losses of such magnitude as to prejudice the Group s ability to carry on its normal business. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 4 AS OF DECEMBER 31 st, 2008

9 In order to identify, manage, measure and monitor concentration risk, the Parent s function sets credit limits and consequently monitoring them using various operating procedures to cover two different types of concentration risk: - significant amount credit exposures on the name of a single counterparty or to a set of counterparties economically connected ( bulk risk ); - credit exposures of counterparties belonging to the same economic sector ( sectorial risk ). Please refer to Table 8 Credit Risk Mitigation Techniques Qualitative Information for coverage and risk mitigation policy. Management, measurement and control One of the credit risk management responsibilities of Group HQ's CRO area is to manage and measure credit risks through the design and use of appropriate methods. This task also involves updating previously developed methods in order to ensure, in cooperation with Global Banking Services (which is responsible for organizational processes), that these policies are implemented in accordance with Basel II standards and the requirements of Banca d'italia. Credit risk is measured at individual borrower level and for the whole portfolio. The approach and tools used for lending to individual borrowers during both the approval and monitoring phases include a credit rating process with high added value, which is differentiated by customer category. During the credit application review process, a customer s creditworthiness is assessed on the basis of an analysis of the following: operating, financial and cash flow data; qualitative information regarding the company s competitive position, its corporate and organizational structure, etc. (only for business customers in the Corporate area); geographical and sector characteristics (only for business customers in the Corporate area); performance data at bank and industry levels (e.g., the Central Risk Bureau); and necessary to assign a rating, meaning the borrower s PD (probability of default) over a time horizon of one year. Each borrower s credit rating is reviewed annually on the basis of new information received during the year. Each borrower is also assessed in the context of any business group with which it is affiliated by taking into account the theoretical maximum risk for the entire Group. Monitoring is carried out using automated systems designed to enable rapid identification and appropriate management of positions showing signs of a deteriorating risk profile, on the basis of models originally created for the Group s Italian entities. Regular monthly monitoring focuses on borrower performance management. This uses all available internal and external information to arrive at a score that represents a short assessment of the risk associated with each borrower monitored. This score is obtained using a statistical function that summarizes available information using a set of proven significant variables that are predictors of an event of default 12 months in advance. Subject to the more general principles given below, the tools and processes used for loan approval and monitoring incorporate appropriate adaptations to address the unique characteristics of different customer segments in order to ensure the highest degree of effectiveness. All information is statistically summarized in an internal rating that takes quantitative and qualitative elements into account, as well as information on the borrower's conduct of the account, if available, which is taken from the loan management scoring procedures described above. 5

10 The internal rating, or risk level assigned to the customer, forms a part of the lending decision calculation. In other words, at a constant credit amount the lending powers granted to the appropriate bodies are gradually reduced in proportion to a heightened borrower-related risk level. The organizational model in use calls for a rating desk, which is separate from loan approval functions. This unit is charged with managing any adjustments made to the automated opinion provided by the model using an override process. Several Group entities have launched projects to standardize lending processes on the basis of the Group s best practice as described above. Other entities are required to ask Group HQ CRO area for its special opinion before providing or reviewing credit facilities for individual customers or business groups if these lines exceed preset limits adjusted according to objective parameters. UniCredit has been authorised by Banca d Italia to use advanced methods to determine regulatory capital for credit risk under Basel 2. In the first stage these methodologies have been adopted by the Parent, certain Italian subsidiaries, HypoVereinsbank (HVB AG) and Bank Austria (BA AG). The remaining Group entities will apply them under a plan of gradual extension notified to Banca d Italia. These ratings are used to calculate the regulatory requirement under Pillar I, but they are principally a fundamental component of decision-making and governance. The main areas where internal rating systems are used are the following: Credit Process, as follows: - Loan approvals and renewals. The assignment of an internal rating is a key factor in credit assessment of counterparty and transaction and the preliminary stage of approval or renewal of a line of credit. The rating is assigned before the credit decision is taken and included in the approval process as an integral part of the assessment, and commented on in the credit proposal. The rating is therefore indispensable, together with the amount of the line, in the selection of the appropriate position or committee for the credit decision. - Monitoring. Credit monitoring aims to identify and promptly react to early symptoms of deterioration in the borrower s credit quality and thus to be able to act before any default occurs, i.e., when there it is still possible to recover the loan. Monitoring focuses primarily on the use of the facility and outcomes concerning the exposure, up to complete closure of the borrowing relationship, where necessary. This not only impacts positively on EAD, it also makes it possible to optimise the conditions for a later recovery, in so far as additional collateral or guarantees are obtained from the borrower, causing a reduction of LGD. - Workout. The process of deciding the strategy to be followed for defaulting loans in respect of the borrower and the transaction, aiming to calculate the Net Present Value of net amounts recovered and the LGD, is based on the LGD definition. If there are alternative strategies, the choice falls on the one with the lowest forecast LGD. LGD is also the basis for the pricing of nonperforming loans transferred to Aspra Finance. Provisioning Policy. Performing loans attract generic provisions on an IBNR basis ( Incurred but not reported losses,), which gives expected loss values using the LCP (Loss Confirmation Period) to calculate provisions. Defaulting loans expected losses are based on a risk assessment and the LGD. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 6 AS OF DECEMBER 31 st, 2008

11 Capital Management and Allocation. Ratings are an essential element for the quantification, management and allocation of capital. The rating systems outputs are assembled by the Parent to arrive at a rating for the whole Group, when measuring capital (both regulatory and economic) and managing capital, on the one hand; and in determining risk-adjusted performance and the adjusted income statement for strategic planning purposes, on the other. Strategic Planning. Borrower risk is an important driver for strategic planning, budgeting and forecasting, for the quantification of RWA, net adjustments to the income statement and loans held in the balance sheet. Reporting. Specific reports are produced for senior management on the credit risk portfolio s performance at consolidated, divisional and regional levels and by individual entity, including average EADs, ELs, PDs and LGDs for each customer segment, in accordance with the internal rating systems in use. Ratings are used in pricing and the targets set for account managers, as well as to identify borrowers producing negative EVA, for whom targeted action is taken. In order to comply with Basel 2, UniCredit Group has carried out specific activities to define and meet all the requirements for the application of CRM (Credit Risk Mitigation) techniques, as follows: Policies were issued to transpose, interpret and internalise CRM within the Group. These documents are in accordance with Banca d'italia Circular 263 dated 27 December 2006 as amended, EU directives 2006/48/CE and 2006/49/CE and the Basel Committee on Banking Supervision s "International Convergence on Capital Measurement and Capital Standards: a New Framework" and aimed to encourage optimisation of the management of loan security and to define the rules for accepting, assessing, monitoring and managing personal guarantees and collateral in line with general and specific requirements. New processes were designed to apply these policies in the management of loan security Group-wide. A gap analysis between the as-is and the target model was the basis for new loan security management processes to be implemented in line with Banca d Italia rules and Group guidelines. In assessing CRM techniques UniCredit Group emphasizes the importance of legal certainty, so this issue was given special attention. IT tools were introduced to automate the loan security management process. UniCredit Group developed a solid and effective system for the application of CRM techniques starting with the assessment and acquisition of loan security and extending through to monitoring and realising security/calling guarantees. This information system enables management, recording and archiving of the data necessary to verify that the guarantee acceptance criteria have been met and calculate the risk indicators. These data are used to determine whether loan security is valid under CRM and appropriate margins as required by Basel 2 (to assess volatility, internally calculated margins are determined based on Value at Risk methodology). Development of advanced rating systems and their introduction into the Group s processes required, under the new regulatory framework, that rating system validation processes be set up within the Parent and all Group entities using advanced rating, as well as an extension of the tasks to be performed by Internal Audit, now to include auditing the systems. 7

12 Validation aims to assess whether IRB systems work properly and are able to predict accurately as well as their overall performance and compliance with regulations, as follows: Assessment of the model development process, specifically its underlying logic and the methodological criteria underlying the calculation of risk parameters. Assessment of the accuracy of the estimates of all significant risk components by analysing the performance of the system, the calibration of the parameters and benchmarking. Checking whether the rating systems are actually in use in the various business areas. Analysing operating processes, control systems, documentation and the IT infrastructure used for the rating systems. The results of internal validation, carried out in accordance with the validation standards and using a depth of analysis according to the type, i.e., Group-wide or local, or location, i.e., Italy or outside Italy) of the rating system, are reported in a single framework with the aim of unifying the analysis of the various components of the rating system. The framework in use consists of a schedule showing the minimum quantitative and detailed organisational requirements of Banca d Italia against specific key principles, regarding various subject areas of analysis of the rating systems, viz. model design, risk components, internal use and reporting, IT and data quality and corporate governance, and serves to assess the detailed position of the rating system as against regulatory requirements. The areas of organisational analysis under the Circular are model design, internal use and reporting, IT and data quality and governance. The aims of internal audits of the internal rating systems include checking the functionality of the entire system of controls over them, specifically by checking: that IRB systems comply with the regulations how rating systems are used in the business and the adequacy and completeness of the validation process of rating systems. The Parent s Internal Audit Department in order to assist Group entities to ensure the quality of their Internal Control Systems and oversee changes in revision methodologies in line with changes in market scenarios has coordinated the development of a common methodology for revising rating systems. This methodology was developed in order to assess whether the conclusions of the risk control function were well grounded and whether regulatory requirements were being met, with special reference to the internal validation of internal rating and risk control systems. Market risk Generally speaking banks market risks are due to price fluctuations or other market risk factors affecting the value of positions on its own books, both the trading book and the banking book, i.e. those arising from transactions and strategic investment decisions. UniCredit Group s market risk management includes, therefore, all activities relating to cash and capital structure management, both in the Parent and in the individual Group companies. The Parent monitors risk positions at Group level. The individual Group companies monitor their own risk positions, within the scope of their specific responsibilities, in line with UniCredit Group supervision policies. The results of individual companies monitoring activities are, in any event, shared with the Parent company. The individual companies comprising the Group produce detailed reports on business trends and related risks on a daily basis, forwarding market risk documentation to the Parent company. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 8 AS OF DECEMBER 31 st, 2008

13 The Parent s Group Market Risk unit is responsible for aggregating this information and producing information on overall market risks. Organizational Structure The Parent s Board of Directors lays down strategic guidelines for taking on market risks by calculating, depending on the propensity to risk and objectives of value creation in proportion to risks assumed, capital allocation for the Parent company and its subsidiaries. The Parent s Risks Committee provides advice and recommendations in respect of decisions taken by the Chief Executive Officer and in drawing up proposals made by the Chief Executive Officer to the Board of Directors with regard to the following: guidance as to the methods to be used to realise models for the measurement and monitoring of Group risks; the Group s risk policies (identification of risk, analysis of the level of propensity to risk, definition of capital allocation objectives and the limits for each type of risk, assignment of related functional responsibilities to the relevant Departments and Divisions); corrective action aimed at rebalancing the Group s risk positions. The Risk Committee comprises the following members: the Chief Executive (Chair of the Committee), the Deputy General Managers, the Chief Risk Officer (chairs the Committee in the absence of the Chief Executive) and the Chief Financial Officer. The Head of the Group Internal Audit Department also attends meeting of the Risk Committee, but is not entitled to vote. In April 2008 the Board of Directors approved the reorganization guidelines for the Group Market Risks model, aimed at combining all Market Risk functionalities under a single responsibility and therefore established the new Group Market Risk Department within the MIB Divisional Risk Office and Group Market Risks Dept. In particular this entails: unifying responsibility for Market Risk Management (measurement, evaluation, monitoring and control) under the new Group Market Risks department ( as in point 2.2), responsible for trading and banking book risk management at Group level and for ensuring consistency in market risk policies, methodologies and practices across divisions and LEs establishing, within the new Group Market Risk department, two specialized teams for Trading and Treasury Risk Management, including: introduction of trading risk manager role, responsible for market risk management of its specific business lines Group-wide introduction of treasury risk manager role, responsible for treasury risk management of its specific banking books Group-wide establishing unitary groups for Market Risk architecture and methodologies, including responsibilities concerning Risk Technologies, Risk Methods, Model Testing and Group-wide New Products Process, but excluding Front Office Risk Modelling 9

14 eallocating responsibilities coherently between Holding and Legal Entities: in particular, Legal Entities/Branches will focus on local New Products Process ( NPP ) implementation, Infrastructure implementation, P&L validation and Desk Control maintaining the CRO s overall responsibilities on Group Market Risks and on MIB Market/ Credit Risks through guidance and monitoring activities to be performed also within the Risk Committee (competent body to approve/share DROs proposals referred to risk strategies, policies, models, limits and monitoring activities/ initiatives), of which the CRO is a member. As a consequence the Board of Directors approved on Aug 1 st the new Market Risk Governance which sets out the framework of the Holding Company Market Risks function in its guiding, supporting and controlling of the correspondent functions in the Legal Entities, in coherence with the role of UniCredit SpA as holding company. In short, the Parent company proposes limits and investment policies for the Group and its entities in harmony with the capital allocation process when the annual budget is drawn up. Group HQ's Asset and Liability Management unit, in coordination with other regional liquidity centers, manages strategic and operational ALM, with the objective of ensuring a balanced asset position and the operating and financial sustainability of the Group s growth policies on the loans market, optimizing the Group s exchange rate, interest rate and liquidity risk. Operational risk Operational risk is defined as the risk of loss resulting from error, violation, interruption, inadequate or failed internal processes, people and systems or from external events. This definition includes legal and compliance risk, but excludes strategic and reputational risk. For example, losses arising from the following can be defined as operational: internal or external fraud, employment practices and workplace safety, clients claims, product distribution, fines and penalties due to breaches of regulations, damage to the company s physical assets, business disruption and system failures or process management. UniCredit Group sets the operational risk management framework as a combination of policies and procedures for controlling, measuring and mitigating the operational risk of the Group and controlled entities. The operational risk policies, applying to all Group entities, are common principles defining the roles of the company bodies, the operational risk management function as well as the relationship with other functions involved in operational risk monitoring and management. The Parent company coordinates the Group entities according to the internal regulation and the Group operational risk control rulebook. Specific risk committees (Risk Committee, ALCO, Operational Risk Committee) are set up to monitor risk exposure, to define risk appetite and mitigating actions, to approve measurement and control methods. The methodology for data classification and completeness, scenario analysis, risk indicators, reporting and capital at risk measurement is set by the Parent company Operational Risk Management function and applies to all Group entities. A pivot element of the risk control framework is the operational risk management application, allowing the collection of the data required for operational risk control and capital measurement. In March 2008, the UniCredit Group received authorisation to use the AMA model for calculating operational risk capital. The use of this method will in time be rolled out to the main entities of the Group. Senior Management is responsible for approving all aspects relating to the Group operational risk framework and verifying the adequacy of the measurement and control system, and is regularly updated on changes to the risk profile and operational risk exposure, with support from the appropriate risk committees if required. The Parent company's committees and their functions are described below. The Risk Committee advises on drawing up guidelines and management policies for the different types of risk, notably deciding on measurement and control methods and the relevant rulebooks. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 10 AS OF DECEMBER 31 st, 2008

15 The Operational Risk Committee - chaired by the Parent company's head of ORM is made up of permanent and guest members. The permanent members are the functions of the Parent company: ORM and other functions involved in controlling and managing operational risk, including Compliance, Legal, Finance, Human Resources, Safety, Banking Services and Internal Audit. Other functions of the Parent company, representing the divisions and ORM functions of relevant entities, are called to sit on the Committee when required. The mission of the Operational Risk Committee is to support the Risk Committee, with responsibility for: proposing interventions on risk noticed or reported by the operational risk functions of the entities that have experienced the operational events or believe there to be exposure to operational risk; recommending insurance strategies for the Group and relevant coverage, including renewals, limits, and exemptions, based on joint proposals from the operational risk control function and the other functions involved; providing reports on existing insurance claims and contracts within the Group; reviewing reports on operational risk; proposing control procedures and limits on operational risk; monitoring risk mitigation actions. The ORM functions regularly update the Committee on the Group's operational risk exposure. Parent company operational risk management unit, in the Strategic Risk management & Control department, establishes the calculation model for operational capital at risk and the guidelines for operational risk control activities, supporting and controlling the legal entities ORM functions, in order to verify that Group standards are met in the implementation of control processes and methodologies. The Operational Risk Management functions of the controlled entities provide specific operational risk training to staff, who can also use intranet training programs, and are responsible for the correct implementation of the Group framework elements. The Parent company's Operational Risk Management function prepares regular updates on regulatory and managerial aspects of operational risk, which are sent to the functions responsible for operational risk control and management. In compliance with regulations, an internal validation process for the operational risk control and measurement system has been set up at the Parent company and the relevant Group entities. This process checks conformity with regulations and Group standards, and is the responsibility of the Operational Risk Management functions of the entities. The ORM functions must provide a summary of the activity carried out and the functions involved in the operational risk control process, and assess whether they comply with regulations and Group standards. Where areas for improvement are identified, the proposed actions must be indicated, along with, where possible, the predicted timeframe for their implementation. Each year, the ORM functions of the entities meeting the advanced (AMA) requirements and those of the Italian entities using the standard (TSA) method must compile the validation document and send it to the Parent company's ORM function (UniCredit ORM). The validation document, together with the opinion of UniCredit ORM and the Internal Audit report, are submitted to the entity's Board of Directors for approval. UniCredit ORM is also responsible for drawing up the Group validation document and submitting it to the UniCredit Board of Directors for approval, together with Internal Audit report. UniCredit developed a proprietary model for measuring the capital at risk. The system for measuring operational risk is based on internal loss data, external loss data (consortium and public data) scenario generated loss data and risk indicators. Capital at risk is calculated per event type class. For each risk class, severity and frequency of loss data are separately estimated to obtain the annual loss distribution through simulation, considering also insurance coverage. The severity distribution is estimated on internal, external and scenario generated data, while the frequency distribution is determined using only the internal data. An adjustment for key operational risk indicators is applied to each risk class. Annual loss distributions of each risk class are aggregated through a copula based method. Capital 11

16 at risk is calculated at confidence level of 99,9% on the overall loss distribution for regulatory purposes and at confidence level 99,97% for economic capital purposes. By the allocation mechanism, the individual legal entities capital requirements are identified, reflecting the Legal Entities risk exposure and risk management effectiveness. The AMA approach has been formally approved by the Supervisory Authority and is expected to be rolled out to all the relevant Group entities before the end of The entities not yet authorised to use the advanced methods contribute to the consolidated capital requirement on the basis of the standard or basic indicator approach. A reporting system has been developed by Parent company to inform senior management and relevant bodies about the Group operational risk exposure and the risk mitigation actions. In particular, quarterly updates are provided on operating losses, capital-at-risk estimates, relevant external events and the main initiatives undertaken to mitigate operational risk in the various business divisions. A summary of the most important risk indicators is drawn up each month. The results of the main scenario analyses carried out at Group level and the relevant mitigation actions undertaken are also submitted to the attention of the Group's Operational Risk Committee. Operational risk management requires process reengineering to reduce the risk exposure, including outsourcing considerations, and the insurance policies management, defining proper deductibles and policies limits. Regularly tested business continuity plans will also assure operational risk management in case of interruption of main business services. The Risk Committee (or other bodies in accordance to local regulations) reviews risks tracked by the Operational Risk functions of the Legal entities, with the support of functions involved in daily operational risk control, and monitors the risk mitigation initiatives. Other Risks The types of risk described above are the main ones. There are others. The Group has identified and re-delineated the risk types and broadened the range, in order to increase the accuracy of risk measurement. At the same time aggregation procedures were developed to enable measurement of overall risk, adding to each type through the determination of internal capital. This work has two aims: the main one is to improve understanding of the value drivers within each business line, so that Risk Management can play an effective role in decision-making. The second objective is to refine the internal control system, in which Risk Management is one of the main players. Redrawing and broadening the identified risk type perimeter to be managed in the Group is accomplished in two stages. The first is the recognition of risk implicit in existing assets and liabilities and the business carried on. The second is definition of measurement methods. Under the first stage the Group has identified the following risk types: business risk; real estate risk; equity investment risk; strategic risk and; reputational risk. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 12 AS OF DECEMBER 31 st, 2008

