## 1kazea2022002 - Preface

## Source details

**Canonical URL:** [1kazea2022002 - Preface](https://www.imf.org/-/media/files/publications/cr/2022/english/1kazea2022002.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2022/english/1kazea2022002.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2022/english/1kazea2022002.pdf.json)

---

### Mission scope and acknowledgements
- The Monetary and Capital Markets (MCM) Department conducted a virtual mission in Almaty, Kazakhstan from November 16, 2020 to January 28, 2021 at the request of the Agency for Regulation and Development of the Financial Market of the Republic of Kazakhstan (the Agency).
- Objective: assist the Agency with development of internal supervisory methodologies for assessment of a bank’s Internal Capital Adequacy Assessment Process (ICAAP) and for setting individual Pillar 2 supervisory capital requirements.
- Activities:
  - Virtual meetings with the Chairperson (Ms. Madina Abylkassymova), Deputy Chairperson (Ms. Mariya Khadzhiyeva), senior and middle management of the Agency.
  - Four training sessions with bank supervisors and other Agency staff.
  - Meetings with representatives of a large domestic bank and a subsidiary of an overseas bank in Kazakhstan.
- Acknowledgements: gratitude expressed to Agency staff, in particular Mr. Oleg Smolyakov, Mr. Ivan Moysov, Mr. Olzhan Taubayev, Mr. Madi Burin and his team, and members of the working group (WG) on developing methodologies for assessing the ICAAP and setting capital add-ons.

### Executive Summary: mission findings and overall assessment
- Focus: strengthen elements of the Agency’s risk-based supervisory framework—development of ICAAP assessment methodology and methodologies for setting Pillar 2 capital add-ons; recommendations and targeted training provided.
- Regulatory context and recent reforms:
  - Legal framework revised in 2018 enabling risk-based supervision (RBS) and addressing insufficient supervisory powers.
  - Regulatory framework strengthened in 2019 with new regulations on corporate governance, risk management, business models, and the ICAAP.
- SREP framework:
  - Agency is rolling out a Supervisory Review and Evaluation Process (SREP) based on the European Union (EU) model; designed by external consultants and an international audit firm.
  - A key SREP element is supervisory assessment of a bank’s ICAAP; Agency plans to roll out ICAAP assessment this year.
  - ICAAP implementation expected to significantly enhance the Agency’s risk-based supervision and provide additional information for supervisors.
  - Agency’s existing SREP methodology will need revision to incorporate ICAAP assessment procedures.
- Working group (WG):
  - WG established to develop methodologies for assessing ICAAP and setting capital add-ons.
  - Mission worked with WG to develop analytical framework, provided checklist for ICAAP documentation assessment, and discussed methodologies for quantifying Pillar 2 capital add-ons.
  - WG produced draft methodologies for ICAAP assessment and capital add-ons based on mission guidance.
- Assessment of draft methodologies and key gaps:
  - Draft ICAAP assessment methodology is a good basis but requires strengthening:
    - Omissions: limited reference to assessment and quantification of Pillar 2 risks; peer group analysis should be incorporated.
    - Need clearer linkages between ICAAP, the risk assessment system (RAS), and SREP.
    - Methodology should be more practical for supervisors: set out actions and expectations at each assessment stage and consult supervisors to test practicability.
  - Draft Pillar 2 capital add-on methodology:
    - Provides detailed approaches for IRRBB and under-provisioning.
    - Lacks approaches for concentration risk and other risks not fully captured by Pillar 1 (e.g., reputational, legal, strategic, and operational risk); mission recommended inclusion where material.
  - Governance and management scalar:
    - Agency proposed a scalar to increase banks’ minimum capital requirements for weaknesses in corporate governance, business model, or risk management.
    - Mission recommended reviewing this approach to align with best practice: apply additional capital requirement above existing minimums, set specific criteria for when add-on is appropriate, and require removal when weakness is addressed.
  - ICAAP governance:
    - Draft methodology should include governance arrangements for the ICAAP assessment: internal decision-making framework, timelines, internal approval processes; linkage to SREP supervisory committee decision processes.
- Training:
  - Four days of training delivered covering ICAAP assessment stages and methodologies for assessing and quantifying Pillar 2 capital add-ons.

### Key recommendations (priorities and timelines)
- 1. Agency to review and finalize the draft methodology for assessing a bank’s ICAAP.
  - Revise: process for requesting ICAAP documentation; supervisory evaluation process of documentation received; process for review of a bank’s internal governance, risk management, and internal controls; usability of methodology by supervisors.
  - Include: review of a bank’s risk appetite statement; analysis of the Pillar 1 and 2 risks against which a bank is required to hold capital; linkages with the RAS and SREP; peer group analysis; governance of the ICAAP assessment.
  - Priority: High. Timeline: ST (short-term, with results less than 6 months).
- 2. Agency to review and finalize the draft methodology for setting individual Pillar 2 supervisory capital requirements.
  - Agreeing methodologies for calculating capital requirements for Pillar 2 risks.
  - Identifying material risks not fully captured by Pillar 1 and drafting methodologies for calculating required capital.
  - Revising approach to determining capital add-ons for governance, business model, or risk management weaknesses.
  - Priority: High. Timeline: ST.
- 3. Agency to review the existing SREP methodology to enhance overall assessment of a bank’s risk profile.
  - Integration of processes for, and results of, the ICAAP assessment.
  - Peer group analysis.
  - Setting of individual Pillar 2 supervisory capital requirements aligned to each bank’s risk profile.
  - Priority: High. Timeline: ST.
- 4. Supervisors to integrate ICAAP assessment and setting individual Pillar 2 capital requirements in the supervisory framework to better tailor supervisory activities to each bank’s risk profile.
  - Priority: High. Timeline: MT (medium term, with results from 6 to 24 months).
- 5. Supervisors to review and assess banks’ ICAAPs and include assessment results in SREP reports.
  - Priority: High. Timeline: MT.
- 6. Supervisors to set up additional individual capital requirements based on banks’ risks not fully covered in Pillar 1 of Basel II.
  - Priority: High. Timeline: MT.

### Introduction: mission purpose and context
- Mission dates: remote mission in Almaty from November 16, 2020 to January 28, 2021.
- Purpose: provide assistance and training on development and implementation of Pillar 2 elements to enhance the Agency’s risk-based supervisory approach—specifically ICAAP assessment and Pillar 2 capital add-ons.
- Background:
  - In 2019, Kazakhstan split monetary policy and financial sector supervisory responsibilities of the National Bank of Kazakhstan (NBK); the new Agency established in Almaty in early 2020.
  - In 2019, NBK completed an asset quality review (AQR) of 14 banks.
  - 2018 legal changes gave supervisory authorities legal authority to adopt RBS; Resolution of the board of the NBK No.188 (November 12, 2019) established new requirements on corporate governance, risk management, internal controls, business models, and ICAAP.
- Prior TA (September 2020) addressed institutional set up and supervisory capacity; Agency included those recommendations in draft Supervisory Plan for 2021.

### Banking sector overview: structure, size, and performance (data as reported)
- Sector composition:
  - Number of commercial banks: 26 commercial banks, of which 14 are affiliated to foreign banks.
  - Note: The license of Tengri Bank JSC, the subsidiary of India’s Punjab National Bank, was revoked in September 2020.
- Aggregate balance sheet and macro shares (as of December 1, 2020):
  - Total assets of the banking sector: US$ 71 billion (KZT 30.3 billion), representing 43 percent of GDP.
  - Total assets increased by 13.4 percent from the start of 2020.
  - Banks comprise 87.2 percent of the total assets of all financial institutions.
- Loan portfolio (as of December 1, 2020):
  - Total loan portfolio: US$ 37 billion (KZT 15.6 billion), an increase of 5.9 percent from the beginning of the year.
  - Loans to corporates: US$ 10 billion (KZT 4.1 billion).
  - Loans to individuals: US$ 16.2 billion (KZT 6.9 billion), an increase of 10.1 percent on the year.
  - Retail loans: US$ 10.6 billion (KZT 4.5 billion), an increase of 2.7 percent in 2020.
- Capital, profitability, and asset quality (as of December 1, 2020):
  - Average total capital ratio: 25.5 percent.
  - Non-performing loan (NPL) level (loans over 90 days past due): 7.9 percent (marginally down from 8.1 percent).
  - Gross profit: US$ 1.7 billion (KZT 742 billion).
  - Return on assets (ROA): 2.8 percent.
  - Return on equity (ROE): 21.1 percent.
  - Exchange rate as of December 1, 2020: US$1:425 Tenge.
- COVID-19 related supervisory measures and cautions:
  - Agency relaxed certain capital, liquidity, loan classification, and provisioning requirements in response to COVID-19.
  - COVID-19 relief measures may hinder timely recognition of loan losses; prudential data on NPLs, profitability, and capital ratios may temporarily not accurately reflect banks’ financial situation.
  - Recommendation: Agency should monitor impact of exceptional measures, encourage targeted loan restructuring, prepare an exit strategy, and withdraw exceptional measures when recovery begins.
  - Banks should produce credible medium-term plans to restore capital and liquidity buffers and address recapitalization needs identified in the AQR.

