Harmonizing Risk Appetites within a Stress Testing Framework. April 2013

Harmonizing Risk Appetites within a Stress Testing Framework April 2013

Contents The Regulatory Evolution and Risk Appetites 3 Deloitte s Approach 9 Definition of Risk Appetite 10 Risk Appetite Framework 12 Leveraging Risk Appetite in Stress Testing and Business Processes 14 Linking Capital Triggers/Appetite to Rating Agency Ratings 27 As used in this document, "Deloitte" means Deloitte & Touche LLP, a subsidiary of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting. 1 Stress Testing and Risk Appetites Evolving Standards

Capital Planning Long-Term Trends - Then SR 1999-18 mentioned both Economic Capital (EC) and Internal Capital Adequacy Assessment (ICAAP) 5 times each. Stress testing was mentioned, but no real regulatory stress test focus till 2008. Risk appetite was not mentioned herein. Pre downturn: Micro-prudential focus (1999) SR 1999-18, Pillar II CCAR/DFA ICAAP ICAAP Economic Value Added (EVA) or Economic Capital (EC) SCAP Stress Testing 2 Stress Testing and Risk Appetites Evolving Standards

Capital Planning Long-Term Trends - Now Macro-prudential supervision focuses on stress testing for banks $10 Billion and greater, as the central tool to monitor capital adequacy in the banking system (see SR 09-04, DFAST and CCAR, CapPR). SR 2009-04 mentioned Stress Tests ~10 times. In 2009 to 2011, Risk Appetite was still not a focus. CCAR s focus on Risk Appetite began in 2012. EC now gets very little focus. Post downturn: Macro-prudential focus (2009 +) CCAR/DFA ICAAP Result: Capital levels have risen under the CCAR/CapPR process post this systematic quantitative and ICAAP qualitative review which consistent with macroprudential perspectives. ~ 25% of large banks ICAAP Fail stress tests annually 3 Stress Testing and Risk Appetites Evolving Standards Risk Appetite SCAP Stress Testing

First Major Appearance of Risk Acceptable to a Firm? First worldwide focus on Risk Appetites came from worldwide regulators in response to the 2007-2008 meltdown. In 2009, the Senior Supervisors Group (SSG) which is comprised of the senior financial supervisors from seven countries* published a report evaluating certain prevalent risk management CCAR/DFA practices and their effectiveness. SR 99-18, Pillar II ICAAP In this report, the SSG identified the failure of some boards of directors and senior managers to establish, measure and adhere to a level of risk acceptable to the firm as one of the Stress key areas that required further work by the firms to improve. 1 Testing * United States, Canada, France, Germany, Japan, Switzerland and United Kingdom regulators ICAAP 1 Senior Supervisors Group Report titled Risk Management Lessons From The Banking Crisis of 2008, October 21, 2009. SCAP 4 Stress Testing and Risk Appetites Evolving Standards

First Major Appearance for Risk Appetite? Question: Where did Risk Appetite Statements come from? Answer: As a result of the first SSG s next paper. In 2010, the SSG conducted and released an additional study focused on the state of risk appetite and issued a series of recommendations. 2 SR 99-18, Pillar II CCAR/DFA The SSG 2010 paper suggested linking a Risk Appetite ICAAP Statement to forward-looking and well-informed strategic decision making processes that can shape a firm s ability to remain profitable while also managing risk prudently. 3 Stress Testing 2 SSG issued another report that evaluates how financial institutions have progressed in developing formal risk appetite frameworks and in building out highly developed IT infrastructures and firm wide data aggregation capabilities December 23, 2010. ICAAP SCAP 3 SSG report titled Observations on Developments in Risk Appetite Frameworks, Dec. 2010, page 1. 5 Stress Testing and Risk Appetites Evolving Standards

