Supervisory Policy Manual

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on line, click on blue underlined headings to activate hyperlinks to the relevant module.

—————————

Purpose

To provide guidance to AIs on the key elements of a sound risk management system for credit risk transfer activities

Classification

A non-statutory guideline issued by the MA as a guidance note

Previous guidelines superseded

Guideline No. 4.6 “Supervisory treatment on asset securitisation and mortgage backed securities”

CR-G-12 “Credit Derivatives”

Application

To all AIs

Structure

1. Introduction

1.1 Terminology 1.2 Background 1.3 Application

1.4 Nature of risks associated with CRT activities 2. Key elements of effective management of CRT activities

2.1 General

2.2 Corporate governance

2.3 Policies, procedures and limits 2.4 Credit assessment and review

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

2.5 Risk measurement and valuation 2.6 Risk monitoring and control

2.7 Management information system and reporting 2.8 Stress-testing

2.9 Independent reviews and audits 3. Specific risk management topics

3.1 Risk concentration 3.2 Reputation risk 3.3 Liquidity risk

3.4 Special purpose entities 3.5 Legal risk and compliance 4. Supervisory approach to CRT activities

4.1 Risk-based supervision 4.2 Risk retention requirement

4.3 High cost credit protection (for locally incorporated AIs) 4.4 Notification requirements (for locally incorporated AIs) 4.5 Information collection

4.6 Capital adequacy framework (for locally incorporated AIs) 4.7 Liquidity requirements

4.8 Large exposure treatment

4.9 Financial disclosure requirements (for locally incorporated AIs)

————————

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

1. Introduction

1.1 Terminology

1.1.1 In this module—

(a) credit risk transfer activities means activities associated with securitization or credit derivative contracts, which include-

(i) acting as the originator of a securitization transaction;

(ii) purchasing or repurchasing securities issued under a securitization transaction;

(iii) retaining an exposure to one or more than one tranche in a securitization transaction;

(iv) providing credit protection or credit enhancement to any of the parties to a securitization transaction;

(v) providing a liquidity facility or cash advance facility for a securitization transaction;

(vi) undertaking roles such as a servicer or swap counterparty in a securitization transaction;

(vii) selling or buying credit protection through credit derivative contracts; and

(viii) trading or investing in financial instruments or transactions (whether funded or unfunded) that transfer credit risk from one party to another party (e.g. credit default swaps ("CDS"), credit-linked notes, asset-backed securities, collateralized debt obligations, etc.);

(b) high cost credit protection means credit protection which has the following features—

(i) the credit protection was purchased by an authorized institution (AI) to hedge the credit risk of an exposure;

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

(ii) there is a delay in recognizing losses in the exposure and the costs of the credit protection in the AI's earnings;

(iii) the AI receives an immediate regulatory capital benefit in the form of a lower risk weight on the exposure; and

(iv) the premiums or fees and other direct or indirect costs paid for the credit protection, combined with other terms and conditions, call into question the degree of credit risk mitigation or credit risk transfer effected by the protection (for example, where the cost of protection is equal to the recorded value of the exposure or where the terms and conditions of the credit protection ensure that the premiums paid throughout the life of the protection will equal the amount of the realized losses in the exposure);

(c) investor, in relation to a securitization transaction, means any person, other than the originator in the transaction, who assumes risk exposure to the transaction;

(d) implicit support, in relation to a securitization transaction, means any direct or indirect support which the originator provides (or has provided) to investors in the transaction in excess of its predetermined contractual obligations;

(e) originator, in relation to a securitization transaction, means a person who—

(i) directly or indirectly originates the underlying exposures in the transaction; or

(ii) serves as a sponsor of the transaction;

(f) reference asset, in relation to a credit derivative contract, means the asset on whose credit status the contract is based;

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

(g) reference entity, in relation to a credit derivative contract, means the entity on whose credit status the contract is based;

(h) securitization exposure, in relation to an AI, means the AI's risk exposure to a securitization transaction;

(i) securitization transaction means a transaction by which the credit risk associated with a pool of underlying exposures is transferred to investors in the transaction through—

(i) the selling of the underlying exposures to a special purpose entity and where the payments to investors in the transaction are serviced by the cash flows from, or depend on the performance of, the underlying exposures; or

(ii) obtaining credit protection for the underlying exposures (which may or may not be held by the originator) and where the payments to investors in the transaction depend on the performance of the underlying exposures; and

(j) underlying exposures—

(i) in relation to a securitization transaction, means one or more than one on-balance sheet or off- balance sheet exposure in respect of which credit risk is transferred to one or more than one person by the originator in the transaction; or

(ii) in relation to a credit derivative contract, means one or more than one reference asset or reference entity specified in the contract.