### Pillar 2 implementation — Enhancing the Agency’s SREP and ICAAP integration
- SREP overview:
  - Agency developed a SREP methodology with external consultants; planned as an annual supervisory process assessing financial and non-financial risks and controls.
  - Agency’s Risk Assessment System (RAS) is based on quarterly analysis of 33 quantitative indicators and 122 qualitative indicators.
    - Quantitative indicators are largely generated automatically by the Bank Analytics and Stress Testing Department (BASTD) from regulatory data.
    - Qualitative indicators are generated from a yes/no questionnaire sent to each bank.
  - Four broad SREP assessment categories: business model and profitability; capital adequacy; liquidity and funding; corporate governance.
  - Quantitative and qualitative indicators generate a rating between one through four for each category; line supervisor can adjust the rating based on existing knowledge; ratings entered into RAS which derives overall SREP rating within each category.
  - Agency has yet to conduct a full SREP but intends to fully implement the framework this year.
- Integration of ICAAP into SREP:
  - Agency is planning to roll out an ICAAP framework this year; the assessment of a bank’s ICAAP will form an important element of the SREP process and an invaluable source of information for supervisors.
  - ICAAP assessment objectives:
    - Identify the risks a bank is running using expert judgement.
    - Assess effectiveness of governance, risk management, and internal controls.
    - Assess whether the bank has an appropriate level of capital to cover the risks identified.
  - The ICAAP documentation will:
    - Provide clarity and depth on overall risks, risk management, and internal controls.
    - Identify risks for which capital is not held and quantify additional capital required.
  - Recommendation: The Agency should review and amend its existing SREP methodology to integrate the new process for, and results of, the ICAAP assessment.
- Supervisory approach and implementation changes:
  - The new SREP framework requires a fundamental change from the former compliance-based regime:
    - Onsite inspections should increasingly focus on assessment of banks’ governance and risk management frameworks.
    - Offsite processes should involve more frequent contact with bank management.
    - More frequent onsite inspections will be required to validate ICAAP assertions about risk management and internal controls.
    - Greater supervisory engagement from offsite teams to substantiate ICAAP submissions.
  - Recommendation: Finalize and implement the ICAAP framework as a matter of priority.
- Peer group analysis:
  - Recommendation: Incorporate peer group analysis into SREP and ICAAP methodologies.
  - Final SREP recommendations submitted to the supervisory committee should include peer group analysis to ensure:
    - Proposed supervisory measures, including quantitative measures relating to additional capital and liquidity requirements, are consistent with comparable banks.
    - Overall SREP approach is proportionate to banks of similar size and complexity.
  - The Agency should revise its SREP methodology to build in peer group analysis.

### ICAAP methodology development and practical enhancements
- Regulatory and timing context:
  - ICAAP regulations set out in Chapter 5 of Regulation No.188 issued in November 2019.
  - The Rules came into force on October 1, 2020.
- Draft internal methodology sets out supervisory processes for each stage of ICAAP assessment, including request procedures, evaluation approach for each risk element (including liquidity and funding, stress testing and corporate governance), and link to SREP final rating.
- Identified weaknesses and recommended improvements:
  - Strengthen practical usability: clearly set out actions and expectations required of supervisors at each stage, including timelines.
  - Provide more detail on internal supervisory processes, systems, template reports, and how supervisors should document findings.
  - Consult supervisors on methodology development to test practicability.
  - Specify content and format of banks’ ICAAP submissions; consider issuing guidance and a template request letter to standardize submissions.
  - Require an executive summary in ICAAP documentation that:
    - Clearly sets out the bank’s view of its risk profile.
    - Quantifies its Pillar 1 and Pillar 2 risks.
    - Describes composition of capital and the bank’s assessment of its own capital adequacy requirement.
  - Address draft methodology omissions: include approaches for identifying and assessing Pillar 2 risks; guidance on reviewing a bank’s Risk Appetite Statement and linking it to individual risk assessments; include peer review approach at each stage.
  - Include governance arrangements around ICAAP assessment, and explicit linkages between ICAAP, RAS, and SREP frameworks, including internal decision-making and timelines for approving outputs.

### Liquidity, funding risks, and ILAAP linkage
- Draft methodology includes liquidity and funding risks (not common in ICAAP documents); this inclusion is sensible until the Agency implements an ILAAP regime that would cover such risks in detail.
- Note: Additional liquidity requirements will form part of the Agency’s Internal Liquidity Adequacy Assessment Process (ILAAP) framework, when implemented.

### Setting individual Pillar 2 supervisory capital requirements
- Key objective: determine minimum level of capital required against material Pillar 1 and Pillar 2 risks.
- Draft methodology identifies risks for which Pillar 1 capital is not held and determines capital add-ons.
  - Two main such risks in the Kazakh banking sector: concentration risk and IRRBB.
  - Credit risk issue in Kazakh context: possible capital shortfalls from under provisioning.
- Under-provisioning:
  - Draft methodology proposes a simple, matrix-based approach for calculating capital add-ons and appears fit for purpose.
- Concentration risk:
  - Draft methodology does not include an approach for capital add-ons for concentration risk.
  - Suggested approaches: Herfindahl-Hirschman index (HHI) or a simpler scalar for risk-weighted assets (RWA) linked to size of business with individual concentration types.
- IRRBB:
  - Draft methodology includes an approach for assessing additional Pillar 2 capital required to cover IRRBB.
  - Recommendations for IRRBB calibration (methodology should consider):
    a) the institution’s governance of IRRBB, strategy of IRRBB, and its risk appetite in relation to interest rate risk;
    b) bank’s nature and composition of the interest rate risk profile (in term of repricing of all asset, liabilities, and off-balance sheet items/cash flows);
    c) assessment of behavioral assumptions the banks is using (non-maturing deposits, prepayments);
    d) impact of different interest rate scenarios on economic value as a portion of the banḱ s own funds—or economic value of equity (EVE);
    e) impact of different interest rate scenarios on earnings—net interest income (NII).
  - Recommendation: Ensure banks with high IRRBB that could result in losses in plausible market scenarios have sufficient capital; perform comprehensive peer analysis to identify outliers.
- Other Pillar 2 risks:
  - Draft methodology does not cover other risks not fully captured by Pillar 1 (e.g., reputational, legal, strategic, and model risk, including in the context of IFRS 9 provisioning, IRRBB, liquidity and operational risk).
  - Recommendation: Incorporate these risks into methodology if considered material; consider whether supervisory measures or capital add-ons are appropriate.
  - Additional capital requirement for such risks should be set on top of other capital add-ons and removed when inadequate control or risk management processes have been addressed.

### Governance-related capital scalar and proportionality
- Agency proposed a governance and management scalar to increase banks’ minimum capital requirements to address weaknesses in corporate governance:
  - Proposed add-on initially represents 2.5 percent of the bank’s available capital above its minimum capital requirements, including any that have been applied for other Pillar 2 risks.
- Assessment of proposal:
  - This approach is not consistent with international best practice.
  - Best practice: apply an additional capital requirement proportionate to the risk identified, above the bank’s existing minimum capital requirements, and remove it when weaknesses have been addressed.
  - Recommendation: Methodology should set out specific criteria the Agency should apply when determining whether a capital add-on for governance weaknesses is appropriate.