17 Defined as follows. Business Risk A contraction of margins not due to market, credit or operational risk, but changes in the competitive environment or customer behaviour. Business risk guidelines give a standard method of calculating the risk arising from income fluctuations. Only midsize and large subsidiaries are required to fully implement the model; small subsidiaries are exempted from this since this risk will be calculated using a simplified procedure. Data are collected quarterly according to a set format provided by the Parent and updated by each Group entity for accounts items that determine income and expense to be input to the model. These items are chosen in such a way as to avoid overlapping with other risk types. Historical series to be used to calibrate volatility and correlations are constructed starting with the monthly accounts and grouped in divisional clusters, while the annual market values by which they are multiplied are extracted from quarterly accounts. The calculation uses normal distribution, on the basis of which an EaR is calculated with a 99.97% confidence interval and a one-year time horizon (variance-covariance method). VaR is then calculated by multiplying the EaR by a factor, which is a function of the three-year time horizon and the interest rate. This is measured for the Group, each Division, each Sub-group and each entity, both in terms of stand-alone risk capital, and diversified; in the case of the latter, the benefit of intra-risk diversification is subsequently reallocated to individual entities in proportion to the ratio of Group VaR to the sum of the stand-alone VaRs of all entities. Each entity s marginal diversified capital exists only as part of the Group s, and is one of the preliminary elements for the calculation of aggregated economic capital. For monitoring purposes business risk is calculated for the Group, the Parent and the Divisions quarterly or whenever thought necessary due to changes in the relevant market. For budgeting purposes it is calculated prospectively to assist the capital allocation process since it is one of the risk measures to be aggregated. Real Estate Risk This consists of the potential losses arising from adverse fluctuations in the value of the Group s property portfolio held by subsidiaries, property trusts and special-purpose vehicles (but not customers property bearing a charge or mortgage). Only mid-size and large subsidiaries are required to fully implement the model; small subsidiaries are exempted from this since this risk will be calculated using a simplified procedure. The calculation of real estate risk excludes property pledged as collateral but includes ancillary companies and subsidiaries property. Data are collected quarterly, according to a set format provided by the Parent and used by each Group entity to provide general information on property held, its market value and carrying amount. For the purposes of real estate risk calculation, if market value cannot be supplied, it is temporarily replaced by carrying amount. Each entity is also required to provide sector indexes for each property according to region or city, which are necessary for the calculation of volatility and correlations in the model. The calculation uses normal distribution, on the basis of which an EaR is calculated with a 99.97% confidence interval and a one-year time horizon (variance-covariance method). The resulting VaR is measured for the Group, each Division, each Sub-group and each entity both in terms of stand-alone risk capital, and diversified; in the case of the latter, the benefit of intra-risk diversification is subsequently reallocated to individual entities on the basis of the entity s marginal contribution to the Group s intra-diversified VaR. 13

18 Each entity s marginal diversified capital exists only as part of the Group s, and is one of the preliminary elements for the calculation of aggregated economic capital. For monitoring purposes real estate risk is calculated for the Group, the Parent and the Divisions quarterly or whenever thought necessary due to changes in the relevant market. For budgeting purposes it is calculated prospectively to assist the capital allocation process since it is one of the risk measures to be aggregated. Equity Investment Risk This consists of the potential losses arising from non-speculative financial investments in companies outside the Group, i.e., outside the scope of consolidation for accounting purposes. Trading book assets are therefore not considered under this heading. Only mid-size and large subsidiaries are required to fully implement the model; small subsidiaries are exempted from this since this risk will be calculated using a simplified procedure. The calculation of equity investment risk excludes equity investments in companies not belonging to the Group or the trading book, but may include: listed or unlisted shares, equity derivatives, private equity and shares in mutual, hedge and private equity funds. Risk assessment is carried out using two distinct methodologies: one is market-based in approach, i.e., based on market prices, for listed investments. The other is an IRB PD/LGD approach taking the carrying amount as its basis, for unlisted investments including those in private equity. Where there is no PD, even one of local origin, mapping using market indexes or standard weights are used. Data are collected quarterly, according to a set format provided by the Parent and updated by each Group entity. To calculate volatility and the correlations needed for the model, specific price indexes are used for listed shares and regional or sectoral indexes for unlisted shares, until an internal rating model is developed for them. Once the database is defined, the calculation uses log-normal distribution, starting from which a VaR calculated with a 99.97% confidence interval and a one-year time horizon (variance-covariance method). The resulting VaR is measured for the Group, each Division, each Sub-group and each entity both in terms of stand-alone risk capital, and diversified; in the case of the latter, the benefit of intra-risk diversification is subsequently reallocated to individual entities on the basis of the entity s marginal contribution to the Group s intra-diversified VaR with a 99.97% confidence interval and a one-year time horizon (variance-covariance method). For monitoring purposes equity investment risk is calculated for the Group, the Parent and the Divisions quarterly or whenever thought necessary due to changes in the relevant market. For budgeting purposes it is calculated prospectively to assist the capital allocation process since it is one of the risk measures to be aggregated. Strategic Risk This arises from unexpected changes in market conditions, failure to recognise trends in the banking sector, or inappropriate assessments of these trends. The risk is that divergent decisions as to how to achieve long-term objectives may be made and be reversible only with difficulty. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 14 AS OF DECEMBER 31 st, 2008

19 Reputational Risk The risk that profit or capital may be reduced due to a negative perception of the bank s image by customers, market players, shareholders, investors or the regulator. In the second stage of redefining and broadening the scope of the risk types to be managed by the Group, the best analytical method was identified: some risk types can be analysed quantitatively using statistical methods, while others require a qualitative approach, for example scenario analysis. Risk Measurement Methods Credit, market, operational, business, real estate and equity investment risk can be measured quantitatively, using: estimated economic capital and stress tests. The Group measures business, real estate and equity investment risk using a quantitative model, since the capital amount determined in this way is used to meet potential losses. By contrast, strategic risk is analysed using scenario analysis, which makes it possible to estimate potential losses in certain situations but this risk is not included in the estimate of aggregate risk, because in this situation capital would not be effective to cope with strategic errors. The multi-dimensional nature of risk makes it necessary to accompany the measurement of economic capital with stress testing, not only in order to estimate losses in certain scenarios, but also to obtain the impact of their determinants. Stress testing is carried out on both individual risk types and aggregated risk by simulating changes together with risk factors to provide consistent support for the calculation of aggregate economic capital. Economic Capital and Internal Capital Aggregate Economic Capital is the maximum potential loss due to the joint effect of the various risk types in a oneyear time horizon and a confidence level consistent with the Group s risk appetite. The risks considered are credit, market, operational, business, real estate and equity investment risk and their interdependence, both in terms of diversification within each risk type and between risks. As prescribed by the Basel 2 Project Rulebook, the Parent is responsible for developing methodology for measurement at Group and Division level, and for designing and implementing measurement processes for the Group s Economic Capital and Internal Capital. Each entity is responsible for developing the processes needed to measure risk in line with the Parent s instructions. Internal Capital, in line with the Group s risk appetite, is calculated by adding a buffer to Aggregate Economic Capital to take account of stress test results and other non-quantifiable risks considered significant for the Group. Economic Capital is a fundamental element when assessing the adequacy of the Group s capital. For monitoring purposes, the Group s, the Parent s and the Divisions Economic Capital is calculated quarterly or whenever thought necessary due to significant changes in the relevant market. For budgeting purposes it is calculated prospectively to assist the capital allocation process. Aggregate Economic Capital and resulting Internal Capital form a significant part of the information on the bank s risk profile, and should be submitted to the entity s governing or decision-making bodies (e.g., the Risk Committee or the Board of Directors). In addition to the foregoing, Group intends to consider the effects of a disaster scenario, i.e., losses arising from extreme situations impacting all risk variables, such as pandemics. Refinement of the risk profile is fully in keeping with Pillar 2 in the new supervisory regulations. 15

20 The Group s approach to capital adequacy is in five stages: risk identification risk measurement capital planning and allocation monitoring and risk governance. The activities described above cover the first two stages in particular, i.e., risk identification and risk measurement both at individual level, and aggregated. Reporting The Reporting and Monitoring within the Group CRO Department provides reports and manages credit risk portfolio oversight using regular and specific monthly and quarterly reports. Its principal purposes are to analyse the main drivers and parameters of credit risk (exposure at default (EAD), expected loss (EL), migration, cost of risk, etc.) in order to adopt timely actions on credit portfolios and to portrait the aggregate risk exposure and developments to overall risks faced by UniCredit Group. In 2008 Reporting and Monitoring Unit continued improving the data quality and the reporting processes, reviewing the existing reports also considering the changed market environment. At divisional level (Retail, Corporate & Investment Banking and Private Banking) there are, furthermore, reporting units in charge of monitoring credit risk positions within their competence-lines. The divisional reporting units produce a quarterly report containing specific divisional information (Credit Tableau de Bord). In 2008, the Group CRO department succeeded in the integration of risk management processes of the ex-capitalia Group portfolio. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 16 AS OF DECEMBER 31 st, 2008

21 Table 2 Scope of application Qualitative disclosure In this section of the pillar 3 is disclosed the prudential scope of consolidation do the UniCredit group, in this scope, defined Banking Group have to be enclosed the subsidiaries with the following characteristics: Banks, financial companies and ancillary banking services companies directly or indirectly controlled to which the line-by-line consolidation method is applied; Banks, financial companies and ancillary banking services companies directly or indirectly participated for a share equal or more than the 20% when they are jointly controlled with other entities, to these subsidiaries has to be applied the proportional consolidation method The following entities are consolidated with equity method: a) banks or financial companies directly or indirectly participated for a share equal or more than the 20% or anyway subjected to significant influence; b) to companies, different from banks, financial companies and ancillary banking services companies directly or indirectly controlled exclusively or jointly or subjected to significant influence. Further prudential treatments provided by the regulation are: the deduction of the value of the subsidiary from the capital and the sum of the subsidiary value to the Risk Weighted Assets. It has to be underlined that the prudential scope of consolidation is set in order to comply with the solvency regulation, different from the IAS/IFRS rules applied to the scope of the Financial Statement, this situation could cause mismatches among similar set of information disclosed in this document and in the F/S 17

22 CONSOLIDATED SUBSIDIARIES Headquarter Treatment in prudential report Treatment in Financial Statement Company name Town Country BANKS UNICREDIT SPA ROME ITALY ALPINE CAYMAN ISLANDS LTD. GEORGE TOWN CAYMAN ISLANDS AS UNICREDIT BANK RIGA LATVIA ASSET MANAGEMENT GMBH VIENNA AUSTRIA ATF BANK KYRGYZSTAN OJSC BISHKEK KYRGYZSTAN BANCA AGRICOLA COMMERCIALE DELLA R.S.M. S.P.A. BORGO MAGGIORE SAN MARINO BANCO DI SICILIA SPA PALERMO ITALY BANK AUSTRIA CREDITANSTALT WOHNBAUBANK AG VIENNA AUSTRIA BANK AUSTRIA REAL INVEST GMBH VIENNA AUSTRIA BANK BPH SA KRAKOW POLAND BANK FUR TIROL UND VORARLBERG AKTIENGESELLSCHAFT INNSBRUCK AUSTRIA BANK PEKAO SA WARSAW POLAND BANKHAUS NEELMEYER AG BREMEN GERMANY BANKPRIVAT AG VIENNA AUSTRIA BANQUE DE COMMERCE ET DE PLACEMENTS SA GENEVA SWITZERLAND BAUSPARKASSE WUSTENROT AKTIENGESELLSCHAFT SALZBURG AUSTRIA BAYERISCHE HYPO- UND VEREINSBANK AG MUNICH GERMANY BKS BANK AG (EHEM.BANK FUR KARNTEN UND STEIERMARK KLAGENFURT AUSTRIA AG) CARD COMPLETE SERVICE BANK AG VIENNA AUSTRIA CJSC BANK SIBIR OMSK RUSSIA DAB BANK AG MUNICH GERMANY DIREKTANLAGE.AT AG SALZBURG AUSTRIA FACTORBANK AKTIENGESELLSCHAFT VIENNA AUSTRIA FINECOBANK SPA MILAN ITALY HVB BANQUE LUEMBOURG SOCIETE ANONYME LUEMBOURG LUEMBOURG HVB INVESTITIONSBANK GMBH HAMBURG GERMANY IRFIS - MEDIOCREDITO DELLA SICILIA S.P.A. PALERMO ITALY JOINT STOCK COMMERCIAL BANK FOR SOCIAL KIEV UKRAINE DEVELOPMENT UKRSOTSBANK JSC ATF BANK ALMATY KAZAKHSTAN MEDIOBANCA BANCA DI CREDITO FINANZIARIO SPA MILAN ITALY NOTARTREUHANDBANK AG VIENNA AUSTRIA OBERBANK AG LINZ AUSTRIA OESTERREICHISCHE CLEARINGBANK AG VIENNA AUSTRIA OESTERREICHISCHE KONTROLLBANK VIENNA AUSTRIA AKTIENGESELLSCHAFT OSTERREICHISCHE HOTEL- UND TOURISMUSBANK VIENNA AUSTRIA GESELLSCHAFT M.B.H. PEKAO BANK HIPOTECZNY S.A. WARSAW POLAND PIONEER INVESTMENTS AUSTRIA GMBH VIENNA AUSTRIA PRVA STAMBENA STEDIONICA DD ZAGREB ZAGREB CROATIA SCHOELLERBANK AKTIENGESELLSCHAFT VIENNA AUSTRIA UNICREDIT (SUISSE) BANK SA LUGANO SWITZERLAND UNICREDIT BANCA DI ROMA SPA ROME ITALY UNICREDIT BANCA PER LA CASA SPA MILAN ITALY UNICREDIT BANCA SPA BOLOGNA ITALY UNICREDIT BANK AD BANJA LUKA BANJA LUKA BOSNIA AND HERZEGOVINA UNICREDIT BANK AUSTRIA AG VIENNA AUSTRIA UNICREDIT BANK CZECH REPUBLIC A.S. PRAGUE CZECH REPUBLIC UNICREDIT BANK DD MOSTAR BOSNIA AND HERZEGOVINA UNICREDIT BANK HUNGARY ZRT. BUDAPEST HUNGARY UNICREDIT BANK IRELAND PLC DUBLIN IRELAND UNICREDIT BANK LTD LUTS'K UKRAINE UNICREDIT BANK SERBIA JSC BELGRADE SERBIA UNICREDIT BANK SLOVAKIA AS BRATISLAVA SLOVAKIA UNICREDIT BANKA SLOVENIJA D.D. LJUBLJANA SLOVENIA UNICREDIT BULBANK AD SOFIA BULGARIA UNICREDIT CAIB AG VIENNA AUSTRIA UNICREDIT CONSUMER FINANCING BANK SPA MILAN ITALY UNICREDIT CORPORATE BANKING SPA VERONA ITALY UNICREDIT CREDIT MANAGEMENT BANK SPA VERONA ITALY UNICREDIT INTERNATIONAL BANK (LUEMBOURG) SA LUEMBOURG LUEMBOURG UNICREDIT JELZALOGBANK ZRT. BUDAPEST HUNGARY UNICREDIT MEDIOCREDITO CENTRALE S.P.A. ROME ITALY UNICREDIT PRIVATE BANKING SPA TURIN ITALY UNICREDIT TIRIAC BANK S.A. BUCAREST ROMANIA VEREINSBANK VICTORIA BAUSPAR AKTIENGESELLSCHAFT MUNICH GERMANY YAPI KREDI AZERBAIJAN BAKU AZERBAIJAN YAPI KREDI BANK NEDERLAND NV AMSTERDAM NETHERLANDS YAPI KREDI MOSCOW MOSKOW RUSSIA YAPI VE KREDI BANKASI AS ISTANBUL TURKEY ZAGREBACKA BANKA DD ZAGREB CROATIA ZAO UNICREDIT BANK MOSKOW RUSSIA Full consolidation Proportional consolidation Consoidated at equity Full consolidation Proportional consolidation Consoidated at equity BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 18 AS OF DECEMBER 31 st, 2008

23 Headquarter Treatment in prudential report Treatment in Financial Statement Company name Town Country FINANCIAL COMPANIES AI BETEILIGUNG GMBH VIENNA AUSTRIA ALLIANZ ZB D.O.O. DRUSTVO ZA UPRAVLJANJE ZAGREB CROATIA DOBROVOLJNIM ALLIANZ ZB D.O.O. DRUSTVO ZA UPRAVLJANJIE OBVEZNIM ZAGREB CROATIA ARABELLA FUNDING LTD. (JERSEY) JERSEY ASPRA FINANCE SPA MILAN ITALY ATF CAPITAL B.V. ROTTERDAM NETHERLANDS BAC FIDUCIARIA SPA DOGANA SAN MARINO BA-CA MARKETS & INVESTMENT BETEILIGUNG GMBH VIENNA AUSTRIA BARODA PIONEER ASSET MANAGEMENT COMPANY LTD MUMBAI INDIA BAVARIA UNIVERSAL FUNDING CORP.(BUFCO) DELAWARE U.S.A. BDR ROMA PRIMA IRELAND LTD DUBLIN IRELAND BETEILIGUNGS-UND HANDELSGESELLSCHAFT IN HAMBURG HAMBURG GERMANY MIT BESCHRANKTER HAFTUNG BLACK FOREST FUNDING CORP. DELAWARE U.S.A. BLUE CAPITAL EQUITY GMBH HAMBURG GERMANY BLUE CAPITAL FONDS GMBH HAMBURG GERMANY BLUE CAPITAL GMBH HAMBURG GERMANY BREAKEVEN SRL VERONA ITALY CA IB D.D. ZAGREB CROATIA CA IB INVEST D.O.O ZAGREB CROATIA CA IB SECURITIES (UKRAINE) AT KIEV UKRAINE CABET-HOLDING-AKTIENGESELLSCHAFT VIENNA AUSTRIA CDM CENTRALNY DOM MAKLERSKI PEKAO SA WARSAW POLAND CENTRAL POLAND FUND LLC WILMINGTON (DE) U.S.A. CORDUSIO SOCIETA' FIDUCIARIA PER AZIONI MILAN ITALY ENTASI SRL ROME ITALY EUROFINANCE 2000 SRL ROME ITALY EUROLEASE RAMSES IMMOBILIEN LEASING GESELLSCHAFT VIENNA AUSTRIA M.B.H. & CO OEG EUROPA FUND MANAGEMENT (EUROPA BEFEKTETESI BUDAPEST HUNGARY ALAPKEZELO RT) EUROPROGETTI & FINANZA S.P.A. ROME ITALY FIDIA SGR SPA MILAN ITALY FINANSE PLC. LONDON UNITED KINGDOM FINECO CREDIT S.P.A. MILAN ITALY FINECO LEASING S.P.A. BRESCIA ITALY FINECO PRESTITI S.P.A. MILAN ITALY FINECO VERWALTUNG AG FRANKFURT AM MAIN GERMANY G.B.S. - GENERAL BROKER SERVICE S.P.A. ROME ITALY GELDILU-TS-2005 S.A. LUEMBOURG LUEMBOURG GELDILU-TS-2007 S.A. LUEMBOURG LUEMBOURG GELDILU-TS-2008 S.A. LUEMBOURG LUEMBOURG H.F.S. HYPO-FONDSBETEILIGUNGEN FUR SACHWERTE MUNICH GERMANY GMBH HVB ALTERNATIVE ADVISORS LLC NEW YORK (NY) U.S.A. HVB ALTERNATIVE FINANCIAL PRODUCTS AG VIENNA AUSTRIA HVB ASSET MANAGEMENT HOLDING GMBH MUNICH GERMANY HVB CAPITAL ASIA LIMITED HONG KONG HONG KONG HVB CAPITAL LLC WILMINGTON (DE) U.S.A. HVB CAPITAL LLC II WILMINGTON (DE) U.S.A. HVB CAPITAL LLC III WILMINGTON (DE) U.S.A. HVB CAPITAL LLC VI WILMINGTON (DE) U.S.A. HVB CAPITAL LLC VIII WILMINGTON (DE) U.S.A. HVB CAPITAL PARTNERS AG MUNICH GERMANY HVB FUNDING TRUST II WILMINGTON (DE) U.S.A. HVB FUNDING TRUST VIII WILMINGTON (DE) U.S.A. HVB GLOBAL ASSETS COMPANY L.P. NEW YORK (NY) U.S.A. HVB HONG KONG LIMITED HONG KONG HONG KONG HVB IMMOBILIEN AG MUNICH GERMANY HVB INVESTMENTS (UK) LIMITED GEORGE TOWN CAYMAN ISLANDS HVB LEASING GMBH HAMBURG GERMANY HVB PROJEKT GMBH MUNICH GERMANY HVB TECTA GMBH MUNICH GERMANY HVB U.S. FINANCE INC. NEW YORK (NY) U.S.A. HVB VERWA 4 GMBH MUNICH GERMANY HVB VERWA 4.4 GMBH MUNICH GERMANY INTERNATIONALES IMMOBILIEN-INSTITUT GMBH MUNICH GERMANY KOC FINANSAL HIZMETLER AS ISTANBUL TURKEY KRAJOWA IZBA ROZLICZENIOWA SA WARSAW POLAND LFL LUFTFAHRZEUG LEASING GMBH HAMBURG GERMANY LOCAT SPA BOLOGNA ITALY LOWES LIMITED NICOSIA CYPRUS MOBILITY CONCEPT GMBH UNTERHACHING GERMANY Full consolidation Proportional consolidation Consoidated at equity Full consolidation Proportional consolidation Consoidated at equity 19

