Banco Santander (Mexico) S.A., Institucion de Banca Multiple, Grupo Financiero Santander Mexico | CIK:0001698287 |

47. Risk management

a)  Cornerstones of the risk function

The Bank has considered that the risk function should be based on the following cornerstones, which are in line with the Bank’s strategy and its business model and in addition take into account the regulatory and supervisory requirements, as well as the best market practices:

1.  Risk map

The risk map covers the main risk categories in which the Bank has its most significant current and/or potential exposures, thus facilitating the identification thereof.

The risk map includes the following:

2.  Risk governance

For the proper development of the risk function, the Bank has a strong governance policy in place to ensure that the risk decisions taken are appropriate and efficient and that they are effectively controlled within the established risk appetite framework.

The Chief Risk Officer (CRO) oversees this function within the bank, advises and challenges the executive line and also reports independently to the Board of Directors.

2.1  Lines of defense

The Bank’s risk management and control model is based on three lines of defense.

The business functions and all support funcionts that generate risk exposure comprise the first line of defense. The role of these functions is to establish a management structure for the risks that are generated as part of their activity ensuring that these remain within the approved appetite risk and the established limits.

The second line of defense is composed by the risk control function, and the compliance and conduct function. The role of these functions is to provide independent oversight and challenge to the risk management activities performed by the first line of defense.

These functions are responsible for ensuring that the risks are managed in accordance with the risk appetite defined by the Board of Directors and to foster a strong risk culture across the Bank. They must also provide guidance, advice and expert opinion in all key risk-related matters.

Internal audit as the third line of defense. As the last layer of control, regularly assesses policies, methods and procedures to ensure they are adequate and are being implemented effectively in the management and control of all risks.

The risk control, compliance and conduct and internal audit functions are sufficiently separated and independent from each other and regarding to other functions they control or supervise for the performance of their duties, and they have access to the Board of Directors and/or its committees, through their maximum responsibles.

2.2  Risk committee structure

Responsibility for the control and management of risk and, in particular, for the setting of the Bank’s risk appetite, rests ultimately in the Board of Directors, which has delegated its powers to committees classed as independent control bodies or decision-making bodies. The Board of Directors is supported by the comprehensive risk management committee. In addition, the Bank’s executive risk committee pays particular attention to the management of all the Bank’s risks.

The following bodies form the highest level of risk governance:

Independent control bodies

Comprehensive risk management committee

This collegiate body is responsible for the effective risk control, ensuring that all risks are managed in accordance with the risk appetite level approved by the Board of Directors, while taking into account at all times an overall view of all the risks included in the general risk framework. This means the identification and monitoring of current and emerging risks and their impact on the Bank’s risk profile.

This committee is chaired by the CRO and is composed of executives directors of the Bank. The risk function, which chairs the committee, as well as the functions of compliance and conduct, financial accounting and control, and management control are represented, among others.

Decision-making bodies

Executive risk committee

This collegiate body is responsible for risk management pursuant to the powers delegated by the Board of Directors and, in its sphere of action and decision-making, oversees all risks.

It participates in decision-making on the assumption of risks at the highest level, guarantees that these are within the limits set in the Bank’s risk appetite and reports on its activities to the Board of Directors or its committees when so required.

This committee is chaired by an executive deputy chairman of the Board of Directors and comprises the CEO, executive officers and other executives of the Bank. The risk function, finance and compliance and conduct, among others, are represented. The CRO has a right to veto the decisions taken by this committe.

3.  Management processes and tools

3.1  Risk appetite and limits structure

Risk appetite is defined as the amount and type of risks considered reasonable to assume for implementing its business strategy, so that the Bank can mantain its ordinary activity in the eveny of unexpected circumstances.

For the latter, severe scenarios are taken into account that could have a negative impact on the levels of capital, liquidity, profitability and/or the share price.

The Board of Directors is the body responsible for annually setting and updating the risk appetite, for monitoring the Bank’s risk profile and ensuring consistency between both of them.

The risk appetite is determined both for the Bank as a whole and for each of the main business units using a methodology adapted to the circumstances of each business unit. The Board of Directors is responsible for approving the respective risk appetite proposals.

Corporate risk appetite principles

The following principles govern the Bank’s risk appetite:

Limits, monitoring and control structure

The risk appetite is formulated every year and includes a series of metrics and limits on these metric (statements) which express in quantitative and qualitative terms the maximum risk exposure that each business unit of the Bank or the Bank as a whole is willing to assume.

Fulfilling the risk appetite limits is continuously monitored. The specialized control functions report at least every quarter to the Board of Directors and its executive risk committee on the risk profile adequacy with the authorized risk appetite.

Linkage of the risk appetite limits with the limits used to manage the business units and portfolios is a key element for making the risk appetite an effective risk management tool

Pillars of the risk appetite

The risk appetite is expressed via limits on quantitative metrics and qualitative indicators that measure the exposure or risk profile by type of risk, portfolio, segment and business line, in both current and stressed conditions. These metrics and risk appetite limits are articulated in five large areas that define the positioning that the Bank wants to adopt or maintain in the development of its business model. 

3.2  Risk identification and assessment (RIA)

The Bank carries out the identification and assessment of the different risks it is exposed to involving the different lines of defense to strengthen its advanced and proactive risk management practice, establishing management standards that not only meet regulatory requirements but also reflect best practices in the market, and being also a risk culture transmission mechanism.

The function includes all the risk identification and assessment processes, as well as its integration within the Bank’s risk profile, its business units and activities, thereby keeping the risk map up to date.

In addition to identifying and assessing the Bank’s risk profile by risk type and business unit, RIA analyses the evolution of risks and identifies areas for improvement in each of the blocks that compose it:

In 2017, the function evolved along three main lines, ensuring the simplification and reinforcement of interaction among the communities of control and the completeness of the risk profile:

3.3  Scenario analysis

The Bank conducts advanced risk management by analyzing the impact that different scenarios could trigger in the environment in which the Bank operates. These scenarios are expressed both in terms of macroeconomic variables, as well as other variables that affect management.

Scenario analysis is a very robust and useful tool for Bank’s Management. It enables the assessment of Bank’s resistance to stressed environments or scenarios and puts into force a set of measures that reduce its risk profile to these scenarios. The objective is to maximize the stability of the consolidated income statement and capital and liquidity levels.