1.2 Background

1.2.1 While recognizing their benefits as a useful means for credit risk and balance sheet management, credit risk transfer ("CRT") activities and a variety of weaknesses associated with their use and corresponding risk management, have been identified among the sources contributing to the global financial crisis which began in 2007. Responding to calls for greater regulation and transparency in respect of CRT

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

activities, international standard setters and regulators in major economies have put forward a number of proposals to refine the regulatory regime and strengthen banks' risk management systems and practices.

1.2.2 The HKMA recognizes that the exposures of the Hong Kong banking sector to CRT activities have in general been comparatively insignificant compared to some other financial centres. Nevertheless, the HKMA considers it prudent and opportune to provide further guidance to the banking sector for the purpose of promoting sound risk management principles and practices for CRT activities and bringing its supervisory guidance into line with the latest international standards. In developing this module account has been taken of standards and best practices proposed by international standard setters, including the Financial Stability Board, the Basel Committee on Banking Supervision (“BCBS”) and the International Organization of Securities Commissions (“IOSCO”), in light of the lessons learned from the global financial crisis.

1.2.3 The HKMA will continue to monitor international regulatory developments and the extent and nature of AIs’ participation in CRT activities, and will consider issuing additional supervisory guidance as and when necessary.

1.3 Application

1.3.1 It is not the intention of the HKMA to require AIs to develop a CRT risk management framework which is separate from that used for other credit, trading and derivative activities. AIs, however, should review regularly the nature, complexity and risk characteristics of their CRT activities to ensure that the risk management framework they use for such CRT activities is capable of addressing the associated risks. The risk management practices and controls for CRT activities should be integrated into AIs’ overall corporate governance frameworks and risk management and control systems.

1.3.2 An AI’s implementation of the governance, risk management and control processes for CRT activities set out in this module should be commensurate with the nature, significance, complexity and risk profile of the AI’s CRT activities as well as the systemic importance of its operations to the Hong Kong

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

financial system. This means that the HKMA will assess the extent of AIs’ adoption of the processes set out in this module on a proportionate basis and will allow some flexibility for individual AIs in adopting certain aspects of the guidance.

1.3.3 Locally incorporated AIs should apply the guidance in this module both on a legal entity basis¹ and on a group basis². This module may also apply to the locally incorporated holding company of an AI where (i) the AI is part of a wider group; and (ii) the majority shareholder controller of the AI is neither a regulated financial institution nor a subsidiary of such an institution. See the paragraphs on approval of controllers in Chapter 4 of the Guide to Authorization for details.

1.3.4 Those AIs which are branches or subsidiaries of foreign banks will normally be expected to apply the guidance to their Hong Kong operations. The HKMA will take into account any group-wide risk management policies, systems and controls for CRT activities that are applicable to the AIs (and whether they have been tailored to suit local circumstances) when considering the extent of the consistency of these AIs’ risk management frameworks for CRT activities with this module.

1.3.5 This module should be read in conjunction with other relevant guidelines issued by the HKMA on capital adequacy, liquidity ratios, leverage ratio, large exposures, disclosure, valuation of financial instruments, corporate governance, remuneration systems, risk management controls (credit, market, liquidity, operational, reputation risks, etc.), stress-testing, and use of models.

1.4 Nature of risks associated with CRT activities

1.4.1 Banks participate in CRT activities for various purposes including portfolio diversification, position taking, trading or arbitrage, risk mitigation (including hedging), funding assets held, and generation of revenues from packaging and distributing CRT products to or for customers. CRT activities can be highly complex and involve various types and forms of

1 This refers to the head office and branches (local and overseas) of an AI.

2 This refers to a banking group which constitutes a locally incorporated AI and its downstream subsidiaries.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

risk that require thorough understanding and management by AIs. The following paragraphs provide an overview of some of the major risks.

Credit risk

1.4.2 The most fundamental risk associated with CRT products is obviously credit risk. In credit derivative contracts, there are typically two sources of credit risk: counterparty credit risk (“CCR”) and the credit risk associated with the reference entity/asset. The interaction between these two sources of credit risk also gives rise to potential wrong-way risk, i.e. the risk that the counterparty’s default risk is positively correlated with that of the reference entity/asset. In securitization, the credit risk hinges mainly on the performance of the underlying exposures.