The Bar Keeps Rising, given the OCC s 2012 Requirements for Risk Appetite Mentioned Publically: ICAAP SCAP Draft According to a recent American Banker Article, only 2 of the 19 (largest) U.S. banks met the regulator's requirements for defining the company's appetite for risk-taking and communicating it across the company. Per the American Banker article, the number of outstanding CCAR/DFA "matters SR 99-18, requiring Pillar II attention" (MRAs) at the 19 banks stood at 1,083 on Sept. 30, 2012, dealing with the OCC's requirements ICAAP for internal auditing, risk management or succession planning. 4 This averages 57 separate MRAs cited at each bank on Stress these 3 topics. Testing So, what does the Fed want? 4 Big Banks Flunk OCC Risk Tests, American Banker 12-13-2012 by Barb Rehm 6 Stress Testing and Risk Appetites Evolving Standards

In Nov 12, the Fed Turned Up the Heat on Risk Appetite: The Fed raised the bar and canonized in the 2013 CCAR/CapPR stress test instructions: A Bank Holding Company (BHC) should establish capital goals aligned with its risk appetite and risk profile as well as expectations of stakeholders, providing specific CCAR/DFA targets for the SR 99-18, Pillar II level and composition of capital. 5 ICAAP The BHC should ensure that maintaining its internal capital goals will allow it to continue its operations under stressful conditions. 6 Stress Testing 5 Comprehensive Capital Analysis and Review 2013 Summary Instructions and Guidance, November 9, 2012, page 24. ICAAP 6 Capital Plan Review 2013 Summary Instructions and Guidance, November 9, 2012, page 20. SCAP 7 Stress Testing and Risk Appetites Evolving Standards

What Have We Learned from the Past Several Years? The evaluation of the causes of the turmoil has underscored the critical importance of effectively managing risk. It has also reinforced the benefits that a properly articulated statement of risk appetite and framework can provide: A clear articulation of the business activities a firm is willing to engage in and the levels of risk it is willing to assume An understanding of the risks taken by the firm, both at the business unit level and in aggregate A foundation for common understanding and communication among internal and external stakeholders A framework for formulating strategic and tactical business decisions A means to engage the board of directors in improving risk governance and discussion of risk from a strategic point of view Ability to measure, monitor and control the actual risk positions against expressed risk appetite, and facilitate communication to stakeholders 8 Stress Testing and Risk Appetites Evolving Standards

Deloitte s Perspective on Risk Appetite Based on our experience with financial services institutions and the results of our Global Risk Management Surveys, we believe that risk appetite: Is an integral and critical component of an Enterprise Risk Management framework and is an important governance tool Provides guiding principles for management in evaluating strategic and investment activities, as well as facilitates tactical decision making across the organization in a transparent way Provides a means to connect, enhance, and integrate strategic planning, capital planning, and stress testing processes Provides a consistent view of risk across the organization and key stakeholders at a sufficient level of granularity to be meaningful Enhances the risk awareness culture of the organization. 9 Stress Testing and Risk Appetites Evolving Standards

Risk Appetite Defined The International Institute of Finance (IIF) defines Risk Appetite as: the amount and type of risk that a company is able and willing to accept in pursuit of its business objectives. 7 The SSG definition is similar, yet somewhat more detailed: Risk appetite is the level and type of risk a firm is able and willing to assume in its exposures and business activities, given its business objectives and obligations to stakeholders. Risk appetite is generally expressed through both quantitative and qualitative means and should consider extreme conditions, events, and outcomes. In addition, risk appetite should reflect potential impact on earnings, capital, and funding/liquidity. 8 7 Implementing robust risk appetite frameworks to strengthen financial institutions, International Institute of Finance, June 2011. 8 Observations on Developments in Risk Appetite Frameworks and IT Infrastructure, SSG, December 23, 2010. 10 Stress Testing and Risk Appetites Evolving Standards

These Relationships can be shown Hierarchically 11 Stress Testing and Risk Appetites Evolving Standards

Related Definitions in a Risk Appetite Framework (RAF) * Components Risk capacity is the full level and type of risk at which a firm can operate and remain within constraints implied by capital and funding needs, as well as other obligations to external stakeholders. Risk capacity is a maximum measure and is not necessarily intended to be reached, meaning that a firm might set a buffer between risk capacity and risk appetite and manage that on an ongoing basis. Risk profile is a point-in-time assessment of actual aggregate risks associated with a firm s exposures and business activities (from stress testing for example), through the use of several tools and measures. Generally, a firm should aim to have its risk profile remain within its stated risk appetite Risk profile minus Risk appetite = Capital (and/or Risk) Availability * RAF is a forward-looking view of a firm s desired risk profile in a variety of scenarios and sets out a process for achieving that risk profile. 12 Stress Testing and Risk Appetites Evolving Standards