The robustness and consistency of the scenario analysis exercises are based on the following pillars:

From January 1, 2018, the processes, models and scenario analysis methodology will be included in the new regulatory requirements (IFRS 9).

The main uses of scenario analysis are as follows:

b)  Credit risk

1.  Introduction to the treatment of credit risk

Credit risk is the risk of financial loss arising from the default or credit quality deterioration of a customer or other third party, to which the Bank has either directly provided credit or for which it has assumed a contractual obligation.

The Bank’s risks function is organized on the basis of three types of customers: 

The Bank has a mainly retail profile, with more than 79% of its total risk exposure being generated by its commercial banking business.

2.   Credit risk map and credit risk parameters

The profile of the credit risk assumed by the Bank is characterized by retail banking operations.

Certain information regarding maximum credit risk exposure is included in Note 12.f.

2.1  Credit risk map – 2016 and 2017

The following table shows the Bank’s maximum credit risk exposure by type of product of Loans and advances to customers as of December 31, 2016 and 2017, without recognizing the availability of collateral or other credit enhancements to guarantee compliance:

 

For financial assets recognized in the consolidated balance sheet, credit risk exposure is equal to the carrying amount excluding impairment losses.

The maximum exposure to credit risk on financial guarantees is the maximum for which the Bank would be liable if these guarantees were called in.

3.  Credit risk from other standpoints

3.1  Credit risk from financial market operations

This section covers credit risk generated in treasury activities with customers, mainly with credit institutions. Operations are developed through money market financial products with different financial institutions and through counter-party risk products which serve the Bank’s clients.

The counterparty credit risk is the risk that the client in an operation could default before the definitive settlement of the cash flows of the operation. It includes the following types of operations: derivative instruments, operations with repurchase commitment, operations with deferred settlement and financing of guarantees.

There are two methodologies for measuring this exposure: i. mark to market (MtM) methodology (replacement value of derivatives) plus potential future exposure (add on) and ii. the calculation of exposure using Monte Carlo simulation for products. The capital at risk or unexpected loss is also calculated, i.e. the loss which, once the expected loss has been subtracted, constitutes the economic capital, net of guarantees and recovery.

After markets close, exposures are re-calculated by adjusting all operations to their new time frame, adjusting the potential future exposure and applying mitigation measures (netting, collateral, etc), so that the exposures can be controlled directly against the limits approved by Management. Risk control is performed through an integrated system and in real time, enabling the exposure limit available with any counterparty, product and maturity to be known at each moment.

3.2  Concentration risk

The concentration risk control is a vital part of management. The Bank continuously tracks the degree of concentration of its credit risk portfolios using various criteria: geographical areas, economic sectors, products and groups of customers.

The Board of Directors, via the risk appetite, determines the maximum levels of concentration. In line with the risk appetite, the executive risk committee establishes the risk policies and reviews the appropriate exposure levels for the adequate management of the degree of concentration of credit risk portfolios. The concentration risk is subject to CNBV regulations on “Large Exposures” as follows:

3.3  Sovereign risk and exposure to other public sector entities

Sovereign risk exposure arises mainly from the Bank’s obligations to maintain certain compulsory deposits in the Central Bank, the establishment of deposits with liquidity excess and fixed-income portfolios held as part of the structural interest rate risk management strategy for the consolidated balance sheet and treasury trading books. The vast majorities of such exposures are in pesos and are funded through repurchase agreements or customer deposits denominated in pesos.

4.  Credit risk cycle

The risk cycle has three phases: pre-sale, sale and post-sale:

Each of these phases is associated with specific decision models established for decision-making in line with the business objectives and credit policies defined by the Bank. The process is constantly revised, incorporating the results and conclusions of the after-sale phase to the study of risk and presale planning.

4.1  Planning

Identification

The identification of credit risk is a key component for the active management and an effective control of portfolios. The identification and classification of external and internal risk in each business allows corrective and mitigating measures to be adopted.

Strategic Commercial Plans

Strategic commercial plans (SCPs) are a basic management and control tool for the Bank’s credit portfolios. The plans are prepared jointly by the commercial and risk area, and define the commercial strategies, risk policies and measures/infrastructures required to meet the annual budget targets. These three factors are considered as a whole, ensuring a holistic view of the portfolio to be planned and allowing a map of all the Bank’s credit portfolios to be drawn up.

Planning allows business targets to be set and specific action plans to be established, within the risk appetite defined by the Bank, and these targets to be met by assigning the necessary means (models, resources, systems).

The comprehensive management of the SCPs means that an up-to-date view of the credit quality of the portfolios is available at all times, credit risk can be measured, internal controls carried out, in addition to regular monitoring of the planned strategies, to anticipate deviations and identify significant changes in risk and their potential impact, along with the application of corrective measures.

SCPs are approved and validated by the executive risks committee. The regular monitoring, established by the governance in place, is also performed by the executive risks committee.

Scenario analysis

Credit risk scenario analysis enables Management to better understand the portfolio's evolution in the face of market conditions and changes in the environment. It is a key tool for assessing the sufficiency of the allowance for impairment losses made and the capital to stress scenarios.

Scenario analysis is applied to all of the Bank's significant portfolios, usually over a three year horizon. The process involves the following main stages:

The entire process takes place within a governance framework, and is thus adapted to the growing importance of this framework and to best market practices, assisting the Bank’s Management in gathering knowledge and in their decision making.

4.2  Risk analysis and credit rating process

Generally speaking, risk study consists of analyzing a customer’s capacity to meet their contractual commitments with the Bank and other creditors. This entails analyzing the customer’s credit quality on a short and medium term horizon, risk operations, solvency and expected return on the basis of the risk assumed.

With this objective, the Bank uses customer credit decision models in all segments in which it operates: Global Corporate Banking (sovereign, financial institutions and corporate companies), commercial banking, institutions, SMEs and individuals.

The decision models applied are based on credit rating drivers. These models and drivers are monitored and controlled to calibrate and precisely adjust the decisions and ratings they assign. Depending on the segment, drivers may be:

The resulting ratings are regularly reviewed, incorporating the latest available financial information and experience in the development of banking relations. The reviews are increased in the case of customers who reach certain levels previously determined in the automatic warning systems and who are classified as special watch.