24 Headquarter Treatment in prudential report Treatment in Financial Statement Company name Town OAK RIDGE INVESTMENT LLC WILMINGTON (DE) U.S.A. OOO UNICREDIT LEASING MOSKOW RUSSIA OPEN SAVING PENSIOON FUND OTAN JSC ALMATY KAZAKHSTAN ORBIT ASSET MANAGEMENT LIMITED HAMILTON BERMUDA ORESTOS IMMOBILIEN-VERWALTUNGS GMBH MUNICH GERMANY PEKAO AUTO FINANSE SA WARSAW POLAND PEKAO FAKTORING SP. ZOO LUBLIN POLAND PEKAO FINANCIAL SERVICES SP. ZOO WARSAW POLAND PEKAO FUNDUSZ KAPITALOWY SP. ZOO WARSAW POLAND PEKAO LEASING HOLDING S.A. WARSAW POLAND PEKAO LEASING I FINANSE S.A. WARSAW POLAND PEKAO LEASING SP ZO.O. WARSAW POLAND PEKAO PIONEER P.T.E. SA WARSAW POLAND PIONEER ALTERNATIVE INVESTMENT MANAGEMENT HAMILTON BERMUDA (BERMUDA) LIMITED PIONEER ALTERNATIVE INVESTMENT MANAGEMENT LTD DUBLIN IRELAND PIONEER ALTERNATIVE INVESTMENT MANAGEMENT SGR PA MILAN ITALY Country PIONEER ALTERNATIVE INVESTMENTS (ISRAEL) LTD TEL AVIV ISRAEL PIONEER ALTERNATIVE INVESTMENTS (NEW YORK) LTD DOVER (DE) U.S.A. PIONEER ASSET MANAGEMENT AS PRAGUE CZECH REPUBLIC PIONEER ASSET MANAGEMENT S.A.I. S.A. BUCAREST ROMANIA PIONEER ASSET MANAGEMENT SA LUEMBOURG LUEMBOURG PIONEER CZECH FINANCIAL COMPANY SRO PRAGUE CZECH REPUBLIC PIONEER FUNDS DISTRIBUTOR INC BOSTON (MA) U.S.A. PIONEER GLOBAL ASSET MANAGEMENT SPA MILAN ITALY PIONEER GLOBAL FUNDS DISTRIBUTOR LTD HAMILTON BERMUDA PIONEER GLOBAL INVESTMENTS (AUSTRALIA) PTY LIMITED MELBOURNE AUSTRALIA PIONEER GLOBAL INVESTMENTS (HK) LIMITED HONG KONG HONG KONG PIONEER GLOBAL INVESTMENTS (TAIWAN) LTD. TAIPEI TAIWAN PIONEER GLOBAL INVESTMENTS LIMITED DUBLIN IRELAND PIONEER INSTITUTIONAL ASSET MANAGEMENT INC WILMINGTON (DE) U.S.A. PIONEER INVESTMENT COMPANY AS PRAGUE CZECH REPUBLIC PIONEER INVESTMENT FUND MANAGEMENT LIMITED BUDAPEST HUNGARY PIONEER INVESTMENT MANAGEMENT INC WILMINGTON (DE) U.S.A. PIONEER INVESTMENT MANAGEMENT LIMITED DUBLIN IRELAND PIONEER INVESTMENT MANAGEMENT LLC MOSKOW RUSSIA PIONEER INVESTMENT MANAGEMENT SHAREHOLDER BOSTON (MA) U.S.A. SERVICES INC. PIONEER INVESTMENT MANAGEMENT SOC. DI GESTIONE MILAN ITALY DEL RISPARMIO PER AZ PIONEER INVESTMENT MANAGEMENT USA INC. WILMINGTON (DE) U.S.A. PIONEER INVESTMENTS AG BERNA SWITZERLAND PIONEER INVESTMENTS KAPITALANLAGEGESELLSCHAFT MUNICH GERMANY MBH PIONEER PEKAO INVESTMENT FUND COMPANY SA (POLISH WARSAW POLAND NAME: PIONEER PEKAO TFI SA) PIONEER PEKAO INVESTMENT MANAGEMENT SA WARSAW POLAND PRIVATE JOINT STOCK COMPANY FERROTRADE KIEV UKRAINE INTERNATIONAL QUERCIA FUNDING SRL VERONA ITALY S+R INVESTIMENTI E GESTIONI (S.G.R.) SPA MILAN ITALY SALOME FUNDING LTD. (JERSEY) DUBLIN IRELAND SOFIPA SOCIETA' DI GESTIONE DEL RISPARMIO (SGR) S.P.A. ROME ITALY SOLOS IMMOBILIEN- UND PROJEKTENTWICKLUNGS GMBH & MUNICH GERMANY CO. SIRIUS BETEILIGUNGS KG SRQ FINANZPARTNER AG BERLIN GERMANY STICHTING CUSTODY SERVICES KBN AMSTERDAM NETHERLANDS STRUCTURED LEASE GMBH GRUNWALD GERMANY TREUCONSULT BETEILIGUNGSGESELLSCHAFT M.B.H. VIENNA AUSTRIA TREVI FINANCE N. 2 S.P.A. CONEGLIANO ITALY TREVI FINANCE N. 3 S.R.L. CONEGLIANO ITALY TREVI FINANCE S.P.A. CONEGLIANO ITALY UNICREDIT (SUISSE) TRUST SA LUGANO SWITZERLAND UNICREDIT (U.K.) TRUST SERVICES LTD LONDON UNITED KINGDOM UNICREDIT ATON INTERNATIONAL LIMITED NICOSIA CYPRUS UNICREDIT BROKER SPA MILAN ITALY UNICREDIT CA IB ROMANIA SRL BUCAREST ROMANIA UNICREDIT CAIB CZECH REPUBLIC AS PRAGUE CZECH REPUBLIC UNICREDIT CAIB HUNGARY LTD BUDAPEST HUNGARY UNICREDIT CAIB POLAND S.A. WARSAW POLAND UNICREDIT CAIB SECURITIES UK LTD. LONDON UNITED KINGDOM UNICREDIT CAIB SERBIA LTD BELGRADE BELGRADE SERBIA UNICREDIT CAIB SLOVAKIA, A.S. BRATISLAVA SLOVAKIA UNICREDIT CAIB SLOVENIJA DOO LJUBLJANA SLOVENIA UNICREDIT CAIB UK LTD. LONDON UNITED KINGDOM UNICREDIT CONSUMER FINANCING AD SOFIA BULGARIA UNICREDIT DELAWARE INC DOVER (DE) U.S.A. Full consolidation Proportional consolidation Consoidated at equity Full consolidation Proportional consolidation Consoidated at equity BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 20 AS OF DECEMBER 31 st, 2008

25 Headquarter Treatment in prudential report Treatment in Financial Statement Company name Town UNICREDIT FACTORING EAD SOFIA BULGARIA UNICREDIT FACTORING SPA MILAN ITALY UNICREDIT GLOBAL LEASING SPA MILAN ITALY UNICREDIT IRELAND FINANCIAL SERVICES PLC DUBLIN IRELAND UNICREDIT LEASING (AUSTRIA) GMBH VIENNA AUSTRIA UNICREDIT LUEMBOURG FINANCE SA LUEMBOURG LUEMBOURG UNICREDIT MENKUL DEGERLER AS ISTANBUL TURKEY UNICREDIT MERCHANT S.P.A. ROME ITALY UNICREDITO ITALIANO CAPITAL TRUST I NEWARK (NJ) U.S.A. UNICREDITO ITALIANO CAPITAL TRUST II NEWARK (NJ) U.S.A. UNICREDITO ITALIANO CAPITAL TRUST III NEWARK (NJ) U.S.A. UNICREDITO ITALIANO CAPITAL TRUST IV NEWARK (NJ) U.S.A. UNICREDITO ITALIANO FUNDING LLC I DOVER (DE) U.S.A. UNICREDITO ITALIANO FUNDING LLC II DOVER (DE) U.S.A. UNICREDITO ITALIANO FUNDING LLC III DELAWARE U.S.A. UNICREDITO ITALIANO FUNDING LLC IV DOVER (DE) U.S.A. VANDERBILT CAPITAL ADVISORS LLC NEW YORK (NY) U.S.A. WEALTH MANAGEMENT CAPITAL HOLDING GMBH MUNICH GERMANY WEALTHCAP INVESTORENBETREUUNG GMBH MUNICH GERMANY WEALTHCAP PEIA MANAGEMENT GMBH MUNICH GERMANY WEALTHCAP REAL ESTATE MANAGEMENT GMBH MUNICH GERMANY ELION DORADCY FINANSOWI SP. ZOO WARSAW POLAND YAPI KREDI FAKTORING AS ISTANBUL TURKEY YAPI KREDI FINANSAL KIRALAMA AO ISTANBUL TURKEY YAPI KREDI HOLDING BV AMSTERDAM NETHERLANDS YAPI KREDI KORAY GAYRIMENKUL YATIRIM ORTAKLIGI AS ISTANBUL TURKEY YAPI KREDI PORTFOY YONETIMI AS ISTANBUL TURKEY YAPI KREDI YATIRIM MENKUL DEGERLER AS ISTANBUL TURKEY YAPI KREDI YATIRIM ORTAKLIGI AS ISTANBUL TURKEY Z LEASING POLLU IMMOBILIEN LEASING GESELLSCHAFT VIENNA AUSTRIA M.B.H. Z LEASING RIGEL IMMOBILIEN LEASING GESELLSCHAFT VIENNA AUSTRIA M.B.H. Z LEASING SIRIUS IMMOBILIEN LEASING GESELLSCHAFT VIENNA AUSTRIA M.B.H. ZAO IMB-LEASING MOSKOW RUSSIA ZAO LOCAT LEASING RUSSIA MOSKOW RUSSIA ZAO UNICREDIT ATON MOSKOW RUSSIA ZB INVEST DOO ZAGREB CROATIA ANCILLARY BANKING SERVICES COMPANIES BA-CA ADMINISTRATION SERVICES GMBH VIENNA AUSTRIA BALEA SOFT GMBH & CO. KG HAMBURG GERMANY BALEA SOFT VERWALTUNGSGESELLSCHAFT MBH HAMBURG GERMANY BANK AUSTRIA GLOBAL INFORMATION SERVICES GMBH VIENNA AUSTRIA BANKING TRANSACTION SERVICES S.R.O. PRAGUE CZECH REPUBLIC DOMUS BISTRO GMBH VIENNA AUSTRIA DOMUS CLEAN REINIGUNGS GMBH VIENNA AUSTRIA DOMUS FACILITY MANAGEMENT GMBH VIENNA AUSTRIA FONDO SIGMA ROME ITALY HVB GESELLSCHAFT FUR GEBAUDE MBH & CO KG MUNICH GERMANY HVB INFORMATION SERVICES GMBH MUNICH GERMANY HVZ GMBH & CO. OBJEKT KG MUNICH GERMANY HYPERION IMMOBILIENVERMIETUNGSGESELLSCHAFT VIENNA AUSTRIA M.B.H. HYPOVEREINS IMMOBILIEN EOOD SOFIA BULGARIA HYPOVEREINSFINANCE N.V. AMSTERDAM NETHERLANDS INFORMATIONS-TECHNOLOGIE AUSTRIA GMBH VIENNA AUSTRIA KYNESTE S.P.A. ROME ITALY LASSALLESTRASSE BAU-, PLANUNGS-, ERRICHTUNGS- UND VIENNA AUSTRIA VERWERTUNGSGESELLSCHAFT M.B.H. LIMITED LIABILITY COMPANY B.A. REAL ESTATE MOSKOW RUSSIA LOCALMIND SPA MILAN ITALY MARKETING ZAGREBACKE BANKE DOO ZAGREB CROATIA POMINVEST DD SPLIT CROATIA PORTIA GRUNDSTUCKS-VERWALTUNGSGESELLSCHAFT MUNICH GERMANY MBH & CO. OBJEKT KG QUERCIA SOFTWARE SPA VERONA ITALY SALVATORPLATZ-GRUNDSTUCKSGESELLSCHAFT MBH & CO. MUNICH GERMANY OHG VERWALTUNGSZENTRUM SOFIGERE SOCIETE PAR ACTIONS SIMPLIFIEE PARIS FRANCE TELEDATA CONSULTING UND SYSTEMMANAGEMENT VIENNA AUSTRIA GESELLSCHAFT M.B.H. TIVOLI GRUNDSTUCKS-AKTIENGESELLSCHAFT MUNICH GERMANY UNI IT SRL LAVIS ITALY UNICREDIT AUDIT (IRELAND) LTD DUBLIN IRELAND UNICREDIT AUDIT SPA MILAN ITALY UNICREDIT BANCASSURANCE MANAGEMENT & MILAN ITALY ADMINISTRATION SRL UNICREDIT CREDIT MANAGEMENT IMMOBILIARE S.P.A. ROME ITALY Country Full consolidation Proportional consolidation Consoidated at equity Full consolidation Proportional consolidation Consoidated at equity 21

26 Headquarter Treatment in prudential report Treatment in Financial Statement Company name Town Country UNICREDIT GLOBAL INFORMATION SERVICES SPA MILAN ITALY UNICREDIT PROCESSES & ADMINISTRATION SOCIETA PER COLOGNO MONZESE ITALY AZIONI UNICREDIT REAL ESTATE ADVISORY SRL VERONA ITALY UNICREDIT REAL ESTATE SPA GENOA ITALY UNIMANAGEMENT SRL TURIN ITALY UPI POSLOVNI SISTEM DOO SARAJEVO BOSNIA AND HERZEGOVINA WAVE SOLUTIONS INFORMATION TECHNOLOGY GMBH VIENNA AUSTRIA ZAGREB NEKRETNINE DOO ZAGREB CROATIA ZANE BH DOO SARAJEVO BOSNIA AND HERZEGOVINA OTHERS A&T-PROJEKTENTWICKLUNGS GMBH & CO. POTSDAMER MUNICH GERMANY PLATZ BERLIN KG ACIS IMMOBILIEN- UND PROJEKTENTWICKLUNGS GMBH & MUNICH GERMANY CO. OBERBAUM CITY KG ACIS IMMOBILIEN- UND PROJEKTENTWICKLUNGS GMBH & MUNICH GERMANY CO. PARKKOLONNADEN KG ACIS IMMOBILIEN- UND PROJEKTENTWICKLUNGS GMBH & MUNICH GERMANY CO. STUTTGART KRONPRINZSTRASSE KG ALEANDERSSON REAL ESTATE I B.V. MUNICH GERMANY ANWA GESELLSCHAFT FUR ANLAGENVERWALTUNG MBH MUNICH GERMANY ARGENTAURUS IMMOBILIEN-VERMIETUNGS- UND MUNICH GERMANY VERWALTUNGS GMBH ARRONDA IMMOBILIENVERWALTUNGS GMBH MUNICH GERMANY ARTIST MARKETING ENTERTAINMENT GMBH VIENNA AUSTRIA ATLANTERRA IMMOBILIENVERWALTUNGS GMBH MUNICH GERMANY AUFBAU DRESDEN GMBH MUNICH GERMANY AWT INTERNATIONAL TRADE AG VIENNA AUSTRIA BA-CA INFRASTRUCTURE FINANCE ADVISORY GMBH VIENNA AUSTRIA BANK AUSTRIA TRADE SERVICES GESELLSCHAFT M.B.H. VIENNA AUSTRIA BAYERISCHE WOHNUNGSGESELLSCHAFT FUR HANDEL UND MUNICH GERMANY INDUSTRIE MBH BDK CONSULTING LUTS'K UKRAINE BETATERRA GESELLSCHAFT FUR IMMOBILIENVERWALTUNG MUNICH GERMANY MBH BLUE CAPITAL EQUITY MANAGEMENT GMBH HAMBURG GERMANY BLUE CAPITAL USA IMMOBILIEN VERWALTUNGS GMBH HAMBURG GERMANY BODEHEWITT AG & CO. KG GRUNWALD GERMANY BO 2004 S.P.A. ROME ITALY CA IMMOBILIEN ANLAGEN AKTIENGESELLSCHAFT VIENNA AUSTRIA CARICESE SRL BOLOGNA ITALY CENTAR KAPTOL DOO ZAGREB CROATIA CENTRUM KART SA WARSAW POLAND COMPAGNIA ITALPETROLI S.P.A. ROME ITALY CONSORZIO SE.TEL. SERVIZI TELEMATICI IN LIQUIDAZIONE NAPOLI ITALY DA VINCI S.R.L. ITALY DELPHA IMMOBILIEN- UND PROJEKTENTWICKLUNGS GMBH MUNICH GERMANY & CO. GROSSKUGEL BAUABSCHNITT ALPHA MANAGEMENT KG DELPHA IMMOBILIEN- UND PROJEKTENTWICKLUNGS GMBH MUNICH GERMANY & CO. GROSSKUGEL BAUABSCHNITT BETA MANAGEMENT KG DELPHA IMMOBILIEN- UND PROJEKTENTWICKLUNGS GMBH MUNICH GERMANY & CO. GROSSKUGEL BAUABSCHNITT GAMMA MANAGEMENT KG ENDERLEIN & CO. GMBH BIELEFELD GERMANY FINAL HOLDING SP.Z.O.O. WARSAW POLAND GEMMA VERWALTUNGSGESELLSCHAFT MBH & CO. MUNICH GERMANY VERMIETUNGS KG GIMMO IMMOBILIEN-VERMIETUNGS- UND VERWALTUNGS MUNICH GERMANY GMBH GOLF- UND COUNTRY CLUB SEDDINER SEE IMMOBILIEN BERLIN GERMANY GMBH GROSSKUGEL IMMOBILIEN- UND PROJEKTENTWICKLUNGS MUNICH GERMANY GMBH GRUNDSTUCKSAKTIENGESELLSCHAFT AM POTSDAMER MUNICH GERMANY PLATZ (HAUS VATERLAND) H.F.S. IMMOBILIENFONDS GMBH MUNICH GERMANY H.F.S. LEASINGFONDS DEUTSCHLAND 7 GMBH & CO. KG MUNICH GERMANY H.F.S. LEASINGFONDS DEUTSCHLAND 1 GMBH & CO. KG MUNICH GERMANY (IMMOBILIENLEASING) HYPO (UK) HOLDINGS LIMITED I.L. LONDON UNITED KINGDOM HYPO-BANK VERWALTUNGSZENTRUM GMBH & CO. KG MUNICH GERMANY OBJEKT ARABELLASTRASSE I-FABER SPA MILAN ITALY INTERRA GESELLSCHAFT FUR IMMOBILIENVERWALTUNG MUNICH GERMANY MBH Full consolidation Proportional consolidation Consoidated at equity Full consolidation Proportional consolidation Consoidated at equity BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 22 AS OF DECEMBER 31 st, 2008