Risk Appetite Concepts using Tier 1 Common (the Regulator Ratio Du Jour) Draft 20.00% 18.00% 9-Qtr Fwd Stressed Risk Profile Capital / Risk Availability: Based on desired rating agency rating 16.00% 14.00% 12.00% 12.00% 11.00% Risk Appetite: Proposed Actual Floor 150 bp Stressed Risk Buffer Stressed Risk Capacity Floor 10.00% 4.50% 6.50% 8.00% 6.00% 5.00% 4.00% Fed's Stress test Pass -Fail Point 2.00% 0.00% Current Credit Risk Market Risk Ops Risk/PPNR Risk Profile Capital Avail. Risk Appetite Risk Buffer Risk Capacity Current Risk Profile (Stressed) Capital/Risk Availability Risk Appetite 13 Stress Testing and Risk Appetites Evolving Standards

Risk Appetite Draft Risk Appetite now fits into Stress Test Processes Assumptions Back Testing, Validation Methodology Materiality Balance and Liabilities Strengths and Weaknesses of Models Qualitative Factors Stress Test Results Governance CCAR ICAAP Controls. Policies and Procedures Ongoing Monitoring of Transparent, Auditable Process Quantitative Factors 14 Stress Testing and Risk Appetites Evolving Standards Capital Buffer for Uncertainty Risk

The Risk Intelligent Enterprise TM Framework 15 Stress Testing and Risk Appetites Evolving Standards

Discussion of Stress Testing, Recovery/Resolution Processes, Rating Agency Ratings and Risk Appetite Draft Capital and Liquidity Triggers Access to Capital and Liquidity mkts. severely constrained Early Remediation Triggers Reverse Stress Test Results Typical Stress Test for Capital Plan Recovery Plan Adverse Severely Adverse Resolution Plan 10% <3% Scenario Probability <2% Rating Agency Rating Dividends, Buybacks Sale of Assets, Other Contingent Action Plans Critical and Core Business, Deposit Resolution 16 Stress Testing and Risk Appetites Evolving Standards

Probability of Credit Loss Draft Credit Losses, Risk Appetite Triggers and Rating Agency Ratings ACL Potential Size of Credit Losses 17 Stress Testing and Risk Appetites Evolving Standards

Credit Losses are not Normally Distributed, but have very Fat Tails, with Low Probability with Large Loss Events Possible (not probable) Probability of Credit Loss 50 % Likely: Baseline (Mean) ACL Expected Loss Dividend Increase Potential Size of Credit Losses 18 Stress Testing and Risk Appetites Evolving Standards

Credit Losses are not Normally Distributed, but have very Fat Tails, with Low Probability with Large Loss Events Possible (not probable) Probability of Credit Loss 50 % Likely: Baseline (Mean) ACL Expected Loss Dividend Increase Unexpected Loss Potential Size of Credit Losses 19 Stress Testing and Risk Appetites Evolving Standards

Probability of Credit Loss All Risks Current Baseline, or Expected, 50% Likely, Capital Profile is an 8.01% Ratio Draft Risk Profile (Credit, OTTI, Ops, Rate & All Risks) 50 % Likely: Baseline (Mean) ACL Dividend Increase Current 8.01% Expected Loss Going Concern CAPITAL Common Equity Tier 1 Impact Unexpected Loss Potential Size of Credit Losses 20 Stress Testing and Risk Appetites Evolving Standards

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Draft Risk Profile (Credit, OTTI, Ops, Rate & All Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Dividend Increase Current 8.01% Expected Loss 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Less 1%** Risk Tolerance Going Concern CAPITAL Common Equity Tier 1 Impact Unexpected Loss Early Warning Potential Size of Credit Losses **1% = Width of Trigger. It is the amount of consumed after a One Standard Deviation Shock from the Expected Scenario 21 Stress Testing and Risk Appetites Evolving Standards