4.3  Establishment of limits, pre-classifications and pre-approvals

This process establishes the risk that each customer is able to assume. These limits are set jointly by the business units and the risk area and have to be approved by the executive risk committee and reflect the expected risk-return by the business unit.

Different models are used according to the segment:

4.4  Transaction decision-making

The sale phase is determined by the decision-making process which analyzes and resolves operations. Approval by the risk area is a prior requirement before contracting any risk operation. All decisions regarding risk must consider the risk appetite, limits and management policies defined in the planning stage, in addition to other factors relevant to the risk and profitability equilibrium.

According to the segment, decision-making follows different procedures:

Credit risk mitigation techniques

The Bank applies various credit risk mitigation techniques on the basis, among other factors, of the type of customer and product. Some are inherent to specific operations (for example, real estate guarantees) while others apply to a series of operations (for example, netting and collateral).

The different mitigation techniques can be grouped into the following categories:

Personal guarantees

This type of guarantees corresponds to those that place a third party in a position of having to respond to obligations acquired by another to the Bank. It includes, for example, sureties, guarantees, stand-by letters of credit, etc. The only ones that can be recognized, for the purposes of calculating capital, are those provided by third parties that meet the minimum requirements set by the supervisor.

Collateral

These are assets that are subject to compliance with the guaranteed obligation. They can be provided by the customer or by a third party. The real goods or rights used for the guarantee may be financial (cash, securities deposits, gold, etc.) or non-financial (property, other moveable property, etc.). Therefore, guarantees can be in the form of:

A very important example of a real financial guarantee is the collateral, which is used for the purpose (as with the netting technique) of reducing counterparty risk. This is a series of instruments with a certain economic value and high liquidity that are deposited/transferred by a counterparty in favour of another in order to guarantee/reduce the credit risk of the counterparty that could result from portfolios of transactions of derivatives with risk existing between them. The operations subject to the collateral agreement are regularly valued (normally daily) applying the parameters defined in the contract so that a collateral amount is obtained (usually cash or securities), which is to be paid to or received from the counterparty.

As a general rule, the repayment capacity is the most important aspect in decisions on the acceptance of risks, although this is no impediment to seek the highest level of real or personal guarantees. In order to calculate the regulatory capital, only those guarantees that meet the minimum qualitative requirements set by the CNBV can be taken into consideration.

Implementation of the mitigation techniques follows the minimum requirements established in the guarantee management policy: legal certainty (possibility of legally requiring the settlement of guarantees at all times), the lack of substantial positive correlation between the counterparty and the value of the collateral, the correct documentation of all guarantees, the availability of documentation for the methodologies used for each mitigation technique and appropriate monitoring, traceability and regular control of the goods/assets used for the guarantee.

Netting by counterparty

The concept of netting is the possibility of determining a net balance between operations of the same type, under the umbrella of a framework agreement such as the ISDA or similar.

It consists of aggregating the positive and negative market values of derivatives transactions that the Bank has with a certain counterparty, so that in the event of default it owes (or the Bank, if the netting off is negative) a single net figure and not a series of positive or negative values corresponding to each of operation with the counterparty.

An important aspect of framework contracts is that they represent a single legal obligation that covers all operations. This is fundamental when it comes to being able to net the risks of all operations covered by the contract with the same counterparty.

4.5  Monitoring / Anticipation

All customers must be monitored in an ongoing and holistic manner that enables the earliest detection possible of any incidents that may arise in relation to risk impacting the customer’s credit rating, so that specific measures (predefined or ad-hoc) can be implemented to correct any deviations that could have a negative impact for the Bank. This responsibility is shared by the commercial and risk functions.

Monitoring is carried out by the risk team, supplemented by internal audit. It is based on customer segmentation:

Measurement and control

In addition to the monitoring of customer’s credit quality, the Bank establishes the control procedures needed to analyze portfolios and their performance, as well as possible deviations regarding planning or approved alert levels.

The function is developed through an integrated and holistic vision of credit risk, establishing as the main elements the control by business units, management models, products, etc., facilitating early detection of specific attention points, as well as preparing action plans to correct any deteriorations.

Portfolio analysis permanently and systematically controls the evolution of credit risk with regard to budgets, limits and benchmark standards, assessing the impacts of future situations, both exogenous and resulting from strategic decisions, to establish measures to bring the risk portfolio profile and volumes within the parameters set by the Bank and in line with its risk appetite.

4.6  Recovery management

Recovery activity is a significant element in the Bank’s risk management. This function is carried out by the recovery area, which defines a strategy and an enterprise-wide focus for recovery management.

The Bank has a recovery management model that sets the guidelines and general lines of action to be applied, always taking into account the particularities that the recovery activity requires (economic environment, business model or a mixture of both).

Recovery activity is aligned with the socio-economic reality of the country and different risk management mechanisms are used with adequate prudential criteria on the basis of age, guarantees and unpaid debt conditions.

The recovery area directly manage customers for which the model has a business focus, where sustained value creation is based on effective and efficient collection management The new digital channels are becoming increasingly important in recovery management and new forms of customer relations are developing.

The diverse features of Bank’s customers make segmentation necessary in order to manage recoveries adequately. Mass management of large groups of customers with similar profiles and products is conducted through processes with a high technological and digital component, while personalized management focuses on customers who, because of their profile, require a specific manager and a more individualized analysis.

Recovery management is divided into four phases: irregularity or early non-payment, recovery of non-performing loans, recovery of written-off loans and management of foreclosed assets.

The management scope for the recovery function includes management of non-productive assets (NPAs), corresponding to the forbearance loan portfolio, non-performing loans, written-off loans and foreclosed assets, where the Bank may use mechanisms to rapidly reduce these assets, such as disposals of loan portfolios or foreclosed assets.

The Bank employs specific policies for recovery management that include the principles of the different recovery strategies, while ensuring the required rating and allowance for impairment loss are maintained. Therefore, the Bank is constantly seeking alternative solutions to legal channels for collecting debt.

