2 Fortis Bank (Nederland) N.V. Pillar 3 disclosure 2009

Transcription

1 Pillar 3 Disclosure 2009

2 2 Fortis Bank (Nederland) N.V. Pillar 3 disclosure 2009

3 3 Fortis Bank (Nederland) N.V. Pillar 3 disclosure 2009 Contents 1. Basel II framework Pillar Pillar Pillar Risk management overview Risk management philosophy Risk management principles Risk organisation Risk management responsibilities Risk governance Capital structure Introduction Pillar 1 regulatory own funds Capital management framework Capital strategy Capital mobility ICAAP/ECAP Pillar Impediments to the prompt transfer of own funds Capital management organisation Scope and perimeter Introduction Scope of application of Basel II approaches Prudential consolidation scope Consolidation differences between IFRS and Basel II Structured Finance and Securitisation Special Purpose Entities Credit risk Definition Risk management framework Credit risk Controlling and monitoring exposure Credit risk mitigation... 39

4 4 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Counterparty Credit Risk Methodology to assign internal capital and credit limits Market risk Definition Market Risk mitigation ALM risk measurement Calculation of Regulatory Capital Operational risk Definition Risk management framework operational risk Securitisation activities Definition Risk management framework securitisation Identification of risks Accounting Principles... 55

5 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Key definitions All amounts in the tables of this Pillar 3 disclosure are denominated in millions of Euro, unless stated otherwise. Because figures have been rounded off, small differences with previously reported figures may occur The following list of definitions will be referred to regularly throughout this report. For each term a brief description explaining the meaning and use of the term is included. This document, although comprehensive of Basel II Pillar 1 risks, excludes risks not covered by the Basel II Pillar 1 framework. For information on these risks or the risk management processes at Fortis Bank (Nederland) N.V. please refer to the Annual Financial Statements Exposure at Default (EAD), Probability of Default (PD) and Loss given Default (LGD) are all measures resulting from Basel II models. EAD and Exposure are different as Exposure represents the accounting value while EAD is the value at the time of default of a specific counterparty. EAD can be either larger than or equal to Exposure (except in case of netting) depending on the model applied and on other factors. The information contained in this report has not been subject to an external audit. Fortis Bank (Nederland) N.V. Fortis Bank (Nederland) N.V. (previously named Fortis Bank Nederland (Holding) N.V.) or the bank refers to Fortis Bank (Nederland) N.V. including its subsidiaries. Since 3 October 2008, the Dutch State has held all ordinary shares in Fortis Bank (Nederland) N.V. In the second quarter of 2010 Fortis Bank (Nederland) N.V. is expected to be transferred to ABN AMRO Group N.V., the new holding company owned by the Dutch State. Fortis Bank (Nederland) N.V. is expected to be merged and integrated with ABN AMRO Bank N.V. Fortis Bank SA/NV Until 3 October 2008, Fortis Bank (Nederland) N.V. was a subsidiary of Fortis Bank SA/NV, which in turn was part of Fortis Group. Master Scale Fortis Bank (Nederland) N.V. has it own internal rating system to assess customers called the Master Scale. It is composed of seventeen performing grades and three non performing grades Fortis Bank (Nederland) N.V. Audit Services Audit Services is used in this document to refer to Fortis Bank (Nederland) N.V. Audit Services De Nederlandsche Bank (DNB) DNB is the financial regulator of Fortis Bank (Nederland) N.V ABN AMRO ABN AMRO refers to the Dutch State-owned businesses and other assets and activities which were legally separated to form the (new) ABN AMRO Bank N.V., established on 6 February 2010 by way of a legal demerger. In the second quarter of 2010 this newly created entity is expected to be transferred to ABN AMRO Group N.V., the new holding company owned by the Dutch State, established on 18 December ABN AMRO is expected to be merged and integrated with Fortis Bank (Nederland) N.V.

6 6 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Basel II framework 1.1 Pillar 1 Fortis Bank (Nederland) N.V. implemented the most advanced approaches to calculate its capital requirements: Internal Rating Based Advanced (AIRBA) for the calculation of Credit Risk, Advanced Measurement Approach (AMA) for the calculation of its Operational Risk requirements and Value at Risk (VaR) for Market Risk. In May 2009, DNB confirmed its approval for the use of AIRBA, AMA and VaR on a stand-alone basis, subject to the execution of a plan to fill in gaps caused by the separation from Fortis Bank SA/NV. This plan has been largely implemented. Credit risk Fortis Bank (Nederland) N.V. applies the Advanced Internal Rating Based approach to at least 85% of its credit portfolios. Fortis Bank (Nederland) N.V. applies the Standardised approach for its credit risk calculation when the Advanced IRB approach cannot be applied or it is not justified. This occurs when: legal entities receive a temporary exemption because they have been acquired recently and their IT systems are not fully integrated for the Advanced IRB approach into the central IT systems. These entities will benefit from central IRB models in due course; legal entities receive a permanent exemption because their credit exposure does not exceed 1% of the credit exposure of the total of Fortis Bank (Nederland) N.V. except when the host supervisor deems the entity material for its financial system. Appendix I contains a list of Solvency Reporting Legal Entities for which credit exposure is calculated using either the Standardised approach or the Advanced IRB approach. Market risk Fortis Bank (Nederland) N.V. will continue to use the Value at Risk (VaR) approach as it did prior to the implementation of Basel II. Operational risk Fortis Bank (Nederland) N.V. has opted for the Advanced Measurement Approach (AMA) applied at consolidated level and based on business lines. In accordance with Article 105 of the CRD, AMA is applied on a top consolidated level basis for both the parent company and its subsidiaries. Fortis Bank (Nederland) N.V. applies AMA to at least 85% of its total income. The AMA developed by Fortis Bank (Nederland) N.V. relies on one policy and framework across all business lines consistently implemented throughout the whole group. To achieve this aim, models, methodologies, processes and IT systems are developed centrally. The materiality assessment is performed at the consolidated level and applied consistently with a top-down approach. The capital requirement is calculated centrally, taking into account diversification effects. By way of a risk-sensitive apportionment, it is then re-allocated to the Solvency Reporting Legal Entities and business lines.