27 Headquarter Treatment in prudential report Treatment in Financial Statement Company name Town IPSE 2000 S.P.A. ROME ITALY ISTRA GOLF DOO UMAG CROATIA ISTRATURIST UMAG, HOTELIJERSTVO I TURIZAM DD UMAG CROATIA JOHA GEBAUDE-ERRICHTUNGS-UND LEONDING AUSTRIA VERMIETUNGSGESELLSCHAFT MBH KHR PROJEKTENTWICKLUNGSGESELLSCHAFT MBH & CO. MUNICH GERMANY OBJEKT BORNITZSTRASSE I KG MALGARA FINANZIARIA SRL TREVISO ITALY MC MARKETING GMBH VIENNA AUSTRIA MC RETAIL GMBH VIENNA AUSTRIA MOC VERWALTUNGS GMBH & CO. IMMOBILIEN KG MUNICH GERMANY MY BETEILIGUNGS GMBH VIENNA AUSTRIA NUOVA TEATRO ELISEO S.P.A. ROME ITALY OMNIA GRUNDSTUCKS-GMBH & CO. OBJEKT OSTRAGEHEGE MUNICH GERMANY KG OTHMARSCHEN PARK HAMBURG GMBH & CO. CENTERPARK MUNICH GERMANY KG x OTHMARSCHEN PARK HAMBURG GMBH & CO. MUNICH GERMANY GEWERBEPARK KG x PARUS GESELLSCHAFT FUR IMMOBILIENVERWALTUNG MBH MUNICH GERMANY PEKAO TELECENTRUM SP. ZOO ZAMOSC POLAND PIRELLI PEKAO REAL ESTATE SP. Z O.O. WARSAW POLAND PLANETHOME AG UNTERFOHRING GERMANY PLANETHOME GMBH MANNHEIM GERMANY RAMIUS FUND OF FUNDS GROUP LLC NEW YORK (NY) U.S.A. RONCASA IMMOBILIEN-VERWALTUNGS GMBH MUNICH GERMANY S.S.I.S. - SOCIETA SERVIZI INFORMATICI SAMMARINESE SPA BORGO MAGGIORE SAN MARINO SE.TE.SI. SERVIZI TELEMATICI SICILIANI S.P.A. PALERMO ITALY SIRIUS IMMOBILIEN- UND PROJEKTENTWICKLUNGS GMBH MUNICH GERMANY SOCIETA' GESTIONE PER IL REALIZZO SPA IN LIQUIDAZIONE ROME SOLARIS VERWALTUNGSGESELLSCHAFT MBH & CO. MUNICH GERMANY VERMIETUNGS KG SVILUPPO GLOBALE GEIE ROME ITALY T & P FRANKFURT DEVELOPMENT B.V. AMSTERDAM NETHERLANDS T & P VASTGOED STUTTGART B.V. AMSTERDAM NETHERLANDS TERRENO GRUNDSTUCKSVERWALTUNG GMBH & CO. MUNICH GERMANY ENTWICKLUNGS- UND FINANZIERUNGSVERMITTLUNGS-KG ITALY Country TL SPA MILAN ITALY UNIVERSALE INTERNATIONAL REALITATEN GMBH VIENNA AUSTRIA V.M.G. VERMIETUNGSGESELLSCHAFT MBH MUNICH GERMANY ZABA TURIZAM DOO ZAGREB CROATIA ZETA FUNF HANDELS GMBH VIENNA AUSTRIA Full consolidation Proportional consolidation Consoidated at equity Full consolidation Proportional consolidation Consoidated at equity SUBSIDIARIES DEDUCTED FROM CAPITAL Headquarter Treatment in prudential report Treatment in Financial Statement Company name Town Country Deduction Full consolidation Proportional consolidation INSURANCE COMPANIES AVIVA SPA MILAN ITALY CREDITRAS ASSICURAZIONI SPA MILAN ITALY CREDITRAS VITA SPA MILAN ITALY YAPI KREDI SIGORTA AS ISTANBUL TURKEY YAPI KREDI EMEKLILIK AS ISTANBUL TURKEY CAPITALIA ASSICURAZIONI S.P.A. MILAN ITALY CNP UNICREDIT VITA S.P.A. MILAN ITALY Consoidated at equity Consoidated at cost 23

28 Table 3 Supervisory capital structure Qualitative disclosure Capital instruments included in Tier 1 capital Amounts as at December 31, 2008 ( thousand) Interest rate maturity date Starting date of prepayment option Amount in original currency (million) Amount included in Regulatory Capital (Eur/000) step-up clause Option to Issued through a suspend interest SPV subsidiary payment 8,05% perpetual Oct-10 EUR yes yes yes 9,20% perpetual Oct-10 USD yes yes yes 4,03% perpetual Oct-15 EUR yes yes yes 5,40% perpetual Oct-15 GBP yes yes yes 8,59% 31-Dec-50 Jun-18 GBP yes yes yes 7,055% perpetual Mar-12 EUR yes no yes 12m L + 1,25% 07-Jun-11 ( ) EUR no no no 12m L + 1,25% 07-Jun-11 ( ) EUR no no no 8,741% 30-Jun-31 Jun-29 USD no yes yes 7,76% 13-Oct-36 Oct-34 GBP no yes yes 9,00% 22-Oct-31 Oct-29 USD no yes yes 3,50% 31-Dec-31 Dec-29 JPY no yes yes 10y CMS ( ) +0,10%, cap 8,00 % perpetual Oct-11 EUR no no no 10y CMS ( ) +0,15%, cap 8,00 % perpetual Mar-12 EUR no no no ( ) perpetual Dec-11 EUR no no yes TOTALE (*) Prepayment option is not available (**) Constant Maturity Swap (***) Interest is linked to results of the company Tier 2 capital upper tier 2 instruments which account for more then 10% of the total issued amount: Interest rate maturity date Starting date of prepayment option Amount in original currency (million) Amount included in Regulatory Capital (Eur/000) step-up clause Option to suspend interest payment 3,95% 1-feb-16 not applicable EUR not applicable Yes ( ) 5,00% 1-feb-16 not applicable GBP not applicable Yes ( ) 6,70% 5-jun-18 not applicable EUR not applicable Yes ( ) 6,10% 28-feb-12 not applicable EUR not applicable Yes ( ) (*) -- if dividend is not paid, payment of intertest is suspended (deferral of interest) -- if losses take share capital and reserves under the threshold set by Banca d'italia to authorize banking business, face value and interest are proportionally reduced Amounts as at December 31, 2008 ( thousand) BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 24 AS OF DECEMBER 31 st, 2008

29 Quantitative disclosure ( thousand) Regulatory capital breakdown A. Tier 1 before prudential filters A.1 Tier 1 positive items: REGULATORY CAPITAL 31/12/2008 A Capital A Share premium account A Reserves A Non-innovative capital instruments A Innovative capital instruments A Net income of the year/interim profit A.2 Tier 1 negative items: A Treasury stocks A Goodwill A Other intangible assets A Loss of the year/interim loss A Other negative items: * Value adjustments calculated on the supervisory trading book * Others B. Tier 1 prudential filters B.1 Positive IAS/IFRS prudential filters (+) B.2 Negative IAS/IFRS prudential filters (-) C. Tier 1 capital gross of items to be deducted (A+B) D. Items to be deducted E. Total TIER 1 (C-D) F. Tier 2 before prudential filters F.1 Tier 2 positive items: F Valuation reserves of tangible assets F Valuation reserves of available-for-sale securities F Non-innovative capital instruments not eligible for inclusion in Tier 1 capital F Innovative capital instruments not eligible for inclusion in Tier 1 capital F Hybrid capital instruments F Tier 2 subordinated liabilities F Surplus of the overall value adjustments compared to the expected losses F Net gains on participating interests F Other positive items F.2 Tier 2 negative items: F Net capital losses on participating interests F Loans F Other negative items -120 G. Tier 2 prudential filters G.1 Positive IAS/IFRS prudential filters (+) G.2 Negative IAS/IFRS prudential filters (-) H. Tier 2 capital gross of items to be deducted (F+G) I. Items to be deducted L. Total TIER 2 (H-I) M. Deductions from Tier 1 and Tier N. Capital for regulatory purposes (E+L-M) O. Tier 3 Capital P Capital for regulatory purposes included Tier 3 (N+O) The amounts of negative difference between expected losses and related write-downs is thousand. 25

30 Table 4 Capital adequacy Qualitative disclosure The UniCredit Group has made a priority of capital management and allocation (for both regulatory and internal capital) on the basis of the risk assumed in order to expand the Group s operations and create value. These activities are part of the Group planning and monitoring process and comprise: planning and budgeting processes: o o o o o proposals as to risk propensity and capitalisation objectives; analysis of risk associated with value drivers and allocation of capital to business areas and units; assignment of risk-adjusted performance objectives; analysis of the impact on the Group s value and the creation of value for shareholders; preparation and proposal of the financial plan and dividend policy; monitoring processes o o o analysis of performance achieved at Group and business unit level and preparation of management reports for internal and external use; analysis and monitoring of limits; analysis and performance monitoring of the capital ratios of the Group and individual companies. The Group has set itself the goal of generating income in excess of that necessary to remunerate risk (cost of equity), and thus of creating value, so as to maximise the return for its shareholders in terms of dividends and capital gains (total shareholder return). This is achieved by allocating capital to various business areas and business units on the basis of specific risk profiles and by adopting a methodology based on risk-adjusted performance measurement (RAPM), which will provide, in support of planning and monitoring processes, a number of indicators that will combine and summarise the operating, financial and risk variables to be considered. Capital and its allocation are therefore extremely important for strategy, since capital is the object of the return expected by investors on their investment in the Group, and also because it is a resource on which there are external limitations imposed by regulatory provisions. The definitions of capital used in the allocation process are as follows: Risk or employed capital: This is the equity component provided by shareholders (employed capital) for which a return that is greater than or equal to expectations (cost of equity) must be provided; Capital at risk: This is the portion of capital and reserves that is used (the budgeted amount or allocated capital) or was used to cover (at period-end - absorbed capital) risks assumed to pursue the objective of creating value. Capital at risk is dependant on the propensity for risk and is based on the target capitalisation level which is also determined in accordance with the Group s credit standing. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 26 AS OF DECEMBER 31 st, 2008

31 If capital at risk is measured using risk management methods, it is defined as internal capital, if it is measured using regulatory provisions, it is defined as regulatory capital. In detail: Internal capital is the portion of equity that is actually at risk, which is measured using probability models over a specific confidence interval. Regulatory capital is the component of total capital represented by the portion of shareholders equity put at risk (Core Equity or Core Tier 1) that is measured using regulatory provisions. Internal capital and regulatory capital differ in terms of their definition and the categories of risk covered. The former is based on the actual measurement of exposure assumed, while the latter is based on schedules specified in regulatory provisions. The consistency between the two different definitions of capital at risk can be obtained by relating the two measures to the Group s target credit rating (AA- by S&P) which corresponds to a probability of default of 0.03%. Thus, internal capital is set at a level that will cover adverse events with a probability of 99.97% (confidence interval), while regulatory capital is quantified on the basis of a Core Tier 1 target ratio in line with that of major international banking groups with at least the same target rating. Thus, during the application process the double track approach is used which assumes that allocated capital is the greater of internal capital and regulatory capital (Core Tier 1) at both the consolidated and business area or business unit levels. If internal capital is higher, this approach makes it possible to allocate the actual capital at risk that regulators have not yet been able to incorporate, and if regulatory capital is higher, it is possible to allocate capital in keeping with regulatory provisions. The starting point for the capital allocation process is consolidated capital attributable to the Group. The purpose of the capital management function performed by the Capital Allocation unit of Planning, Finance and Administration is to define the target level of capitalisation for the Group and its companies in line with regulatory restrictions and the propensity for risk. Capital is managed dynamically: the Capital Allocation unit prepares the financial plan, monitors capital ratios for regulatory purposes on a monthly basis and anticipates the appropriate steps required to achieve its goals. On the one hand, monitoring is carried out in relation to both shareholders equity and the composition of capital for regulatory purposes (Core Tier 1, Tier 1, Lower and Upper Tier 2 and Tier 3 Capital), and on the other hand, in relation to the planning and performance of risk-weighted assets (RWA). The dynamic management approach aims to identify the investment and capital-raising instruments and hybrid capital instruments that are most suitable for achieving the Group s goals. If there is a capital shortfall, the gaps to be filled and capital generation measures are indicated, and their cost and efficiency are measured using RAPM. In this context, value analysis is enhanced by the joint role played by the Capital Allocation unit in the areas of regulatory, accounting, financial, tax-related, risk management and other aspects and the changing regulations 1 affecting these aspects so that an assessment and all necessary instructions can be given to other Group HQ areas or the companies asked to perform these tasks. - 1 e.g.: BIS II, IAS/IFRS, etc. 27

32 Steps to strengthen capital By a resolution passed on October the 5 th, 2008, UniCredit s Board of Directors approved a plan of measures aimed to strengthen UniCredit s capital for the specific purpose of increasing dividend-paying capital in a total amount of up to 3 billion through the issuance of new ordinary shares offered as an option to shareholders pursuant to paragraphs one, two and three of Article 2441 of the Civil Code. In light of the highly volatile market environment, in order to ensure a good outcome for the capital increase, Mediobanca has linked the placement of equity-linked instruments convertible to UniCredit shares (so-called CASHES) to this increase. As a part of the same plan to strengthen the Group s capital, at the same meeting the Board of Directors also expressed its intention to propose to the shareholders meeting called to approve the 2008 financial statements to pay a dividend in the form of the allocation of new UniCredit shares in a total amount estimated at 3.6 billion (socalled scrip dividends). Capital increase pursuant to paragraphs one, two and three of Article 2441 of the Civil Code Reasons for the transaction As noted above, the transaction to increase dividend-paying capital is a part of the broader plan to strengthen the Group s position in a highly volatile and uncertain market environment with the intention of reassuring stakeholders, customers and themarket in general that the Group is strong. By accelerating the process of strengthening the Group s capital, the capital increase was also carried out to support the implementation of the Group s business plan in the context of achieving the strategic goals set. As previously indicated, the transaction meets the primary objective of increasing UniCredit s capital base, however, even though it generates a positive cash flow at the time the capital increase is finalised, it has only a marginal impact on the Group s overall cash position given the large scale of the consolidated financial statements. Taking into account the issuance of the CASHES in connection with the capital increase and the related usufruct and swap contracts entered into with Mediobanca, in its letter of December 30 th, 2008 Banca d Italia indicated that it could find no reason for not including the funds generated from the issuance of the shares sold in connection with the capital increase in the calculation of Core Tier 1 capital. Details and timing of the transactions On November 14 th, 2008, at the request of the Board of Directors, an extraordinary meeting of UniCredit s shareholders approved a dividend-paying capital increase, to be carried out in whole or in part, in an amount of up to 3 billion through the issuance of up to 973,078,170 ordinary shares with a nominal value of 0.50 each with regular dividend entitlement (January the 1 st, 2008). In exercising the powers granted to him by the shareholders meeting, the CEO set the number of new ordinary UniCredit shares to be issued to implement the capital increase at 972,225,376. Thus, the allocation ratio was set at 4 new ordinary UniCredit shares for every 55 shares held. Thus, the value of the offering, including additional paid-in capital was 2,997,370, On December 23 rd, 2008, CONSOB authorized the publication of the prospectus for the offering in the form of an option and authorised the listing of the ordinary UniCredit shares resulting from the capital increase on the MTA (automated stock market system) of Borsa Italiana, the Frankfurt Stock Exchange and the Warsaw Stock Exchange. The new shares were offered as an option to UniCredit s ordinary and savings shareholders from the 5 th up to the 23 rd of January 2009 pursuant to paragraphs one, two and three of Article 2441 of the Civil Code at a unit issuance price of Euro per share (corresponding to the reference price for ordinary UniCredit shares at the end of trading of the MTA of Borsa Italiana on October the 3 rd, 2008) including of additional paid-in capital. At the end of the option exercise period, 4,647,192 new ordinary UniCredit shares were subscribed (equal to 0.48% of the shares included in the offering in the form of an option). BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 28 AS OF DECEMBER 31 st, 2008

33 The unexercised options (13,304,200,034 options) were later offered by UniCredit on the MTA of Borsa Italiana at trading sessions on 9 th, 10 th, 11 th, 12 th and 13 th February 2009 pursuant to the third paragraph of Article 2441 of the Civil Code, but none of them was purchased. The capital increase was secured by the obligation, which was assumed by Mediobanca pursuant to a security agreement entered into on December 23 rd, 2008, to underwrite the number of newly issued shares corresponding to any options remaining unexercised even after the offering of unexercised options on the stock exchange pursuant to the third paragraph of Article 2441 of the Civil Code, in the amount of the total capital increase. Based on the above, Mediobanca underwrote 967,578,184 ordinary UniCredit shares on February 23 rd, The shares, which were underwritten by Mediocredito in this manner, and which, on the basis of the agreements, may be allocated as necessary to a third-party custodian bank chosen by Mediobanca (the Custodian Bank ), were used (by an outside entity (the Bank of New York (Luxembourg) SA, Bank of New York SA ) to service an issue of equitylinked instruments maturing in 2050 and convertible to ordinary UniCredit shares (the so-called CASHES). Features of the CASHES CASHES are financial instruments convertible to ordinary UniCredit shares based on a conversion ratio set at the time of issuance (adjustments may be made during the life of the loan to take into account extraordinary events, such as business combinations, capital increases etc., in accordance with rules based on procedures related to convertible financial instruments). The exercise price of the conversion option incorporated in the CASHES (subject to the above adjustments) is equal to the reference price (3.083) of ordinary UniCredit shares at the end of trading of the MTA of Borsa Italiana reported on October 3 rd, Conversion may occur at any time at the request of the investor, but no sooner than 40 days from the issuance date. However, conversion will be automatic, inter alia, under the following circumstances: if, seven years from the issuance date, the market price for UniCredit shares over a period of 30 consecutive trading days exceeds, for at least 20 days, an amount equal to 150% of the CASHES subscription price; if UniCredit s overall capital requirement on a consolidated basis falls below the 5% threshold (or another threshold specified, from time to time, in bank regulatory provisions for the purposes of absorbing the losses in innovative equity instruments); in the event UniCredit breaches the payment obligations assumed in connection with the usufruct contract; in the event of the insolvency or liquidation of UniCredit; in the event of the insolvency or liquidation of Mediobanca (or the Custodian Bank). The new shares that serve as the underlying asset for the CASHES are subject to a usufruct contract between UniCredit and Mediobanca entered into on February 23 rd, Pursuant to this contract, while the residuary right of ownership for the above shares rests with Mediobanca, the dividend entitlement to those shares as well as voting rights remain with UniCredit. As a result, in a manner similar to the provisions regulating treasury shares, UniCredit may not exercise voting rights (which will, therefore, remain suspended until the conversion of the CASHES or, if there is no conversion, for the entire thirty-year term of the usufruct) and the dividend will be for the benefit of the other shareholders. As consideration for the usufruct, UniCredit will pay Mediobanca (or the Custodian Bank) an annual fee payable quarterly equal to 3-months Euribor plus a spread of 450 bp applied to the nominal value of the CASHES. The payment of the fee will be due if cash dividends are distributed in relation to the UniCredit shares and if there are distributable profits reported in the consolidated financial statements for the previous year. This fee will be used by Mediobanca (or the Custodian Bank) to make payments through Bank of New York SA in relation to the CASHES; in fact, these instruments grant the right to the payment of interest quarterly. The right of usufruct granted to UniCredit shall remain in effect until the conversion of the CASHES, or, in the event of no conversion, for a period of up to thirty years. Starting in the thirtieth year, if the usufruct contract is not renewed (and if the CASHES are not converted), 29

34 UniCredit will have the right to receive from Mediobanca (or the Custodian Bank) an amount equal to the net dividends related to the shares used to service the CASHES issue on the basis of a swap contract entered into with Mediobanca, also on February 23 rd, The placement of CASHES was completed in February As a part of the private placement process, Mediobanca placed the CASHES with several institutional investors in an overall amount of 2,983,000,000, which largely corresponds to the value of the shares subscribed by Mediobanca and used to service the CASHES issue. Free capital increase pursuant to Article 2442 of the Civil Code As part of measures to strengthen the company s capital base, at the time the distribution of 2008 profits was approved, a proposal was made concerning the establishment of a specific reserve for allocating profits to shareholders through the issuance of new free shares. This reserve will be allocated to share capital to implement a free increase in share capital pursuant to Article 2442 of the Civil Code through the issuance of ordinary shares and savings shares with a nominal value of 0.50 for a total nominal amount of ,50. The new shares will be issued in the following proportions: 13 ordinary shares for every 36 ordinary shares held, with the exception of 476,000 ordinary treasury shares held and 967,564,061 ordinary shares underwritten by Mediobanca Banca di credito finanziario SpA and used to support the issuance of the CASHES financial instruments; both UniCredit and Mediobanca have waived the right to the assignment (Mediobanca pursuant to the usufruct agreement signed on 23 rd February 2009); 1 savings share for every 5 savings shares held. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 30 AS OF DECEMBER 31 st, 2008