Restructured/refinanced loan portfolio (forbearance loan portfolio)

The term “restructured/refinanced loan portfolio” or “forbearance loan portfolio” refers, for the purposes of the Bank’s risk management, to the modification of the payment conditions of a loan that allow a customer, who is experiencing financial difficulties (current or foreseeable), to fulfil their payment obligations, on the basis that if this modification were not made it would be reasonably certain that they would not be able to meet their financial obligations. The modification could be made to the original transaction or through a new transaction replacing the previous one.

The Bank follows a highly rigorous policy in this management process, so that it is performed in accordance with the best practices and in strictest compliance with regulatory requirements. This policy sets down strict criteria for the evaluation, classification and monitoring of such transactions, ensuring the strictest possible care and diligence in their granting and follow up. Therefore, the transaction must be focused on recovery of the amounts due, the payment obligations must be adapted to the customer's actual situation and losses must be recognised as soon as possible if any amounts are deemed irrecoverable.

Forbearances may never be used to delay the immediate recognition of losses or to hinder the appropriate recognition of risk of default

Further, the policy defines the classification criteria for the forbearance transactions in order to ensure that the risks are suitably recognised, bearing in mind that they must remain classified as doubtful or watch-list performing for a prudential period of time to attain reasonable certainty that repayment capacity can be recovered.

Certain information regarding renegotiated loans is included in Note 12.e.

c)   Trading market and structural risk

1.  Activities subject to market risk and types of market risk

The perimeter of activities subject to market risk involve these operations where patrimonial risk is assumed as a consequence of market factors variations. Thus they include trading risks and also structural risks, which are also affected by market shifts.

This risk comes from changes in risk factors - interest rates, inflation rates, exchange rates, share prices, the spread on loans, commodity prices and the volatility of each of these elements - as well as from the liquidity risk of the various products and markets in which the Bank operates, and balance sheet liquidity risk.

All these market risks can be partly or fully mitigated by using options, futures, forwards and swaps.

Other types of market risk require more complex hedging. For example :

In addition to market risks, balance sheet liquidity risk must also be considered: unlike market liquidity risk, balance sheet liquidity risk is defined as the possibility of not meeting payment obligations on time, or doing so at excessive cost. Among the losses caused by this risk are losses due to forced sales of assets or margin impacts due to the mismatch between expected cash inflows and outflows.

Pension risk, which is described below, also depend on shifts in market factors.

Depending on the nature of the risk, activities are segmented as follows:

2.  Trading market risk

The Bank's trading risk profile remained moderately low in 2017, in line with previous years, due to the fact that the Bank’s activity has traditionally focused on providing services to its customers, with only limited exposure to complex structured assets, as well as the diversification and risk factors.

Value at Risk

The standard methodology the Bank applies to trading activities is VaR, which measures the maximum expected loss with a certain confidence level and time frame. The standard for historic simulation is a confidence level of 99% and a time frame of one day. Statistical adjustments are applied enabling the most recent developments affecting the levels of risk assumed to be incorporated efficiently and on a timely manner. A time frame of two years or at least 520 days from the reference date of the VaR calculation is used. Two figures are calculated every day: one applying an exponential decay factor that accords less weight to the observations furthest away in time and another with the same weight for all observations. The higher of the two is reported as the VaR.

The average daily Total VaR of the Bank’s market trading operations in 2015 stood at 71 million pesos, lower than that for 2014 at 86 million pesos. In 2015, the changes in VaR were due mainly to changes in the interest rate risk factor as a result of the trading book’s strategy. VaR modeling did not change during 2015. At the end of December 2015, VaR stood at 70 million pesos.

Average daily Total VaR decreased by 15 million pesos with respect to 2014. This decrement was concentrated in interest rate VaR, where the average daily decreased from 88 million pesos to 68 million pesos. The average daily equity VaR and exchange rate VaR fell from 18 million pesos to 17 million pesos, and 14 million pesos to 10 million pesos, respectively.

The risk assumption profile, in terms of VaR and results, showed that VaR during 2015 remained at levels below the limit of 192 million pesos. During the first and second semester of 2015, the average daily Total VaR was 71 million pesos. VaR stayed in levels between 52 million pesos and 105 million pesos in the second semester, as a result of interest rates increase expectation.

The average daily Total VaR of the Bank’s market trading operations in 2016 stood at 77 million pesos, higher than that for 2015 at 71 million pesos. In 2016, the changes in VaR were due mainly to changes in the interest rate risk factor as a result of the trading book’s strategy. VaR modeling did not change during 2016. At the end of December 2016, VaR stood at 132 million pesos.

Average daily Total VaR increased by 6 million pesos with respect to 2015. This increment was concentrated in interest rate VaR, where the average daily increased from 68 million pesos to 71 million pesos. The average daily equity VaR and exchange rate VaR fell from 17 million pesos to 4 million pesos, and increased 10 million pesos to 17 million pesos, respectively.

The risk assumption profile, in terms of VaR and results, showed that VaR during 2016 remained at levels below the limit of 230 million pesos. During the first semester of 2016, the average daily Total VaR was 73 million pesos and during the second semester of 2016, the average daily Total VaR was 79 million pesos. VaR stayed in levels between 48 million pesos and 189 million pesos in the second semester, as a result of interest rates increase expectation.

The average daily Total VaR of the Bank’s market trading operations in 2017 stood at 95 million pesos, higher than that for 2016 at 77 million pesos. In 2017, the changes in VaR were due mainly to changes in the interest rate risk factor as a result of the trading book’s strategy. VaR modeling did not change during 2017. At the end of December 2017, VaR stood at 129 million pesos.

Average daily Total VaR increased by 18 million pesos with respect to 2016. This increment was concentrated in interest rate VaR, where the average daily increased from 71 million pesos to 96 million pesos. The average daily equity VaR and exchange rate VaR increased from 4 million pesos to 5 million pesos, and 17 million pesos to 51 million pesos, respectively.

The risk assumption profile, in terms of VaR and results, showed that VaR during 2017 remained at levels below the limit of 245 million pesos. During the first semester of 2017, the average daily total VaR was 97 million pesos and during the second semester of 2017, the average daily Total VaR was 93 million pesos. VaR stayed in levels between 58 million pesos and 138 million pesos in the second semester, as a result of interest rates increase expectation.