7 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Fortis Banks (Nederland) N.V. aims to cover all material legal entities in AMA. As for the Credit risk approach there are temporary and permanent exemptions whereby Fortis Bank (Nederland) N.V. applies the Basic Indicator Approach (BIA). This occurs when: legal entities receive a temporary exemption because they have been acquired recently and their systems are not fully integrated for AMA; legal entities receive a permanent exemption because their income is not considered material compared to the consolidated total income of Fortis Bank (Nederland) N.V. Appendix I contains a list of Solvency Reporting Legal Entities for which credit exposure is calculated using either the Basic Indicator approach or the Advanced Measurement approach. 1.2 Pillar 2 The risk structure of Fortis Bank (Nederland) N.V. relies on its integrated risk management and the organisation along business lines. Fortis Bank (Nederland) N.V. has a central risk management department, and the risk managers of all business lines report to the Chief Risk Officer. This ensures that a single approach based on the same policies and methodologies is rolled out throughout the entire organisation. As part of this process, care is also taken to apply all relevant guidelines using a top-down approach, in particular with regard to internal governance. Fortis Bank (Nederland) N.V. executes risk-taking activities within the Risk Governance Framework. The ICAAP monitors the Risk Governance Framework on a continuous basis and assesses the adequacy of capital.

8 8 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Pillar 3 Fortis Bank (Nederland) N.V. complies with the Pillar 3 disclosure requirements as described in the European Directive 2006/48/EC. The Pillar 3 disclosure contains two parts: qualitative disclosure that includes information on processes, policy and an explanation of implementation decisions; quantitative reports that include tabulated data with basic analysis and distributions. The qualitative and quantitative parts are disclosed annually (for the first time for full-year 2008). Fortis Bank (Nederland) N.V. updates some reports of the quantitative part on a semi-annual basis (for the first time disclosed for half-year 2009). Guidelines for preparing the Pillar 3 disclosure are contained in the Pillar 3 formal policy approved by the Management Board. Content of disclosure Fortis Bank (Nederland) N.V. has designed its disclosure based on requirements of the European Directive 2006/48/EC and on the guidelines of the Financial Stability Forum. The bank aims to provide a comprehensive overview of its capital requirements for Credit Risk, Market Risk and Operational Risk and its level of capital calculated for solvency purposes. Significant subsidiaries Fortis Bank (Nederland) N.V. uses the following two criteria to define its significant subsidiaries: Material contribution to the consolidated results of Fortis Bank (Nederland) N.V. Material importance of the financial institutions in the local context (i.e. market share). Based on these criteria, Fortis Bank (Nederland) N.V. has no significant subsidiaries.

9 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Risk management overview Fortis Bank (Nederland) N.V. is a financial services provider offering a wide range of banking products and related services. As such, the bank creates value through the origination, warehousing, and transformation of risks that are properly manageable either at position or at overall portfolio level. In this chapter the risk management department is referred to as RISK. 2.1 Risk management philosophy Fortis Bank (Nederland) N.V. defines risk as the possible deviation from anticipated outcomes that have an impact on the value, capital or earnings of the bank, its business objectives, or future opportunities. The bank s risk results from exposure to external and/or internal risk factors inherent to its business activities. Risk taking is an integral part of Fortis Bank (Nederland) N.V. s value proposition to its stakeholders. The bank only aims to take risks that it understands well and which it can adequately manage, either at position or at overall portfolio level. If it is efficient and affordable for the bank to do so, Fortis Bank (Nederland) N.V. actively seeks exposure to these risks. The bank reduces to tolerable levels risks that it does not actively seek, but which are consequential to its business undertakings. 2.2 Risk management principles A set of guiding principles, collected in the risk governance framework, forms the basis of risk management at Fortis Bank (Nederland) N.V. Within this framework, the bank seeks to ensure for all significant risks their identification, assessment, control, monitoring, reporting and management. The guiding principles of RISK are the following: RISK manages rather than avoids risks; RISK takes a holistic view of all risks; Three lines of defence are central to the structuring and operations of risk management: commercial functions; Risk department; and Audit Services; RISK embodies a single organisation within the bank using one set of methodologies and reporting tools; RISK has a one-tier organisation, with single reporting lines, covering the full risk taxonomy; RISK promotes risk awareness in the Management Board; RISK participates in this Board and is involved in all its key decisions; RISK has a centralised organization with local mandates that are limited to meet the minimum regulatory, legal, and fiscal requirements; RISK does not have a profit mandate; RISK functions independently but in close relation to the business; As a partner, RISK provides the business with a competitive advantage; To promote trust and confidence, RISK is transparent and has an open risk culture; RISK enhances communication between Fortis Bank (Nederland) N.V. and its external stakeholders; RISK is proactive and applies a forward- looking approach. 2.3 Risk strategy Fortis Bank (Nederland) N.V. s risk strategy defines how and to what extent the bank takes various types of risk to achieve its business objectives and sets out to what extent undesired risks should be mitigated or avoided. The risk strategy is composed of the following components: the bank s attitude towards risks, its risk tolerance and its risk appetite. Fortis Bank

