AICB Bank Risk Practices (BKR, Malaysia) cheat sheet

Three lines model: first line owns and manages risk in the business; second line (risk, compliance) sets frameworks and challenges; third line (internal audit) gives independent assurance to the board.

The board approves risk appetite and the risk management framework; the board risk committee oversees it; senior management implements it through delegated limits and policies.

Risk appetite is expressed as qualitative statements plus quantitative tolerances (e.g. maximum credit concentration, minimum liquidity ratio, earnings-at-risk cap) and cascades into business-line limits.

A risk register records each risk with an owner, inherent rating, controls, residual rating and treatment plan; ratings are reviewed at least annually or on material change.

Chief Risk Officer independence: the CRO reports to the CEO administratively but has a direct reporting line to the board risk committee, and is not compensated on revenue targets.

Enterprise risk management aggregates all risk types against a common risk taxonomy so that capital, limits and reporting use consistent definitions.

Policy hierarchy: board-approved policy, then management standards/procedures, then desk-level operating instructions; deviations require documented approval at the appropriate level.

BNM's Risk Governance framework expects a board-approved risk appetite, a functioning board risk committee, and clear accountability for risk-taking across the organisation.

Expected loss EL = PD x LGD x EAD; unexpected loss is covered by regulatory and economic capital, expected loss by pricing and provisions.

Risk-weighted assets under the standardised approach use supervisory risk weights on exposure classes; the IRB approach uses internal PD, LGD and EAD estimates subject to supervisory approval and data minima.

Credit grading must separate borrower default probability from facility loss severity; LGD reflects collateral, seniority and workout costs, not borrower quality.

A default is typically triggered by 90 days past due on a material obligation or by unlikeliness to pay (e.g. restructuring into distress, bankruptcy filing).

Credit concentration limits cap single-name, connected-group and sector exposures as a percentage of capital; connected groups are aggregated through ownership and control links.

Loan classification and impairment provisioning follow a staged approach: performing, underperforming/credit-impaired watch, and impaired, with collective plus specific provisions.

Covenant monitoring and annual reviews are control activities; a covenant breach requires escalation, re-grading and possibly a limit or facility amendment.

Credit risk mitigation (guarantees, collateral, credit derivatives) reduces capital requirements only if legally effective, enforceable and meets operational requirements such as documentation and legal review.

Value at Risk (VaR) estimates the maximum loss over a holding period at a confidence level (e.g. 1-day 99% VaR); it says nothing about the size of losses beyond that threshold.

Expected Shortfall (ES) is the average loss in the tail beyond the VaR percentile; it is sub-additive and better captures tail risk than VaR.

Sensitivity measures: DV01 (price change per 1bp yield move), duration and convexity for rates, delta/gamma for options, beta for equities.

Standardised approach capital uses supervisory risk weights and prescribed correlations; internal models approach requires supervisory approval, backtesting and stress testing.

Backtesting compares daily P&L against VaR: exceptions beyond the expected number at the chosen confidence trigger supervisory capital add-ons and model review.

Trading book versus banking book boundary: positions must be actively managed and valued at least daily to qualify for trading book treatment; intent and liquidity determine classification.

Interest rate risk in the banking book (IRRBB) is measured by repricing gap and earnings-at-risk plus economic value of equity sensitivity to rate shocks.

Hedging effectiveness must be documented and tested; ineffective hedges create basis risk and hedge accounting may fail, causing P&L volatility.

Definition: risk of loss from inadequate or failed internal processes, people, systems, or external events; it includes legal risk but excludes strategic and reputational risk.

Basel event categories: internal fraud, external fraud, employment practices and workplace safety, clients/products/business practices, damage to physical assets, business disruption and system failures, execution/delivery/process management.

Standardised approach capital = 15% of average annual gross income over the prior three years; the basic indicator approach uses 15% of positive gross income.

The three lines model assigns control ownership and risk identification to the business, framework and challenge to operational risk, and independent assurance to audit.

Key risk indicators (KRIs) are forward-looking metrics with thresholds that trigger escalation before losses materialise; loss data is backward-looking.

Risk and control self-assessments (RCSA) rate inherent risk and control effectiveness to derive residual risk, and feed the operational risk register.

Business continuity planning requires a business impact analysis, recovery time objectives, recovery point objectives and tested alternate arrangements.

Outsourcing and third-party risk: due diligence, contractual service levels, exit plans and ongoing monitoring; material outsourcing requires notification to the regulator.

Liquidity Coverage Ratio (LCR) = high-quality liquid assets / net cash outflows over 30 calendar days; the minimum is 100%.