35 Quantitative disclosure ( thousand) Capital adequacy A. RISK ASSETS A.1 Credit and counterparty risk Categories/Items Non weighted items 31/12/08 Weighted items/requirement s 1. Standardized approach IRB approaches 2.1 Foundation Advanced Securitizations B. CAPITAL REQUIREMENTS B.1 Credit and counterparty risk B.2 Market Risk 1. Standardized approach Internal models Concentration risk 0 B.3 Operational risk 1. Basic indicator approach (BIA) Traditional standardized approach (TSA) Advanced measurement approach (AMA) B.4 Other capital requirements 0 B.5 Total capital requirements C. Risk assets and capital ratios C.1 Weighted risk assets C.2 Tier 1 capital/weighted risk assets (Tier 1 capital ratio) 6,66 C.3 Capital for regulatory purposes (included Tier 3)/Weighted risk assets (Total capital ratio) 10,70 31

36 Reclassification of Financial Assets According with the changes in IAS 39 and IFR7 several legal entities of UniCredit Group have reclassified part of their assets portfolio and therefore the Group risk position, reported in this disclosure, has been affected. The following table details the financial assets reclassified in H2 2008, as reported in sections 1-4 of Part (A.2) Accounting Principles Main Balance-Sheet Items. These assets are (non-derivative) structured credit products and bonds issued by corporate or financial institutions. As prescribed by IFRS 7, the table provides the reclassified assets face value, carrying value and fair value at December 31, 2008 for each category as well as the pre-tax fair value losses that would have been recognized if the reclassification had not been carried out. The application of the amortized cost method to these assets adjusted where necessary to take into account writedowns resulting from credit risk assessment caused interest receivable of 161,893 thousand to be recognized from the date of reclassification and write-downs of 84,836 thousand. More detailed information about this reclassification are available in the consolidated Financial Statement (Amounts in thousands of ) NOMINAL AMOUNT CARRYING AMOUNT AMOUNTS AS AT FAIR VALUE FAIR VALUE LOSSES NOT RECOGNIZED DUE TO RECLASSIFICATION (PRE-TA) Financial assets reclassified from category "Held for Trading" to "Loans and Receivables": 19,322,448 18,204,747 15,774,049-2,279,779 - Structured credit products 10,258,804 9,391,044 7,778,965-1,522,423 - Other debt securities 9,063,644 8,813,703 7,995, ,356 Financial assets reclassified from category "Held for Trading" to "Held to Maturity" 135, , ,750-7,414 Financial assets reclassified from category "Available for Sale" to "Loans and Receivables" 680, , , (*) TOTAL 20,138,758 19,042,462 16,595,281-2,287,290 (*) amount pertaining to revaluation reserve instead of Profit and Loss. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 32 AS OF DECEMBER 31 st, 2008

37 Table 5 Credit risk: general disclosures for all banks Qualitative disclosure Definition of impaired and past-due exposures Impaired loans and receivables are divided into the following categories: Non-performing loans - formally impaired loans, being exposure to insolvent borrowers, even if the insolvency has not been recognised in a court of law, or borrowers in a similar situation: measurement is on a loan-by-loan or portfolio basis; Doubtful loans - exposure to borrowers experiencing temporary difficulties, which the Group believes may be overcome within a reasonable period of time: measurement is generally on a loanby- loan basis or, for loans singularly not significant, on a portfolio basis for homogeneous categories of loans; Restructured loans - exposure to borrowers with whom a rescheduling agreement has been entered into including renegotiated pricing at interest rates below market, the conversion of part of a loan into shares and/or reduction of principal: measurement is on a loan-by-loan basis, including the present value of losses due to loan rates being lower than funding cost. Past-due loans - total exposure to any borrower not included in the other categories, who at the balancesheet date has expired facilities or unauthorised overdrafts that are more than 180 days past due. Total exposure is recognised in this category if, at the balance-sheet date, either: - - the expired or unauthorised borrowing; or: - the average daily amount of expired or unauthorised borrowings during the last preceding quarter are equal to or exceed 5% of total exposure. Measurement is on a portfolio basis using historical and statistical information. Collective assessment is used for groups of loans for which individually there are no indicators of impairment, but to which latent impairment can be attributed, inter alia on the basis of the risk factors in use under Basel II. Description of methodology applied to determinate the write-downs Loans and receivables are non-derivative financial assets with fixed or determinable payments that are not quoted in an active market. Loans and receivables are recognised on the date of contract signing, which normally coincides with the date of disbursement to the borrower. These items include debt instruments with the same characteristics. 33

38 After initial recognition at fair value, which usually is the price paid including transaction costs and income which are directly attributable to the acquisition or issuance of the financial asset (even if not paid), a loan or receivable is measured at amortised cost using the effective interest method, allowances or reversals of allowances being made where necessary on remeasuring. A gain or loss on loans and receivables that are not part of a hedging relationship is recognised in profit or loss: when a loan or receivable is derecognised: in item 100 (a) Gains (losses) on disposal ; or: when a loan or receivable is impaired: in item 130 (a) Impairment losses (a) loans and receivables. Interest on loans and receivables is recognised in profit or loss on an accruals basis under item 10 Interest income and similar revenue. Delay interest is taken to the income statement on collection or receipt. A loan or receivable is deemed impaired when it is considered that it will probably not be possible to recover all the amounts due according to the contractual terms, or equivalent value. Allowances for impairment of loans and receivables are based on the present value of expected cash flows of principal and interest less recovery costs and any prepayments received; in determining the present value of future cash flows, the basic requirement is the identification of estimated collections, the timing of payments and the rate used. The amount of the loss on impaired exposure classified as nonperforming, doubtful or restructured according to the categories specified below, is the difference between the carrying value and the present value of estimated cash flows discounted at the original interest rate of the financial asset. If the original interest rate on a financial asset discounted for the first time in the year of changeover to IFRS, was not available, or obtaining it would have been too costly, the average interest rate on unimpaired positions in the year in which the original impairment of the asset was recognised, is used. This rate is maintained in all later years. Recovery times are estimated on the basis of any repayment schedules agreed with the borrower or included in a business plan or reasonably predicted, based on historical recovery experience observed for similar classes of loans, taking into account the type of loan, the geographical location, the type of security and any other factors considered relevant. Loans and receivables are reviewed to identify those that, following events occurring after initial recognition, display objective evidence of possible impairment. These problem loans are reviewed and analysed periodically at least once a year. Any subsequent change vis-à-vis initial expectations of the amount or timing of expected cash flows of principal and interest causes a change in allowances for impairment and is recognised in profit or loss in item 130(a) Impairment losses (a) loans and receivables. If the quality of the loan or receivable has improved and there is reasonable certainty that principal and interest will be recovered in a timely manner according to contractual terms, a reversal is made in the same profit or loss item, within the amount of the amortised cost that there would have been if there had been no impairments. Derecognition of a loan or receivable in its entirety is made when the loan or receivable is deemed to be irrecoverable or is written off. Write-offs are recognised directly in profit or loss under item 130(a) Impairment losses (a) loans and receivables and reduce the amount of the principal of the loan or receivable. Reversals of all or part of previous impairment losses are recognised in the same item. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 34 AS OF DECEMBER 31 st, 2008

39 Quantitative disclosure ( thousand) Credit and counterparty risk AMOUNTS AS AT31/12/08 CREDIT AND COUNTERPARTY RISK NON-WEIGHTED AMOUNTS WEIGHTED AMOUNTS REQUIREMENT A. CREDIT AND COUNTERPARTY RISK A.1 STANDARDIZED APPROACH - RISK ASSETS A.1.1. Exposures with or secured by central governments or central banks A.1.2. Exposures with or secured by regional administrations and local au A.1.3. Exposures with or secured by administrative bodies and noncommercial undertakings A.1.4. Exposures with or secured by multilateral development banks A.1.5. Exposures with or secured by international organizations A.1.6. Exposures with or secured by supervised institutions A.1.7. Exposures with or secured by corporates A.1.8. Retail exposures A.1.9. Exposures secured by real estate property A Past due exposures A High risk exposures A Exposures in the form of guaranteed bank bonds (covered bond) A Short term exposures with corporates A Exposures in the form of Collective Investment Undertakings (CIU) A Other exposures A.2 IRB APPROACH - RISK ASSETS A.2.1. Exposures with or secured by central administration and central banks A.2.2. Exposures with or secured by supervised institutions, public and territorial entities and other entities A.2.3. Exposures with or secured by corporate A.2.4. Retail exposures secured by residential real estate property A.2.5. Qualified revolving retail exposures A.2.6. Other retail exposures A.2.7. Purchased receivables: diluition risk A.2.8. Other assets A.2.9. Specialized lending - slotting criteria A Alternative treatment of mortgages A Settlement risk: exposures connected to non DVP transactions with supervisory weighting factors A.3 IRB APPROACH - EPOSURES IN EQUITY INSTRUMENTS A.3.1. PD/LGD approach: risk assets A.3.2. Simple risk weight approach: risk assets - Private equity exposures in sufficiently diversified portfolios Exchange-traded equity exposures Other equity exposures A.3.3. Internal models approach: risk assets

40 ( thousand) Credit Risk: on/off balance sheet information to banks Balance-sheet exposures Amounts as at: 31/12/08 Exposures/Portfolio Financial assets held for trading Financial assets at fair value through profit or loss Available for sale financial assets Held to maturity financial instruments Loans and receivables with banks Non-current assets and disposal groups classified as held for sale Off-Balance sheet exposures Gross Gross exposure Average exposure Average exposure Gross exposure Average exposure Gross exposure exposure Average exposure Gross exposure Average exposure Gross exposure Average exposure Gross exposure Average exposure A. Balance sheet exposures a) Non-performing loans b) Doubtful loans c) Restructured exposures d) Past due exposures e) Country Risk f) Other assets Total A B. Off-balance sheet exposures a) Impaired b) Others Total B TOTAL A+B BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 36 AS OF DECEMBER 31 st, 2008

41 ( thousand) Credit Risk: on/off balance sheet information to customers Balance-sheet exposures Amounts as at: 31/12/08 Exposures/Portfolio Financial assets held for trading Financial assets at fair value through profit or loss Available for sale financial assets Held to maturity financial instruments Loans and receivables with customers Non-current assets and disposal groups classified as held for sale Off-Balance sheet exposures Gross exposure Average exposure Gross exposure Average exposure Gross exposure Average exposure Gross exposure Average exposure Gross exposure Average exposure Gross exposure Average exposure Gross exposure Average exposure A. Balance sheet exposures a) Non-performing loans b) Doubtful loans c) Restructured exposures d) Past due exposures e) Country Risk f) Other assets Total A B. Off-balance sheet exposures a) Impaired b) Others Total B TOTAL A+B

42 ( thousand) Distribution of balance sheet and off-b/s exposures to banks by geo area Amounts as at: 31/12/08 Exposures/Geographical areas Italy Other European countries America Asia Rest of the world Gross exposure Net exposure Gross exposure Net exposure Gross exposure Net exposure Gross exposure Net exposure Gross exposure Net exposure A. Balance sheet exposures a) Non-performing loans b) Doubtful loans c) Restructured exposures d) Past due exposures e) Other exposures Total A B. Off-Balance sheet exposures a) Non-performing loans b) Doubtful loans c) Other impaired assets d) Other exposures Total B Total A+B ( thousand) Distribution of balance sheet and off-b/s exposures to costumers by geo area Amounts as at: 31/12/08 Exposures/Geographical areas Italy Other European countries America Asia Gross exposure Net exposure Gross exposure Net exposure Gross exposure Net exposure Gross exposure Net exposure Rest of the world Gross exposure Net exposure A. Balance sheet exposures a) Non-performing loans b) Doubtful loans c) Restructured exposures d) Past due exposures e) Other exposures Total A B. Off-Balance sheet exposures a) Non-performing loans b) Doubtful loans c) Other impaired assets d) Other exposures Total B Total A+B BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 38 AS OF DECEMBER 31 st, 2008

43 ( thousand) Distribution of balance-sheet and off-b/s exposures to customers by business sector( 1st part) Amounts as at: 31/12/08 Governments Other public entities Financial companies Exposures/Business sector Gross exposure Writedowns Net exposure Gross exposure Writedowns Net exposure Gross exposure Writedowns Net exposure Total Total Total A. Balance sheet exposures a) Non-performing loans b) Doubtful loans c) Restructured exposures d) Past due exposures e) Other exposures Total A B. Off-Balance sheet exposures a) Non-performing loans b) Doubtful loans c) Other impaired assets d) Other exposures Total B TOTAL A+B

44 ( thousand) Distribution of balance-sheet and off-b/s exposures to customers by business sector (2nd part) Amounts as at: 31/12/08 Insurance companies Non financial companies Other entities Exposures/Business sector Gross exposure Writedowns Net exposure Gross exposure Writedowns Net exposure Gross exposure Writedowns Net exposure Total Total Total A. Balance sheet exposures a) Non-performing loans b) Doubtful loans c) Restructured exposures d) Past due exposures e) Other exposures Total A B. Off-Balance sheet exposures a) Non-performing loans b) Doubtful loans c) Other impaired assets d) Other exposures Total B TOTAL A+B BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 40 AS OF DECEMBER 31 st, 2008

45 ( thousand) Time breakdown by contractual residual maturity of financial assets Amounts as at: 31/12/08 Items/Maturities On demand 1 to 7 days 7 to 15 days 15 days to 1 month 1 to 3 months 3 to 6 months 6 months to 1 year 1 to 5 years over 5 years Unspecified Maturity Balance-sheet assets a) Government securities b) Listed debt securities c) Other debt securities d) Units in Invetsment Funds e) Loans Banks Customers Off-Balance sheet transactions a) Financial derivatives with exchange of principal - long positions short positions b) Deposits and borrowings to be received - long positions short positions c) Irrevocable commitments to disburse funds - long positions short positions

46 ( thousand) Balance-sheet exposures: change in overall impairments Amounts as at: 31/12/08 Exposures to banks Exposures to customers Source/Categories Nonperforming loans Doubtful loans Restructured exposures Past due exposures Country Risk Total Non-performing loans Doubtful loans Restructured exposures Past due exposures Country Risk Total A. Opening gross writedowns B. Increases B.1 Writedowns B.2 Transfers from other impaired exposures B.3 Other increases C. Reductions C.1 Write-backs from evaluation C.2 Write-backs from recoveries C.3 Write-offs C.4 Transfers to other impaired exposures C.5 Other reductions D. Final gross writedowns of which: - specific writedowns portfolio adjustments E. Writedowns through Profit or Loss BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 42 AS OF DECEMBER 31 st, 2008

47 Table 6 Credit risk: disclosures for portfolios treated under the standardized approach and specialized lending and equity exposures treated under IRB approaches Qualitative disclosure Credit risk Standardized approach List of the ECAI (External Credit Assessment Institution) and ECA (Export Credit Agency) used in the standaridized approach and of the credit portfolios on which the ratings supplied by these entities are applied. Credit risk Porfolios Exposures with central governments and central banks Exposures with international organizations Exposures with multilateral development banks Exposures with corporate and other entities Exposures with Collective Investments Undertakings (CIU) ECA / ECAI - Fitch Ratings; - Moody's Investor Services; - Standard and Poor's Rating Services Ratings characteristics (1) Solicited e unsolicited - solicited rating: shall mean a rating assigned for a fee following a request a request from from the entity evaluated. Ratings assigned without such a request shall be treated as equivalent to solicited ratings if the entity had previously obtained a solicited rating from the same ECAII. - unsolicited rating: shall mean a rating assigned without a request from the entity evaluated and without payment of a fee. 43

48 Securitizations Porfolios Position on securitizations with short term rating Position on securitizations different from those with short term rating ECA / ECAI - Fitch Ratings; - Moody's Investor Services; - Standard and Poor's Rating Services Quantitative disclosure ( thousand) Specialized lendings Remaining maturity/assesment Exposure amounts as at31/12/08 Regulatory categories 1 - strong 2 - good 3 - satisfactory 4 - weak 5 - default Remaining maturity less than 2,5 years Remaining maturity equal to or more than 2,5 years Total Specialized Lendings ( thousand) Equity exposures - simple risk weight approach Categories Weights Exposure amounts as at31/12/08 Private equity exposures in sufficiently diversified portfolios 190% Exchange-traded equity exposures 290% 0 Other equity exposures 370% Total Equity Exposures BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 44 AS OF DECEMBER 31 st, 2008

49 ( thousand) Standardized approach - risk assets Amounts as at31/12/08 Exposures classes Exposure amount Collaterals Secured exposures Guarantees and other similar contracts Credit derivatives Exposures with or secured by central governments and central banks credit quality step credit quality step credit quality step credit quality step 4 and credit quality step 6 0 Exposures with or secured by regional administrations and local authorities credit quality step credit quality step credit quality step credit quality step 4 and credit quality step 6 0 Exposures with or secured by administrative bodies and non-commercial undertakings credit quality step credit quality step credit quality step credit quality step 4 and credit quality step 6 0 Exposures with or secured by multilateral development banks credit quality step credit quality step credit quality step credit quality step 4 and credit quality step 6 0 Exposures with or secured by international organizations Exposures with or secured by supervised institutions credit quality step credit quality step credit quality step credit quality step 4 and credit quality step Exposures with or secured by corporates credit quality step credit quality step credit quality step 3 and credit quality step 5 and Retail exposures Exposures secured by real estate property Past due exposures High risk exposures Exposures in the form of guaranteed bank bonds Short-term exposures with corporates credit quality step credit quality step credit quality step credit quality step form 4 to 6 0 Exposures in the form of Collective Investment Undertakings (CIUs) credit quality step credit quality step credit quality step 3 and credit quality step 5 and Other exposures Total on-balance-sheet risk assets Total guarantees given and committed lines Total derivatives contracts Total SFT transactions and long settlement transactions Total from contractual cross product netting 0 Total

50 Table 7 Credit risk: disclosures for portfolios treated under IRB approaches Qualitative disclosure By its authorization no dated 28 March 2008 Banca d Italia authorized the UniCredit Group to use the advanced approach for calculating the capital requirement for credit and operational risks. In the first stage this approach has been adopted by the Parent Company, certain Italian subsidiaries, HypoVereinsbank (HVB AG) and Bank Austria (BA AG); subsequently it is expected that other Group entities will adopt it under an extension plan drawn up in 2008 following the change to the scope of consolidation on the absorption of the former Capitalia Group; this update was notified to Banca d Italia on September 30 th With reference to credit risk, the Group has been authorized to use internal PD and LGD calculations for Group credits (Sovereign, Banks, Multinationals and Global Project Finance transactions) and for its Italian banks credits (mid-corporate and retail, not including Capitalia s exclusive credits, for which the AIRB approach will be adopted during 2009). In 2008 regulatory EAD parameters were used for the above credits. In December 2008 the Group applied to Banca d Italia for authorization to use internal EAD calculations for Group credits. An application will be made in 2009 in respect of its Italian banks credits. In general, the following table summarizes the rating systems requiring authorization that are used by the Group with an indication of the entities where they are used and the related asset class. Rating system Legal entity Asset portfolio Sovereign (PD, LGD,EAD*) Banks (PD, LGD,EAD*) Multinational corporate (PD, LGD,EAD*) UCI, HVB, BA, UCCB, UCB, BDR, BDS, UCFIN UCI, HVB, BA, UCCB, UCB, BDR, BDS, UCFIN UCB, UCCB, HVB, BA Central governments and central banks Institutions subjected to supervision Corporate Global Project Finance (PD, LGD,EAD*) HVB Corporate Global Project Finance (PD, LGD, EAD*) HVB, UCCB, MCC Corporate BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 46 AS OF DECEMBER 31 st, 2008