Exposures related to complex structured assets

The Bank’s policy with respect to the approval of new transactions involving complex structures is highly prudent and conservative. It is subject to strict supervision by the Management. Before approving a new transaction, product or underlying asset, the market risk area verifies:

-The existence of an appropriate valuation model to monitor the value of each exposure: Mark-to-Market, Mark-to-Model or Mark-to-Liquidity.

-The availability in the market of observable data (inputs) needed to be able to apply this valuation model.

Provided the two aforementioned conditions are met, the market risk area ascertains:

-The availability of appropriate systems, duly adapted to calculate and monitor every day the results, positions and risks of new operations.

-The degree of liquidity of the product or underlying asset, in order to make possible their coverage when deemed appropriate.

Calibration and test measures

The real losses can differ from the forecasts by the VaR for various reasons related to the limitations of this metric. This is set out in detail later in the section on the methodologies. The Bank regularly analyses and contrasts the accuracy of the VaR calculation model in order to confirm its reliability.

The most important test consists of backtesting exercises analyzed in all cases with the same methodology. Backtesting consists of comparing the forecast VaR measurements, with a certain level of confidence and time frame, with the real results of losses obtained in a same time frame. This enables anomalies in the VaR model of the portfolio in question to be detected (for example, shortcomings in the parameterization of the valuation models of certain instruments, not very adequate proxies, etc.).

The Bank calculates three types of backtesting:

In 2015, there were no exceptions to 99% VaR (i.e., days when the daily loss exceeded VaR). During 2015, there were five Value at Earnings (VaE) breaks (i.e., days when the daily gain exceeded VaE), due mainly to the changes in the interest rates.

In 2016, there were one exception to 99% VaR (i.e., days when the daily loss exceeded VaR). During 2016, there were twelve VaE breaks (i.e., days when the daily gain exceeded VaE), due mainly to the changes in the interest rates and foreign exchange.

In 2017, there were no exception to 99% VaR (i.e., days when the daily loss exceeded VaR). During 2017, there were no VaE breaks (i.e., days when the daily gain exceeded VaE).

The number of exceptions occurred is consistent with the assumptions specified in the VaR calculation model.

3.  Structural balance sheet risks

3.1  Main aggregates and variations

The market risk profile inherent in the Bank’s balance sheet, in relation to its asset volumes and shareholders’ funds, as well as the budgeted financial margin, remained moderate in 2017, in line with previous years.

Structural VaR

A standardized metric such as VaR can be used for monitoring total market risk for the banking book, excluding the trading activity of Global Corporate Banking distinguishing between fixed income (considering both interest rates and credit spreads on ALCO portfolios), exchange rate and equities.

In general the structural VaR is not significant according to the assets amounts or capital of the Bank.

Structural interest rate risk

The interest rate risk in the consolidated balance sheet management portfolios, measured in terms of sensitivity of the net interest margin (NIM) at one year to a parallel increase of 100 basis points in the yield curve, remained stable throughout 2015 under 1,247 million pesos, mainly due to the short-term repricing of the credit portfolio. At the end of December 2015, the risk consumption measured in terms of 100 basis points sensitivity of the market value of equity (MVE) stood under 3,389 million pesos.

The table below shows the distribution of interest rate risk by maturity as of December 31, 2015. The reported amounts include estimated interest on fixed and variable rate instruments. Interest on variable rate instruments is determined using the rate in effect as of the balance sheet date for the first scheduled interest payment and amounts are determined based on the contractual spread for each period thereafter. (Millions of pesos):

 

The interest rate risk in the balance sheet management portfolios, measured in terms of sensitivity of the NIM at one year to a parallel increase of 100 basis points in the yield curve, remained stable throughout 2016 under 1,100 million pesos, mainly due to the short-term repricing of the credit portfolio. At the end of December 2016, the risk consumption measured in terms of 100 basis points sensitivity of the MVE stood under 3,700 million pesos.

The table below shows the distribution of interest rate risk by maturity as of December 31, 2016. The reported amounts include estimated interest on fixed and variable rate instruments. Interest on variable rate instruments is determined using the rate in effect as of the balance sheet date for the first scheduled interest payment and amounts are determined based on the contractual spread for each period thereafter. (Millions of pesos):

 

The interest rate risk in the balance sheet management portfolios, measured in terms of sensitivity of the net interest margin (NIM) at one year to a parallel increase of 100 basis points in the yield curve, remained stable throughout 2017 under 900 million pesos, mainly due to the short-term repricing of the credit portfolio. At the end of December 2017, the risk consumption measured in terms of 100 basis points sensitivity of the MVE stood under 3,000 million pesos.

The table below shows the distribution of interest rate risk by maturity as of December 31, 2017. The reported amounts include estimated interest on fixed and variable rate instruments. Interest on variable rate instruments is determined using the rate in effect as of the balance sheet date for the first scheduled interest payment and amounts are determined based on the contractual spread for each period thereafter. (Millions of pesos):

 

Structural foreign currency risk

Structural exchange rate risk arises from Bank operations in foreign currencies. This management is dynamic and seeks to limit the impact on the core capital ratio of movements in exchange rates.

Structural equity risk

The Bank maintains equity positions in its banking book in addition to those of the trading portfolio. These positions are maintained as available-for-sale portfolios (equity instruments) or as equity stakes, depending on the percentage or control.

Structural equity positions are exposed to market risk. VaR is calculated for these positions using market price data series or proxies.

3.2  Methodologies

Structural interest rate risk

The Bank analyzes the sensitivity of the NIM and MVE to changes in interest rates. This sensitivity arises from maturity and interest rate re-pricing gaps in the various balance sheet items.

Taking into consideration the balance-sheet interest rate position and the market situation and outlook, the necessary financial measures are adopted to align this position with that desired by the Bank. These measures can range from the taking of positions on markets to the definition of the interest rate features of commercial products.

The metrics used by the Bank to control interest rate risk in these activities are the interest rate gap, the sensitivity of NIM and MVE to changes in interest rates, the duration of capital and VaR for economic capital purposes.

The interest rate gap analysis focuses on the mismatches between the interest reset periods of both on and off-balance-sheet assets and liabilities. This analysis facilitates a basic snapshot of the balance-sheet structure and enables concentrations of interest rate risks in the various maturity buckets to be detected. Additionally, it is a useful tool for estimating the possible impact of potential changes in interest rates on the Bank’s NIM and MVE.