10 10 Fortis Bank (Nederland) N.V. Pillar 3 disclosure 2009 (Nederland) N.V. s risk strategy follows from the bank s corporate strategy, which is aligned with the bank s strategic objectives and leads into the bank s planning and capital management processes. The bank s risk strategy is closely connected with these elements. Risk strategy stipulates effective utilisation of capital. Equity capital provided by the shareholder and other providers of riskbearing funding support the bank s risk-taking activities. This capital constitutes the bank s financial buffer against risks. In connection with capital management, Fortis Bank (Nederland) N.V. s risk strategy stipulates the productive use of available capital in order to achieve the bank s business objectives. Fortis Bank (Nederland) N.V. classifies risk as either core or non-core. The bank s attitude to risk reflects its desire or willingness to take certain types of risk. In addition, it reflects to what extent the bank wants to avoid or mitigate others. To clarify and enhance communication about this, Fortis Bank (Nederland) N.V. has classified each type of risk the bank may run as either core or non-core risk. Core risks Core risks are those risks to which Fortis Bank (Nederland) N.V. actively seeks exposure. Provided it is efficient for the bank to do so and the bank can contain and manage the exposure, these risks are either at position or at portfolio level. Fortis Bank (Nederland) N.V. seeks to: continuously improve its understanding of risk; extend the universe of risks it underwrites; intermediate as well as to enhance its ability to manage existing risk exposures. Major sub-categories of core risks are: credit risk; market risk (ALM risk and trading risk); liquidity risk. Non-core risks Conversely, Fortis Bank (Nederland) N.V. has identified several non-core risks. These are risks the bank as a rule does not seek but that arise from undertaking business. These include, but are not limited to, operational risk. Operational risk comprises business risk and event risk. Fortis Bank (Nederland) N.V. reduces these risks to acceptable levels, taking into account the cost and benefit tradeoffs. This way, the bank manages its operational risks and protects its reputation, ensuring that its business practices conform to the highest standards of integrity, as specified in the bank s Code of Conduct. Risk appetite and risk tolerance Risk appetite represents the desired amount of risk the Supervisory Board allows the bank to take in order to fulfil its strategy. Risk tolerance represents the maximum amount of risk the Supervisory Board allows the bank to take. Both risk appetite and risk tolerance take into account the constraints set by all stakeholders (shareholders, debt holders, management, employees, clients, broader society) and their agents (regulators, rating agencies, and other agencies). The Fortis Bank (Nederland) N.V. Risk Appetite & Tolerance Statement sets thresholds within which the bank is tolerant to see adverse events affect its earnings, capital base and value generation. As such, the framework ensures that:

11 Fortis Bank (Nederland) N.V. Pillar 3 disclosure key objectives as expressed publicly by the bank can be met with a reasonable degree of confidence; the company s value is protected against excessive volatility; the desired risk profile of the bank is clearly defined, communicated and understood by all stakeholders; markets have confidence in the bank s risk management capacities. Further information on Fortis Bank (Nederland) N.V. s risk strategy is provided in the Annual Financial Statements 2009, chapter 6. Stress testing Fortis Bank (Nederland) N.V. applies a stress testing framework to all risk types and all businesses to exercise the mandate of the Management Board to apply stress scenarios that anticipate extreme events and/or a persistently negative business environment. This framework identifies consequences of the application of these stress scenarios such as potential loss and increased concentrations of risk. The stress testing framework enables the bank to: provide forward-looking assessments of risk; support capital and liquidity planning procedures; take into account spill-over effects, reputation risks related to one risk-type affecting another risk-type or business; assist in uncovering hidden risks and interactions among risks through a reverse stress test; overcome limitations of models and historical data; underpin the setting of the bank s risk tolerance and appetite; develop mitigation or contingency plans across a range of stressed conditions; support internal and external communication. A quarterly report is produced for the Management and Supervisory Boards. This report provides a forward-looking analysis on how hypothetical adverse external (market) conditions would impact Fortis Bank (Nederland) N.V. A formal Stress Testing Policy has been approved by the Management Board. 2.4 Risk organisation Fortis Bank (Nederland) N.V. has designed its risk management structure to enable the implementation of its risk strategy. Apart from this, this risk organisation structure aims to ensure: clear responsibility and accountability regarding risk management; independent risk management functions; adequate resourcing and well-trained risk management functionaries; transparent and coherent risk-related decision-making throughout the bank, taking into account all types of risk the bank s risk taxonomy distinguishes. 2.5 Risk management responsibilities Overall responsibility for the risks the bank takes rests with the Management Board. The Management Board validates and approves Fortis Bank (Nederland) N.V. s risk philosophy and risk strategy. For this, the Management Board uses a clear definition of risk attitude, level of risk tolerance and desired risk appetite. Fortis Bank (Nederland) N.V. has entrusted the execution of risk strategy to its Management Board. The Management Board is also responsible for the approval of risk management policies and for the bank s risk culture and risk appetite. It ensures the adequate set-up of the bank s risk management, keeping management informed of the bank s material risks at all times.