51 Rating System Legal Entity Asset Portfolio Corporate Integrated Rating (RIC) PD UCCB Corporate RIC LGD UCCB, Aspra Finance Corporate Mid Corporate (PD, LGD, EAD) HVB Corporate Commercial Real Estate Finance (PD, LGD, EAD) HVB Corporate / Retail Exposures Asset Backed Commercial Paper (PD, LGD, EAD) HVB Securitization positions Income Producing Real Estate (IPRE) Slotting Criteria HVB Corporate Acquisition and Leverage Finance (PD, LGD, EAD) HVB Corporate Global Shipping (PD, LGD, EAD) HVB Corporate Mid Corporate (PD, LGD, EAD) BA Corporate IPRE (PD, LGD, EAD) BA Corporate Non Profit (PD, LGD, EAD) BA Corporate Small Business Integrated Rating (RISB) PD** UCB, BDR, BDS Retail Exposures RISB LGD** Rating Integrato Privati (RIP) Mutui Ipotecari PD** Rating Integrato Privati (RIP) Mutui Ipotecari LGD** UCB, BDR, BDS, Aspra Finance UCB, BDR, BDS, UCFIN UCB BDR, BDS, Aspra Finance, UCFIN Retail Exposures Retail Exposures Retail Exposures Small Business (PD, LGD, EAD) HVB Retail Exposures Private Individuals (PD, LGD, EAD) HVB Retail Exposures Small Business (PD, LGD, EAD) BA Retail Exposures Private Individuals (PD, LGD, EAD) BA Retail Exposures * Bank of Italy authorization still pending ** With reference to BDR and BDS IRBA approach is initially foreseen for counterparties coming from legal entities of the previous scope of UniCredit Group (post carve out) for which it was already authorized the use of adevanced approach. 47

52 The above rating models are used for the purposes of calculating the regulatory requirement resulting from first pillar obligations, but more importantly, they represent a fundamental component of decision-making and governance processes. Specifically, the areas where internal rating systems are most often used are as follows: Various phases of credit processes: - Approval/renewal. The assignment of internal ratings is a key moment in the credit assessment of the counterparty/transaction and is a preliminary phase in providing/renewing lines of credit. The rating, which is assigned before approval, is made available as a part of the approval process, which is largely integrated in the assessment and discussed in the credit proposal. Thus, along with loan exposure, the rating is a key factor for defining the appropriate body for the approval. - Monitoring. The loan monitoring process is aimed at identifying and quickly reacting to the initial symptoms of a potential deterioration in a customer s credit quality, and thus, it makes it possible to intervene before an actual default occurs (i.e., when it is still possible to recover credit exposure). This activity mainly focuses on monitoring exposure movements leading to the point of completely disengaging from the customer as necessary. In addition to determining the positive impact in terms of EAD, the monitoring process makes it possible to optimize conditions for the potential subsequent recovery phase through requests for additional security resulting in the reduction of LGD. - Loan recovery. The process of assessing the strategy to be used for loans classified as default positions, which is carried out at the customer/transaction level and aimed at the simulated calculation of the Net Present Value of the net amounts recovered and LGD, is based on the definition of LGD. If there are several alternative recovery strategies, the one with the lowest LGD is chosen. LGD is also the basis for pricing to be assigned to non-performing loans transferred to Aspra Finance. Provision policies. For performing loan customers, the incurred but not reported loss (IBNR) methodology has been adopted. This approach uses the amounts of the projected loss by means of the Loss Confirmation Period (LCP) parameter for the calculation of provisions. For counterparties in the default category, loss provisions are based on the assessment of the exposure risk profile and LGD. Capital management and allocation. Ratings are also an essential element in the process of quantifying, managing and allocating capital. Specifically, the output of rating systems is integrated, at the level of the Parent Company of the overall Group, in processes aimed at measuring and managing (regulatory and economic) capital, on the one hand, and in processes aimed at determining risk adjusted performance" measures and the adjusted income statement for the purposes of strategic planning. Strategic planning. Customer risk is a key determinant in the area of strategic planning, budgeting and provisions for quantifying RWA, impairment losses reported in the income statement, and loans reported in the balance sheet. Reporting. Specific reports are produced for top management at the consolidated, divisional and regional levels and for individual entities. These reports show credit risk portfolio performance and provide information on default exposure, projected losses, PD and average LGDs for various customer segments in accordance with the internal rating systems implemented. Ratings are also used to determine pricing and MBOs to be assigned to account managers and to identify customers with negative EVA for which targeted strategies are adopted. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 48 AS OF DECEMBER 31 st, 2008

53 To achieve compliance with the so-called Basel 2 regulations, the UniCredit Group has carried out specific actions aimed at determining and meeting all the requirements needed to apply Credit Risk Mitigation (CRM) procedures. These actions include the following: Issuance of policies reflecting the implementation, interpretation and internalization of CRM regulatory requirements within the Group. There were several reasons for producing this documentation, for which reference was made to Banca d Italia Circular No. 263 of 27 December 2006 and subsequent updates, EU directives 2006/48/EC and 2006/49/EC and to the document International Convergence of the Measurement of Capital and Capital Ratios, New Regulatory Framework of the Basel Committee on Banking Supervision. Its aim was to encourage the optimization of collateral management and to establish rules for the acceptability, assessment, monitoring and management of guarantees and collateral in keeping with general and specific requirements. Definition of new processes reflecting the application of policies in the management of collateral within the Group. Based on a gap analysis between the current status and target model, the Group implemented new processes for managing collateral in keeping with the requirements of Banca d Italia regulations and the Group s guidelines. Since the UniCredit Group emphasizes the importance of the requirement of legal certainty in the assessment of CRM procedures, there was a special focus on implementing processes needed to meet this requirement. Implementation of IT tools that make it possible to automate the process of managing collateral. In particular, the UniCredit Group developed a reliable and effective system for applying CRM procedures starting with the assessment and acquisition of collateral to the monitoring and enforcement of collateral. The implementation of the IT system made it possible to manage, gather and archive the data needed to verify whether acceptability requirements have been met and to calculate risk indicators. These data are used to determine whether collateral is valid for the purposes of CRM and to apply appropriate prudential margins as required by the Basel 2 regulations (margins estimated internally that are based on the Value at Risk methodology have been determined for the assessment of volatility)1. In addition, based on the new regulatory structure, the development of advanced rating systems and their introduction in corporate processes have resulted in the need to establish at both the Parent Company and individual entities a process for validating rating systems and an increase in the activities that Internal Audit is required to audit with respect to such systems. The purpose of the validation process is to express an opinion concerning the proper operation, predictive ability and overall performance of the IRB systems adopted and their consistency with regulatory requirements specifically through: the assessment of the model development process with a particular emphasis on the underlying approach and the methodological criteria supporting the estimate of risk parameters; the assessment of the accuracy of estimates of all major risk components through system performance analysis, parameter calibration and benchmarking; 1 See Table 8, Procedures for Mitigating Credit Risk Qualitative Information for additional details on the management of the process for determining procedures for mitigating credit risk. 49

54 verification that the rating system is actually used in various management areas; the analysis of operating processes, monitoring safeguards, documentation and IT facilities related to the rating systems. The validation process established within the Group first calls for a distinction to be made between the initial and ongoing validation. The purpose of the initial validation is to assess the positioning of the Group s rating systems in relation to minimum regulatory requirements and the Parent Company s guidelines and standards concerning methodology, processes, data quality, quantitative and qualitative validation procedures, internal governance and technological environment by identifying any gaps or critical areas in relation to these requirements. On the other hand, the purpose of ongoing validation is to continually assess the proper operation of all components of the rating system and to monitor its compliance with internal and regulatory requirements. Secondly, the process calls for the specific assignment of responsibilities for validating so-called Group-wide systems and local systems. For Group-wide systems, the methodology for which applies only at the Group level, responsibility is assigned to the Parent Company, while individual entities are responsible for local rating systems. The Parent Company is still responsible for the initial and ongoing monitoring of the proper performance of development and validation activities carried out locally and the proper operation of the rating system by also providing suggestions generated by internal and external benchmarking that are aimed at following best practices. Based on the revalidation process, the Parent Company issues a non-binding opinion on local rating systems during the initial phase before approval is given by the appropriate bodies, and later whenever significant changes are made. The unit responsible for validation procedures is independent from the units responsible for developing models and from the internal audit area that audits the process and outcome of the validation. This unit has established guidelines for validating rating systems aimed at a convergence towards standard validation procedures in terms of both content and tools, thereby ensuring that the criteria for assessing results are shared including through the introduction of standard trigger values and encouraging a comparison between the different systems. The use of triggers makes it possible to depict test results using a stop-light system whose colors are associated with various levels of severity of the phenomena reported. Special emphasis was placed on establishing a standard approach for validating models by identifying minimum test requirements and methods for reporting the related results. Tests are divided into qualitative and quantitative analyses. The qualitative section is used to assess the effectiveness of the methodology used to create the model, the inclusion of all significant factors and the ability to depict the data used during the development phase; The quantitative section assesses the performance, stability and calibration of the overall model as well as its specific components and individual factors. A hierarchy of the above analyses has been established that provides details as a function of the specific (initial or ongoing) validation or ongoing monitoring phase and the results obtained. In fact, the performance of certain tests is dependent on whether critical areas are identified in the performance of analyses at the next-highest level. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 50 AS OF DECEMBER 31 st, 2008

55 The data and documents related to the validation procedures done to date are saved in special storage areas ensuring rapid access to, and security of, the information and the ability to reproduce all analyses performed. In addition, the Group has a validation tool that makes it possible to calculate the indicators required by the Basel Committee in Working Paper 14, Studies on the Validation of Internal Rating Systems, for validating credit risk models. This tool complies with the IT requirements of Banca d Italia and is fully integrated with the workplace environment. The results of internal validation activities are related to a single reporting model (framework) in order to assign the analysis of the various components of the rating system to business units. These activities are performed in accordance with validation standards, and the depth of their analyses is a function of the type (group-wide or local) or location (Italy or abroad) of the rating system. The framework adopted consists of the schematic reclassification of all detailed minimum quantitative and organizational requirements imposed by Banca d Italia into specific key principles related to different subject areas for analyzing the rating system (model design, risk components, internal use and reporting, IT, data quality and corporate governance). The framework is useful for assessing the detailed status of rating systems vis-a-vis regulatory provisions. The analysis areas attributable to the organizational requirements specified in the Circular are model design, internal use and reporting, IT/data quality and governance. When auditing internal rating systems, Internal Audit s aim is to check the functionality of the entire system of controls over them. These checks comprise the following: Check that the IRB systems comply with regulations Ascertain how the rating systems are used for business purposes and Check that the rating validation process is adequate and complete. In order to assist Group entities to ensure the quality (functionality and adequacy) of their Internal Control Systems and to modify their internal auditing methods in line with changes in their business scenarios, the Parent s Internal Audit Department (UC IAD) has coordinated the development of a common set of internal auditing methods and manages on an ongoing basis the maintenance and improvement. These methods have been developed in order to assess the accuracy of the conclusions of the risk control functions as well as compliance with the regulatory requirements, particularly in respect of the internal validation process of internal rating and risk control systems. It should be noted that internal audit functions are not directly involved in the design or selection of the model. In accordance with its mission UC IAD directly audits UniCredit SpA and, when needed, the legal entities of the Group, also managing the coordination of the activity of subsidiaries internal audit functions. The audits necessary to assess the functionality of the rating systems are given suitable space in the Group audit planning process, organised by UC IAD, which agrees their inclusion in internal audit plans with the Group entities. UC IAD then monitors performance of these audits by a specific function and if necessary contacts the entity where there are deviations from plan. UC IAD also regularly reports on its activity and results to the Parent s Internal Control & Risks Committee and Statutory Auditors. 51

56 Group-wide models Foreword In connection with the approval by the Supervision Authority and for the purposes to complete the LGD model developed fro Group credit portfolios ( including large Italy corporate segment for which has been decided to extend the use of the model built for multinational counterparties) referred exclusively to the unsecured portion, have been added three new modules: 1) default counterparty module; 2) module to manage the haircuts of real estate collateral; 3) module to manage the haircuts of financial assets collateral. In the first case the focus is on not secured exposure LGD that has to be integrated with guarantees information, in order to have an overall estimation of LGD transaction-based: given the segment low-default it has been proceeded basically on experiential basis, with the support of work-out historical data. In the case of real estate collaterals, the haircut, shared by type of real estate and geographical area/region, measures the loss in percentage value of the real estate value when the collateral has been sold to the market after to have started the recovery procedure. The haircut calculation methodology consist in the estimation (through a stochastic process) of the expected price in the average recovery time, the deduction of the general expenses and the calculation of the net present value. For prudential purposes has been inserted a minimum haircut amount. With reference to the financial assets collaterals the methodological approach foreseen that the coverage has to be estimated by each security on the basis of market value of the financial collateral (s.c. mark-to-market) adding an haircut that has to consider the risk of the security market, of the ownership period and of the liquidity risk. For the above mentioned modules, subjected previously to internal assessment, the Group is waiting for the Supervision Authority authorization. A description of the already used models is reported hereafter. Sovereigns Rating model The approach used for the development of the country rating model is shadow rating whereby an attempt is made to duplicate the ranking capabilities of external (ECAI) ratings using macroeconomic and qualitative factors. The following steps were taken to arrive at the final model: Sample Selection: Determination of countries to be included in the sample; Univariate Analysis: Calculation of explanatory potential of each qualitative and quantitative factor; Multivariate Analysis: Determination of optimal subset of factors using stepwise techniques supported by the experience of analysts; Combination of quantitative and qualitative modules; Calibration: The score of the final model is calculated on the basis of parameters in order to reproduce the actual PDs; Model Testing: Mapping of model results with approved PDs. Two separate models were designed for emerging and developed countries. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 52 AS OF DECEMBER 31 st, 2008

57 The quantitative module for the latter uses variables related to the balance of trade, interest rates, the importance of the banking system, per-capita GDP and the level of government debt. The qualitative module includes variables related to the development of the financial system, socio-political conditions and economic conditions. The quantitative module for emerging countries uses the following variables: exports as a percentage of gross domestic product (GDP); external debt; the amount of foreign currency reserves; the level of direct, foreign investments as a percentage of GDP; debt service compared to exports; the inflation rate and per-capita GDP. The qualitative module includes variables concerning the stability of the financial system, the flexibility of the economic system, socio-political conditions, economic conditions and debt service. The validation unit checked on an ongoing basis the design of the model, the implicit default definition, the qualitative and quantitative characteristics of the model, override methods, calibration, segmentation into the two groups (developed and emerging countries) and the development sample and conducted the usual performance and stability tests. Naturally, because of the type of counterparties involved and low number of defaults among sovereign entities, development and validation samples are limited in size. Sovereigns LGD model This model, which was developed in November 2006, uses a regressive approach with the involvement of experts, starting with a large set of macroeconomic variables, of which six were included in the final version. The dependent variable (LGD) was calculated using internal and external data. The model, which was designed with the aim of calculating LGD for direct exposure to sovereign counterparties, provides LGD only for unsecured exposure. The explanatory variables selected are as follows: GDP as a percentage of total world GDP; external debt as a percentage of exports; indicator of debt position with respect to IMF; export volatility; average inflation rate in G7; and default timing (period preceding the default). In addition to performing the usual performance and stability tests, the validation unit checked the consistency of definitions of default, segmentation and override; the use of internal and external sources for recoveries; cost estimates and the methodology for discounting recoveries; and the need to introduce conservative adjustments for negative phases in the economic cycle. Besides the methodology, the assessment activity has involved the IT features and the data quality - both in the steps of model development and ongoing and the process features, with special focus on the correct implementation fo the rating system for the countries and on the use for managerial purposes for the risk parameters internally estimated. Rating model for banks The approach used for developing bank ratings, which are defined as shadow ratings, attempts to duplicate the ranking capability of external ratings using a combination of quantitative and qualitative factors. It was decided to construct two different models one for banks resident in developed countries and one for banks in emerging markets since it is believed that there are different risk drivers for the two segments. 53

58 Specific adjustments to be made to the PD resulting from the EM and DC model were introduced to take the following aspects into account: Environmental factor: The rating is improved for banks with high environmental standards; Government support and industry guarantee funds: Various corrections were introduced to take into account the support provided to banks by governments and by special industry-based guarantee funds; Transfer risk: The model takes into account the risk that the debtor is unable to obtain foreign currency to meet its obligations, even though it has the corresponding local currency. The final quantitative model for banks resident in developed countries covers several categories of factors: profitability, risk profile, size and funding. The situation is similar for banks in emerging countries with different weightings for factor categories: profitability, risk profile, size, capitalization and funding. The validation unit has checked on an ongoing basis the design of the model, the implicit default definition, the selection of factors and transformations of variables, the multivariate analysis of the quantitative and qualitative model, the combination of the two modules, calibration, and adjustments for the environment and transfer risk, the override features and the possible impact on a rating cluster, and it conducted performance and stability tests. Banks LGD model The model developed is based on experience. The methodology is currently only applied to senior, unsecured performing loan exposure, which represents the majority of exposure to banks. The application of advanced methodologies to situations of default exposure or unsecured junior exposure is planned for The individual LGD value was calculated starting with an analysis of financial statements by simulating the break-up and sale of the bank s assets after repaying any creditors with a higher level of seniority. In order to obtain a realistic and conservative valuation of the bank s assets, haircuts were established for each type of asset to take into account the likely deterioration that occurs before default, the differences between market and book value and between market value and sales proceeds. In addition, based on the fact that the success of the recovery phase largely depends on the applicable legal/institutional environment, specific haircuts were introduced for each country to take legal risk into account. Finally, haircuts were introduced to reflect the costs of the recovery process based on the assessment of workout experts. Since the assets of the borrowing bank are stated in local currency, but the final recovery must be estimated in the currency of the creditor, a haircut is applied to assets in local currency that is tied to exchange rate volatility in order to take depreciation risk into account. The validation unit checked on an ongoing basis the design and scope for applying the model, the model s components, experience-based amendments and overrides. As much has it has been possible also external benchmarks have been examined; further, special attention to the analysis has been given to the assessment of the haircuts related to the different assets categories. Besides the methodology, the assessment activity has involved the IT features and the data quality - both in the steps of model development and ongoing and the process features, with special focus on the correct implementation fo the rating system for the countries and on the use for managerial purposes for the risk parameters internally estimated. It conducted performance analyses, checked the methodology used for discounting recoveries, grouping by countries, and the estimate of haircuts due to legal and institutional risks, and it analyzed distressed debt transactions as an external benchmark. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 54 AS OF DECEMBER 31 st, 2008

59 Multinational Corporate Rating model This rating model applies to multinational companies defined as companies with consolidated turnover or operating revenues greater than 500 million for at least 2 consecutive years. Following the shadow rating methodology, the model is made up of a quantitative and qualitative component. The quantitative section is developed around a multivariate analysis of elements such as financial ratios for capital, profitability, interest coverage and size. This module produces a probability of default. The qualitative module consists of a set of questionnaires that analyze corporate aspects such as management quality, organizational structure, market share, etc. The qualitative module produces a value, expressed in terms of notches, that is used to modify the quantitative rating; the maximum variation with respect to the qualitative rating was set by experts. The result of the two modules is then upgraded or downgraded to reflect the company s inclusion in a group. The multivariate selection led to the inclusion of the following variables that have been appropriately altered: ordinary cash flows over value of production, earnings before taxes over value of production, EBITDA over interest expense, adjusted net worth over capital employed and value of production. A regression is done of these variables on the logarithm of the relative frequency of default furnished by Standard & Poors. During 2008 the Multinational Rating System has been extended to Italian Large Corporate segment (ILC). This segment in general, includes all enterprises with a turnover or operating revenues greater between 250 and 500 million. Considered the reduced portfolio default number and the high degree of analogy with Multinational Corporate (MNC), it has been decided to adequate the methodology already working for the MNC segment, developing the model on the basis of consistent standards and steps of process. The need of a model for internal estimation of the PD and LGD risk parameters for Italian Large Corporate (ILC) segment in UniCredit CorporateBanking (UCCB) has been justified on the one hand by the compliance with the Basel II advanced IRB approach requirements and, on the other hand, by the will to improve the full and exact control of the measurement parameters of credit risk. The validation unit checked on an ongoing basis the design and segmentation of the model, the quantitative and qualitative modules and their composition and calibration, override, the representativeness of the development sample compared to internal data. It analyzed combined performance and performance by geographic area, the definition of economic group used for rating purposes and its impact in term of performance and model calibration, and the quality of internal and external data used for the shadow rating. Multinational Corporate LGD model Rating agencies recently evaluated recovery levels for speculative grade companies. Since they did not have historical series of internal recovery rates for multinational companies (since this is a portfolio with a low risk of default), they started with these evaluations and developed a model based on the shadow rating approach supplemented by experts opinions. 55