### Appendix I — September 2020 TA recommendations (key items and timelines)
- 1. Develop and adopt an action plan to strengthen the Agency’s institutional set up, including its operational independence, accountability and transparency, and overall banking supervisory capacity.
  - Priority: Hig h
  - Timeline: I
- 2. Sign a MoU with the NBK that sets out the coordination and cooperation arrangements between the two institutions, including the responsibilities and accountability of each institution and protocols for the exchange of information.
  - Priority: Hig h
  - Timeline: ST
- 3. Review and enhance the organizational structure and staffing of the Banking Regulation Department (BRD) to ensure effective prudential banking supervision. To include:
  - restructure the BRD to transfer all non-critical to financial stability functions to other Departments of the Agency;
  - establish a dedicated Supervisory policy team within the BRD for drafting supervisory procedures and operating manuals, ensuring consistent treatment of the implementation of the Agency’s supervisory approach, and supporting supervisory planning;
  - embed the new Bank Analytics and Stress Testing Department into the SREP f ramework to ensure effective coordination with offsite and onsite teams and to provide valuable input to effective banking supervision;
  - prescribe the role and responsibilities of the Agency’s supervisory committee in legislation and ensure that supervisory decisions are taken at a level appropriate to the significance of the issue;
  - build up specialist risk expertise among onsite and offsite teams;
  - introduce a comprehensive training program for offsite and onsite supervisors to address identified skill shortages required to assess banks’ corporate governance, risk management, business models; consider the possibility of seconding staff to foreign supervisory authorities.
  - Priority: Hig h
  - Timeline: M
- 4. Develop or update offsite, onsite, and SREP processes and procedures. To include:
  - undertake more frequent offsite qualitative risk and corporate governance reviews, using banks’ internal management documents and reports;
  - introduce regular prudential meetings with banks’ senior and middle management, including an annual meeting with Supervisory and Executive boards on strategic issues;
  - enhance annual supervisory plans for the banking sector, by including high-level supervisory priorities, the supervisory p rograms for individual banks and more risk-f ocused onsite inspection plans;
  - implement fully an ICAAP regime and capital-ons;
  - update the supervisory procedures, manuals, roles and responsibilities of structural units, including supervisors’ job descriptions, for conducting a SREP and integrating offsite and onsite supervision into the new framework;
  - develop supervisory procedures for documenting and recording supervisory findings and supervisory judgements, arrangements for the approval of SREP results, including scores, and for communicating the outcomes of the SREP to the banks.
  - Priority: Hig h
  - Timeline: M
- 5. Amend legislation by including additional safeguards to enhance the Agency’s operational independence, including the implementation of FSC recommendations, and by prescribing the accountability framework; strengthen the Agency’s transparency by additional disclosures.
  - Priority: Medium
  - Timeline: M
- 6. Require banks to produce credible medium-term capital and liquidity restoration plans to mitigate the impact of the exceptional COVID-19 measures.
  - Priority: Hig h
  - Timeline: I
- Timeline legend (exact wording):
  - I, immediate,   with  results less th an  3  mo n th s; ST, short-term,  with results fro m 3 to  6 mo n th s; MT, medium  term,  with  results from 6 to 24 months.

### Appendix II — Structure of the banking sector: January 1, 2021 (top bank-level statistics)
- HALYK SAVINGS BANK OF KAZAKHSTAN
  - ASSETS (US$BN): 23.7
  - MARKET SHARE (PERCENT): 32
- SBERBANK
  - ASSETS (US$BN): 10.2
  - MARKET SHARE (PERCENT): 10.2
- FORTE BANK
  - ASSETS (US$BN): 6.9
  - MARKET SHARE (PERCENT): 6.9
- KASPI BANK
  - ASSETS (US$BN): 9
  - MARKET SHARE (PERCENT): 9
- BANK CENTER CREDIT
  - ASSETS (US$BN): 5.9
  - MARKET SHARE (PERCENT): 5.9
- ATF BANK
  - ASSETS (US$BN): 3.8
  - MARKET SHARE (PERCENT): 3.8
- ‘OTBASY BANK’ HOUSE CONSTRUCTION SAVINGS BANK
  - ASSETS (US$BN): 5.5
  - MARKET SHARE (PERCENT): 5.5
- FIRST HEARTLAND JÝSAN BANK
  - ASSETS (US$BN): 5.3
  - MARKET SHARE (PERCENT): 5.3
- EURASIAN BANK
  - ASSETS (US$BN): 3.9
  - MARKET SHARE (PERCENT): 3.9
- CITIBANK
  - ASSETS (US$BN): 2.9
  - MARKET SHARE (PERCENT): 2.9
- BANK RBK
  - ASSETS (US$BN): 2.4
  - MARKET SHARE (PERCENT): 3.2
- ALFA-BANK
  - ASSETS (US$BN): 1.8
  - MARKET SHARE (PERCENT): 2.4
- ALTYN BANK
  - ASSETS (US$BN): 1.4
  - MARKET SHARE (PERCENT): 1.9
- NURBANK
  - ASSETS (US$BN): 1.0
  - MARKET SHARE (PERCENT): 1.4
- HOME CREDIT AND FINANCE BANK
  - ASSETS (US$BN): 0.9
  - MARKET SHARE (PERCENT): 1.3
- BANK OF CHINA
  - ASSETS (US$BN): 0.9
  - MARKET SHARE (PERCENT): 1.2
- JSC BANK VTB (KAZAKHSTAN)
  - ASSETS (US$BN): 0.8
  - MARKET SHARE (PERCENT): 1.1
- INDUSTRIAL AND COMMERCIAL BANK OF CHINA
  - ASSETS (US$BN): 0.5
  - MARKET SHARE (PERCENT): 0.7
- AB “KAZAKSTAN-ZIRAAT INTERNATIONAL BANK
  - ASSETS (US$BN): 0.3
  - MARKET SHARE (PERCENT): 0.4
- BANK KASSA NOVA
  - ASSETS (US$BN): 0.2
  - MARKET SHARE (PERCENT): 0.3
- CAPITAL BANK KAZAKHSTAN
  - ASSETS (US$BN): 0.1
  - MARKET SHARE (PERCENT): 0.1
- ASIA CREDIT BANK
  - ASSETS (US$BN): 0.1
  - MARKET SHARE (PERCENT): 0.2
- SHINHAN BANK KAZAKHSTAN
  - ASSETS (US$BN): 0.1
  - MARKET SHARE (PERCENT): 0.2
- AL-HILAL ISLAMIC BANK
  - ASSETS (US$BN): 0.1
  - MARKET SHARE (PERCENT): 0.2
- ZAMAN-BANK
  - ASSETS (US$BN): 0.1
  - MARKET SHARE (PERCENT): 0.0
- NATIONAL BANK OF PAKISTAN (JSC SUBSIDIARY)
  - ASSETS (US$BN): 0.1
  - MARKET SHARE (PERCENT): 0.1
- TOTAL: 74 100
- Note: 14 banks participated in AQR 2019 (in grey).
- Note: Source: The Agency.

