Harmonizing Risk Appetites within a Stress Testing Framework

Harmonizing Risk Appetites within a Stress Testing Framework H. Walter Young Audit & Enterprise Risk Services April 2013

Contents The Regulatory Evolution and Risk Appetites 3 Deloitte s Approach 9 Definition of Risk Appetite 10 Risk Appetite Framework 12 Leveraging Risk Appetite in Stress Testing and Business Processes 14 Linking Capital Triggers/Risk Appetite to Rating Agency Ratings 27 Risk Appetite Implementation Tips 32 As used in this document, "Deloitte" means Deloitte & Touche LLP, a subsidiary of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting. 1 Harmonizing Risk Appetites within a Stress Testing Framework

Capital Planning Regulatory Evolution - Then SR 1999-18* mentioned both Economic Capital (EC) and Internal Capital Adequacy Assessment (ICAAP) 5 times each. Stress testing was mentioned, but no real regulatory stress test focus until 2008. Risk appetite was not mentioned in 1999.. Pre downturn: Micro-prudential focus (1999) SR 1999-18, Pillar II Economic Value Added (EVA) or Economic Capital (EC) *http://www.federalreserve.gov/boarddocs/srletters/1999/sr9918.htm 2 Harmonizing Risk Appetites within a Stress Testing Framework

Capital Planning Regulatory Evolution - and Now Macro-prudential supervision focuses on stress testing for banks $10 Billion and greater, as the central tool to monitor capital adequacy in the banking system (see SR 09-04*, DFAST and CCAR, CapPR)**. SR 09-04 mentioned Stress Tests ~10 times. In 2009 to 2011, Risk Appetite was still not a focus. CCAR s focus on Risk Appetite began in 2012. EC now gets very little focus. Result: The aggregate tier 1 common equity ratio of the 18 firms that underwent the recent CCAR Stress Tests has more than doubled, from 5.6% of riskweighted assets at the end of 2008 to 11.3% at the end of 2012 1 The bar keeps rising as ~ 20-25% of large banks Fail components of stress tests annually *SR 09-04=http://www.federalreserve.gov/boarddocs/srletters/2009/SR0904.htm ** DFAST = Dodd Frank Act Stress Test, CCAR= Comprehensive Capital Analysis and Review, CapPR= Capital Plan Review *** DFA= Dodd Frank Act, http://www.sec.gov/spotlight/dodd-frank.shtml, SCAP= Supervisory Capital Assessment Program ICAAP Post downturn: Macro-prudential focus (2009 +) Risk Appetite CCAR/DFA*** ICAAP Stress Testing 1 See Ben S. Bernanke, Chairman Board of Governors of the Federal Reserve System at Maintaining Financial Stability: Holding a Tiger by the Tail, page 4 a Financial Markets Conference, Sponsored by the Federal Reserve Bank of Atlanta, Stone Mountain, Georgia, 4/8/2013 3 Harmonizing Risk Appetites within a Stress Testing Framework SCAP***

First Major Appearance of Risk Acceptability to Banks First worldwide focus on Risk Appetites came from worldwide regulators in response to the 2007-2008 downturn. In 2009, the Senior Supervisors Group (SSG) which is comprised of the senior financial supervisors from seven countries* published a report evaluating certain prevalent risk management practices and their effectiveness. In this report, the SSG identified the failure of some boards of directors and senior managers to establish, measure and adhere to a level of risk acceptable to the firm as one of the key areas that required further work by the firms to improve. 2 * United States, Canada, France, Germany, Japan, Switzerland and United Kingdom regulators 2 Senior Supervisors Group Report titled Risk Management Lessons From The Banking Crisis of 2008, October 21, 2009. 4 Harmonizing Risk Appetites within a Stress Testing Framework