1.4.3 The issue of default correlation exists not only in the context of wrong-way risk, but also across different underlying exposures in a portfolio of CRT products, or in a CRT product (e.g. first-to-default CDS and collateralized debt obligations (“CDO”)) the payoff of which is linked to the credit performance of a pool of underlying exposures. Assessment of default correlation is critical to evaluating the risk of CRT products. Banks which use CRT products for hedging purposes are also exposed to the risk of imperfect correlation between changes in the value of the hedging instrument and that of the exposure being hedged (viz., a form of “basis risk”).

Market risk

1.4.4 Banks with trading portfolios of CRT products are also exposed to credit migration risk, i.e. the risk of direct losses due to changes in the internal/external rating of a CRT product or its reference entity / asset and the risk of indirect losses arising from credit migration events.

1.4.5 Although both CRT and non-CRT products are subject to similar market risk management considerations in many aspects, the market risk management of CRT activities is arguably more vulnerable to model risk because both the pricing and valuation of CRT products are strongly driven by models, in particular for illiquid or complex products like CDOs. Therefore, errors or inappropriate assumptions in

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

developing the models may pose a risk to sound risk management.

Liquidity risk

1.4.6 Liquidity risk associated with CRT activities can be viewed from two different perspectives. Firstly, originators of securitization transactions may be called upon unexpectedly to provide funding in relation to such transactions, potentially at a time when they are already under stress. This type of liquidity risk could arise from contractual obligations such as liquidity facilities or early amortization built into the securitization structure, or from implicit support stemming from reputational considerations. In the case of credit derivative contracts, additional liquidity needs may be due to margin calls or requests for additional collateral, for instance, as a result of a rating downgrade of the reference entities.

Secondly, the secondary market liquidity of CRT products can dry up very quickly when certain events occur (e.g. a sudden failure of a large specialty investor or a surprise cluster of corporate defaults). For certain complex CRT products, secondary market liquidity is somewhat limited, making it hard or costly for banks to close or offset positions before the products expire.

Other risks

1.4.7 Other risks that could become unexpectedly damaging in times of market stress or financial crisis include reputation risk and legal risk. For example, the default of a special purpose entity (“SPE”) sponsored by a bank, or any misrepresentation to customers of the level of risk associated with a CRT product, could result in damage to a bank’s reputation. Sources of legal risk include the (generally) complex and lengthy documentation associated with CRT transactions, and issues arising from key parties to transactions (e.g. investors, trustee, swap providers) residing in different jurisdictions (resulting in contractual clauses being interpreted differently).

1.4.8 In addition, structural issues, for example, triggers and payment waterfalls in securitization transactions, may also carry significant risk implications for banks. (See paragraphs 2.4.13 and 2.4.14 for more information.)

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

2. Key elements of effective management of CRT activities

2.1 General

2.1.1 AIs should carefully consider and identify the balance of risk and reward before entering into CRT transactions. They should not engage in CRT activities unless they have the expertise and resources to understand and properly manage the credit and other risks³ associated with these activities, and are capable of valuing their positions in CRT products in a prudent, consistent and reliable manner. It is also important for AIs to assess, before engaging in CRT activities, the availability of the information necessary for their ongoing monitoring of the risks associated with such activities.

2.1.2 AIs should be able to identify, aggregate and analyse risks associated with CRT activities on a firm-wide basis. Certain complex CRT products may not easily fit into normal risk management processes and therefore may require special provision and attention within AIs’ risk management frameworks.

2.1.3 An AI’s risk management framework for CRT activities should (i) be approved by its Board of Directors (or by a designated committee of the Board); (ii) be commensurate with the complexity, level of risk and volume of the AI’s CRT activities;

and (iii) cover all the AI’s CRT activities and the associated risks, including concentration risk, reputation risk and legal risk.

2.1.4 In the case of a locally incorporated AI, the HKMA will expect all risks arising from CRT activities, particularly those that are not fully captured under the Banking (Capital) Rules (“BCR”), to be addressed in the AI’s capital adequacy assessment process (“CAAP”). See CA-G-5 “Supervisory Review Process” for the supervisory standards on CAAP.