### Appendix III — Supervisory issues for consideration on receipt of ICAAP documentation (high-level checklist)
- Executive Summary of the ICAAP report — supervisor’s checklist:
  - Is there a clear overview of the risks to which the bank is exposed?
  - Is there a clear explanation of the capital required to cover each risk?
  - Are any deviations from the Pillar 1 framework clearly stated?
  - Are Pillar 2 risks set out and the capital against such risks clear?
  - Are other risks quantified?
  - Is the overall assessment of the bank’s internal capital adequacy requirement clearly stated?
- Organization and governance of ICAAP:
  - Does the ICAAP comply with the requirements set out in Chapter 5 of 188 Regulation?
  - What is the internal governance of the ICAAP? Has it been approved by the board?
  - Is the ICAAP commensurate with the size, scale and risks of the business?
  - Does the ICAAP outline the business undertaken, the risks being run, structure of the business, legal entity, management’s risk appetite, the governance supporting this, the risk and control environment etc?
  - How is the ICAAP used internally? Is it a dynamic document that is used to manage risks?
- Risk appetite statement:
  - Does the Risk Appetite Statement comply with the requirements of Chapter 3 of the Rules?
  - Is the Risk Appetite Statement owned by the board and appropriate senior management committees?
  - Does the risk appetite statement consider all material risks to which the bank is exposed and contains risk limits, tolerances and thresholds?
  - Peer analysis—how have similar banks calibrated their risk limits?
- Capital-related information in the ICAAP:
  - Does the ICAAP explain how these risks arise within the business?
  - Does the ICAAP describe the bank’s organisation of credit, market and operational risk management in line with Chapter 5 of Regulation 188?
  - Does the ICAAP explain what risks aren’t covered under Pillar 1 and which non-Pillar 1 risks are to be covered by capital or qualitative measures?
  - Has capital been calculated for Pillar 2 risks (e.g., IRRBB and concentration risk)? Are the methodologies for calculating Pillar 2 risks clearly stated?
  - Does the firm use an economic capital model? Is the capital plan it generates relevant to the business?
  - Does the ICAAP detail/explain stress tests?
- Stress tests:
  - Are the stress tests proportionate to the size and nature of the business?
  - Are all material risks run by the bank covered by the stress tests?
  - Are the stress tests appropriately calibrated and are underlying assumptions reasonable?
  - Are the stress tests comparable with peer banks? Does the ICAAP include reverse stress tests?
- Additional information that may be requested:
  - Risks identified in outsourcing contracts?
  - Risks arising from remuneration policy?
  - Risks arising from new products or product change?
  - Risks arising from information technology/cyber events?
  - Risks arising from operational risk failures?
  - Any new material issues identified in internal audit reports?
- Business Model Analysis (BMA):
  - Does the BMA documentation comply with Chapter 2 of Regulation 188?
  - Does the BMA contain at least a three-year outlook?
  - Is the strategy regularly updated and approved by the board?
  - Are the strategic plans appropriate given the current business model and management execution capabilities?
  - Does the BMA consider wider group risks if group issues could affect the Kazakhstan sub?
- Internal governance and internal controls:
  - Does the bank have a transparent organizational structure with clear responsibilities and separation of risk taking from risk management and control functions?
  - Is the functioning of the board appropriate? Is there evidence of clear and strong communication of strategies and policies to all relevant staff and that the risk culture is applied across all levels of the institution?
  - Is the internal audit function independent and operates effectively in accordance with established internal standards and requirements?
  - Is the bank’s ICAAP (and ILAAP) framework sound, effective and comprehensive?
- Risks to capital — Pillar 1 and Pillar 2 risks:
  - Every Pillar I risk should be assessed for potential impact considering inherent risk and management/controls.
  - Pillar 2: Given the bank’s business, strategy, risk and control environment, have all risks not fully captured under Pillar 1 been clearly identified and quantified?
  - IRRBB: assess composition of interest rate profile; gap analysis; results of scenario and stress testing; sensitivity of EVE and NII to changes in interest rates and assumptions.
  - Concentration risk: assess single-name, sectoral, geographical, product, and collateral concentrations; consider HHI or capital add-on/increased risk weight for exposures larger than x percent of capital.
- Peer analysis (role in ICAAP and SREP):
  - Supervisors should assess a bank against similar banks across factors including risks identified, risk appetite statements, limit frameworks, business model analysis, internal governance, Pillar 1 and Pillar 2 capital quantification, liquidity and funding profile, stress tests and outcomes.

*Source: IMF MCM Department remote mission report (Almaty, November 16, 2020–January 28, 2021).*

### Preface ................................................................................................................

### 1kazea2022002 - Preface

### Preface: mission scope and acknowledgements
- The Monetary and Capital Markets (MCM) Department conducted a virtual mission in Almaty, Kazakhstan from November 16, 2020 to January 28, 2021 at the request of the Agency for Regulation and Development of the Financial Market of the Republic of Kazakhstan (the Agency).
- Objective: assist the Agency with development of internal supervisory methodologies for assessment of a bank’s Internal Capital Adequacy Assessment Process (ICAAP) and for setting individual Pillar 2 supervisory capital requirements.
- Activities:
  - Virtual meetings with the Chairperson (Ms. Madina Abylkassymova), Deputy Chairperson (Ms. Mariya Khadzhiyeva), senior and middle management of the Agency.
  - Four training sessions with bank supervisors and other Agency staff.
  - Meetings with representatives of a large domestic bank and a subsidiary of an overseas bank in Kazakhstan.
- Acknowledgements: gratitude expressed to Agency staff, in particular Mr. Oleg Smolyakov, Mr. Ivan Moysov, Mr. Olzhan Taubayev, Mr. Madi Burin and his team, and members of the working group (WG) on developing methodologies for assessing the ICAAP and setting capital add-ons.

### Executive Summary: mission findings and overall assessment
- Focus: strengthen elements of the Agency’s risk-based supervisory framework—development of ICAAP assessment methodology and methodologies for setting Pillar 2 capital add-ons; recommendations and targeted training provided.
- Regulatory context and recent reforms:
  - Legal framework revised in 2018 enabling risk-based supervision (RBS) and addressing insufficient supervisory powers.
  - Regulatory framework strengthened in 2019 with new regulations on corporate governance, risk management, business models, and the ICAAP.
- SREP framework:
  - Agency is rolling out a Supervisory Review and Evaluation Process (SREP) based on the European Union (EU) model; designed by external consultants and an international audit firm.
  - A key SREP element is supervisory assessment of a bank’s ICAAP; Agency plans to roll out ICAAP assessment this year.
  - ICAAP implementation expected to significantly enhance the Agency’s risk-based supervision and provide additional information for supervisors.
  - Agency’s existing SREP methodology will need revision to incorporate ICAAP assessment procedures.
- Working group (WG):
  - WG established to develop methodologies for assessing ICAAP and setting capital add-ons.
  - Mission worked with WG to develop analytical framework, provided checklist for ICAAP documentation assessment, and discussed methodologies for quantifying Pillar 2 capital add-ons.
  - WG produced draft methodologies for ICAAP assessment and capital add-ons based on mission guidance.
- Assessment of draft methodologies and key gaps:
  - Draft ICAAP assessment methodology is a good basis but requires strengthening:
    - Omissions: limited reference to assessment and quantification of Pillar 2 risks; peer group analysis should be incorporated.
    - Need clearer linkages between ICAAP, the risk assessment system (RAS), and SREP.
    - Methodology should be more practical for supervisors: set out actions and expectations at each assessment stage and consult supervisors to test practicability.
  - Draft Pillar 2 capital add-on methodology:
    - Provides detailed approaches for IRRBB and under-provisioning.
    - Lacks approaches for concentration risk and other risks not fully captured by Pillar 1 (e.g., reputational, legal, strategic, and operational risk); mission recommended inclusion where material.
  - Governance and management scalar:
    - Agency proposed a scalar to increase banks’ minimum capital requirements for weaknesses in corporate governance, business model, or risk management.
    - Mission recommended reviewing this approach to align with best practice: apply additional capital requirement above existing minimums, set specific criteria for when add-on is appropriate, and require removal when weakness is addressed.
  - ICAAP governance:
    - Draft methodology should include governance arrangements for the ICAAP assessment: internal decision-making framework, timelines, internal approval processes; linkage to SREP supervisory committee decision processes.
- Training:
  - Four days of training delivered covering ICAAP assessment stages and methodologies for assessing and quantifying Pillar 2 capital add-ons.