First Major Appearance for Risk Appetite? Question: Where did Risk Appetite Statements come from? Answer: In the SSG s next paper (2010), emphasis on Risk Appetite was made, including a series of recommendations. This new SSG paper suggested linking a Risk Appetite Statement to forward-looking and well-informed strategic decision making processes that can shape an organization s ability to remain profitable while also managing risk prudently. 3 3 SSG issued another report that evaluates how financial institutions have progressed in developing formal risk appetite frameworks and in building out highly developed IT infrastructures and organization wide data aggregation capabilities December 23, 2010. See SSG report titled Observations on Developments in Risk Appetite Frameworks, Dec. 2010, page 1. 5 Harmonizing Risk Appetites within a Stress Testing Framework

The Bar Keeps Rising, given the OCC s 2012 Requirements for Risk Appetite Mentioned Publically: According to a recent American Banker Article, only 2 of the 19 (largest) U.S. banks met the regulator's requirements for defining the company's appetite for risk-taking and communicating it across the company Per the American Banker article, the number of outstanding "matters requiring attention" (MRAs) at the 19 banks stood at 1,083 on Sept. 30, 2012, dealing with the OCC's* requirements for internal auditing, risk management or succession planning 4 This averages ~57 separate MRAs per each bank on these topics So, what does the Federal Reserve / OCC / FDIC** want? *OCC= The Office of the Controller of the Currency **FDIC= Federal Deposit Insurance Company *4 Big Banks Flunk OCC Risk Tests, American Banker 12-13-2012 by Barb Rehm 6 Harmonizing Risk Appetites within a Stress Testing Framework

In November 2012, the Federal Reserve Turned Up the Heat on Risk Appetite: The Federal Reserve raised the bar and canonized a Risk Appetite request into the 2013 CCAR/CapPR stress test instructions: A Bank Holding Company (BHC) should establish capital goals aligned with its risk appetite and risk profile as well as expectations of stakeholders, providing specific targets for the level and composition of capital. 5 The BHC should ensure that maintaining its internal capital goals will allow it to continue its operations under stressful conditions. 6 So, now that Risk Appetites are required, How do we use them? 5 Comprehensive Capital Analysis and Review 2013 Summary Instructions and Guidance, November 9, 2012, page 24. 6 Capital Plan Review 2013 Summary Instructions and Guidance, November 9, 2012, page 20. 7 Harmonizing Risk Appetites within a Stress Testing Framework

What Have We Learned from the Past Several Years? The evaluation of the causes of the turmoil has underscored the critical importance of effectively managing risk. It has also reinforced the benefits that a properly articulated statement of risk appetite and framework can provide: A clear articulation of the business activities an organization is willing to engage in and the levels of risk it is willing to assume An understanding of the risks taken by the organization, both at the business unit level and in aggregate A foundation for common understanding and communication among internal and external stakeholders A framework for formulating strategic and tactical business decisions A means to engage the board of directors in improving risk governance and discussion of risk from a strategic point of view Ability to measure, monitor and control the actual risk positions against expressed risk appetite, and facilitate communication to stakeholders 8 Harmonizing Risk Appetites within a Stress Testing Framework

Deloitte s Perspective on Risk Appetite Based on our experience with financial services institutions and the results of the Deloitte Touche Tohmatsu Limited Global Risk Management Surveys, we believe that risk appetite: Is an integral and critical component of an Enterprise Risk Management framework and is an important governance tool Provides guiding principles for management in evaluating strategic and investment activities, as well as facilitates tactical decision making across the organization in a transparent way Provides a means to connect, enhance, and integrate strategic planning, capital planning, and stress testing processes Provides a consistent view of risk across the organization and key stakeholders at a sufficient level of granularity to be meaningful Enhances the risk awareness culture of the organization. 9 Harmonizing Risk Appetites within a Stress Testing Framework