60 The construction of the model consists of several phases: 1. Use of industry averages in which differences can be interpreted by experts (heuristically these represent the intersections in a regression model); 2. Determination of a list of factors provided by experts; 3. Elimination of outliers; 4. Projection of factors at the default level, defining the time from default as Log(100%) Log(PD). This makes it possible to compare companies with different ratings; 5. Selection of factors at the univariate level based on discriminating power; 6. Multivariate regression; verification of impact; 7. Calibration and downturn adjustment; 8. Haircuts for legal risk and recovery costs based on the counterparty s country of residence. The model designed in this manner represents LGD derived from a database for bond debt, and as such it has a negative impact since it does not take into account the probability and effects of debt restructuring that are typical of bank loans and similar products that make up the most representative portion of the UniCredit Group s portfolio. Thus, a cure rate was used that was defined by experts on the basis of results obtained with local models using corporations (Italy, Austria and Germany). This parameter makes it possible to go from a so-called LGD bond to an LGD loan. As well as the Pd parameter, also the Loss Given Default of Multinational Corporate system has been extended to Italian large Corporate segment during The validation unit checked on an ongoing basis the design of the model and the quality and conservative nature of estimates. It also conducted a benchmarking analysis of recoveries using external data and data from rating agencies regarding the growing literature on this subject,. Besides the methodology, the assessment activity has involved the IT features and the data quality - both in the steps of model development and ongoing and the process features, with special focus on the correct implementation fo the rating system for the countries and on the use for managerial purposes for the risk parameters internally estimated. Project Finance rating model The GPF rating model is an expert model. It is based on a set of 29 factors that drive a questionnaire in which there are 5 possible levels of answers. The 29 factors can be grouped in five key areas that cover project risks. The final score is a weighted average of scores obtained from the factors. The 5 combined areas are as follows: project sponsor risk, execution or completion risk, operating risk, exogenous risks (e.g., macroeconomic risks) and cash-flow-related risk. The development of the rating system was supported by experts in the origination area. The specific nature of project finance and partial independence from counterparties that support the project can only be addressed with a high degree of flexibility, which is made possible by the use of risk mitigation phenomena or by a change of weightings of individual factors, or from the standpoint of weak links. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 56 AS OF DECEMBER 31 st, 2008

61 Portfolio segmentation is based on the following criteria: The project is developed by a legal entity separate from the sponsor; There is a separation (lack of recourse) between the special-purpose vehicle and sponsor. At times, for short periods, this separation may disappear. Credit decisions are mainly based on future cash flows produced by the project; The financial structure is based on the quality and quantity of project cash flows; Risks are shared by those participating in financing; Project assets and revenues are used to secure creditors; Only specialized departments at UCI HVB and BA are involved; Project volume is over 20 million; Projects for which economic risk is limited to 15% (maximum of 30 million) through export insurance guarantees are specifically excluded from the portfolio. The model was calibrated by determining which score levels are assigned to rating levels. Thus, the associated PD values are not continuous but absolute; a single PD value is assigned to each rating. During 2008, the GPF system has been extended to UniCredit Corporate Banking and o Mediocredito Centrale. The validation unit has checked the design of the model as well as performance on a combined, group risk, and single factor basis. It also analyzed stability, adjustment mechanisms and overrides, and whether estimates are conservative, and it performed a benchmarking analysis, although the availability of external ratings is limited. All these activities have concerned the Group GPF portfolio, booked in: HVB, BA, UCCB, MCC. The LGD model for Project Finance operations (GPF) To summarize, the GPF LGD model is based on estimates differentiated by the industry sector underlying the project. The final result, LGD as a percentage of EAD, is provided by the ones complement of the discounted recovery rate to which recovery costs are added as well as an adjustment for the timing of recoveries. For sectors in which sufficient internal information was available, external data were ignored, and for those in which there was insufficient internal data, analyses of recovery rates done by Standard & Poors were used in the area project finance, at times directly, and at times in combination with internal data if allowed by the large size of the subset. Using Standard & Poors data for December 2005, a downturn scenario was determined, taking the crisis period following the Enron situation between 2001 and 2002 as a reference, from which a specific downturn factor was obtained. The validation unit has checked the design of the model, and the performance and representation of the sample (used for the development of the model, which was built using internal and external data) in terms of geographic areas and sectors. All these activities have concerned the Group GPF portfolio, booked in: HVB, BA, UCCB, MCC. Besides the methodology, the assessment activity has involved the IT features and the data quality - both in the steps of model development and ongoing and the process features, with special focus on the correct implementation fo the rating system for the countries and on the use for managerial purposes for the risk parameters internally estimated. 57

62 Group Wide segments EAD model The need of this new model come from, on the one hand, the target to comply with Basel II requirements of the advanced IRB approach and, on the other hand, from the need to measure the risk connetted to any asset in order to manage it and to define its price in a proper way. The main driver of the EAD is the product type and the calculation is tied to three components. Firstly, according to supervisory requirements, it has been assumed that the current Balance Sheet exposure will continue to exist up till the default. To this value has to be added the expected value of a possible drawdown of the granted credit line, and third, the possibility of an overdraft over the amount of the current credit line is considered as percentage of the granted credit line. Furthermore it has to be considered, for the significant products, the probability of a request of refund by a third party, to which has been granted a guarantee in case of default. For the purpose to make consistent the corporate default sample in the scope of application of this model, it has been restricted to the counterparties with at least a credit facility with a granted credit line not less than The assessment activity has checked the model design with special care to the reasonableness of the underlying assumptions, the choice of the development sample included. The model estimates have been compared with the related value internally examined. Also the IT and the data quality features have been subjected to internal assessment. Besides the methodology, the assessment activity has involved the IT features and the data quality - both in the steps of model development and ongoing and the process features, with special focus on the correct implementation fo the rating system for the countries and on the use for managerial purposes for the risk parameters internally estimated. For this Group model the authorization of the supervisory Authority for the use for regulatory purposes is expected. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 58 AS OF DECEMBER 31 st, 2008

63 Local models, Italy Foreword Following the authorization of the supervisory authority and to the purposes to enlarge the internal methodologies also to the portion of portfolio coming from the legal entities of the former Capitalia Group, with reference to the Italian credit portfolios during 2008 have been implemented the following changes and extensions_ Rating Integrato Corporate (PD, LGD) revision and enlargement to the shared customers of former Capitalia; Rating Integrato Small Business (PD, LGD) revision and enlargement to the shared customers of former Capitalia; RIP Mortgages (PD, LGD) revision and enlargement immigrants portfolio; Advanced IRB extended to Aspra Finance (vehicle managing non performing loans ); Here below are described the currently used models: Integrated Corporate Rating (ICR) The ICR provides a rating for exposure to the category of companies at UniCredit Corporate Banking in the mid-corporate segment, it means enterprises to which has been granted a credit facilities with revenues (or total assets if revenue information is not available) up to 250 million. In its current version, the ICR, which was developed in several phases with the support of the company Centrale Bilanci, integrates various components at several levels. At the first level, the score generated by financial statement variables (the CE.BI score) is integrated with qualitative information from questionnaires completed by the account manager. At the second level, the previous rating is supplemented with geographic, industry and size information. Finally, at the third level, performance information is combined to arrive at an integrated corporate rating. The first phase of the project, which was launched operationally in May 2003, ended with the integration of geographic and industry risk factors in the first-level company rating (financial statements + qualitative assessment) already used by the bank. These variables make it possible to complete the company risk profile with risk elements that are ordinarily attributable to a company s industry, geographic location and size with the industry risk level assessed on a projected basis. In order to incorporate performance monitoring information in the rating, a model was structured using second-level company scores and the performance score for 13 months prior to the default as explanatory variables. The Kernel analysis of the distribution of the ICR score over the UniCredit Corporate Banking portfolio led to the identification of 9 rating categories. The validation unit checked the design of the model and the reliability (performance and stability, including in significant sub-portfolios) of its various modules (financial statement score, qualitative score, geographic and industry component and performance score), and reviewed the model s override rules. It also analyzed coverage by relationships and exposure and calibration by counterparty monitoring status, including at the segment level. 59

64 During 2008 it has been implemented and validated some improvements, effective starting from March 2009 summarized here below: Redefinition, on a representative sample of the existing UCCB portfolio, of the discriminant variables of the behavioural model; Introduction of a new combination algorithm of the behavioural score with the secong level enterprise rating through a sole integral function, enabled to increase the predictive capability. Update of the default definition based on the more recent Basel II regulation; Introduction of a new integral function of the acceptance score with the second level enterprise score, finalized to improve the performances of the disbursement rating; Italian Small Business segment Rating model The model has been structured in order to optimize the aggregation of the different informative sources, both internal (qualitative, financial, customer data and behavioural) and external (BoI Centrale dei Rischi data flow and other risk data providers) differentiating between disbursement to new customers or to already recorded customers and on the basis of a enterprises portfolio segmentation that reflects the size and the seniority of the enterprise in the market. The modules developed within the revision of the system are the following: Customer data; External behavioural module (CE.RI./SIA); Financial module; Credit Bureau modules (Experian and Crif) Qualitative module; Internal behavioural module. The estimation process of the different modules has been shared in the steps here after described: univariate analysis, multivariate analysis, specification of the model and assessment. The method applied is the total stepwise logistic regression. The estimation is performed using the Weight of Evidence (Woe) technique. At the end of the estimation procedure of the logistic model, the same is scaled (homogenised) in a way that the scores of different models can be comparable. Identified the significant regressors, it has to be build the scorecard report that resume in a synthetic way the variables used in the model, the weight of each factor and the level of statistical significance. The homogenised score of each model contributes to the production of the PD and the counterparty Rating class on the basis of the weight connected to the same model, compared to that of the others and with the conditions connected to the seniority of the relationship with the bank, discriminating between those already customer and those new customer, and to the type of Small business customer under examination. The model has been re-calibrated keeping considering the late integration of former Capitalia credit portfolio and also considering the overall default rates. The re-calibrations have been done for each one of the three new territorial entities: UniCredit Banca SpA (UCB), UniCredit Banca di Roma (BDR) and Banco di Sicilia SpA (BDS) BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 60 AS OF DECEMBER 31 st, 2008

65 The validation unit has checked the model design in its whole and its solidity (performance and stability, also in the significant sub-portfolios).in the different models that compose it. Further It has been analysed the calibration both at overall and segment level. Besides the methodology, the assessment activity has concerned the IT features, data quality and process, with specific focus on the correct implementation of the rating system and on the use, for managerial purposes, of the risk parameters internally estimated. Rating model for the Italian Individual segment: Mortgages The target portfolio of the Integrated Individual Rating (IIR) model, which is based on a pool approach, consists of the set of all categories of mortgages handled at UniCredit Banca and UniCredit Banca per la Casa which are used for the purchase, construction and re-modelling of residential properties by individual customers and for the purchase of properties for the purposes of business carried out by individuals included in the family firm sector. As regards the Group s instalment products, the incorporation of specific characteristics of an individual product for the purposes of determining its pool resulted in assigning a potentially different probability of default to each relationship of the same counterparty, although the customer s characteristics are among the fundamental drivers used to identify pools. Like all other rating systems for the Group s portfolio of individuals, the development of the IIR model was also broken down into two separate phases. The first phase consists of identifying pools related to the portfolio in the loan approval phase, and the second consists of identifying pools related to the existing portfolio. Using statistical techniques, pools covering the entire portfolio were identified. Following this process, tree structures were created in which the leaves correspond to the pools identified. The PD associated with each pool is then estimated using the default rate observed for the exposure attributed to it. The individual pools were then combined into rating categories using cluster analysis. In the process of assigning the probability of default, the assessment made during the initial approval process is maintained during the first six months of the relationship unless an excess of over a month is discovered, and starting in the seventh month, the transaction s allocation to the corresponding pool is recalculated using the tree established for the existing portfolio. Performance variables gain greater significance with the age of the mortgage. For the peculiarities connected the different origins of he exposures contributing to the risk portfolio coming from the former UBCasa, the rating model has some personalizations, above all with reference to the portfolio acquired through the Abbey National channel. In the analysis of the whole portfolio of the former Banca per la Casa have been defined three segmentation trees The initial discriminating variable of which is the maturity of the mortgage (the number of months from disbursement greater of less than 6) and the place of origin for mortgages with a longer maturity. Specifically these include: a tree created for the portfolio in the loan approval or application phase, used for assigning the probability of default to all mortgages that are less than 6 months old; a tree for the existing former ANBI portfolio to be used for mortgages from the former ANBI that are more than 6 months old; a tree for the existing former Adalya-Kiron portfolio created in order to estimate PD for former Adalya mortgages that are more than 6 months old. A feature common to the three segmentations is the assignment of greater risk to the pool of those credit files that have payment delays or delinquencies of over one month. 61

66 The validation unit checked during 2007 the design of the model and the underlying loan approval process score, their discriminating capacity and the stability of the sample over time. In addition, special emphasis was placed on analyzing sub-models identified based on the mortgage s age and its channel of origin. Finally, coverage, in terms of relationships and exposure, and calibration were analyzed on a combined and sub-portfolio basis. During 2008 some changes have been brought to the Individual Rating integrated system (RIP) for mortgages, coming from the change in the definition of default, from the need to make uniform the treatment of mortgages under approval by UniCredit Banca per la Casa and UniCredit Banca, following up the unification of portfolios of the two banks, and by the enlargement of the time windows. The new definition, adopted to the purposes to conform to supervisory regulation, provides the shift to default when happens a supervisory overdraft and/or 7 outstanding instalments or the transfer to doubtful loan or to non-performing loan. Afterwards, the need to uniformity of treatment of the mortgages between UniCredit Banca per la Casa and UniCredit Banca has driven to a new homogenization of the disbursement score grids. Ultimately, the enlargement of the time windows under examination has implied the calibration of the portfolios and disbursement pools and the re-definition of the rating classes. In the same period it has happened the development of a specific grid for mortgages granted to immigrants, justified both by an increase of the customers included in this segment, represented by transactions where at least one of the counterparties among the borrowers or guarantors is born out of Italy and has citizenships different from Italian, also considering the different riskiness combined with the two customer segments (subjected or not to bankruptcy), for which was already existing a grid. The chosen model is statistical type and it has been used the logistical function form. The assessment function has performed two different tasks, aimed to check on the one hand the calibration of the model and on the other hand the introduction of the new grid immigrants, its performance and stability in the time and the impact of its insertion in the assessment of mortgage portfolio in its whole. Local Italian portfolios LGD LGD models are specific to UniCredit Corporate Banking, UniCredit Banca and UniCredit Consumer Financing depending on the area of application (product and segment), although the estimating methodology is the same (i.e., regressive). The Group selected the workout method for measuring LGD. In this method, the loss rate is calculated on the actual recovery observed using historical data, starting with cash flows generated on the specific loan from the time it goes into default until the end of the recovery process. With regard to the estimate, separate regressive models were used for the watchlist and non-performing phases, while for the past-due phase, an average change in exposure was calculated by counterparty segment and by major product category (instalment, non-instalment loans). The block approach makes it necessary to determine a method for integrating the results of the various models for the calculation of the overall LGD. In particular, it is necessary to determine two types of parameters. The first are tied to the composition of loans when they initially enter into default (assuming a default, the probability that it will occur in the form of a past-due, watchlist or non-performing loan). The second are tied to the probability of a transition between the various stages of default (using UniCredit's terminology, the latter are defined as "danger rates"). In addition to several variables concerning the counterparties customer data and the type and characteristics of relationships, the collateral used to cover exposure is particularly important. UniCredit Corporate Banking, UniCredit Banca and UniCredit Consumer Financing have decided to incorporate the impact of the various types of collateral in LGD, even if regulations call for an alternative, as in the case of guarantees, for which it is possible to replace the customer s PD and LGD with the corresponding parameters of the guarantor when assessing the risk associated with the portion of exposure secured. Thus, the possibility of treating the secured and BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 62 AS OF DECEMBER 31 st, 2008

67 unsecured portions of exposure separately is not taken into account. Instead, the Loss Given Default is calculated at the relationship level as a function of the existing collateral and its value, if significant. With particular reference to the segment consisting of individuals, it was decided to jointly (UniCredit Banca and UniCredit Consumer Financing for the portion related to former Banca per la Casa) develops the model for mortgages. As regards Corporate and Small Business, the group opted to use a jointly developed model for certain types of relationships. Limited to the non-performing loan phase, the highest level of detail possible, i.e., the relationship, was taken into account for the calculation of the value of LGD. With regard to the watchlist phase, the bank instead developed two models for each segment with a differentiation based on installment and non-installment exposure. This decision was driven by the database used for the calculation of observed LGD (i.e., SISBA) in which unpaid debt resulting from advances becomes, for all intents and purposes, cash exposure, which is therefore indistinguishable from current account exposure. Thus, the relationship is the unit of measure for creating models for the watch list phase only with respect to the model for instalment exposure, while the unit of measure for all non-instalment relationships with the same customer is exposure by counterparty. During 2008 have been introduced some changes to the LGD model for the Italian portfolio: the first intervention has concerned the way to manage the risk free rate among the models: the variable has been on an ongoing basis rather than the discrete way. Secondly it has been developed a new approach the estimation of a LGD that reflects the recessionary conditions of the economic cycle (LGD Downturn). The new approach provide the calculation for the downturn effect as adjustment of LGD estimated by the models without the downturn effect through two ratios obtained with a regression that interpolates the estimated LGD from the models without the downturn and a new variable that identify the change of status to non performing loan has happened or not for the recessive phase. The third intervention is done by a review of the effect of the bankruptcy legal action. The fourth and last intervention has concerned the insertion in the LGD calculation for the non exposures already non performing of a new variable that consider the possible shift to partial writedowns. All the models have been recalibrated consistently with what has been done in the PD models; with specific reference to the LGD of the system Rating Integrato Privati (RIP) for mortgages there was furthermore the need to make uniform the treatment of the parameters between the former UniCredti Banca per la Casa and UniCredit Banca because of the merge of the portfolios of the two banks. Finally, for the latter model, it has been provided to review the method to aggregate the geographical areas eliminating the classes Lazio e Umbria and Marche e Toscana and creating the class Centro, with the aim to improve the economic understanding and to make this model uniform with similar LGD models developed by other entities. The validation unit, that during 2007 reviewed the structure of the model, its consistency with the definition of PD, the effect of the economic cycle, the methodology used for discounting recoveries, the cost allocation and the treatment of assets in default and made test aimed to verify the accuracy and of the calibration of the models, during 2008 has concentrated on the qualitative assessment of all the revisions applied to the models, besides to monitor performances and calibration. 63

68 Extension of the LGD model to Aspra Finance The focus of Aspra Finance is the purchase and the management of doubtful loans originated by the banks of financial companies of the Group. Therefore in this company have been progressively concentrated the historical Non Performing Loans portfolios (NPLs) of the legal entities of the Group. To this purpose it has to be noted that for the IRB portfolio the basic criteria for the definition of the NPL portfolio price is represented, and will be represented in the future sales, by the LGD for the default exposures. The adoption for supervisory purposes of the internal rating systems existing in the seller banks and already authorized by the Supervisory Entity, as well as the future adoption of credit risk assessment models that will be submitted to this authorization, are aimed to ensure, within the non performing assets sale, the neutrality in respect the expected loss calculation and the risk weighted assets and to avoid fluctuations of capital absorptions coming from intercompany transactions. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 64 AS OF DECEMBER 31 st, 2008