3 These include factors which increase transaction complexity, such as structural features and the roles of parties involved in the transaction.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

2.2 Corporate governance

2.2.1 Effective risk management of CRT activities requires a sound corporate governance and remuneration system. General requirements and practices in this regard are set out in CG-1

“Corporate Governance of Locally Incorporated Authorized Institutions”, CG-5 “Guideline on a Sound Remuneration System”, IC-1 “General Risk Management Controls”, CR-G-1

“General Principles of Credit Risk Management” and CA-S-10

“Financial Instrument Fair Value Practices”. The paragraphs below focus on corporate governance issues that are regarded as particularly important to CRT activities.

2.2.2 The Board of an AI should provide adequate oversight of senior management in respect of the AI’s CRT activities and ensure that the policies and responsibilities governing such CRT activities (including the purposes for which these activities may be conducted) are clearly defined before the AI participates in any CRT activities, and that the policies are subject to review as business and market circumstances change, in particular when the complexity of CRT activities engaged in by the AI increases. Moreover, the Board should ensure adequate resources for developing in-house expertise to facilitate comprehensive understanding and effective risk management of CRT activities.

2.2.3 The Board and senior management of an AI should ensure that CRT activities are included in the firm-wide risk management process. The risks of CRT activities should not be viewed in isolation (e.g. within an organizational silo or a particular risk category) but should be considered from the perspective of interaction with different risk types and different activities undertaken by the AI.

2.2.4 Under the direction of the Board, senior management should approve procedures and controls to implement the Board’s policies governing CRT activities. Moreover, they should review the AI’s CRT activities regularly to ensure that the risks taken are consistent with the risk appetite approved by the Board. All material and fundamental changes to a business model involving CRT activities should be approved by the senior management. The Board’s endorsement is warranted if the changes could have a potential negative impact on the risk profile of the AI.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

2.2.5 Senior management should be sufficiently knowledgeable about any CRT activities in which the AI engages, in order to identify and raise pertinent questions about long term risks posed to the AI by the CRT activities concerned and to participate meaningfully in discussions on CRT related risks and the technical aspects of CRT activities. This would include an adequate understanding of the key assumptions underlying the business models, valuation methodologies and risk models applied to the AI’s CRT activities. Senior management should evaluate the potential impact on the AI if any of these assumptions fail.

2.2.6 The senior management of originating AIs and AIs which use SPEs in CRT activities should be attentive to regulatory and accounting requirements on significant risk transfer, de- recognition and consolidation.

2.2.7 AIs which are both originators and investors should put in place proper systems of control to avoid conflicts of interest between these two roles and any potential distortion of incentives regarding investment strategy. For example, the structuring team and trading team should not be under the same reporting line, and investment advice provided by each team should be independent and free of the influence of the other team.

2.2.8 The CRT activities of the Hong Kong branches of foreign banks should be operated within policies and procedures approved by their head office and consistent with those approved by the Board for the bank as a whole. Regular reports on risk exposures and profitability should be submitted to their head office.

2.3 Policies, procedures and limits

General requirements

2.3.1 An AI’s written policies and procedures should provide for adequate and timely identification, measurement, monitoring, control and mitigation of the risks posed by its CRT activities at both business-line and firm-wide levels. In the case of originating AIs, these policies and procedures should also address significant risk transfer and other risks such as warehousing risk, funding and liquidity risks arising from

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

events such as early amortization, reputation risk and implicit support.

2.3.2 The policies and procedures should cover the following aspects—

(a) the governance and control structure, which defines the roles, responsibilities and lines of authority of the Board, Board committees, other firm-wide committees, senior management, business units, and independent support and control functions involved in the management and risk management of CRT activities and their respective reporting relationships;

(b) the categories (including definitions) of approved CRT products and activities (e.g. trading (including position- taking and arbitrage), risk mitigation (such as hedging) and investment). The nature of the products and activities should be carefully defined to ensure, for example, that activities described as arbitrage do not in practice involve the taking of outright positions;

(c) the AI's strategy, appetite and limits for different types of CRT products and activities, with a description of how the CRT products and activities align with the AI’s overall risk management strategies and internal capital allocation;

(d) the relevant levels of authority for engaging in CRT activities;

(e) the approach and procedures for identifying, measuring, monitoring, reviewing, reporting and managing the associated risks, which should, inter alia, include the following—

(i) detailed requirements for the evaluation and approval of new CRT products or activities (see paragraphs 2.3.11 to 2.3.12 below);

(ii) credit policy for CRT activities, including credit underwriting standards, controls and information requirements (e.g. type and nature of information required for credit assessment and review) (see

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

subsection 2.4 below).