Risk Appetite Defined The International Institute of Finance (IIF) defines Risk Appetite as: the amount and type of risk that a company is able and willing to accept in pursuit of its business objectives. 7 The SSG definition is similar, yet somewhat more detailed: Risk appetite is the level and type of risk a firm is able and willing to assume in its exposures and business activities, given its business objectives and obligations to stakeholders. Risk appetite is generally expressed through both quantitative and qualitative means and should consider extreme conditions, events, and outcomes. In addition, risk appetite should reflect potential impact on earnings, capital, and funding/liquidity. 8 7 Implementing Robust Risk Appetite Frameworks to strengthen financial institutions, International Institute of Finance, June 2011. 8 Observations on Developments in Risk Appetite Frameworks and IT Infrastructure, SSG, December 23, 2010. 10 Harmonizing Risk Appetites within a Stress Testing Framework

These Relationships can be shown Hierarchically 11 Harmonizing Risk Appetites within a Stress Testing Framework

Related Definitions in a Risk Appetite Framework (RAF) * Components Risk capacity is the full level and type of risk at which an organization can operate and remain within constraints implied by capital and funding requirements, as well as other obligations to external stakeholders. Risk capacity is a maximum measure and is not necessarily intended to be reached, meaning that an organization might set a buffer between risk capacity and risk appetite and manage that on an ongoing basis. Risk profile is a point-in-time assessment of actual aggregate risks associated with an organization s exposures and business activities (from stress testing for example), through the use of several tools and measures. Generally, an organization should aim to have its risk profile remain within its stated risk appetite Risk profile minus Risk appetite = Capital (and/or Risk) Availability * RAF is a forward-looking view of a organization s desired risk profile in a variety of scenarios and sets out a process for achieving that risk profile. 12 Harmonizing Risk Appetites within a Stress Testing Framework

Risk Appetite Concepts using Tier 1 Common (the Regulator Ratio Du Jour-Chart Illustrative) 20.00% 18.00% 9-Qtr Fwd Stressed Risk Profile Capital / Risk Availability: Based on desired rating agency rating 16.00% 14.00% 12.00% 12.00% 11.00% Risk Appetite: Proposed Actual Floor 150 bp Stressed Risk Buffer Stressed Risk Capacity Floor 10.00% 4.50% 6.50% 8.00% 6.00% 5.00% 4.00% Fed's Stress test Pass -Fail Point 2.00% 0.00% Current Credit Risk Market Risk Ops Risk/PPNR Risk Profile Capital Avail. Risk Appetite Risk Buffer Risk Capacity Current Risk Profile (Stressed) Capital/Risk Availability Risk Appetite 13 Harmonizing Risk Appetites within a Stress Testing Framework

Risk Appetite Risk Appetite is now part of a Stress Test Process Credit Loss Models, Fees, ORE Loss Assumptions Back Testing, Validation Methodology Linking Stress Tests to Macro Factors Materiality Asset Balances, Liabilities, and Income Statements Strengths and Weaknesses of Models Qualitative Factors Stress Test Results Governance ICAAP, CCAR, CapPR, $10-$50 Billion Bank Controls. Policies and Procedures Ongoing Monitoring of Transparent, Auditable Process Quantitative Factors Capital Buffer for Uncertainty Risk 14 Harmonizing Risk Appetites within a Stress Testing Framework

Risk Governance and Risk Ownership fit within, The Risk Intelligent Enterprise TM Framework 15 Harmonizing Risk Appetites within a Stress Testing Framework

Discussion of Stress Testing, Recovery/Resolution Processes, Rating Agency Ratings and Risk Appetite Capital and Liquidity Triggers Access to Capital and Liquidity mkts. severely constrained Early Remediation Triggers Reverse Stress Test Results Typical Stress Test for Capital Plan Recovery Plan Adverse Severely Adverse Resolution Plan 10% <3% Scenario Probability <2% Rating Agency Rating Dividends, Buybacks Sale of Assets, Other Contingent Action Plans Critical and Core Business, Deposit Resolution 16 Harmonizing Risk Appetites within a Stress Testing Framework