69 Local models, Germany Mid-corporate rating model The Mittelstandsrating model aims to provide ratings for exposure to the HVB category of companies headquartered in Germany with revenues of million. The model is made up of two components: a quantitative and qualitative module. The score resulting from the analysis of financial statements results in the partial rating for operating conditions. The qualitative model instead provides the partial rating for the company s situation. The final rating is created from a combination of the two partial ratings. The quantitative module is made up of 12+1 statistical sub-modules called Maschinelle Analyse von Jahresabschlüssen (automated financial statement analyses) or MAJA. The area of application of each of these sub-modules is dependent upon the company s industry and size. In general, the risk factors included in the quantitative module (which were selected using a process including statistical analyses and discussions with experts) cover the following areas of analysis: Asset structure; Financial situation; Growth in production/margins. The qualitative module instead covers areas of analysis concerning: the financial situation (not directly covered by the quantitative module) in the context of assessing the ability to repay debt and the future ability to incur debt; sector, market and product; management/business structure; risk factors and performance. Finally, the final rating can be adjusted manually (overridden) if the additional information indicate that the calculated rating is not appropriate. This practice is subject to specific restrictions and constraints and is closely monitored by the internal validation unit. The internal validation unit checked the design of the model, the reliability (performance and stability) of its various modules (the quantitative module with its related sub-modules, and the qualitative module) and its calibration. It also analyzed the process of assigning ratings, rules for attributing exposure to the model concerned and the override process. 65

70 Small business rating model The HVB smallcorp rating model covers small and medium-sized German companies (up to 3 million in net income based on simplified accounting, specifically for business partnerships with unlimited personal liability the net income is up to 15 million) and individuals with residence in Germany whose income is mainly from freelance activities, independent work or income from a small or medium-sized business in which they are major shareholders or owners. The application of the model depends on how many assigned parties are involved in the credit facility: If there is no or one assigned party, the Scoring GK (small business) module is used; if there are at least three parties involved, the Rating GK (small business) module is used. The Scoring GK module calculates a single score that is then mapped to a PD. The score is obtained using two different scorecards depending on whether the counterparty is fully responsible for the company s liabilities or not. In both cases, the same information is used: The so-called MAJA Values, which are financial statement scores developed statistically in a manner similar to what was used for mid-sized corporations; Internal industry scores; Behaviour scores. In the case of an individual, debt levels are used as an additional risk factor. The Rating GK module consists of two separate modules, one for the company and one for the related individual(s) (owners/major shareholders). The score used for each related individual follows the rules of the model used for individuals combining elements that are typical of the loan approval phase and performance aspects. The ratings of each related individual are then combined in an overall rating based on the level of their equity investments in the company(ies). BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 66 AS OF DECEMBER 31 st, 2008

71 The score of the small and medium-sized companies is calculated in subsequent steps: 1. First, a quantitative rating is calculated for each company combining: - MAJA Values ; - Internal industry scores; - Length of bank relationship; - Behaviour Score. The above does not apply to the "construction" sector where MAJA values are only combined with the "MORI" rating for the real estate market and the property being financed. 2. A down-notching is required if the financial information is more than 18 months old. 3. The overall rating of the individual is combined with the rating of the company with different weightings depending on whether the loan is provided to the company or to one of the related individuals. 4. Finally, the rating may be adjusted upon the occurrence of one of the so-called termination events (a set of predetermined events that require the immediate downgrading of the counterparty) on the basis of an expert assessment. In the latter case, a downgrade correction might be done,but an upgrade is subject to specific approval and is closely monitored by the internal validation unit. The override process is only allowed for customer with a high exposure. The internal validation unit checked the design of the model, including through user audits. It also analyzed the performance and calibration of the overall model and the various modules (quantitative module with the related submodules, and qualitative module) and the stability of the underlying sample. Finally, it reviewed the process for assigning the rating and the override process. In addition to the above described small business rating model there is a specific application scorecard in place for customers having a low exposure (up to 50,000). Individual rating model The HVB private individuals rating model covers all individuals excluding self-employed customers.individuals with high property lease income are also excluded. They are considered as part of the Commercial Real Estate portfolio and assessed using the appropriate rating system. The rating model for individuals consists of 12 scorecards: application scorecards (at least one for each product type) and 4 behaviour scorecards. Both scores are combined on account level, or one of the two scores is used depending on the time period since account opening. All assessments available on a customer (in the event the customer has more than one relationship with the bank) are combined based on a model developed on external data in order to obtain an overall probability of default for the individual customer. First, this approach calls for determining a relationship PD for each transaction. All relationship PDs for the same product category are then combined (using a weighted average for exposure) into a product PD. Finally, all product PDs contribute to the determination of a customer PD based on exposure, the information weighting (that summarizes how, and how far in advance, each product contributes information on the future default of the customer) and the risk factor for the product combination that specifies the different contribution of each product combination to the projected rate of default. 67

72 The validation unit checked the design of the model and its reliability in terms of performance and calibration. In addition, it analyzed the performance of the various underlying modules and their calibration, and also separately reviewed the different possible combinations of products used by the same customer. In addition to the above described HVB private individuals rating model there are separate scorecards in place for wealthy customers and customers with a high exposure. Rating model for Commercial Real Estate Finance The rating model for HVB s Commercial Real Estate Finance (CRE) is used in Germany to assess exposure to: Real estate dealers: Companies whose financial statements report income that comes mainly from the construction (or purchase) and subsequent sale of buildings for residential or commercial (offices, stores) uses; Real estate investors that publish financial statements: Companies whose financial statements report income that comes mainly from the lease of owned residential and commercial properties; Real estate investors that do not publish financial statements: Companies with no financial statements or individual customers with income coming mainly from the lease of owned properties. This model provides a different module for each of the three categories of counterparties indicated above. Each module is made up of three sub-modules: a) a qualitative module that aims to assess the quality and reliability of management, the abilities of the management team, the quality of organizational management and the bank's experience in managing relationships with the company; b) a qualitative module that aims to assess the asset/project to be financed or already financed (by the bank or other lender), including the quality and implicit risk of the portfolio of the company s properties/projects, its planning capabilities (based on past experience) and cash flows planned/projected in future years; c) a quantitative financial module based on the company s financial statements supplemented with a qualitative assessment of the quality, reliability and completeness of the financial statements. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 68 AS OF DECEMBER 31 st, 2008

73 Modules a) and b) are expert-based systems in which the factors and their weightings were determined by a team of experts and refined over time based on experience gained, while module c) was developed statistically. The results of the three sub-modules are then combined on the basis of the score (Log-PD for the quantitative module), with the weighting defined on the basis of expert opinions, and the final score calibrated statistically. The three modules all use the same sub-modules. What changes is the weighting used to combine the partial scores into the overall score. The validation unit assessed the design of the model including through an analysis of responses to a questionnaire provided to users. It also tested the reliability of the model and its modules in terms of performance and calibration, and the stability of the sample, including through the use of transition matrices. Finally, it analyzed the coverage of the portfolio and checked in how many cases there were invalid ratings due to the failure to update several components of the model and overruling rules. Rating model for Acquisition and Leveraged Finance transactions The Acquisition and Leveraged Finance" (ALF) model is used for the assessment of projects to finance/refinance corporate acquisition transactions in which additional bank liabilities are added to the normal operating debt of the company acquired in order to finance the acquisition. The debt resulting from the acquisition is repaid out of the future cash flow of the company acquired, and, in certain cases (i.e., acquisitions that involve strategic investors), out of the cash flows of the acquiring company. Acquisition transactions and their corporate and tax implications (often involving several jurisdictions) demand specific expertise during the audit phase, and require: appropriate risk-return relationships in addition to a loan structure based on a realistic cash flow simulation model; the adjustment of the acquired company s financial and debt repayment structure to future cash flows; the combined use of highly differentiated borrowing tools (senior debt, junior debt, mezzanine debt, etc.). In terms of procedural aspects, the "ALF rating" is essentially a financial rating that calculates the acquired company s probability of default based on equity and financial ratios taken from the provisional financial statements and income statement. There is no qualitative module since in the preparation of the provisional financial statements, a large amount of qualitative information based on experts opinions is already implicitly taken into consideration. The provisional financial statements are prepared with the aid of models that simulate future cash flows (INCAS, international financial model). In this case, manual adjustments (overrides) are also allowed with respect to individual financial ratios and the end rating, and these adjustments must be approved by the units in charge and must be closely monitored by the internal validation unit. 69

74 The validation unit performed qualitative and quantitative analyses to check the model s reliability. In particular, the qualitative analyses of the model s design are based on results of a questionnaire provided to users. The results of the model were compared with internal and external benchmarks from a quantitative viewpoint. Income Producing Real Estate (IPRE) rating model The IPRE-Slotting Criteria model provides an assessment of a particular category of specialized loan related to cash-flowbased real estate transactions in which the bank has direct access to the cash flows produced in the transaction. Since it is the result of slotting criteria, the model was obtained by following the project assessment procedures dictated by prudential rules. To be specific, the model uses qualitative risk factors and a scoring process that produces an overall score on the basis of the type of property or number of properties to be assessed. Different scorecards are created as a function of the type of ownership/property. The valuation criteria of the scorecards are divided into 5 risk categories as indicated in the regulatory provisions. Each risk category is assessed on the basis of different risk factors using a questionnaire, and the user assigns an individual score on a scale of 1-5 to each question. The combination of the various scores results in the final assessment. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 70 AS OF DECEMBER 31 st, 2008

75 GLOS rating ("Global Shipping", rating model for Ship financing) The principal characteristic of ship financing is the granting of loans for the acquisition of ships, principally secured by a mortgage on the financed asset. Ship finance is an asset based credit business which completely depends on the cash generating capabilities of those vessels being financed. The focus of HVB's ship finance is the financing of quality tonnage mainly consisting of standard ships for which a liquid, transparent, and efficient secondary market exists. This includes e. g. container vessels, bulk carrier, and tanker. Ship finance is mainly transaction based, characterized by no (or only limited) recourse to the sponsor(s). The GLOS rating covers all functions to calculate a probability of default (PD) and the loss given default (LGD) of the borrower. The PD calculation in the quantitative module is based on a monte carlo simulation. The development of the quantitative factors (e. g. the ship value) is based on the stochastic process, the parameters are validated and estimated annually, based on external data. The cash flow is calculated for each quarter of the financing period. The financial rating based on quantitative factors is adjusted based on the following qualitative factors (upward or downward adaptation of PD by a certain number of notches): Commercial management (e. g. reputation) Technical management (e. g. fleet size) Position of HVB (e.g. covenants) Insurance Vessel quality Fallback financing The validation unit assessed the design of the model, including a qualitative validation through user audit (questionnaire). It also tested the reliability of the model and its (quantitative and qualitative) modules in terms of performance and stability (incl. stress test) and verified the model calibration. 71

76 Rating model for Asset Backed Commercial Paper operations The model, developed by replicating the approach of the rating agencies, assigns a rating to HVB s commitments in relation to vehicles that issue Asset Backed Commercial Paper, and is used only in cases where the transaction is suitable to be given an internal valuation as required by the Regulatory Authority. Three types of exposure are distinguished: Letters of credit Lines of liquidity Swap agreements This Rating System comprises different models which are applied according to the type of exposure underlying the securitization operation. In particular, there are 7 models: 1. Trade receivables; 2. Mortgage warehousing (to cover the residential mortgages segment); 3. Single rated securities; 4. Commercial mortgages (to cover the commercial mortgages segment); 5. Loans and leases; 6. Rated securities and corporate loans; 7. Credit cards All of the above models consist of a quantitative module which supplies a rating class and a qualitative module whose results influence the quantitative module through the upward or downward movements of notches. For the quantitative module, two principal methodologies are used according to the type of underlying exposure and the residual life of the assets within the vehicles: Reserve Based approach: used for assets with a short residual life (typically less than 6 months) within the vehicle (and consequently the commitment also has a limited duration). For this type of transaction, a point in time valuation is carried out in order to determine, in a static manner, the reserves required to cover the losses. Cash Flow Based approach: used for assets with a longer residual life. In this case, instead of making a point in time valuation, the evolution of the assets within the vehicle is evaluated by using models which take account of the expected cash flows to determine the reserves necessary to cover the losses suffered. Apart from the above difference, the structure of the model is generally very similar, as can be seen from the graphic below: BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 72 AS OF DECEMBER 31 st, 2008

77 General model structure Reserve Based Model General model structure Cash flow models 73

78 All the qualitative modules have been developed on the basis of feedback from experts in the sector. The validation unit has assessed the conformity of the approach followed by HVB with the criteria used by the Rating Agencies and declared that it satisfies the minimum requirements prescribed by current legislation. LGD model The LGD represents the financial loss suffered by the bank on the individual transaction, and is calculated as a percentage of the exposure to default. The LGD is calculated for each individual transaction and takes account of the fact that different types of default are possible: Liquidation: total liquidation and forced recovery of collaterals. The relationship with the customer is terminated and the customer is removed from the portfolio. Settlement: the customer re-enters the performing portfolio after reporting a major loss (> 100) to the bank. Cure: once the period of difficulty is over, the customer re-enters the performing portfolio after reporting a major loss to the bank. In the case of a Cure, the LGD is set at 0, while in the other two cases the estimation of the LGD follows a work-out approach, with separate estimation of the recoveries deriving from collaterals and those deriving from the unsecured part of the exposure. Personal guarantees are not taken into account in the models, since the substitution approach is used for this type of guarantee. In order to determine the final value of the LGD, the following factors are taken into consideration: minimum value that the LGD can fall to under legislative provisions (e.g. 10% for mortgages); estimated rate of non-cure cases; discounted expected recovery value of the collaterals, net of direct costs; discounted expected rate of loss of the unsecured portion of the transaction,; percentage of indirect costs (net of the recoveries made after closure of the positions which it has not been possible to re-attribute to the individual position); any adjustment factor to take account of a potential worsening of the economic cycle. With regard to the procedure for estimating the rate of recovery from the guarantee, this has been obtained on the basis of a historical sample and calculated differently for the following types of collaterals: real estate; other collaterals (physical); other collaterals (non-physical). This value has then been discounted by taking account of the average observed duration of the defaults. With regard to the procedure for estimating the unsecured part, on the other hand, this has been carried out separately for seventeen customer segments (the principal categories are retail, small business, corporate, real estate developers, real estate investors, real estate housing companies, etc.). BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 74 AS OF DECEMBER 31 st, 2008

79 The validation unit has examined the structure of the model, its coherence with the definition of PD, the effect of the economic cycle, the methodology for discounting recovery flows, the allocation of costs and the handling of the assets in default. The calibration of the model and its components has also been checked. EAD model The EAD model determines the expected exposure on a transaction at the time of the default. It is estimated for each individual transaction as the sum of two components: EAD = EAD OnBalance + EAD OffBalance Where the parameter that is estimated is obviously the EAD (Off balance). This parameter may be generically defined as the sum of the following elements: EAD OffBalance = CEQ x endorsement + min(ceq,leq) x max( 0, external line drawing) + max[0, LOF x external line + BO OCF x max(0,drawing external line)] Where: CEQ: Credit Equivalent Factor; this is the credit conversion factor for the credit, and represents the portion of the commitment/guarantee issued by the bank that will be used; LEQ: Limit Equivalent Factor; this is the percentage of the amount unused 12 months before the default that is expected to be used at the time of the default; LOF: Limit Overdraft Factor; BO: Base Overdraft; BO and LOF: these are the parameters that estimate the expected amount of use that, at the time of the default, will exceed the allocated maximum limit (overdraft amount); in the application phase, in order to avoid a double counting for cases where the counterparty is already in an overdraft situation, a correction is made using the OCF (Overdraft Correction Factor); Endorsement: amount of commitments issued to the bank s customer; external line: line of credit; drawing: current use. The parameters defined above are then differentiated according to the product macro-typologies defined within the regulatory calculation engine. For the purposes of evaluating the model, the parameters have been assessed by calculating on the basis of the weighted averages for each segment. The validation unit has examined the design model with particular reference to the coherence of the defined parameters, the need to include a downturn parameter and the coherence of the definition of default with that used in the PD and LGD models. The calibration of the model and its components, including their major sub-segments, has also been checked. 75

80 Local Models, Austria division Mid corporate rating model The Firmenkundenrating Inland rating (= Midcorporate PD rating) concerns itself with ratings for exposures to the category of Bank Austria (BA) businesses based in Austria with annual turnover of more than 1.5 million and less than 500 million. The model consists of two components: a quantitative module and a qualitative module. The risk factors for the quantitative module have been selected on the basis of both statistical and expert criteria. The principal risk factors included in the quantitative module generally cover the following areas of analysis: Size; Structure of liabilities Dynamic factors (such as ROI) Equity ratio The qualitative module, on the other hand, covers the areas of analysis relating to: Overdraft behaviour, orders level/capacity utilization, market position Management quality Accounting and reporting Equipment systems and organization The qualitative rating and the final financial rating (= quantitative rating after verification of the possibility of applying an age restriction and carrying out a first override on the basis of the information available) are combined to obtain the socalled Combined Customer Rating. The warning signals are applied to this rating in order to obtain the Modified Customer Rating. It is also possible to apply an override to this rating, thus producing the Stand alone Customer Rating. If this rating is older than 15 months, an age restriction is applied, resulting in its downgrade. The figure below depicts in detail the different phases involved in determining the final rating. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 76 AS OF DECEMBER 31 st, 2008

81 The validation unit has also evaluated the design of the model by analyzing the responses to a questionnaire submitted to users. It has also tested the behaviour of the model and the modules that it comprises in terms of performance and calibration. Finally, it has carried out analyses aimed at identifying any distorting behaviours in the use of the qualitative questionnaire, the overrides and the warning signals, as well as analyzing the matrix of transition between financial rating and final rating. Small Business rating model This rating model is applicable to small or medium-sized Austrian businesses (up to 1.5 million of annual turnover or using cash based accounting) and small-scale self-employed professionals and non-profit organizations. The general design of the model consists of an application module and a behaviour module. The application module is applied principally in the following cases: new client; the customer requests a further line of credit for which the total exposure exceeds 50,000 or there is no behaviour score (irrespective of the amount of the exposure); updated balance sheet information is available; warning signals have been modified / have arisen. The application module contains qualitative and quantitative information about the counterparty. Dependent on the accounting regime (full accounting versus cash based accounting) the quantitative risk factors cover at least 3 of the following areas of analysis: Profitability; Debt coverage; Debt ratio; Earnings. The qualitative risk factors cover the areas of analysis relating to: Industrial sector / line of business; Default history; Experience of management; Protection against risk; cash collection management. If the customer s transaction is older than 6 months and the conterparty s exposure is not above 1 million, the behavior module is calculated automatically on a monthly basis. The risk factors for the behaviour module have been selected on the basis of a thorough analysis carried out by a mixed team of experts in statistics, product management, market and credit analysis. 77

82 The two modules (application and behaviour) are combined using different weights according to the exposure and the age of the application score in order to obtain a combined PD, which, once mapped to the master scale, determines the calculated rating. The final valid rating is obtained by modifying the calculated rating on the basis of any available negative information or of warning signals in general. The figure below depicts in detail the different phases involved in determining the final rating. For counterparties with exposure above 1 million only the application module is used, but extended with the possibility for underwriters to overrule the calculated rating. The validation unit has verified the appropriateness of the design of the model and carried out quantitative analyses principally aimed at evaluating the discriminating power of the model and its components. It has also verified the stability of the small business population and the calibration of the model. Private Individuals rating model The Private Individuals rating model is applicable to all individuals other than self-employed professionals and independent labourers. The model consists of 6 scorecards: 3 application cards and 3 behaviour cards, differentiated according to the type of product (mortgages, current accounts and consumer loans), statistically combined in order to obtain a counterparty PD. In a first step, one of the six scorecards mentioned above is applied for each transaction. If the age of the transaction is less than 6 months, the application scores are used; conversely, if the transaction is older than 6 months, the behavior score is calculated and updated each month. In a second step, the so-called integration logic considers for each transaction possible effects deriving from any other types of transactions that the client has with the bank. The result of this procedure gives the Account specific customer score for each transaction. In the third step, all the PDs thus determined for the transactions of the customer concerned are combined by geometric averaging to obtain the Customer PD. In the fourth and final step, the PDs are mapped to the rating classes using the BA Masterscale. BASEL 2 THIRD PILLAR DECEMBER 31 ST, 2008 BASEL 2 THIRD PILLAR 78 AS OF DECEMBER 31 st, 2008