(iii) methodologies, models and standards used for measuring and valuing risk exposures to CRT activities (see subsection 2.5 below);

(iv) limit structures and monitoring of limit usage (including frequency of limit review, method of approval, and authority required to change limits) (see paragraphs 2.3.6 to 2.3.10 below);

(v) controls on exceptions to policies, procedures and limits (including procedures to escalate and address breaches of limits);

(vi) management reporting system (see subsection 2.7 below); and

(vii) stress-testing procedures (see subsection 2.8 below);

(f) the use of external credit ratings in a manner that does not encourage mechanistic undue reliance on such ratings and is consistent with sound risk management practices;

(g) the criteria for classifying exposures arising from CRT activities into the trading or the banking book;

(h) (in the case of locally incorporated originating AIs which intend to seek, or have obtained, the MA’s prior consent under BCR §229(1)) the systems and controls to ensure that—

(i) any possible reduction in capital requirements in relation to the underlying exposures is justified by a commensurate credit risk transfer to third parties;

and

(ii) all the applicable requirements set out in BCR Schedule 9 or 10, as the case may be, are complied with on an ongoing basis, and the methods and procedures used to assess credit risk transfer are appropriate and have taken into account stress scenarios;

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

(i) standards or guidelines to ensure that transaction documents and confirmations associated with CRT transactions are executed promptly; and

(j) internal controls, accounting guidelines, tax treatment and independent audit to ensure effective and efficient operation, reliable financial information, and compliance with relevant laws, regulations, accounting standards and internal policies.

2.3.3 The HKMA would regard it as good practice for an AI to take the Criteria for identifying simple, transparent and comparable securitisations (“STC criteria”) issued jointly by the BCBS and IOSCO in July 2015 into account in the AI’s policies and procedures for securitization activities and adopt the criteria wherever it is feasible to do so. In general, it is easier for investors to understand and assess the risks of a securitization transaction that has a simple structure and risk characteristics. Making securitization transactions more transparent and comparable should also contribute to the availability of more useful information to investors, enabling them to more readily assess a transaction’s risks and returns, and compare different securitization products. An investing AI may therefore make use of the STC criteria in its due diligence and risk evaluation process to consider, among other things, whether a securitization transaction possesses a level of simplicity, transparency and comparability that could enable the AI to understand, and evaluate on an ongoing basis, the risks and performance of the transaction. In the case of an originating AI, the STC criteria should assist the AI in developing and structuring new securitization transactions that could appeal to less sophisticated investors and contribute to the development of sustainable securitization markets.

2.3.4 All staff members engaged in CRT activities or the review of such activities should be fully conversant with the relevant policies, procedures and limits.

2.3.5 The policies, procedures and limits (including the underlying assumptions) should be regularly reviewed and updated to reflect changes in the AI’s risk strategy and risk appetite, latest regulatory and accounting requirements, and market developments.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

Limits

2.3.6 AIs should identify the various types of risk associated with their CRT activities and establish a clear and comprehensive set of limits to control these risks.

2.3.7 The limits should cover both banking book and trading book exposures (whether on- or off-balance sheet) and, where applicable, contingent commitments and potential future exposures, that could arise from CRT activities. The limits should be designed in such a way as to reflect the characteristics of an AI’s CRT activities, including the nature, scale and complexity of the CRT activities and the types of risk to which the AI is exposed.

2.3.8 Given the complexity of CRT products, AIs should be aware of the limitations of commonly used limit structures in capturing risk exposures to these products. AIs should therefore consider using more than one type of risk measure as the basis of their limits. Limits set by AIs should take into account their risk appetite and stress-testing results.

2.3.9 The limits should also be integrated, to the fullest extent possible, with the firm-wide limits on the same risks as they arise in the course of an AI’s other activities. When risks are not quantifiable, an AI should nevertheless demonstrate an awareness of the potential impact.

2.3.10 Examples of limits include—

(a) Position limits, credit risk limits and market risk limits, which may be computed in various ways (e.g. based on notional or volume, Value-at-Risk (“VaR”), risk sensitivities to risk factors such as interest rates or credit spreads, etc.) depending on the role played by the AI (e.g. originator, swap provider, credit protection provider, etc.) and the volume and complexity of the CRT activities involved;

(b) Concentration limits, including limits on exposures with similar risk characteristics and on exposures to a particular reference entity or obligor. Limits can be set by product types, geographical regions, economic/industry sectors, types of underlying

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

exposures or by other relevant risk drivers. AIs should also consider the challenges that exist in pricing illiquid, complex instruments when setting portfolio concentration risk limits for CRT products (see also subsection 3.1 below);

(c) CCR limits, including pre-settlement limits and settlement limits. See also CR-G-13 “Counterparty Credit Risk Management”;

(d) Liquidity risk limits, including limits on the size and nature of liquidity facilities provided to securitization transactions⁴; and

(e) Limits for volatile or illiquid markets or instruments.