### Key recommendations (Table 1): priorities and timelines
- 1. Agency to review and finalize the draft methodology for assessing a bank’s ICAAP. Revisions and inclusions:
  - Revise: process for requesting ICAAP documentation; supervisory evaluation process of documentation received; process for review of a bank’s internal governance, risk management, and internal controls; usability of methodology by supervisors.
  - Include: review of a bank’s risk appetite statement; analysis of the Pillar 1 and 2 risks against which a bank is required to hold capital; linkages with the RAS and SREP; peer group analysis; governance of the ICAAP assessment.
  - Priority: High. Timeline: ST (short-term, with results less than 6 months).
- 2. Agency to review and finalize the draft methodology for setting individual Pillar 2 supervisory capital requirements. To include:
  - Agreeing methodologies for calculating capital requirements for Pillar 2 risks.
  - Identifying material risks not fully captured by Pillar 1 and drafting methodologies for calculating required capital.
  - Revising approach to determining capital add-ons for governance, business model, or risk management weaknesses.
  - Priority: High. Timeline: ST.
- 3. Agency to review the existing SREP methodology to enhance overall assessment of a bank’s risk profile. To include:
  - Integration of processes for, and results of, the ICAAP assessment.
  - Peer group analysis.
  - Setting of individual Pillar 2 supervisory capital requirements aligned to each bank’s risk profile.
  - Priority: High. Timeline: ST.
- 4. Supervisors to integrate ICAAP assessment and setting individual Pillar 2 capital requirements in the supervisory framework to better tailor supervisory activities to each bank’s risk profile.
  - Priority: High. Timeline: MT (medium term, with results from 6 to 24 months).
- 5. Supervisors to review and assess banks’ ICAAPs and include assessment results in SREP reports.
  - Priority: High. Timeline: MT.
- 6. Supervisors to set up additional individual capital requirements based on banks’ risks not fully covered in Pillar 1 of Basel II.
  - Priority: High. Timeline: MT.

### I. Introduction: mission purpose and context
- Mission dates: remote mission in Almaty from November 16, 2020 to January 28, 2021.
- Purpose: provide assistance and training on development and implementation of Pillar 2 elements to enhance the Agency’s risk-based supervisory approach—specifically ICAAP assessment and Pillar 2 capital add-ons.
- Background:
  - In 2019, Kazakhstan split monetary policy and financial sector supervisory responsibilities of the National Bank of Kazakhstan (NBK); the new Agency established in Almaty in early 2020.
  - In 2019, NBK completed an asset quality review (AQR) of 14 banks.
  - 2018 legal changes gave supervisory authorities legal authority to adopt RBS; Resolution of the board of the NBK No.188 (November 12, 2019) established new requirements on corporate governance, risk management, internal controls, business models, and ICAAP.
- Prior TA (September 2020) addressed institutional set up and supervisory capacity; Agency included those recommendations in draft Supervisory Plan for 2021.

### II. Banking sector overview: structure, size, and performance (data as reported)
- Sector composition:
  - Number of commercial banks: 26 commercial banks, of which 14 are affiliated to foreign banks.
  - Note: The license of Tengri Bank JSC, the subsidiary of India’s Punjab National Bank, was revoked in September 2020.
- Aggregate balance sheet and macro shares (as of December 1, 2020):
  - Total assets of the banking sector: US$ 71 billion (KZT 30.3 billion), representing 43 percent of GDP.
  - Total assets increased by 13.4 percent from the start of 2020.
  - Banks comprise 87.2 percent of the total assets of all financial institutions.
- Loan portfolio (as of December 1, 2020):
  - Total loan portfolio: US$ 37 billion (KZT 15.6 billion), an increase of 5.9 percent from the beginning of the year.
  - Loans to corporates: US$ 10 billion (KZT 4.1 billion).
  - Loans to individuals: US$ 16.2 billion (KZT 6.9 billion), an increase of 10.1 percent on the year.
  - Retail loans: US$ 10.6 billion (KZT 4.5 billion), an increase of 2.7 percent in 2020.
- Capital, profitability, and asset quality (as of December 1, 2020):
  - Average total capital ratio: 25.5 percent.
  - Non-performing loan (NPL) level (loans over 90 days past due): 7.9 percent (marginally down from 8.1 percent).
  - Gross profit: US$ 1.7 billion (KZT 742 billion).
  - Return on assets (ROA): 2.8 percent.
  - Return on equity (ROE): 21.1 percent.
  - Exchange rate as of December 1, 2020: US$1:425 Tenge.
- COVID-19 related supervisory measures and cautions:
  - Agency relaxed certain capital, liquidity, loan classification, and provisioning requirements in response to COVID-19.
  - COVID-19 relief measures may hinder timely recognition of loan losses; prudential data on NPLs, profitability, and capital ratios may temporarily not accurately reflect banks’ financial situation.
  - Recommendation: Agency should monitor impact of exceptional measures, encourage targeted loan restructuring, prepare an exit strategy, and withdraw exceptional measures when recovery begins.
  - Banks should produce credible medium-term plans to restore capital and liquidity buffers and address recapitalization needs identified in the AQR.

### III. Pillar 2 implementation
- A. Enhancing the Agency’s SREP
  - SREP overview:
    - Agency developed a SREP methodology with external consultants; planned as an annual supervisory process assessing financial and non-financial risks and controls.
    - Agency’s Risk Assessment System (RAS) is based on quarterly analysis of 33 quantitative indicators and 122 qualitative indicators.
      - Quantitative indicators are largely generated automatically by the Bank Analytics and Stress Testing Department (BASTD) from regulatory data.
      - Qualitative indicators are generated from a yes/no questionnaire sent to each bank.
    - Four broad SREP assessment categories: business model and profitability; capital adequacy; liquidity and funding; corporate governance.
    - Quantitative and qualitative indicators generate a rating between one through four for each category; line supervisor can adjust the rating based on existing knowledge; ratings entered into RAS which derives overall SREP rating within each category.
    - Agency has yet to conduct a full SREP but intends to fully implement the framework this year.

  - Observations and recommendations related to SREP and ICAAP integration:
    - ICAAP assessment is a core SREP element; Agency plans to roll out ICAAP assessment this year.
    - The ICAAP assessment should be integrated into the SREP methodology and RAS.
    - The ICAAP assessment methodology should be operationally usable by supervisors and include peer group analysis and governance arrangements.
    - Supervisors should be trained and consulted during finalization of methodologies to ensure practicability.

*Source: IMF MCM Department remote mission report (Almaty, November 16, 2020–January 28, 2021).*

### 11. The Agency will need to amend its existing SREP methodology to incorporate the

### 1kazea2022002 - 11. The Agency will need to amend its existing SREP methodology to incorporate the

### Integration of ICAAP into SREP
- The Agency is planning to roll out an ICAAP framework this year; the assessment of a bank’s ICAAP will form an important element of the SREP process and an invaluable source of information for supervisors.
- ICAAP assessment objectives:
  - Identify the risks a bank is running using expert judgement.
  - Assess effectiveness of governance, risk management, and internal controls.
  - Assess whether the bank has an appropriate level of capital to cover the risks identified.
- The ICAAP documentation will:
  - Provide clarity and depth on overall risks, risk management, and internal controls.
  - Identify risks for which capital is not held and quantify additional capital required.
- Recommendation: The Agency should review and amend its existing SREP methodology to integrate the new process for, and results of, the ICAAP assessment.

### Supervisory approach and implementation changes
- The new SREP framework requires a fundamental change from the former compliance-based regime:
  - Onsite inspections should increasingly focus on assessment of banks’ governance and risk management frameworks.
  - Offsite processes should involve more frequent contact with bank management.
  - More frequent onsite inspections will be required to validate ICAAP assertions about risk management and internal controls.
  - Greater supervisory engagement from offsite teams to substantiate ICAAP submissions.
- Recommendation: Finalize and implement the ICAAP framework as a matter of priority.

### Peer group analysis
- Recommendation: Incorporate peer group analysis into SREP and ICAAP methodologies.
- Final SREP recommendations submitted to the supervisory committee should include peer group analysis to ensure:
  - Proposed supervisory measures, including quantitative measures relating to additional capital and liquidity requirements, are consistent with comparable banks.
  - Overall SREP approach is proportionate to banks of similar size and complexity.
- The Agency should revise its SREP methodology to build in peer group analysis.

### ICAAP methodology development and practical enhancements
- Regulatory and timing context:
  - ICAAP regulations set out in Chapter 5 of Regulation No.188 issued in November 2019.
  - The Rules came into force on October 1, 2020.
- The Agency has developed a draft internal methodology that:
  - Sets out supervisory processes for each stage of ICAAP assessment, rationale, scope, request procedures, evaluation approach for each risk element (including liquidity and funding, stress testing and corporate governance), and link to SREP final rating.
- Identified weaknesses and recommended improvements:
  - Strengthen practical usability: clearly set out actions and expectations required of supervisors at each stage, including timelines.
  - Provide more detail on internal supervisory processes, systems, template reports, and how supervisors should document findings.
  - Consult supervisors on methodology development to test practicability.
  - Specify content and format of banks’ ICAAP submissions; consider issuing guidance and a template request letter to standardize submissions.
  - Require an executive summary in ICAAP documentation that:
    - Clearly sets out the bank’s view of its risk profile.
    - Quantifies its Pillar 1 and Pillar 2 risks.
    - Describes composition of capital and the bank’s assessment of its own capital adequacy requirement.
  - Address draft methodology omissions: include approaches for identifying and assessing Pillar 2 risks; guidance on reviewing a bank’s Risk Appetite Statement and linking it to individual risk assessments; include peer review approach at each stage.
  - Include governance arrangements around ICAAP assessment, and explicit linkages between ICAAP, RAS, and SREP frameworks, including internal decision-making and timelines for approving outputs.