Benefits of Articulating Risk Appetite Provides a clear articulation of the business activities an organization is willing to engage in and the levels of risk it is willing to assume Provides a structure for discussion of the balance between business strategy and risk Provides guiding principles for management in determining whether strategic/business activities and risk levels are acceptable or not Provides a consistent view of risk across the organization to facilitate decision making Serves as a means to engage the board of directors in discussions of risk from a strategic point of view Enhances the risk awareness culture 17 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss Credit Losses, Risk Appetite Triggers and Rating Agency Ratings ACL Potential Size of Credit Losses 18 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss Credit Losses are not Normally Distributed, but have very Fat Tails, with Low Probability with Large Loss Events Possible (not probable) 50 % Likely: Baseline (Mean) ACL Expected Loss Dividend Increase Potential Size of Credit Losses 19 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss Credit Losses are not Normally Distributed, but have very Fat Tails, with Low Probability with Large Loss Events Possible (not probable) 50 % Likely: Baseline (Mean) ACL Expected Loss Dividend Increase Unexpected Loss Potential Size of Credit Losses 20 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss All Material Risk Measures Current Baseline, or Expected, 50% Likely, Capital Profile is an 8.01% Ratio Risk Profile (Credit, OTTI, Ops, Rate & All Material Risks) 50 % Likely: Baseline (Mean) ACL Dividend Increase Current 8.01% Expected Loss Going Concern CAPITAL Common Equity Tier 1 Impact Unexpected Loss Potential Size of Credit Losses 21 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Risk Profile (Credit, OTTI, Ops, Rate & All Material Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Dividend Increase Current 8.01% Expected Loss 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Less 1%** Risk Tolerance Going Concern CAPITAL Common Equity Tier 1 Impact Unexpected Loss Early Warning Potential Size of Credit Losses **1% = Width of Trigger. It is the amount of consumed after a One Standard Deviation Shock from the Expected Scenario 22 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Risk Profile (Credit, OTTI, Ops, Rate & All Material Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** Going Concern CAPITAL Risk Buffers and Triggers Common Equity Tier 1 Impact Unexpected Loss Early Warning Reduce Equity Repurchases Potential Size of Credit Losses **1%, 2% etc. = Width of Trigger. It is the amount of consumed after a 1.65 Standard Deviation Shock from the Expected Scenario 23 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Risk Profile (Credit, OTTI, Ops, Rate & All Material Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** 2.3 % Likely 2.0 Std Dev. Extreme Adverse Stress Going Concern CAPITAL Risk Buffers and Triggers Less 3%** Common Equity Tier 1 Impact Unexpected Loss Early Warning Reduce Equity Repurchases Dividend Cuts Potential Size of Credit Losses **1, 2, 3% etc. = Width of Trigger. It is the amount of consumed after a 1, 2, 3 Standard Deviation Shock from the Expected Scenario 24 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Risk Profile (Credit, OTTI, Ops, Rate & All Material Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Early Warning Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** 2.3 % Likely 2.0 Std Dev. Extreme Adverse Stress Going Concern CAPITAL Unexpected Loss Risk Buffers and Triggers Less 3%** HSR Limit 6% + 50 bp buffer Common Equity Tier 1 Impact Reduce Equity Repurchases Dividend Cuts Potential Size of Credit Losses **1, 2, 3% etc. = Width of Trigger. It is the amount of consumed after a 1, 2, 3 Standard Deviation Shock from the Expected Scenario 25 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Risk Profile (Credit, OTTI, Ops, Rate & All Material Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** 2.3 % Likely 2.0 Std Dev. Extreme Adverse Stress Going Concern CAPITAL Unexpected Loss Risk Buffers and Triggers Less 3%** 1% Likely, Target Risk Tolerance Floor HSR Limit 6% + 50 bp buffer Risk Capacity 5.0% Well Capitalized Less 3.5%** Common Equity Tier 1 Impact Early Warning Reduce Equity Repurchases Dividend Cuts Possible Raise Potential Size of Credit Losses **1, 2, 3% etc. = Width of Trigger. It is the amount of consumed after a 1, 2, 3 Standard Deviation Shock from the Expected Scenario 26 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss Triggers are a Function of Distribution of Losses from Various Stress Test Probability Distributions Risk Profile (Credit, OTTI, Ops, Rate & All Material Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** 2.3 % Likely 2.0 Std Dev. Extreme Adverse Stress Going Concern CAPITAL Unexpected Loss Risk Buffers and Triggers Less 3%** 1% Likely, Target Risk Tolerance Floor HSR Limit 6% + 50 bp Buffer Risk Capacity 5.0% Well Capitalized Less 3.5%** Gone Concern CAPITAL Common Equity Tier 1 Impact Early Warning Reduce Equity Repurchases Dividend Cuts Possible Raise Cut Preferred Dividend Potential Size of Credit Losses **1, 2, 3% etc. = Width of Trigger. It is the amount of consumed after a 1, 2, 3 Standard Deviation Shock from the Expected Scenario 27 Harmonizing Risk Appetites within a Stress Testing Framework