New product evaluation

2.3.11 An AI’s new product evaluation process should cover new CRT products and activities. In addition to the general requirements set out in subsection 3.3 of IC-1, the process should—

(a) take into consideration the performance of a new CRT product or activity under stress scenarios (including both firm-specific and market-wide);

(b) include reputation risk as a fundamental component of the risk assessment; and

(c) allow the attachment, where appropriate, of conditions (e.g. limits, performance requirements, and requirements that key assumptions must remain valid) to the approval given to a new CRT product or activity.

2.3.12 The post-implementation evaluation of a new CRT product or activity should assess the extent to which the product/activity has performed as expected and whether the risk characteristics of the product/activity have been consistent with expectations. Furthermore, AIs should review at the earliest opportunity any significant (potentially “outsized”)

4 AIs providing liquidity facilities to asset-backed commercial paper (“ABCP”) programmes may also set limits on the amount of commercial paper maturing during any one time period (e.g. overnight, 1 week, 2 weeks, 1 month, etc.).

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

profitability and market share gains to ensure that they do not reflect a deficiency in the original pricing or risk assessment of the product/activity.

2.4 Credit assessment and review

General principles

2.4.1 When investing in CRT products, AIs should conduct appropriate analysis of the underlying risks and should not rely excessively or solely on the external credit ratings assigned to the products / counterparties and/or the fact that the product is marketed or arranged by a well-known financial institution. The analysis should be conducted not only at acquisition but also on an ongoing basis, and should be commensurate with the complexity of the CRT products and the materiality of an AI’s holdings in them.

2.4.2 AIs should make sure that they understand the structure and other important variables which determine (both directly and indirectly) the value of CRT products in both normal and stress scenarios. Moreover, the reasons for differences in yields of CRT products irrespective of external credit ratings and the relevancy of historical data on underlying exposures in the current environment should be taken into consideration.

AIs which undertake CRT transactions on both the asset and the liability sides of the balance sheet should have the ability to assess the relevant credit risk on a comparable basis regardless of how the transactions appear on the balance sheet.

2.4.3 For securitization exposures, AIs should, on an ongoing basis and for each of their securitization exposures, have a comprehensive understanding of the risk characteristics of both the securitization exposure (whether on- or off-balance sheet) and the underlying exposures of the securitization exposure. The originating AI of a securitization transaction should assess its exposures to the transaction, including credit enhancement, liquidity facilities, derivative transactions and retained tranches, on an arm’s length basis in accordance with its normal credit/risk assessment and approval processes.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

2.4.4 When originating or acquiring assets that are intended to be securitized in the future, an AI should apply to the assets a due diligence process, credit underwriting criteria and standards of analysis that are as stringent as those for assets originated or acquired by the AI for its own retention. The credit analysis should include a reasonable assessment (supported with sufficient documentation) of a borrower’s repayment ability.

2.4.5 AIs which undertake CRT activities for the purposes of risk mitigation should fully understand the risks to be mitigated, the potential effects of the mitigation and whether or not or the extent to which the mitigation is effective.

2.4.6 See also CR-G-1, CR-G-2 “Credit Approval, Review and Records” and CR-G-3 “Credit Administration, Measurement and Monitoring”.

Use of external credit ratings

2.4.7 AIs may use external credit ratings as a reference tool in their investment policies or risk management processes (e.g. risk measurement, valuation and reporting). The ratings, however, should not replace appropriate risk analysis and management on the part of AIs.

2.4.8 When using external credit ratings for CRT products, AIs are expected to—

(a) understand the nature and scope of the ratings (particularly those assigned to CDOs) and how these differ from those of the external credit ratings assigned to other types of debt obligation;

(b) understand the major differences in the rating methodologies for CRT products used by different credit rating agencies;

(c) seek to understand the extent to which the ratings are conveying information on probability of default or expected loss as opposed to information on the potential for loss in unexpected circumstances; and

(d) understand the methodology, parameters and basis on which the credit opinion of a credit rating agency is

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

based and assess whether major assumptions made by the credit rating agency are reasonable.