The flows of all the on- and off-balance-sheet aggregates must be broken down and placed at the point of repricing or maturity. The duration and sensitivity of aggregates that do not have a contractual maturity date are analyzed and estimated using an internal model.

The sensitivity of the NIM measures the change in the expected net interest income for a specific period (12 months) given a parallel shift in the yield curve.

The sensitivity of the NIM is calculated by simulating the margin both for a scenario of changes in the yield curve and for the current scenario, the sensitivity being the difference between the two margins so calculated.

The sensitivity of the MVE is a complementary measure to the sensitivity of the net interest.

This sensitivity measures the interest rate risk implicit in the MVE based on the effect of changes in interest rates on the present values of financial assets and liabilities.

Structural foreign currency risk

These activities are monitored by measuring positions, VaR and results on a daily basis.

Structural equity risk

These activities are monitored by measuring positions, VaR and results on a monthly basis.

Limit control system

As already stated for the market risk in trading, under the framework of the annual limits plan, limits are set for balance sheet structural risks, responding to the Bank's risk appetite level.

The main limits are:

-Limit on the sensitivity of net interest income to one year.

-Limit of the sensitivity of equity value.

-Net position in each currency.

In the event of exceeding one of these limits or their sub limits, the risk management responsibles must explain the reasons it occurred and provide action plans to correct it.

d)   Pensions risk

In managing the risk associated with the defined-benefit employee pension funds, the Bank assumes the financial, market, credit and liquidity risks incurred in connection with the fund’s assets and investments and the actuarial risks arising from the fund’s liabilities, i.e., the pension obligations to its employees.

The aim pursued by the Bank in pensions risk control and management is primarily to identify, measure, follow up, control, mitigate and report this risk. The Bank’s priority, therefore, is to identify and mitigate all clusters of pension’s risk.

Therefore, in the methodology used by the Bank, the total losses on assets and liabilities in a stress scenario defined by changes in interest rates, inflation and stock markets indexes, as well as credit and operational risk, are estimated every year.

e)   Liquidity and funding risk

Structural liquidity management seeks to finance the Bank’s recurring business with optimal maturity and cost conditions, avoiding the need to assume undesired liquidity risks.

Liquidity management at the Bank is based on the following principles:

In order to ensure the effective application of these principles by the Bank, it was necessary to develop a management framework resting on the following three cornerstones:

The Bank develops the ILAAP, an internal self-assessment process of the adequacy of liquidity which must be integrated into the Bank’s other risk management and strategic processes. It focuses on both quantitative and qualitative matters.

Funding strategy in 2017

The Bank’s funding activity over the last few years has focused on mantaining its management model and, in particular, adapting the strategies to the increasingly demanding requirements of both markets and regulators.

In general terms, the approaches to funding strategies and liquidity management mantained by the Bank are:

All these developments, built on the foundations of a solid liquidity management model, enable the Bank to enjoy a very robust funding structure today. The basic features of this are:

 

Customer deposits are the Bank’s major source of funds. These customer deposits represent around 50.2% of the Bank’s consolidated total liabilities and at the end of 2017 they accounted for 99.9% of loans and advances to customers.

Medium and long term wholesale funding represented 16.0% of the Bank’s retail funding (including deposits from the Central Bank and credit institutions) and enabled it to comfortably cover for the loans and advances to customers not financed with customer deposits (commercial gap).

Evolution of liquidity in 2017

At the end of 2017, in comparison with 2016, the Bank reported:

Liquidity risk

The table below shows the distribution of the liquidity risk by maturity as of December 31, 2015. The reported amounts include cash flows from interest on fixed and variable rate instruments. The interest on variable rate instruments is determined using the forward interest rates for each period presented. (Millions of pesos):

 

 

The table below shows the distribution of the liquidity risk by maturity as of December 31, 2016. The reported amounts include cash flows from interest on fixed and variable rate instruments. The interest on variable rate instruments is determined using the forward interest rates for each period presented. (Millions of pesos):

 

The table below shows the distribution of the liquidity risk by maturity as of December 31, 2017. The reported amounts include cash flows from interest on fixed and variable rate instruments. The interest on variable rate instruments is determined using the forward interest rates for each period presented. (Millions of pesos):

 

Compliance with regulatory ratios

As part of its liquidity management model, in recent years the Bank has been managing the implementation, monitoring and compliance with the liquidity and leverage requirements set by local and international financial legislation.

LCR (Liquidity Coverage Ratio)

On December 31, 2014, the CNBV and the Central Bank published in the DOF, the General Provisions on Liquidity Requirements for Banking Institutions, which establish liquidity requirements that credit institutions must comply always in accordance with the guidelines established by the Committee on Regulation of Bank Liquidity at its meeting held on October 17, 2014.

The objectives of the liquidity requirements are as follows:

The liquidity coverage ratio is the result of dividing the liquid assets by the net cash flow.

During the fourth quarter of 2017, the weighted average LCR for the Bank is 176.14%, complying with the Bank´s desired risk profile and well above the regulatory minimum established.

NSFR (Net Stable Funding Ratio)

The CNBV and Mexican Central Bank have not issued its final definition of the net stable funding ratio based on the guidelines approved by the Basel Committee in October 2014.

This ratio seeks to reduce the liquidity risk for a longer time horizon, by requiring the banks that finance their activities through stable sources of financing, in accordance with the liquidity and maturity of its assets, mitigating the risk of episodes of liquidity stress in the future, and also prevents excessive dependence on sources of short-term wholesale financing.

f)   Operational risk

1.  Definition and objectives

The Bank defines operational risk (OR) as the risk of losses from defects or failures in its internal processes, people or systems, or external events, thus covering risk categories such as fraud, and technological, cyber, legal and conduct risk.

Operational risk is inherent in all products, activities, processes and systems, and is generated in all business and support areas. For this reason, all employees are responsible for managing and controlling the operational risks generated in their sphere of action.

This chapter refers to operational risks in general (these are also referred to as non-financial risks). Particular aspects of some risk factors are set out in more detail in specific sections.