12 12 Fortis Bank (Nederland) N.V. Pillar 3 disclosure 2009 The Management Board takes decisions that have a significant impact on the allocation of capital and the bank s liquidity requirements and, as a consequence, on the overall risk profile. Taking into account the Supervisory Board approved risk tolerance, the Management Board ensures a proper balance between the bank s commercial interests and the risks the bank needs to take. The Management Board provides the Supervisory Board with adequate information for it to properly judge whether Fortis Bank (Nederland) N.V. s business activities fit in with the bank s risk tolerance. The Supervisory Board periodically assesses this on a strategic level. The various RISK functions support the Management Board in exercising its duties. One of the members of the Management Board, the Chief Risk Officer, is explicitly responsible for decision-making about risk management. He is involved in the timely preparation of decisions that are of material importance to the bank s risk profile, especially in cases where such decisions could lead to a deviation from the Supervisory Board approved risk tolerance. Risk Management also takes into account the importance of financial stability and the impact that systemic risk may have on the bank s risk profile. RISK performs the following tasks: measures, analyses, and limits risks; sets risk method standards; develops and implements internal models for risk evaluation of products and processes; analyses portfolio performance based on a range of risk parameters; monitors on an ongoing basis and improves core processes (e.g. risk based pricing tools); prepares regular or ad-hoc reports on the current risk situation to management and risk committees; ensures consistency and efficiency of all available risk related data on all aggregated levels (e.g. single transactions or divisions); assesses the effect of macroeconomic scenarios on the entire bank s portfolio (Stress Testing). 2.6 Risk governance Fortis Bank (Nederland) N.V. s comprehensive risk committee structure ensures the bank takes risk decisions at the appropriate level. The bank s decision structure consists of several levels of risk committees. Further details on Fortis Bank (Nederland) N.V. s risk governance is provided in the Annual Financial Statements 2009, chapter 6.

13 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Capital structure 3.1 Introduction Fortis Bank (Nederland) N.V. holds capital to cover its risks. The amount and quality of the bank s capital is subject to rules, guidelines and/or expectations from several stakeholders, including its regulators. This chapter describes the composition of the bank s available regulatory own funds under the first pillar of Basel II. 3.2 Pillar 1 regulatory own funds The Pillar 1 regulatory own funds at Fortis Bank (Nederland) N.V. s consolidated level are calculated based on IFRS figures according to the rules set by De Nederlandsche Bank (DNB). The available regulatory own funds are classified into three main categories: Tier 1 capital, Tier 2 capital and Tier 3 capital. The key terms and conditions of each of these categories are summarised below. Tier 1 capital Tier 1 capital is composed of shareholders equity, minority interests, non-innovative Tier 1 capital, and innovative Tier 1 capital instruments after the application of prudential filters. Shareholders equity consists of share capital, share premium reserve, unrealised gains and losses, reserves and net profit attributable to shareholders. The unrealised gains and losses are excluded from Tier 1 capital computation except for the unrealised losses on available-for-sale equities which are fully deducted from Tier 1 capital. Minority interests reflect the equity of minority shareholders in a subsidiary. DNB allows in its core capital non-innovative hybrid instruments such as profit-sharing certificates. Those non-innovative instruments must meet the criteria set by DNB, including the requirements that they must be permanent and should have a loss absorption capacity similar to common equity. Outstanding non-innovative capital instruments at Fortis Bank (Nederland) N.V. are: Mandatory Convertible Securities On 7 December 2007, Fortis Bank Nederland (Holding), Fortis Bank SA/NV, Fortis SA/NV and Fortis N.V. issued Mandatory Convertible Securities (MCS) with a nominal amount of EUR 2 billion (which results in about EUR 1,992 million of capital at the end of 2009). The MCS constitute unsecured and subordinated obligations of Fortis Bank Nederland (Holding) N.V., Fortis Bank SA/NV, Fortis SA/NV and Fortis N.V. The MCS are subordinated to all other loans, subordinated loans and preference shares, but rank senior to ordinary shares; Non-cumulative perpetual preference shares for EUR 210 million; Non-cumulative non-voting perpetual preference shares (issued by Fortis Bank Nederland (Holding) N.V. via Fortis Capital Company Limited (FCC) in June 1999). Following the cash settlement of the FCC preference shares of June 2009 EUR 87.5 million is outstanding, which qualifies as non-innovative capital Innovative Tier 1 instruments are subordinated debt instruments that do not have a maturity date and have a relatively high capacity for loss absorption. They must also meet strict rules that are predefined by DNB. No innovative Tier 1 instruments are currently outstanding at Fortis Bank (Nederland) N.V.