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Draft Risk Profile (Credit, OTTI, Ops, Rate & All Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** Going Concern CAPITAL Risk Buffers and Triggers Common Equity Tier 1 Impact Unexpected Loss Early Warning Reduce Equity Repurchases Potential Size of Credit Losses **1%, 2% etc. = Width of Trigger. It is the amount of consumed after a 1.65 Standard Deviation Shock from the Expected Scenario 22 Stress Testing and Risk Appetites Evolving Standards

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Draft Risk Profile (Credit, OTTI, Ops, Rate & All Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** 2.3 % Likely 2.0 Std Dev. Extreme Adverse Stress Going Concern CAPITAL Risk Buffers and Triggers Less 3%** Common Equity Tier 1 Impact Unexpected Loss Early Warning Reduce Equity Repurchases Dividend Cuts Potential Size of Credit Losses **1, 2, 3% etc. = Width of Trigger. It is the amount of consumed after a 1, 2, 3 Standard Deviation Shock from the Expected Scenario 23 Stress Testing and Risk Appetites Evolving Standards

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Draft Risk Profile (Credit, OTTI, Ops, Rate & All Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Early Warning Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** 2.3 % Likely 2.0 Std Dev. Extreme Adverse Stress Going Concern CAPITAL Unexpected Loss Risk Buffers and Triggers Less 3%** HSR Limit 6% + 50 bp buffer Common Equity Tier 1 Impact Reduce Equity Repurchases Dividend Cuts Potential Size of Credit Losses **1, 2, 3% etc. = Width of Trigger. It is the amount of consumed after a 1, 2, 3 Standard Deviation Shock from the Expected Scenario 24 Stress Testing and Risk Appetites Evolving Standards

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Draft Risk Profile (Credit, OTTI, Ops, Rate & All Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** 2.3 % Likely 2.0 Std Dev. Extreme Adverse Stress Going Concern CAPITAL Unexpected Loss Risk Buffers and Triggers Less 3%** 1% Likely, Target Risk Tolerance Floor HSR Limit 6% + 50 bp buffer Risk Capacity 5.0% Well Capitalized Less 3.5%** Common Equity Tier 1 Impact Early Warning Reduce Equity Repurchases Dividend Cuts Possible Raise Potential Size of Credit Losses **1, 2, 3% etc. = Width of Trigger. It is the amount of consumed after a 1, 2, 3 Standard Deviation Shock from the Expected Scenario 25 Stress Testing and Risk Appetites Evolving Standards

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Draft Risk Profile (Credit, OTTI, Ops, Rate & All Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** 2.3 % Likely 2.0 Std Dev. Extreme Adverse Stress Going Concern CAPITAL Unexpected Loss Risk Buffers and Triggers Less 3%** 1% Likely, Target Risk Tolerance Floor HSR Limit 6% + 50 bp Buffer Risk Capacity 5.0% Well Capitalized Less 3.5%** Gone Concern CAPITAL Common Equity Tier 1 Impact Early Warning Reduce Equity Repurchases Dividend Cuts Possible Raise Cut Preferred Dividend Potential Size of Credit Losses **1, 2, 3% etc. = Width of Trigger. It is the amount of consumed after a 1, 2, 3 Standard Deviation Shock from the Expected Scenario 26 Stress Testing and Risk Appetites Evolving Standards

Triggers and a Targeted Rating Agency Rating are a Function of Distribution of Losses from Various Stress Test Probability Distributions Probability of Credit Loss Risk Profile (Credit, OTTI, Ops, Rate & All Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Early Warning Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** 2.3 % Likely 2.0 Std Dev. Extreme Adverse Stress Going Concern CAPITAL Unexpected Loss Risk Buffers and Triggers Less 3%** 1% Likely, Target Risk Tolerance Floor HSR Limit 6% + 50 bp Buffer Risk Capacity 5.0% Well Capitalized Less 3.5%** Gone Concern CAPITAL Common Equity Tier 1 Impact Targeted A Rating Agency Rating has a 99.92% Likely Survival Level for Reduce Equity Repurchases Dividend Cuts Possible Raise Cut Preferred Dividend Potential Size of Credit Losses **1, 2, 3% etc. = Width of Trigger. It is the amount of consumed after a 1, 2, 3 Standard Deviation Shock from the Expected Scenario 27 Stress Testing and Risk Appetites Evolving Standards