The Bank’s target in the area of OR management and control is to identify, assess and mitigate risk concentrations, regardless of whether they produce losses or not. Analyzing exposure to OR helps to establish priorities in managing this risk. During 2017, the Bank has sought further improvement in its management model through a number of different initiatives designed by the CRO. One of these initiatives is to continue the Advanced Operational Risk Management (AORM) transformation project. This programme is designed to enhance operational risk management capacities through an advanced risk measurement approach, helping to reduce future exposure and losses impacting the consolidated income statement.

Starting November 2016, the Bank uses the Alternative Standardized Approach provided for under Basel II standards for the purpose of calculating regulatory capital for operational risk. The regulatory capital for operational risk is calculated under Mexican Banking GAAP.

The various phases of the operational risk management and control model are the following:

The following are needed for each of the aforementioned processes:

Risk identification, measurement and assessment model

A series of quantitative and qualitative techniques and tools have been defined by the Bank to identify, measure and assess operational risk. These are combined to produce a diagnosis on the basis of the risks identified and an assessment of the area or business unit through their measurement and evaluation.

The quantitative analysis of this risk is carried out mainly with tools that register and quantify the level of potential losses associated with operational risk events. Qualitative analysis seek to assess aspects (coverage, exposure) linked to the risk profile, enabling the existing control environment to be captured.

Operational risk information system

The Bank’s information system, called Heracles, supports operational risk management tools, providing information for reporting functions and needs. The objective of Heracles is to improve decision making for OR management throughout the Bank.

This objective will be achieved by ensuring that those responsible for risks in every part of the Bank have a comprehensive vision of the risk, and the supporting information they need, when they need it. This comprehensive and timely vision of risk is facilitated by the integration of various programmes, such as assessment or risks and controls, scenarios, events and metrics, using a common taxonomy and methodological standards. This integration provides a more accurate risk profile and significantly improves efficiency by cutting out redundant and duplicated effort.

Mitigation measures

The Bank uses the model to monitor the mitigation measures for the main risk which have been identified through the internal OR management tools (internal event database, indicators, selfassessment, scenarios, audit recommendations, etc.) and other external information sources (external events and industry reports).

Active mitigation management became even more important in 2017, with the participation of the first line of defense and the operational risk control function, through which specialist business and support functions exercise additional control. Furthermore, the Bank continued to move forward with pre-emptive implementation of operational risk management and control policies and procedures.

Cyber-security and data security plans

Throughout 2017, the Bank continued paying full attention to cybersecurity risks, which affect all companies and institutions, including those in the financial sector. This situation is a cause of concern for all entities and regulators, prompting the implementation of preventative measures to be prepared for any attack of this kind.

A new organizational structure has been specified and Bank governance for management and control of this risk has been reinforced. Specific committees have been set up and cyber-security metrics have been included in the Bank's risk appetite.

The Bank’s intelligence and analysis function has also been reinforced, by contracting Bank threat monitoring services. In addition, progress is being made in mitigation activities related to the identification and access management, with the backing of Bank’s Management.

Progress has also been made in the incident registration, notification and escalation mechanisms for internal reporting and reporting to CNBV.

Business continuity plan

The Bank has a business continuity management system (BCMS), which ensures that the business processes of the Bank will continue to operate in the event of a disaster or serious incident.

This basic objective is to:

During 2017, the Bank continued to advance in implementing and continuously improving its business continuity management system. The Bank has reviewed the methods and approaches to reinforce governance of the review and approval of continuity strategies and plans, to ensure that this process is implemented at the Bank, to comply with new regulatory requirements and to cover emerging risks (such as cyber-risk).

g)   Compliance and conduct risk

Scope, mission, definitions and objective

The compliance and conduct function fosters the adherence of the Bank to the rules, supervisory requirements, principles and values of good conduct, by setting standards, and discussing, advising and reporting in the interest of employees, customers, shareholders and the community as a whole.

This function addresses all matters related to regulatory compliance, prevention of money laundering and terrorism financing, governance of products and consumer protection, and reputational risk.

Under the current configuration of the three lines of defense at the Bank, compliance and conduct is an independent second-line control function under the CEO, reporting directly and regularly to the Board of Directors and its committees, through the Chief Compliance Officer (CCO). This configuration is aligned with the requirements of banking regulation and with the expectations of CNBV.

The risks are defined as:

The Bank’s objective is to minimize the probability that irregularities occur and that any irregularities that should occur are identified, assessed, reported and quickly resolved.

Other control functions (risks and internal audit) also take part in controlling these risks.

Compliance risk control and supervision

The first lines of defense have the primary responsibility for managing compliance and conduct risks, jointly with the business units, that directly originate such risks, and the compliance and conduct function. This is performed either directly or through assigning compliance and conduct activities or tasks.

The function is also responsible for setting up, fostering and ensuring that business units begin to use the standardised frameworks, policies and standards applied throughout the Bank. For this purpose, in 2017 a standard regulatory tree has been developed throughout the Bank, as well as a process for its monitoring and systematic control.

The CCO is responsible for reporting to Bank’s governance and management bodies, and must also advise and inform, as well as promote the development of the function.

In 2017, the Bank has reinforced and evolved the compliance and conduct model, especially at the business units. The Bank has put in place the necessary components to ensure ongoing control and oversight by creating robust governance schemes, and systems for reporting and interacting with business units in accordance with the governance model operated by the Bank.

Furthermore, internal audit - as part of the third line of defense functions - performs the tests and audits necessary to verify that adequate controls and oversight mechanisms are being applied, and that the Bank’s rules and procedures are being followed.

In 2017, the Bank has reviewed, updated and streamlined frameworks for the compliance and conduct function. These are first-level documents that regulate the function, with which the management of the various business units must comply.

The General Code of Conduct enshrines the ethical principles and rules of conduct that govern the actions of all Bank’s employees. It is supplemented in certain matters by the rules found in other codes and their internal rules and regulations.

In addition, the General Code of Conduct sets out:

The compliance and conduct function is responsible for ensuring effective implementation and oversight of the General Code of Conduct, as the Board of Directors is the owner of the Code and the frameworks that implement it.

Governance and organization model

In accordance with the mandate entrusted by the board of Directors to the compliance and conduct function, in 2017, great strides were made in the strategic compliance programme. In the two previous years, the scope and objectives of the model were defined, and the initiative was implemented. In 2017, it was implemented at the Bank's various business units, so that by the end of 2018 the Bank will have achieved compliance and conduct function in line with the highest standards of the finance industry.