14 14 Fortis Bank (Nederland) N.V. Pillar 3 disclosure 2009 Tier 2 capital Tier 2 capital is subdivided into upper Tier 2 and lower Tier 2 capital. Upper Tier 2 capital consists of debt instruments with an indefinite term (i.e. cumulative preference shares) and other financial instruments such as positive revaluations on available-for-sale equities (after tax). Lower Tier 2 capital consists of other long-term subordinated liabilities that meet certain specified criteria and (cumulative) preference shares with a fixed term (not available within Fortis Bank (Nederland) N.V.). Total of upper Tier 2 capital that Fortis Bank (Nederland) N.V. holds is 57 million as of December Lower Tier 2 at Fortis Bank (Nederland) N.V. consists of other subordinated liabilities and includes: Loans from third parties with a total amount of billion with an interest rate in the range of 3.6% to 8.6% and a maturity in the range of 2010 to 2039; A conversion by the Dutch State of EUR 1.35 billion of Tier 2 instruments (subordinated loans) into Tier 1 capital (common equity) on 24 December 2009 reinforced Tier 1 capital and is in line with recent announcements of the Basel committee with respect to the future capital structure of banks. Due to this increase of Tier 1 capital there was no need to restrict Tier 2 capital to a maximum of 50% of Tier 1 capital. Tier 3 capital Tier 3 capital consists of short-term subordinated liabilities. Tier 3 Capital is a regulatory item that was introduced in 1996 to cover market risk requirements only. No Tier 3 debt was outstanding at the end of Basel II specific capital components, prudential filters and deductions There are multiple Basel II specific capital components, deductions and prudential filters that limit the capital under the Basel II framework. At Fortis Bank (Nederland) N.V. the following applies: Value adjustments for credit risk positions in standardised approach (+); Intangible assets (-); IRB provision shortfall and equity expected loss amounts (-); A linear maturity adjustment on subordinated liabilities with a maturity less then five years (-); Fortis Bank (Nederland) N.V. holds capital to cover its risks. The amount and quality of the bank s capital is subject to rules, guidelines and/or expectations from many different stakeholders, including its regulators, rating agencies, the market, shareholders, fiscal authorities and Fortis Bank (Nederland) N.V. s management. This chapter describes the composition of the bank s available regulatory own funds under the first pillar of Basel II.

15 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Capital Structure Share capital and reserves 4,401 21,492 Net profit attributable to shareholders 406 (18,486) Minority interests 4 73 Unrealised gains and losses Non-innovative and hybrid capital instruments 2,081 1,986 Total core Tier 1 capital 6,892 5,065 Innovative hybrid capital instruments 450 Participating interests in financial institutions (5) (5) Intangible assets (128) (162) Other deductions & filters (49) (77) Shortfall (78) (174) Tier 1 capital 6,632 5,097 Subordinated loans 2,238 3,690 Participating interests in financial institutions (5) (5) Unrealised gains and losses Other deductions & filters (1,052) Shortfall (78) (174) Tier 2 capital 2,213 2,528 Tier 3 capital Total capital before profit appropriation 8,845 7,625 Note The amount of Lower Tier 2 Capital is restricted by our regulator (DNB) to a maximum of 50% of Tier 1 Capital. Figures represent Full Basel II which are Basel II without any transitional requirements.

16 16 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Capital management framework This chapter summarises the approach of Fortis Bank (Nederland) N.V. to assessing the adequacy of its capital, which is managed at group level, to support current and future activities. 4.1 Capital strategy When managing its capital, Fortis Bank (Nederland) N.V. aims to optimise return on its shareholder s capital within the limits defined by the bank s management in its risk-appetite parameters. These limits also incorporate the constraints set by regulators and rating agencies on the capital base. This means that through the management of its capital, the bank strives to ensure the efficient use of its capital within its businesses while maintaining a solid and cost-effective capital base (with respect to the mix and amount of capital). Part of the bank s strategy is to assure its position as a well capitalised bank. Below is a summary of the capital requirements and capital ratio calculated according to Basel II regulation.

17 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Capital requirements Credit Risk Internal Rating Based (IRB) Central governments and banks Institutions Corporate 1,263 1,529 Retail Equity exposures (in the banking book) 19 1 Securitisation positions Other Non credit Obligation Assets Total 2,213 2,360 Credit Risk Standardised Approach (SA) Central governments and Central Banks Regional Governments and local authorities 1 Administrative Bodies and Non-Commercial Multilateral Development Banks International organisations Institutions Corporate Retail claims Claims Secured on real Estate Property Past due items Regulatory high-risk categories Covered bonds Short-term claims on Institutions and Corporate Collective Investment Undertakings Other Total Other risks Market Risk of which (i) Trading Book exposures of which (a) Position risk in traded debt instruments (b) Position risk in equities (ii) All Business Activities of which 7 7 (a) Foreign Exchange Risk 7 7 (b) Commodities Settlement Risk Operational Risk of which Advanced Methodology Approach Basic Indicator Approach Total Total Capital requirement 3,470 3,672

18 18 Fortis Bank (Nederland) N.V. Pillar 3 disclosure 2009 Capital ratio Full Basel II Basel I Full Basel II Basel I Risk Weighted Assets Credit risk 34,856 65,881 39,459 69,737 Operational risk 8,056 6,161 Country risk Market risk Total 43,372 67,162 45,894 70,932 Available Capital 8,845 8,979 7,625 7,973 * Tier 1 capital 6,632 6,710 5,097 5,271 Solvency Capital 8,845 8,979 7,625 7,973 Tier 1 ratio 15.3% 10.0% 11.1% 7.4% Total capital ratio 20.4% 13.4% 16.6% 11.2% Basel II including Transitional Floor Transitional floor Basel I ) 80.0% 100.0% Tier 1 ratio 12.5% 7.4% Total capital ratio 16.7% 11.2% Note Total Capital for solvency reporting differs between full Basel II and Basel II including transitional floor in the amount of shortfall provisions that can be ignored when the floor is applied. * The amount of capital for 2008 differs from the one published in the Pillar 3 Disclosure due to adjustments registered after the publication in Capital Add-on In May 2009, DNB confirmed the bank s Basel II compliance on stand-alone basis, subject to several conditions. One of these conditions is that some of the PD models can be used internally in risk management processes, but the associated capital requirement should at least be equal to the capital requirement calculated under the standardised approach. These additional requirements for credit risk will no longer apply once approval for the newly developed credit risk models is granted by DNB. The table below presents the capital requirement Credit Risk Standardised Approach including and excluding the additional requirements.