Probability of Credit Loss Triggers and a Targeted Rating Agency Rating are a Function of Distribution of Losses from Various Stress Test Probability Distributions Risk Profile (Credit, OTTI, Ops, Rate & All Material Risks) 1%=Width of Stair-step is Amount of Common Equity Tier 1 () using up One Standard Deviation of Risk from Baseline 50 % Likely: Baseline (Mean) ACL Current 8.01% Expected Loss Dividend Increase 16 % Likely 1.0 Std Dev. (Onetail) Stress Operating Target Early Warning Less 1%** 5 % Likely 1.65 Std Dev. Severe Adverse Stress Risk Tolerance Less 2%** 2.3 % Likely 2.0 Std Dev. Extreme Adverse Stress Going Concern CAPITAL Unexpected Loss Risk Buffers and Triggers Less 3%** 1% Likely, Target Risk Tolerance Floor HSR Limit 6% + 50 bp Buffer Risk Capacity 5.0% Well Capitalized Less 3.5%** Gone Concern CAPITAL Common Equity Tier 1 Impact Targeted A Rating Agency Rating has a 99.92% Likely Survival Level for Reduce Equity Repurchases Dividend Cuts Possible Raise Cut Preferred Dividend Potential Size of Credit Losses **1, 2, 3% etc. = Width of Trigger. It is the amount of consumed after a 1, 2, 3 Standard Deviation Shock from the Expected Scenario 28 Harmonizing Risk Appetites within a Stress Testing Framework

Triggers can be Correlated to Rating Agency Ratings Levels at a 3 Standard Deviation Level Table 4, page 8 of S&P's: "Default, Transition, and Recovery: 2011 Annual Global Corporate Default Study And Rating Transitions" Descriptive Statistics On One-Year S&P Global Probability of Default (PD) Rates in Percent AAA AA A BBB BB B CCC/C Minimum (%) 0 0 0 0 0 0.25 0 Maximum (%) 0 0.38 0.38 1.02 4.22 13.84 48.75 Weighted long-term average (%) 0 0.02 0.08 0.24 0.89 4.48 26.89 Median (%) 0 0 0 0.19 0.73 3.62 22.14 Standard deviation 0 0.07 0.11 0.27 1.05 3.32 12.75 2008 default rates (%) * 0 0.38 0.38 0.48 0.78 4 26 * Highest Historical Year For a AA Rating, it is assumed that 99.98% of the time the company has sufficient capital, or a 0.02% Likelihood of Default. For a Single A Rating, it is assumed that 99.92% of the time the company has sufficient capital, or a 0.08% Likelihood of Default. Currently a sample Bank s 1-Year implied Kamakura JC-5 PD is 0.21%, obviously approximating an BBB S&P rating. This is even better than B, the actual S&P rating 10 10 See WWW.Kamakuraco.com 29 Harmonizing Risk Appetites within a Stress Testing Framework