Triggers can be Correlated to Rating Agency Ratings Levels at a 3 Standard Deviation Level Table 4, page 8 of S&P's: "Default, Transition, and Recovery: 2011 Annual Global Corporate Default Study And Rating Transitions" Descriptive Statistics On One-Year S&P Global Probability of Default Rates in Percent AAA AA A BBB BB B CCC/C Minimum (%) 0 0 0 0 0 0.25 0 Maximum (%) 0 0.38 0.38 1.02 4.22 13.84 48.75 Weighted long-term average (%) 0 0.02 0.08 0.24 0.89 4.48 26.89 Median (%) 0 0 0 0.19 0.73 3.62 22.14 Standard deviation 0 0.07 0.11 0.27 1.05 3.32 12.75 2008 default rates (%) * 0 0.38 0.38 0.48 0.78 4 26 * Highest Historical Year For a AA Rating, it is assumed that 99.98% of the time the company has sufficient capital, or a 0.02% Likelihood of Default. For a Single A Rating, it is assumed that 99.92% of the time the company has sufficient capital, or a 0.08% Likelihood of Default. Currently your Bank s 1-Year implied Kamakura JC-5 PD is 0.21%, obviously approximating an BBB S&P rating. This is even better than B, the actual S&P rating. The Kamakura Implied Rating overall is better @ BB-. 28 Stress Testing and Risk Appetites Evolving Standards

Single A Ratings are Consistent with a 3 Standard Deviation One- Tailed Stress Test Std Dev Cumulative Distribution Area under curve +/- std dev -4 0.00% -3 0.13% -2 2.28% -1 15.87% 0 50.00% 1 84.13% 68.27% 2 97.72% 95.45% 3 99.87% 99.73% 4 100.00% 99.99% 29 Stress Testing and Risk Appetites Evolving Standards

Single A Ratings are Consistent with a 3 Standard Deviation One- Tailed Stress Test Normal curve* - one tail Area on left of 3 sigma 99.87% -5-4 -3-2 -1 0 1 2 3 4 5 *Normal curve illustration used to set probabilities. Illustrative only. 30 Stress Testing and Risk Appetites Evolving Standards

End State: Capital and Risk Appetite Process Can Integrate the Stress Draft Test Results Concurrently into: Capital Planning; Economic Capital; Concentration Management; Business Line Risk/Return within ICAAP Views Result: Integration of Stress Test Results, Economic Capital, Concentration Management, New Loan Pricing all integrated into Business Line Processes and Results, including Capital Usage, and Product Level Pricing. Full process includes risk assessment and performance measurements. Process evaluates shareholder returns, rating agency ratings, and all regulatory requirements. Management (economic capital) and regulatory stress test and risk reports: Translate results into appropriate dynamic and static risk reports Concentration, Uncertainty, & De-Risking Action Plans Stress Results / Annual Budget Reporting Consistent and transparent ICAAP, Capital, & Governance process with documented stress test models Stress Testing Governance and ICAAP Oversight Integrated ICAAP, Capital, Concentration & Risk Appetite Process Capital Policy Scenario Development Capital Policies level set expectations, roles & responsibilities, capital buffers and trigger levels, and required actions to preserve capital Types of scenarios: Expected Losses for all Risks ~<1% Likely Unexpected Loss Views Idiosyncratic Scenarios Regulator-driven Scenarios Reverse Stress Test At the loan and transaction level, any higher risk assets can be isolated and the proper economic capital allocated, Assets or Geographic Regions with Risk Profiles beyond Risk Appetite Limits can be sold. Expected & Unexpected Losses @ Transaction Level 31 Stress Testing and Risk Appetites Evolving Standards Business Mix, Risk Appetite & Concentration, New Business Profile Risk Profile Risk Tolerance and Buffers Hightened Supervisory Review Response Levels Concentrations: Uses of Capital by Product Optimal Business Mix Profile

This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this presentation. About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting Member of Deloitte Touche Tohmatsu Limited