19 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Impact of additional capital requirements Including additional capital requirements Excluding additional capital requirements Capital Add-on Credit Risk Standardised Approach (SA) Central governments and Central Banks Regional Governments and local authorities Administrative Bodies and Non-Commercial Multilateral Development Banks International organisations Institutions Corporate Retail claims Claims Secured on real Estate Property Past due items Regulatory high-risk categories Covered bonds Short-term claims on Institutions and Corporate Collective Investment Undertakings Other Total Key capital management principles When managing its capital, the following three key operating principles apply at the level of Fortis Bank (Nederland) N.V. and at the level of each material subsidiary: Principle 1: Group-wide capital management Fortis Bank (Nederland) N.V. manages its capital and risk at group level. Capital Management is centralised within Risk management which cooperates closely with Finance and with the businesses CFOs and Risk representatives. This centralised capital management is essential in order to strive towards the optimisation of financial flexibility and capital mobility within Fortis Bank (Nederland) N.V. and in order to meet strategic objectives and to withstand stress in the financial markets. Principle 2: Value-driven capital management Fortis Bank (Nederland) N.V. manages capital and risk from an economic perspective, taking into account external capital requirements. During the budgeting and target-setting, capital is allocated to businesses to support the bank s strategy and to optimise return on capital. Furthermore, the cost of capital is optimised via disciplined management of capital requirements (i.e. use of Risk Weighted Assets limits). This value-driven management of our capital requires a forwardlooking, multi-year, clear and transparent view of risk and capital. Principle 3: Accountable capital organisation An effective capital organisation implies clearly defined responsibilities with corresponding accountability. 4.2 Capital mobility In order to benefit from risk diversification, Fortis Bank (Nederland) N.V. also takes measures to optimise the mobility of its capital while taking into consideration limits set by regulators and fiscal authorities.

20 20 Fortis Bank (Nederland) N.V. Pillar 3 disclosure 2009 Any excess capital above target will be repatriated to the bank to the maximum extent possible. Capital held at consolidated level will thus easily be redeployed, when needed, in a very short time frame. When transferring capital, Fortis Bank (Nederland) N.V. takes into account the following: local regulatory rules (solvency and company regulation), local tax regulation, local accounting considerations and contractual restrictions. This includes the impediments to prompt transfer of own funds detailed in paragraph 4.3. Finally, centralised funding and liquidity management ensures optimised flows of funds to cover unexpected losses within Fortis Bank (Nederland) N.V. 4.3 ICAAP/ECAP Pillar 2 As a financial services provider, the acceptance of risk and its active management are core competences of Fortis Bank Nederland. The Risk Taxonomy is the starting point of the Internal Capital Adequacy Assessment Process (ICAAP) and serves several purposes: It provides a description of all broad risk categories Fortis Bank (Nederland) N.V. faces in the conduct of its business as a diversified bank; It links the various sources of risk with the risk management framework by classifying them in line with the Fortis Bank (Nederland) N.V. Risk Governance structure.

21 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Total Risk Credit Risk Market Risk Operational Risk Liquidity Risk Counterparty Risk ALM Risk Business Risk Funding Liq. Risk Country Risk Interest rate Risk Equity Risk Real Estate Risk Forex Risk Spread Risk Adverse changes in volumes Adverse changes in margins and costs Reputation Risk Strategic Risk Interest rate Risk Concentration Risk Trading Risk Event Risk Market Liq. Risk Concentration Risk Stemming from: Single Name Obligor Geography/Country Industry Product or Structure Price Risk and Volatility Risk, on a broad range of market factors. Price Risk and Risk stemming from operational events: Internal fraud External fraud Malicious damage Employee practices & Workplace safety Clients, products and business practices Disasters and public safety Technology and infrastructure failures Execution, delivery and process management Figure 1 - Risk Taxonomy Risk management is an integral part of the entire management of the bank and Economic Capital (ECAP) is the key risk metric used. At the end of 2008 the bank started an Economic Capital project. The project is in its final stage. Economic Capital figures are expected to be available on a regular basis as of Q ECAP as core risk metric ECAP is calculated for all activities and entities of Fortis Bank (Nederland) N.V. For each risk type, qualitative and/or quantitative methodologies for assessing and measuring the risks are developed. Within the framework of risk analysis, ECAP is used as an indicator for adequacy, risk aggregation, capital allocation and limit steering as well as an input parameter for measurement within the value management framework. Performance measurement and, partially, risk-adjusted pricing within the business lines also uses ECAP as a basis.