### Liquidity, funding risks, and ILAAP linkage
- The draft methodology includes liquidity and funding risks (not common in ICAAP documents); this inclusion is sensible until the Agency implements an ILAAP regime that would cover such risks in detail.
- Note: Additional liquidity requirements will form part of the Agency’s Internal Liquidity Adequacy Assessment Process (ILAAP) framework, when implemented.

### Setting Individual Pillar 2 supervisory capital requirements
- Key objective: determine minimum level of capital required against material Pillar 1 and Pillar 2 risks.
- Draft methodology identifies risks for which Pillar 1 capital is not held and determines capital add-ons.
  - Two main such risks in the Kazakh banking sector: concentration risk and IRRBB.
  - Credit risk issue in Kazakh context: possible capital shortfalls from under provisioning.
- For under-provisioning: draft methodology proposes a simple, matrix-based approach for calculating capital add-ons and appears fit for purpose.
- For concentration risk:
  - Draft methodology does not include an approach for capital add-ons for concentration risk.
  - Suggested approaches: Herfindahl-Hirschman index (HHI) or a simpler scalar for risk-weighted assets (RWA) linked to size of business with individual concentration types.
- For IRRBB:
  - Draft methodology includes an approach for assessing additional Pillar 2 capital required to cover IRRBB.
  - Recommendations for IRRBB calibration (methodology should consider):
    a) the institution’s governance of IRRBB, strategy of IRRBB, and its risk appetite in relation to interest rate risk;
    b) bank’s nature and composition of the interest rate risk profile (in term of repricing of all asset, liabilities, and off-balance sheet items/cash flows);
    c) assessment of behavioral assumptions the banks is using (non-maturing deposits, prepayments);
    d) impact of different interest rate scenarios on economic value as a portion of the banḱ s own funds—or economic value of equity (EVE);
    e) impact of different interest rate scenarios on earnings—net interest income (NII).
  - Recommendation: Ensure banks with high IRRBB that could result in losses in plausible market scenarios have sufficient capital; perform comprehensive peer analysis to identify outliers.
- Other Pillar 2 risks:
  - Draft methodology does not cover other risks not fully captured by Pillar 1 (e.g., reputational, legal, strategic, and model risk, including in the context of IFRS 9 provisioning, IRRBB, liquidity and operational risk).
  - Recommendation: Incorporate these risks into methodology if considered material; consider whether supervisory measures or capital add-ons are appropriate.
  - Additional capital requirement for such risks should be set on top of other capital add-ons and removed when inadequate control or risk management processes have been addressed.

### Governance-related capital scalar and proportionality
- The Agency has proposed a governance and management scalar to increase banks’ minimum capital requirements to address weaknesses in corporate governance:
  - Proposed add-on initially represents 2.5 percent of the bank’s available capital above its minimum capital requirements, including any that have been applied for other Pillar 2 risks.
- Assessment of proposal:
  - This approach is not consistent with international best practice.
  - Best practice: apply an additional capital requirement proportionate to the risk identified, above the bank’s existing minimum capital requirements, and remove it when weaknesses have been addressed.
  - Recommendation: Methodology should set out specific criteria the Agency should apply when determining whether a capital add-on for governance weaknesses is appropriate.

*Italic: Source — excerpt from 1kazea2022002 PDF chapter on SREP and ICAAP methodology amendments.*

### APPENDIX I. SEPTEMBER 2020 TA RECOMMENDATIONS

### APPENDIX I. SEPTEMBER 2020 TA RECOMMENDATIONS

### Key recommendations and priorities
- 1. Develop and adopt an action plan to strengthen the Agency’s institutional set up, including its operational independence, accountability and transparency, and overall banking supervisory capacity.  
  - Priority: Hig h  
  - Timeline: I
- 2. Sign a MoU with the NBK that sets out the coordination and cooperation arrangements between the two institutions, including the responsibilities and accountability of each institution and protocols for the exchange of information.  
  - Priority: Hig h  
  - Timeline: ST
- 3. Review and enhance the organizational structure and staffing of the Banking Regulation Department (BRD) to ensure effective prudential banking supervision. To include:  
  - restructure the BRD to transfer all non-critical to financial stability functions to other Departments of the Agency;  
  - establish a dedicated Supervisory policy team within the BRD for drafting supervisory procedures and operating manuals, ensuring consistent treatment of the implementation of the Agency’s supervisory approach, and supporting supervisory planning;  
  - embed the new Bank Analytics and Stress Testing Department into the SREP f ramework to ensure effective coordination with offsite and onsite teams and to provide valuable input to effective banking supervision;  
  - prescribe the role and responsibilities of the Agency’s supervisory committee in legislation and ensure that supervisory decisions are taken at a level appropriate to the significance of the issue;  
  - build up specialist risk expertise among onsite and offsite teams;  
  - introduce a comprehensive training program for offsite and onsite supervisors to address identified skill shortages required to assess banks’ corporate governance, risk management, business models; consider the possibility of seconding staff to foreign supervisory authorities.  
  - Priority: Hig h  
  - Timeline: M
- 4. Develop or update offsite, onsite, and SREP processes and procedures. To include:  
  - undertake more frequent offsite qualitative risk and corporate governance reviews, using banks’ internal management documents and reports;  
  - introduce regular prudential meetings with banks’ senior and middle management, including an annual meeting with Supervisory and Executive boards on strategic issues;  
  - enhance annual supervisory plans for the banking sector, by including high-level supervisory priorities, the supervisory p rograms for individual banks and more risk-f ocused onsite inspection plans;  
  - implement fully an ICAAP regime and capital-ons;  
  - update the supervisory procedures, manuals, roles and responsibilities of structural units, including supervisors’ job descriptions, for conducting a SREP and integrating offsite and onsite supervision into the new framework;  
  - develop supervisory procedures for documenting and recording supervisory findings and supervisory judgements, arrangements for the approval of SREP results, including scores, and for communicating the outcomes of the SREP to the banks.  
  - Priority: Hig h  
  - Timeline: M
- 5. Amend legislation by including additional safeguards to enhance the Agency’s operational independence, including the implementation of FSC recommendations, and by prescribing the accountability framework; strengthen the Agency’s transparency by additional disclosures.  
  - Priority: Medium  
  - Timeline: M
- 6. Require banks to produce credible medium-term capital and liquidity restoration plans to mitigate the impact of the exceptional COVID-19 measures.  
  - Priority: Hig h  
  - Timeline: I

- Timeline legend (exact wording):  
  - I, immediate,   with  results less th an  3  mo n th s; ST, short-term,  with results fro m 3 to  6 mo n th s; MT, medium  term,  with  results from 6 to 24 months.