Single A Ratings are Consistent with a 3 Standard Deviation One- Tailed Stress Test Std Dev Cumulative Distribution 11 Area under curve +/- std dev -4 0.00% -3 0.13% -2 2.28% -1 15.87% 0 50.00% 1 84.13% 68.27% 2 97.72% 95.45% 3 99.87% 99.73% 4 100.00% 99.99% 11 See Wonnacott & Wonnacott: Econometrics, John Wiley and Sons, 1970, page 538 30 Harmonizing Risk Appetites within a Stress Testing Framework

Single A Ratings are Consistent with a 3 Standard Deviation One- Tailed Stress Test Normal curve* - one tail Area on left of 3 sigma 99.87% -5-4 -3-2 -1 0 1 2 3 4 5 *Normal curve illustration used to set probabilities. Illustrative only. 31 Harmonizing Risk Appetites within a Stress Testing Framework

Establishing a Risk Appetite Statement Begin with the overall strategic objectives, which may include mission, value drivers as well as types of business activities, products or geographies Engage the right stakeholders early, which may include Strategic Planning, Risk Management, Finance Ground risk appetite in risk capacity, taking into account financial constraints, regulatory standing, risk management capabilities, etc. Develop a Board-Approved Risk Appetite Statement, including qualitative and quantitative aspects Formalize and approve Risk Appetite Statement 32 Harmonizing Risk Appetites within a Stress Testing Framework

Components of a Risk Appetite Statement Board level Risk Appetite Statement should: Articulate the Board s and management s view on the balance between the mission/strategy of the organization and the risk it is willing to assume. Address both qualitative statements and quantitative metrics for a broad array of risks facing the organization (e.g., earning, earnings volatility, capital, liquidity, credit, market, etc.) The Board level Risk Appetite Statement is commonly supplemented by an ERM dashboard with the risk appetite metrics translated into more specific limits for different risks, business units, or products. Vision Board Level Risk Appetite Statement Enterprise-wide Risk Philosophy / Preamble For Each Key Risk Category: Qualitative Risk Appetite Statement(s) Quantitative Measure(s) and Limit(s) 33 Harmonizing Risk Appetites within a Stress Testing Framework

Examples of Risk Appetite Statements Illustrative Enterprise-wide Risk Philosophy Statements We will only engage in risk activities where it has core competencies, such as XXX. Our activities will focus on proactive portfolio management, balance sheet strength and capital discipline. We seek opportunities to maximize our returns while managing risks, by providing sophisticated services, capabilities, and products that embody personal service and responsiveness to help our clients achieve success. We will only take risks that we can quantify as part of our core customer relationships and that advance our business and objectives. We will only provide products and services that are aligned with our core mission of XXX We will protect and preserve our credit rating and strive be an A rated organization. 34 Harmonizing Risk Appetites within a Stress Testing Framework

Examples of Risk Appetite Statements (Cont d) Illustrative Qualitative and Quantitative Risk Appetite Statements and Limits Strategic Risk - Earnings Qualitative: We will understand the sources and drivers of earnings, including our cost of capital and net interest margin, and strive to maintain a stable growth in earnings. Quantitative: We will strive to achieve an efficiency ratio of between X% and X%. Strategic Risk - Capital Qualitative: We will ensure capital adequacy by maintaining capital ratios consistent with our target of a Well-Capitalized rating, and our severely adverse scenario being no lower than 5% Tier 1 Common Quantitative: We will strive to maintain a capital cushion of at least X basis points above the capital ratios required to be well-capitalized. Credit Risk - Diversification Quantitative: We will diversify our portfolio as follows: No more than X% of Economic Capital invested in any one industry segment At least X% concentration in US businesses No more than X% of our portfolio invested in assets rated below B by S&P 35 Harmonizing Risk Appetites within a Stress Testing Framework