22 22 Fortis Bank (Nederland) N.V. Pillar 3 disclosure 2009 Best Practice Methods Risks are measured and evaluated using current best practice statistical and quantitative methods. Methodologies and actual risk levels are subject to periodic reviews. ECAP is updated to reflect most recent changes in risk methodologies. ECAP also includes add-ons to be able to incorporate any risk which is not factored into internal models. Fortis Bank (Nederland) N.V. established an internal procedure to ensure that these risks outside internal models are constantly monitored and included in ECAP. To assess the capital adequacy of Fortis Bank (Nederland) N.V., economic capital is compared with the Available Financial Resources. Available Financial Resources Available Financial Resources (AFR) are the capital components available to Fortis Bank (Nederland) N.V. to cover losses on a going concern basis. They represent the economic view on the bank s capital. AFR represents the amount of resources that the bank can draw upon in the event of a crisis to cover losses on a going concern basis. The criteria for inclusion or exclusion of capital components within AFR are: 1. The loss absorption capacity of the capital component on a going concern basis. To be able to cover losses on a going concern basis, capital components should meet the following requirements: They must be equity or have strong equity characteristics; When considering liabilities, these instruments must be unsecured and subordinated in order to have them available even under adverse conditions; Instruments should not be redeemable at the initiative of the holder or without prior consent of the supervisory authority. 2. Protection of the reputation of Fortis Bank (Nederland) N.V. Finally, capital adequacy is determined by comparing Available Financial Resources with the total economic capital that is required to cover all risk types. Actions that follow from assessing the capital adequacy can focus on the amount of Available Financial Resources or the amount of required economic capital. Economic capital The economic capital is determined as follows: Identify all material risk to which Fortis Bank (Nederland) N.V. is exposed, in a forward-looking manner. The bank s material risks are based on the bank s integrated risk profile as stated in the Risk Taxonomy; Calculate the amount of economic capital that is required to cover the identified material risks. 4.4 Impediments to the prompt transfer of own funds The banking activities of Fortis Bank (Nederland) N.V. are almost entirely within legal entities that are located in the Netherlands. These legal entities have been guaranteed by Fortis Bank (Nederland) N.V. with the so-called 403 declaration. They are also part of Fortis Bank (Nederland) N.V. s tax unit for corporate tax. This means that apart from legal and regulatory legislation, there are no specific material impediments to the prompt transfer of own funds of the bank. 4.5 Capital management organisation The organisation of capital management is fully integrated into the governance structure of Fortis Bank (Nederland) N.V. as described in chapter 2. At bank level, the Risk & Capital Committee (RCC) assists the Management Board in ensuring the adequacy of the bank s capital in relation to the said risks and to the risks inherent in the operations as a whole. The Committee supports the CEO and the Management Board in understanding and managing the risks and capital of the bank.

23 Fortis Bank (Nederland) N.V. Pillar 3 disclosure The Management Board is responsible for: eefining an internal capital management process; setting adequate capital targets; ensuring adequate capitalisation. The Board is assisted by the Asset & Liability Committee (ALCO), which is responsible for the management of liquidity, interest rate, corporate foreign exchange risk, investments, long-term funding and capital management of the bank. Furthermore, the ALCO is advised on strategic capital subjects by the Capital Platform. This platform brings together expertise on capital management such as Finance and Risk.

24 24 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Scope and perimeter 5.1 Introduction Fortis Bank (Nederland) N.V., incorporated in the Netherlands, with its registered office at Prins Bernhardplein 200, Amsterdam, The Netherlands, is almost entirely owned by the State of The Netherlands, represented by its Ministry of Finance. Fortis Bank (Nederland) N.V. is a shareholder in operating companies and service companies, either directly or indirectly through subsidiaries. Figure 2 Fortis Bank (Nederland) N.V. ownership and main subsidiaries* (*) See Annual Financial Statements 2009 for list of participations, reported and publiched according to Article 2:414 of the Dutch Civil Code. (**) Total interest of the Dutch State, including indirect interest, is 97.9%. (***) Comprises non-comulative Preference Shares A. 5.2 Scope of application of Basel II approaches The scope of application of Basel II approaches is determined based on the legal consolidation scope. To determine the prudential consolidation scope for prudential reporting towards the regulators the so-called prudential filters are applied to the legal consolidation scope.

25 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Prudential consolidation scope The legal consolidation scope of Fortis Bank (Nederland) N.V. is determined in accordance with IAS 27 Consolidated and Separate Financial Statements, IAS 28 Investments in Associates, IAS 31 Interests in Joint Ventures, and in accordance with SIC-12 Consolidation Special Purpose Entities. All companies for which Fortis Bank (Nederland) N.V., directly or indirectly, has the power to govern the financial and operating policies so as to obtain benefits from their activities enter into the consolidation scope of Fortis Bank (Nederland) N.V. and are fully consolidated. Investments in joint ventures (contractual agreements whereby Fortis Bank (Nederland) N.V. and other parties undertake an economic activity that is subject to joint control) and investments in associates (investments in which Fortis Bank (Nederland) N.V. has a significant influence, but which it does not control, generally holding between 20% and 50% of the voting rights) are also part of the consolidation scope, but are accounted for using the equity method in IFRS and the pro-rata method in Basel II; SR Hypotheken is a joint venture of Fortis Bank (Nederland) N.V. Subsidiaries, joint ventures and associates are consolidated from the date on which effective control is transferred to Fortis Bank (Nederland) N.V. and are no longer consolidated from the date that control ceases. Prudential filters The prudential consolidation scope is used for reporting to the regulator. The starting point is the legal consolidation scope to which the prudential filters are applied. These prudential filters are agreed with DNB. The prudential consolidation scope is agreed yearly with the consolidating supervisor DNB, and it is applied without any change as the Basel II consolidation scope. The list of the legal entities entering the prudential consolidation scope is available in the supporting documentation of this disclosure in Appendix II. Entities deducted from own funds Own funds are calculated after deduction of participating interests in credit, insurance and other linked financial institutions to avoid duplicate counting (i.e. to avoid the use of the same equity) at the parent company's level and at the level of the participating interest. Fortis Bank (Nederland) N.V. deducts four entities with a total amount of EUR 10.1 million. Entities deducted from own funds are: ABACUS Wertpapier Handelsgesellschaft GmbH; Secfinex Ltd; Trade Credit Re Insurance Company SA; European Merchant Services B.V. Solvency-reporting legal entities Solvency-reporting legal entities are credit institutions, investment firms and other financial institutions that report their solvency ratios to their local regulators on an individual and/or consolidated basis, in accordance with the European Capital Requirements Directive (for countries in the European Union) or with local regulation (for countries outside the European Union). A complete list of Fortis Bank (Nederland) N.V. solvency-reporting legal entities is provided in Appendix I. Identification of credit institutions and investment firms The starting point is the prudential consolidation scope as defined in the previous section. In line with the definitions of the European CRD, all European credit institutions and investment firms within this scope are potential solvency-reporting legal entities. Other financial institutions In accordance with the CRD, only credit institutions and investment firms should provide solvency reporting; nevertheless, some European financial holdings and other European financial institutions are required to report their solvency ratio following national regulations. Outside the European Union, solvency-reporting legal entities are selected in accordance with local regulations.