2.4.9 Locally incorporated AIs using external credit ratings for capital adequacy purposes should, as part of their CAAP, regularly review whether the risk-weights assigned to their CRT exposures are appropriate for the inherent risk of the exposures. Where an AI determines that the inherent risk is significantly higher than that implied by the assigned risk- weight, the AI should reflect this higher degree of credit risk in the evaluation of its overall capital adequacy.

Credit risk of underlying exposures in securitization transactions 2.4.10 AIs should monitor, on an ongoing basis and in a timely

manner, performance information on the underlying exposures of their securitization exposures. Such information would typically include, where relevant,

(a) exposure type;

(b) percentage of underlying exposures (e.g. loans) that are more than 30, 60 and 90 days past due;

(c) default rates, prepayment rates and underlying exposures in foreclosure;

(d) collateral type and occupancy (in the case of properties);

(e) frequency distribution of credit scores or other measures of creditworthiness in relation to the underlying exposures;

(f) frequency distribution of loan-to-value ratios; and (g) industry and geographical diversification.

2.4.11 If the underlying exposures are themselves securitization exposures (referred to in this paragraph as “underlying securitization exposures”), AIs should have the information set out in paragraph 2.4.10 not only on the underlying securitization exposures, such as the issuer name and credit quality, but also on the characteristics and performance of the underlying exposures of the underlying securitization exposures.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

2.4.12 When an AI manages a large portfolio of CRT products (e.g.

portfolios of CDS or CDO positions), it should be aware of the correlation among individual instruments, the implications of simultaneous defaults of multiple underlying exposures, and the mechanics of tranche investments. AIs should note that the value and returns of CDO tranches (in particular the first- loss pieces), even when the underlying exposures of the tranches are well-diversified, may exhibit high volatility.

Products like CDOs of CDOs are even more complex, as the extent of correlation needs to be assessed not just among individual products, but also among the underlying CDO tranches.

Analysis of transaction structure

2.4.13 AIs should have a thorough understanding of all structural features of a CRT product that would materially impact on the performance of the AIs’ exposures to the product, such as contractual payment waterfall and waterfall-related triggers, credit enhancements, liquidity enhancements, market value triggers, and deal-specific definitions of default.

2.4.14 AIs investing in CRT products with dynamic structures⁵ should evaluate carefully the track record of the manager appointed to manage the pools of underlying exposures. It is also important to consider the covenants governing the actions of, and the nature of discretion given to, the manager in order to evaluate the potential for conflict of interest and the possible impact of the manager’s actions on the interests of the AIs as investors. Key issues in this regard include triggers that call for or prevent certain actions, provisions governing the diversion of cash flows to various tranches, and the ability/right of the manager to substitute underlying exposures.

Credit risk of reference entities / reference assets

2.4.15 AIs providing credit protection (whether through a funded CRT instrument (e.g. credit-linked note) or an unfunded CRT instrument (e.g. CDS) should perform sufficient credit

5 “Dynamic structure” refers to a transaction structure under which the composition of the underlying exposures of the transaction is actively managed and therefore may change, through purchase and sale of individual underlying exposures, over time during the life of the transaction.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

analysis of the reference entity or reference asset underlying the CRT instrument concerned.

2.4.16 If the reference entity or reference asset of a CRT instrument used for hedging an exposure is not identical to the obligor of, or the asset giving rise to, that exposure, an AI should evaluate the extent to which the reference entity or reference asset is indeed an appropriate proxy for the exposure which the AI intends to hedge.

2.4.17 AIs holding a portfolio of long and short positions in CRT instruments should also take into account, in their risk assessment, the risk that payments may have to be made on one side of the positions without being entitled to receive the corresponding payments from the other side if the definition of credit events on the long side is different from that on the short side.

Counterparty credit risk

2.4.18 All counterparties in CRT activities, regardless of the extent of collateral support, should be subject to a sound due diligence process. In conducting the due diligence process, AIs should consider not only the CCR exposures arising out of the CRT products but also all other credit exposures to the same counterparty. The analysis should also evaluate, where possible, whether the counterparty is exposed to significant concentration risk arising from credit protection provided by it.

AIs may take into consideration legally enforceable netting arrangements in their analyses. CCR exposures should be monitored against approved credit limits on a frequent basis (in most cases, daily).

2.4.19 AIs should include in their risk management processes an assessment of wrong-way risk (including the default correlation between a CRT instrument and the exposure hedged by the instrument). Decisions to hedge exposures with counterparties (e.g. monoline insurers) with wrong-way risk should be reviewed and approved by appropriate levels of senior management.