Governance

The following committees are collegiate compliance and conduct governance bodies:

Regulatory compliance

The following functions are in place for adequate control and supervision of regulatory compliance risks:

Product governance and consumer protection

The products and consumer protection governance function defines the key elements needed for adequate management and control of commercialization and consumer protection risks, which are defined as risks arising from inadequate practices in customer relations, customer treatement, the products offered to customers and their suitability for each specific customer.

Anti-money laundering and anti-terrorism financing

One of the Bank’s strategic objectives is to maintain an advanced and efficient anti-money laundering and anti-terrorism financing systems, constantly adapted to international regulations, with the capacity to confront the development of new techniques by criminal organizations.

Reputational risk

In 2017, the Bank made significant progress implementing the reputational risk model.

The specific characteristics of reputational risk are a vast number of sources that requires a unique approach and control model, separate from other risks. The reputational risk management requires for a an interaction with both first and second lines of defense functions and with management functions in relation to the stakeholders in order to ensure a comprehensive supervision of the risk, efficiently supported on the current control frameworks. The aim is for reputational risk to be integrated into both business units and support activities, and internal processes, thus allowing the risk control and oversight functions to integrate them in their activities.

The reputational risk model is accordingly based on a prominently preventive approach to risk management and control, and also on effective processes for identification and early warning Management of events, and subsequent monitoring of events and detected risks.

h)   Model risk

The Bank has far-reaching experience in the use of models to help make all kinds of decisions, and risk management decisions in particular.

A model is defined as a system, approach or quantitative methods which applies theories, techniques or statistical, economic, financial or mathematical hypotheses to convert input data into quantitative estimates. The models are simplified representations of real world relationships between observed characteristics, values and observed assumptions. By simplifying in this way, the Bank can focus attention on the specific aspects which are considered to be most important to apply a certain model.

Use of models entails model risk, defined as the risk of loss arising from inaccurate predictions that prompt the Bank to take sub-optimal decisions, or misuse of a model.

According to this definition, the sources of model risk are as follows:

The materialization of model risk may prompt financial losses, inadequate commercial and strategic decision making or damages to the Bank's reputation.

The Bank has been working towards the definition, management and control of model risk for several years. Since 2015, a specific area has been put aside to control this risk.

Model risk management and control functions are guided by the model risk management model, with principles, responsibilities and processes that are common across the Bank. The model addresses organization, governance, model management and model validation, among other matters.

i)    Strategic risk

Strategic risk counts with a strategic risk control and management model. This model includes the definition of the risk, the principles and key processes for management and control, as well as functional and governance aspects.

Strategic risk is the risk of loss or harm arising from strategic decisions or poor implementation of decisions affecting the long-term interests of the Bank’s main stakeholders, or inability to adapt to changes in the environment.

The Bank’s business model is a key factor for strategic risk. It has to be viable and sustainable, and capable of generating results in line with the Bank's objectives and over time.

j)    Capital risk

The Bank defines capital risk as the risk that the Bank does not have sufficient capital, in quantitative or qualitative terms, to fulfil its internal business objectives, regulatory requirements, or market expectations.

The capital risk function, in its capacity as second line of defense, controls and oversees the activities of the first line of defense chiefly by means of the following processes:

Through this function, the Bank intend to carry out a complete follow-up and periodic checking of risk capital and adequate coverage capital adequacy according to the Bank's risk profile.

Regulatory capital

The Basel III regulatory framework implemented in Mexico since January 2013 establishes minimum capital levels in a very significant manner, both quantitatively (increased minimum requirements for Core Capital and Tier 1 Basic Capital, plus higher deductions from capital base) and from a qualitative point of view (higher quality of required capital).

From the capital standpoint, Basel III redefines what is considered to be available capital at financial institutions (including new deductions and raising the requirements for eligible equity instruments), increases the minimum capital requirements, requires financial institutions to operate permanently with capital buffers, and adds new requirements in relation to the risks considered.

The Bank currently has robust capital ratios, in keeping with its business model and risk profile, which, coupled with its substantial capacity to generate capital organically.

At 31 December 2016 and 2017, the Bank met the minimum capital requirements established by current legislation.

Model roll-out

As regards credit risk, the Bank continued its plan to implement Basel’s internal ratings-based (IRB) approach for regulatory capital calculation for credit risk. As of December 31, 2017, the Bank currently has supervisory authorization to use the AIRB approach for calculating the regulatory capital requirements for the following loan portfolios: Global Corporate Banking, financial institutions (banks), local corporates and real estate developers.

With regard to operational risk, until September 2015, the CNBV considered the application of the Basic Indicator method for calculating the capital requirement for this type of risk. As a result of regulatory changes published in October 2015 by the CNBV, it was made available for banks to utilize -with previous approval from the CNBV- the application of the Standardized Approach (TSA), the Alternative Standardized Approach (ASA) or the Advanced method (AMA) for calculating the capital requirement for operational risk. The Bank started calculating the Operational Risk capital requirements under the ASA on November 2016.

For market risk, the calculation of the capital requirement is made under the standard methodology according to the provisions established by CNBV.

Leverage ratio

To ensure the financial stability of the banking system as a whole, as well as to comply with the agreements of the Basel Committee on Banking Supervision, the CNBV established the methodology to calculate the leverage ratio for banks. This leverage ratio shows if the capital of the banks adequately supports their assets. Such information is helpful for the market participants, as well as for the supervisory work of the CNBV.

This ratio is calculated as Tier 1 capital divided by leverage exposure. Exposure is calculated as the sum of the following items:

The Sole Circular for Banks issued by the CNBV does not establish a minimum percentage of compliance, as it is considered for the baseline reference effect (the minimum of 3%).

As of December 31, 2017, the leverage ratio for the Bank is 7.03%.

Systemic important bank

In April 29, 2016, the Bank was appointed by the CNBV as a systemic important bank, assigning a Grade III of systemic importance. As a result, the Bank should progressively constitute in four years a capital preservation supplement of 1.20%, starting 2016.

As of December 31, 2017, the Bank has constituted 50% of the capital preservation supplement required.