26 26 Fortis Bank (Nederland) N.V. Pillar 3 disclosure 2009 Fortis Bank (Nederland) N.V. complies with these guidelines. Assessment of levels of application Whether solvency-reporting legal entities have to report on an individual basis and/or on (sub)consolidated level depends on the regulatory requirements in each country. Waivers Fortis Bank (Nederland) N.V. uses the following waivers: Based on Article 69.1 a waiver can be obtained for subsidiaries that are included in consolidated reporting (when the subsidiary belongs to the same member state as the parent). Based on Article 69.3 a waiver can be obtained for stand-alone reporting of parent companies that are included in consolidated reporting 5.4 Consolidation differences between IFRS and Basel II For Fortis Bank (Nederland) N.V. differences between IFRS and Basel II consolidation are: Securitisation Special Purpose Entities are not included in the Basel II scope but in the IFRS one (for more information please refer to Chapter 10); Entities, depending on the size of the participations of Fortis Bank (Nederland) N.V., can be excluded from the consolidation scope of Basel II and deducted as participations from the Basel II solvency capital. Entities in the scope of Basel II are fully consolidated, proportionally consolidated or deducted from own funds. 5.5 Structured Finance and Securitisation Special Purpose Entities Fortis Bank (Nederland) N.V. holds some SPEs related to Structured Finance and Securitisation; the list of material SPEs (above 0.5% of their total asset size compared to the bank s total asset size) are reported below. Size of material SPE 2009 Structured Finance SPE % of the institution size Moeara Enim Investeringsmaarschappij IV B.V. 1.2% Brooklyn Investment B.V. 0.7% Securitisation SPE Dolphin Master Issuer B.V. 16.0% Goldfish Master Issuer B.V. 5.1% Beluga Master Issuer B.V. 2.5% Delphinus 2006-I B.V. 1.7% Delphinus 2004-II B.V. 0.8% Delphinus 2003-I B.V. 0.6% Delphinus 2001-II B.V. 0.5%

27 Fortis Bank (Nederland) N.V. Pillar 3 disclosure Credit risk 6.1 Definition Credit risk is the risk to earnings or capital arising from an obligor s failure to meet the terms of any contract or to otherwise fail to perform as agreed. 6.2 Risk management framework Credit risk Credit risk represents the largest risk type within Fortis Bank (Nederland) N.V. s risk profile, reinforcing the need for a well articulated credit risk management framework. The bank s risk management framework is discussed extensively in the Financial Statements Credit Risk Management Credit risk management within Fortis Bank (Nederland) N.V. is governed by the bank s credit policy framework, with a Central Credit Risk Policy governing key high level issues and principles and specific policies dealing with various subjects. These policies together contain a set of principles, rules, guidelines and procedures for identifying, measuring, approving and reporting credit risk within Fortis Bank (Nederland) N.V. The policies establish a consistent framework for credit riskgenerating activities, either through direct lending relationships or through other activities resulting in credit risk, such as investment activities. Following the decision taken in October 2008 to separate the banking activities of Fortis Bank (Nederland) N.V. from those of Fortis SA/NV, Fortis Bank (Nederland) N.V. initiated a review of its Credit Policy framework. This review process continued during 2009 and a substantial number of policies were revised and renewed. As a result, Fortis Bank (Nederland) N.V. now has a suitable set of credit policies that reflect the bank s risk appetite and operating scale on a stand-alone basis. Credit risk exposure Fortis Bank (Nederland) N.V. s overall credit risk exposure (before collateral held and other credit enhancements) is measured and presented as the principal amount of on-balance-sheet claims or off-balance-sheet potential claims on customers and counterparties, as at 31 December. Credit risk exposure is presented based on the classification in the balance sheet, as this most accurately reflects the nature and characteristics of the exposure. Credit risk rating Credit risk rating is the result of the risk rating assignment process, which is based on a qualified assessment and formal evaluation. This rating is the result of: an analysis of each obligor s financial history and estimation of its ability to meet debt obligations in the future; the quality and safety of an asset, based on the issuer's financial condition indicating the likelihood that a debt issuer will be able to meet scheduled interest and principal repayments. The ultimate goal of the process is to calculate the Expected Loss within one year for every given borrower or asset. Fortis Bank (Nederland) N.V. has therefore drawn up a Master Scale, which ranges from 0 to 20 and gives an indication of the probability that a counterparty will default within one year. Master Scale ratings from 0 to 5 are considered investment grade, from 6 to 17 sub-investment grade and from 18 to 20 impaired loans. Fortis Bank (Nederland) N.V. has internal models for all credit portfolios for the parameters PD, LGD and EAD. The calculations and storage of the model outcomes take place in several rating systems for the various business lines. If External Credit Assessment Institutions ratings are available for certain counterparties, these are used to benchmark our internal model outcomes.