Net Stable Funding Ratio (NSFR) = available stable funding / required stable funding; it must be at least 100% and covers a one-year horizon.

High-quality liquid assets must be unencumbered, readily convertible to cash and accepted by the central bank; Level 1 assets receive no haircut, Level 2 assets haircuts and caps.

Funding concentration limits cap reliance on any single depositor, wholesale market or tenor bucket to reduce rollover risk.

Liquidity stress testing models idiosyncratic, market-wide and combined scenarios over short horizons; results set the size of the liquidity buffer.

Survival horizon measures how many days the bank can meet outflows under stress using its buffer; it should exceed the board-approved minimum.

Intraday liquidity risk arises from payment and settlement obligations; monitoring covers peak usage, timing of inflows and access to intraday credit.

Contingency funding plan sets early warning indicators, escalation triggers, funding sources and communication protocols for a liquidity event.

Compliance risk is the risk of legal or regulatory sanctions, financial loss or reputational damage from failure to comply with laws, regulations, codes and standards.

Anti-money laundering controls: customer due diligence, beneficial ownership identification, enhanced due diligence for high-risk customers, ongoing transaction monitoring and suspicious transaction reporting.

Know Your Customer must be completed before establishing a relationship; simplified due diligence is only allowed for demonstrably lower-risk cases.

Sanctions screening compares customers and transactions against designated lists; matches are investigated and true matches blocked and reported.

Compliance testing and monitoring is independent of the business and reports results to the compliance committee and board risk committee.

Personal dealing and conflicts of interest policies require pre-clearance, disclosure and restricted lists around material non-public information.

Regulatory change management maps new or amended rules to affected policies, systems and controls with owners and target dates.

Whistleblowing arrangements must allow confidential reporting of breaches and protect reporters from retaliation.

Legal risk is the risk of loss from unenforceable contracts, defective documentation, litigation or adverse legal interpretation; it is a subset of operational risk.

Contract enforceability depends on capacity, authority, legality of object, certainty of terms and correct execution; netting opinions support close-out netting.

Regulatory capital adequacy under Basel III uses Common Equity Tier 1, Tier 1 and Total capital ratios against risk-weighted assets, plus leverage and buffer requirements.

Capital buffers include the capital conservation buffer, countercyclical buffer and, for systemic banks, higher loss absorbency requirements.

Legal entity structures and booking models determine which regulator, resolution regime and capital rules apply to a transaction.

Breach of a regulatory requirement may trigger reporting obligations, remediation plans, supervisory action and, in serious cases, enforcement penalties.

Documentation risk is managed through approved templates, legal review of non-standard terms and collateral enforceability checks across jurisdictions.

Regulatory reporting must be accurate, complete and timely; sign-off is required from accountable executives with evidence retained.

Risk reports must be accurate, timely, complete and decision-useful; frequency matches the volatility of the risk and the needs of the recipient.

The reporting hierarchy runs from desk-level limit utilisation to business-line summaries to board and regulator packs, with consistent definitions across all layers.

Limit monitoring reports show utilisation against approved limits, breaches, approvals for temporary excesses and remediation status.

Key risk indicators, loss events, near misses and emerging risks are reported alongside quantitative exposures so the board sees forward-looking signals.

Data governance: single authoritative source, documented lineage, reconciliation to the general ledger and controls over manual adjustments.

Regulatory returns must be reconciled to internal management information; unexplained differences indicate control gaps in either reporting chain.

Dashboards should include trends and thresholds, not only point-in-time values, so deterioration is visible before a limit is breached.

Board risk reporting covers risk appetite statement compliance, top and emerging risks, stress test results, capital and liquidity positions, and remediation of supervisory findings.

Stress testing applies severe but plausible scenarios (recession, rate shock, funding freeze, idiosyncratic event) to quantify potential losses, capital and liquidity impact.

Scenario design combines historical episodes, hypothetical forward-looking events and reverse stress testing that identifies the point of business model failure.

Capital adequacy compares available capital with risk-weighted assets plus buffer requirements; the capital planning buffer covers stress-period losses.

ICAAP is the bank's internal assessment of capital adequacy over a multi-year horizon, covering all material risks including those not fully captured in Pillar 1.

Pillar 1 covers credit, market and operational risk; Pillar 2 covers risks not fully captured and supervisory review; Pillar 3 covers disclosure.

Reverse stress testing starts from a defined failure point (e.g. breach of minimum capital) and works backwards to identify the scenarios that cause it.

Stress results feed limit setting, capital planning, contingency funding plans and recovery plans; they are not a compliance exercise isolated from decision-making.

Recovery and resolution planning: recovery options restore viability, while resolution plans enable orderly wind-down without taxpayer support.