*Italic: Source: APPENDIX I. SEPTEMBER 2020 TA RECOMMENDATIONS — as provided.*

---

### APPENDIX II. STRUCTURE OF THE BANKING SECTOR: JANUARY 1, 2021

### Top bank-level statistics (assets and market share as presented)
- HALYK SAVINGS BANK OF KAZAKHSTAN  
  - ASSETS (US$BN): 23.7  
  - MARKET SHARE (PERCENT): 32
- SBERBANK  
  - ASSETS (US$BN): 10.2  
  - MARKET SHARE (PERCENT): 10.2
- FORTE BANK  
  - ASSETS (US$BN): 6.9  
  - MARKET SHARE (PERCENT): 6.9
- KASPI BANK  
  - ASSETS (US$BN): 9  
  - MARKET SHARE (PERCENT): 9
- BANK CENTER CREDIT  
  - ASSETS (US$BN): 5.9  
  - MARKET SHARE (PERCENT): 5.9
- ATF BANK  
  - ASSETS (US$BN): 3.8  
  - MARKET SHARE (PERCENT): 3.8
- ‘OTBASY BANK’ HOUSE CONSTRUCTION SAVINGS BANK  
  - ASSETS (US$BN): 5.5  
  - MARKET SHARE (PERCENT): 5.5
- FIRST HEARTLAND JÝSAN BANK  
  - ASSETS (US$BN): 5.3  
  - MARKET SHARE (PERCENT): 5.3
- EURASIAN BANK  
  - ASSETS (US$BN): 3.9  
  - MARKET SHARE (PERCENT): 3.9
- CITIBANK  
  - ASSETS (US$BN): 2.9  
  - MARKET SHARE (PERCENT): 2.9
- BANK RBK  
  - ASSETS (US$BN): 2.4  
  - MARKET SHARE (PERCENT): 3.2
- ALFA-BANK  
  - ASSETS (US$BN): 1.8  
  - MARKET SHARE (PERCENT): 2.4
- ALTYN BANK  
  - ASSETS (US$BN): 1.4  
  - MARKET SHARE (PERCENT): 1.9
- NURBANK  
  - ASSETS (US$BN): 1.0  
  - MARKET SHARE (PERCENT): 1.4
- HOME CREDIT AND FINANCE BANK  
  - ASSETS (US$BN): 0.9  
  - MARKET SHARE (PERCENT): 1.3
- BANK OF CHINA  
  - ASSETS (US$BN): 0.9  
  - MARKET SHARE (PERCENT): 1.2
- JSC BANK VTB (KAZAKHSTAN)  
  - ASSETS (US$BN): 0.8  
  - MARKET SHARE (PERCENT): 1.1
- INDUSTRIAL AND COMMERCIAL BANK OF CHINA  
  - ASSETS (US$BN): 0.5  
  - MARKET SHARE (PERCENT): 0.7
- AB “KAZAKSTAN-ZIRAAT INTERNATIONAL BANK  
  - ASSETS (US$BN): 0.3  
  - MARKET SHARE (PERCENT): 0.4
- BANK KASSA NOVA  
  - ASSETS (US$BN): 0.2  
  - MARKET SHARE (PERCENT): 0.3
- CAPITAL BANK KAZAKHSTAN  
  - ASSETS (US$BN): 0.1  
  - MARKET SHARE (PERCENT): 0.1
- ASIA CREDIT BANK  
  - ASSETS (US$BN): 0.1  
  - MARKET SHARE (PERCENT): 0.2
- SHINHAN BANK KAZAKHSTAN  
  - ASSETS (US$BN): 0.1  
  - MARKET SHARE (PERCENT): 0.2
- AL-HILAL ISLAMIC BANK  
  - ASSETS (US$BN): 0.1  
  - MARKET SHARE (PERCENT): 0.2
- ZAMAN-BANK  
  - ASSETS (US$BN): 0.1  
  - MARKET SHARE (PERCENT): 0.0
- NATIONAL BANK OF PAKISTAN (JSC SUBSIDIARY)  
  - ASSETS (US$BN): 0.1  
  - MARKET SHARE (PERCENT): 0.1

- TOTAL: 74 100

- Note: 14 banks participated in AQR 2019 (in grey).  
- Note: Source: The Agency.

---

### APPENDIX III. SUPERVISORY ISSUES FOR CONSIDERATION ON RECEIPT OF INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS DOCUMENTATION

### Executive Summary of the ICAAP report — supervisor’s checklist
- Is there a clear overview of the risks to which the bank is exposed?  
- Is there a clear explanation of the capital required to cover each risk?  
- Are any deviations from the Pillar 1 framework clearly stated?  
- Are Pillar 2 risks set out and the capital against such risks clear?  
- Are other risks quantified?  
- Is the overall assessment of the bank’s internal capital adequacy requirement clearly stated?

### Organization and governance of ICAAP
- Does the ICAAP comply with the requirements set out in Chapter 5 of 188 Regulation?  
- What is the internal governance of the ICAAP? Has it been approved by the board?  
- What other units in the bank have been involved in the ICAAP process?  
- Is the ICAAP commensurate with the size, scale and risks of the business?  
- Does the ICAAP outline the business undertaken, the risks being run, structure of the business, legal entity, management’s risk appetite, the governance supporting this, the risk and control environment etc?  
- How is the ICAAP used internally?  
- Is it a dynamic document that is used to manage risks?  
- What circumstances would lead to the ICAAP being updated?

### Risk appetite statement
- Does the Risk Appetite Statement comply with the requirements of Chapter 3 of the Rules?  
- Is the Risk Appetite Statement owned by the board and appropriate senior management committees?  
- Is the risk appetite statement documented in writing and there is evidence that it is communicated to the staff of the bank?  
- Does the risk appetite statement consider all material risks to which the bank is exposed and contains risk limits, tolerances and thresholds?  
- Are the limits comprehensive, internally consistent and realistic given the business undertaken?  
- Is the risk appetite framework forward-looking and in line with the bank’s strategic planning horizon, and regularly reviewed?  
- Does the risk strategy consider the financial resources of the bank (i.e. the risk appetite should be consistent with supervisory own funds and liquidity requirements and other supervisory measures)?  
- Does it explain how/where risk limits were set?  
- What evidence is there that management uses the Risk Appetite Statement to run the business?  
- Peer analysis—how have similar banks calibrated their risk limits?

### Capital-related information in the ICAAP
- Does the ICAAP explain how these risks arise within the business?  
- In line with Chapter 5 of Regulation 188, does the ICAAP describe the bank’s organisation of credit, market and operational risk management. For credit, the ICAAP should include:  
  - details of the credit risk management process from approval, administration, detailed credit analysis/monitoring, managing and dealing with troubled loans;  
  - details of the credit rating model or scoring analysis;  
  - details of the loan classification system;  
  - details of the information technology system for credit risk.  
- (There are similarly detailed requirements for market risk and operational risk in Chapter 5 of Reg 188.)  
- Is the information in these documents sound, effective and comprehensive?  
- Does the ICAAP explain what policies and procedures the firm uses to manage these risks?  
- Is the risk and control environment explained in the ICAAP?  
- Is the internal structure of risk management clearly explained (e.g., committees, management information etc.) and consistent with the views of the Agency?  
- Does the ICAAP document how Pillar 1 is calculated? Does it enable the supervisor to confirm that the standardised approach has been applied correctly?  
- Does the ICAAP explain what risks aren’t covered under Pillar 1?  
- Does the ICAAP explain which of the non-Pillar 1 risks are to be covered by capital and which will be covered by qualitative measures?  
- Does the ICAAP set out clearly any Pillar 2 risks identified?  
- Has capital been calculated for Pillar 2 risks (e.g.,   IRRBB and concentration risk)?  
- Are the methodologies for calculating Pillar 2 risks clearly stated?  
- Have other risks not captured by Pillar 1 been identified?  
- Has capital been calculated for such risks and the methodology specified?  
- Does the firm use an economic capital model? Is the capital plan it generates relevant to the business (i.e., it’s not group and not relevant to Kazakhstan)?  
- Does the ICAAP detail/ explain stress tests?

### Stress tests
- Are the stress tests proportionate to the size and nature of the business?  
- Are all material risks run by the bank covered by the stress tests?  
- Are the stress tests appropriately calibrated?  
- Are the underlying assumptions in the stress tests reasonable?  
- Are the stress tests comparable with peer banks?  
- Does the ICAAP include reverse stress tests? How are these calibrated?  
- Do stress tests indicate a low point?  
- If applicable, how are regulatory-driven stress tests incorporated into the ICAAP?

### Additional information that may be requested
- Risks identified in outsourcing contracts?  
- Risks arising from remuneration policy?  
- Risks arising from new products or product change?  
- Risks arising from information technology/cyber events?  
- Risks arising from operational risk failures?  
- Any new material issues identified in internal audit reports?