Example Responsibilities Three Lines of Defense Model The three lines of defense governance model can be applied to Risk Appetite framework: Business Units, Risk Management, and Internal Audit Board of Directors 1 st Line of Defense 2 nd Line of Defense 3 rd Line of Defense Business Units Risk Management Internal Audit Role Take and manage risk Set risk policy and monitor Validate Conduct business in accordance with agreed strategy and related risk appetite and tolerances Promote a strong risk culture and sustainable risk-return decision Establish and operate business unit risk and control structure able to ensure operation within agreed policies and risk tolerances Conduct rigorous self-testing against established policies, procedures and limits Perform thoughtful, periodic risk self-assessments Report /escalate risk tolerance breaches Establish risk management policies and procedures, methodologies and tools, including risk appetite framework, and make available throughout enterprise Facilitate establishment of risk appetite statement and set risk tolerances and limits Monitor risk tolerances and limits and communicate with the CEO and the board regarding exceptions Provide independent risk oversight across all risk types, business units and locations Perform independent testing and validation that the risk appetite, risk policies, risk procedures and related controls are functioning as intended Perform independent testing and validation of business unit risk and control elements Provide assurance to management and the board related to the quality and effectiveness of the risk management program, including risk appetite processes 36 Harmonizing Risk Appetites within a Stress Testing Framework

Implementing Risk Appetite Framework Implementing Risk Appetite Framework is an iterative process and should be evolving and improving through experience, disciplined reviews and changing events. Risk appetite should be closely aligned with the pursued strategy. Once approved by the Board, the Risk Appetite statement should be communicated enterprisewide Strategic goals and value drivers Risk Appetite Statement The firms risk appetite framework should foster board level debate on actionable elements that clearly articulate firms intended responses to losses of capital and breaches in limits Action and correction Risk metrics and limits Firms can consider implementing a dashboard approach. Monitoring and reporting Cascading Ability to monitor actual risk profile against risk appetite and limits and report information to senior management and the board on a timely basis is critical, but heavily depends on the IT infrastructure. Risk appetite should be translated into meaningful metrics and limits for each key business activity (e.g., business lines, units, etc.). 37 Harmonizing Risk Appetites within a Stress Testing Framework

End State: Risk Appetite Process Can Integrate with Stress Test Results Concurrently into: Capital Planning; Economic Capital; Concentration Management; Business Line Risk/Return all within ICAAP Views Consistent and transparent ICAAP, Capital, & Governance process with documented stress test models Result: Integration of Stress Test Results, Economic Capital, Concentration Management, New Loan Pricing integrated into Business Line Processes and Results, including Capital Usage, and Product Level Pricing. Full process includes risk assessment and performance measurements. Process evaluates shareholder returns, rating agency ratings, and capital regulatory requirements. Management (economic capital) and regulatory stress test and risk reports: Translate results into appropriate dynamic and static risk reports Concentration, Uncertainty, & De-Risking Action Plans Stress Results / Annual Budget Reporting Stress Testing Governance and ICAAP Oversight Integrated ICAAP, Capital, Concentration & Risk Appetite Process Capital & Liquidity Policies plus Risk Appetite Scenario Development Capital & Liquidity Policies level set with Board Approved Risk Appetite Statement, sets Roles & Responsibilities, capital buffers and trigger levels, and required actions to preserve capital Types of scenarios: Expected Losses for material Risks ~<1% Likely Unexpected Loss Views Idiosyncratic Scenarios Regulator-driven Scenarios Reverse Stress Test At the loan and transaction level, higher risk assets can be isolated and the proper economic capital allocated, Assets or Geographic Regions with Risk Profiles beyond Risk Appetite Limits can be sold. Expected & Unexpected Losses @ Transaction Level 38 Harmonizing Risk Appetites within a Stress Testing Framework Business Mix, Risk Appetite & Concentration, New Business Profile Risk Profile Risk Tolerance and Buffers Hightened Supervisory Review Response Levels Concentrations: Uses of Capital by Product Optimal Business Mix Profile

This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this presentation. Member of Deloitte Touche Tohmatsu Limited