### Business Model Analysis (BMA)
- Does the BMA documentation comply with Chapter 2 of Regulation 188?  
- Does the BMA contain at least a three-year outlook?  
- Is the strategy regularly updated and approved by the board?  
- Are the strategic goals clearly identified?  
- Have target market segments been identified?  
- Is there an analysis of the strategy’s strengths and weaknesses?  
- Does the bank generate strong and stable returns which are acceptable given its risk appetite and funding structure?  
- Are there any material and unsustainable asset concentrations or concentrated sources of income?  
- Does the bank have a strong/sustainable position in the market?  
- Does the current strategy reinforce its market position?  
- Are the bank’s financial forecasts based on plausible assumptions about the future business environment?  
- Are the strategic plans appropriate given the current business model and management execution capabilities?  
- Does the BMA outline the size of individual business lines (revenue, customers, P&L, etc), concentrations, geographical exposures?  
- Does the BMA consider wider group risks (i.e., if the crystallisation of group issues could affect the Kazakhstan sub?)

### Internal governance and internal controls
- Does the bank have a transparent organizational structure with clear responsibilities and separation of risk taking from risk management and control functions?  
- Is the functioning of the board appropriate?  
- Is the number of members of the board adequate, and composition appropriate?  
- Do members demonstrate a sufficient level of commitment and independence?  
- Is there a fit and proper assessment of members upon appointment and on an ongoing basis?  
- Is the effectiveness of the board reviewed?  
- Is sufficient time allowed for board members to consider risk issues, and appropriate access granted to information on the risk situation of the bank?  
- Does the board set the bank’s governance principles, corporate values and appropriate standards, including independent whistle-blowing processes and procedures?  
- Does the board understand the bank’s operational structure (e.g., entities and the links and relationships amongst them; special purpose or related structures) and the associated risks?  
- Is there evidence of clear and strong communication of strategies and policies to all relevant staff and that the risk culture is applied across all levels of the institution?  
- Does the bank’s ethical corporate and risk culture create an environment of effective challenge in which decision-making processes promote a range of views?  
- Is the remuneration policy in line with the bank’s risk profile and maintained, approved and overseen by the board?  
- Is the internal audit function independent and operates effectively in accordance with established internal standards and requirements?  
- Is the recovery plan complete and credible and recovery planning arrangements are appropriate?  
- Does the bank have policies in place to identify and avoid conflicts of interest?  
- Does the bank have an outsourcing policy and strategy that considers the impact of the outsourcing on its business?  
- Is the bank’s ICAAP (and ILAAP) framework sound, effective and comprehensive?

### Risks to capital — Pillar 1 risks (assessment focus)
- Every Pillar I risk should be assessed from the point of potential impact on the bank considering the level of inherent risk and management and controls.  
- Inherent credit risk:  
  - What is the nature and composition of credit exposure, and of exposures to complex products (CCR, settlement risk, country risk, FX lending, specialized lending)  
  - Credit concentration in line with peers?  
  - Level of forborne and NPLs is in line with peers?  
  - IFRS 9, coverage of provisions and CVA adjustments in line with peers?  
  - Quality of guarantees and collateral?  
  - Results of stress testing?  
- Management/control of credit risk:  
  - Is there consistency between credit-risk policy, strategy and risk appetite?  
  - Does the organizational framework for credit risk show clear responsibilities and separation of tasks between risk takers and management and control functions?  
  - Is credit risk measurement, monitoring and reporting appropriate for the scale of the business?  
  - Sound, effective and comprehensive credit risk limit system and compliance with risk appetite and strategy.  
- Inherent market risk:  
  - Is the credit risk limit system comprehensive and in compliance with risk?  
  - What is the nature and composition of market risk exposure and of exposures to complex products (FX, position risk (risk—general and specific), equity risk, commodity risk)?  
  - Is there a market risk concentration?  
  - Is there volatility of returns around market risk exposures?  
  - Results of stress testing?  
- Management/control of market risk:  
  - Is there consistency between market-risk policy, strategy and risk appetite?  
  - Are there clear responsibilities and separation of tasks (between risk takers and management and control function)?  
  - Is market risk measurement, monitoring and reporting appropriate?  
  - Is the market risk limit system comprehensive and in compliance with risk appetite and strategy?  
- Inherent operational risk:  
  - What is the nature of operational risk events and exposures (conduct risk, ICT risk, model risk)?  
  - What is the frequency of “low frequency/high severity losses”?  
  - What is the exposure to operational risk events - comparison to peers, scenario analysis?  
  - What is the level of losses experienced in recent years and trend (compared to peers)?  
- Management/control of operational risk:  
  - Is there consistency between operational-risk policy, strategy and risk appetite?  
  - Are there clear responsibilities and clear separation of tasks (between risk takers and management and control functions)?  
  - Is the operational risk measurement, monitoring and reporting appropriate?  
  - Is the operational risk control framework comprehensive?  
- Additional assessment directly linked to the amount of capital covering Pillar 1 risks:  
  - Has the bank allocated assets correctly to the appropriate RWAs as per standardised methodologies?  
  - Is Pillar 1 capital quantification adequate for the risk undertaken?  
  - Is there a clear articulation of the capital required for these risks?  
  - Is the methodology for such calculations clear and accurate?

### Risks to capital — Pillar 2 risks
- Given the bank’s business, strategy, risk and control environment etc, have all risks not fully captured under Pillar 1 been clearly identified and quantified?  
- Have IRRBB and concentration risk been identified and quantified?  
- Have all other risks not captured by Pillar 1 been identified and quantified, including but not limited to:  
  - Strategic risk  
  - Reputational risk  
  - Legal risk  
  - Model risk (IRRBB, liquidity, etc.)  
- IRRBB should be assessed from the point of potential impact on the bank considering the level of inherent risk and management and controls.

### IRRBB — inherent risk and management/control
- Inherent IRRBB:  
  - What is the nature and composition of the interest rate profile?  
  - assessment of timing mismatch in the maturity and repricing of assets, liabilities and off-balance sheet positions (re-pricing risk)  
  - assessment of gap analysis (correct assignment to buckets), or duration calculations, granularity depends on size and complexity of the bank  
  - assessment of risk arising from the changes in slope and shape of the yield curve  
  - assessment of risk arising from e.g. hedging and embedded options (e.g., prepayments)  
  - results of scenario and stress testing  
  - sensitivity of eve to changes in interest rates  
  - sensitivity of earnings to changes in interest rates (NII)  
  - sensitivity of EVE and NII to changes in underlying assumptions (e.g., prepayment assumptions change)  
- Management/control of IRRBB:  
  - Is there consistency between IRRBB policy, strategy and risk appetite?  
  - Are there clear responsibilities and clear separation of tasks (between risk takers and management and control functions)?  
  - Is the IRRBB measurement, monitoring and reporting appropriate?  
  - Is the IRRBB risk control framework comprehensive and consistent with internal limits, compliance and the bank’s risk appetite statement?

### Concentration risk
- This may be assessed within credit risk assessment framework. Special attention to be paid to single-name concentration (special attention to be paid to group of connected clients)  
- Areas for attention:  
  - sectoral concentration;  
  - geographical concentration;  
  - product concentration;  
  - guarantee and collateral concentration  
- General to Pillar 2 risks:  
  - Is there a clear articulation of the capital required for these risks?  
  - Is the methodology for such calculations clear and accurate?  
  - Do these produce an increased capital requirement to be held under Pillar 2?  
  - In case of IRRBB as a result of:  
    - The effect of interest rate shock on EVE  
    - Different shifts in the yield curve  
    - Longer-term averages, not just the latest value, trend being included.  
  - In case of concentration risk through:  
    - The HHI;  
    - Capital add-on/increased risk weight for exposures larger than x percent of capital.

### Peer analysis (role in ICAAP and SREP)
- Supervisors should assess a bank against similar banks across a range of factors, including but not limited to:  
  - Risks identified  
  - Risk appetite statements  
  - Limit frameworks  
  - Business model analysis  
  - Internal governance  
  - Pillar 1 capital quantification, Pillar 1 capital ratio  
  - Pillar 2 capital proposed  
  - Liquidity and funding profile  
  - Stress tests proposed  
  - Outcome of stress tests

*Italic: Source: APPENDIX III. SUPERVISORY ISSUES FOR CONSIDERATION ON RECEIPT OF INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS DOCUMENTATION — as provided.*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2022/english/1kazea2022002.pdf_