2.4.20 See also CR-G-13 for more guidance.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

Effectiveness of credit risk transfer mechanism

2.4.21 AIs should recognize that CRT transactions, as a tool for hedging / mitigating credit risk, do not remove all credit risk from the exposures being hedged. They should evaluate, at the inception as well as on a ongoing basis until maturity of the transactions, the degree of risk transference (e.g. by reference to the terms of the transaction such as credit events covered, materiality threshold), and the associated impact on capital adequacy in the case of locally incorporated AIs, so as to avoid overestimating the credit protection obtained or the credit risk transferred. The evaluation should consider, among other things, factors listed in paragraph G3.4 of Annex G of CA-G-5 related to high cost credit protection. The economic substance of CRT transactions that may constitute high cost credit protection, or that have unusually high-cost or innovative features should be documented.

2.4.22 In the case of securitization transactions for which the originating AI concerned intends to seek, or has obtained, the MA’s prior consent under BCR §229, the evaluation of the degree of risk transference should also cover—

(a) an assessment of the risks involved in the securitization transaction concerned, including the credit risk of the underlying exposures and the tranches of the securitization transaction (including both tranches transferred and retained);

(b) the factors mentioned in Q&A #1 under the subject

“Significant credit risk transfer” of the Q&As issued by the HKMA in December 2014 and any other factors that affect the substance of credit risk transfer (e.g. currency or maturity mismatch, any connection between the originating AI and the third parties to which the credit risk is transferred, the thickness of the mezzanine and junior tranches relative to the credit risk profile of the underlying exposures, etc.); and

(c) an assessment of whether the possible reduction in capital requirements for the underlying exposures is in line with the credit risk transfer achieved.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

2.5 Risk measurement and valuation

2.5.1 Aggregation of risks

Firm-wide risk aggregation

(a) At the firm-wide level, AIs should assess and manage the risks of CRT activities (both for trading and non- trading purposes) together with the risks of other activities undertaken by the AIs, taking into account the interrelationships among these risks in their risk management processes (including stress-testing), on an integrated basis to ensure that sufficient consideration is given to risk correlation and concentration.

(b) AIs should ensure that their measures of credit exposure to individual obligors are as comprehensive as possible, especially when conducting analyses of concentration risk and CCR. Both direct exposures (e.g.

loans, credit derivative contracts and OTC derivative transactions) and indirect exposures (e.g. exposures to guarantors such as monoline insurers and exposures arising from CRT transactions) should be covered.

Special purpose entities

(c) AIs using SPEs in their CRT activities should have the capability to aggregate, assess and report the risks associated with all their SPEs (whether on- or off- balance sheet) in conjunction with all other firm-wide risks. Since an AI may perform multiple roles (e.g.

originator, servicer, swap provider, etc.) in a CRT transaction, the AI should ensure that the exposures to the SPE arising from each of these roles are effectively aggregated, monitored, and reported to the senior management and the Board (or its designated risk management committee).

(d) An AI should assess risks associated with its SPE(s) (whether on- or off-balance sheet) carefully and include the SPE(s) in its liquidity stress-testing. The assessment should consider how the SPE(s) and associated risk issues (e.g. the effects of covenants and triggers) may affect the financial, liquidity, and capital

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

positions of the AI. Senior management should ensure that the Board is aware of the risks associated with the SPE(s) and understands their implications for the overall risk appetite.

(e) It is usually difficult for an AI to assess in advance the probability of it providing support (especially as regards

“implicit” support) to its SPE(s). AIs, however, should aggregate the activities and risks of an SPE with their own activities and risks for risk management purposes once there is a likelihood or evidence of such support being required (See also subsection 3.4 for other risk management considerations in relation to SPEs).

2.5.2 Risk measures

(a) Risk measurement methodologies that are applicable to CRT activities may include internal credit risk rating systems (typically for measuring default risk and loss severity), VaR, stress loss and other sensitivity measures (e.g. sensitivity of present value to a basis point movement in credit spreads), and key operational risk indicators or scorecards. Risks that are not well reflected by standard risk measures should be subject to additional controls, which may include pre-approval of transactions and specific risk limits.

(b) AIs should avoid over-reliance on a single risk measurement methodology or specific model. They should seek to use a wide range of risk measures (including notional amounts of gross and net positions or profit and loss) to discuss and challenge views on risks in a disciplined manner. When there is uncertainty about the accuracy of assumptions underlying risk measures (e.g. when markets are unduly volatile), it could be useful to revisit simple risk measures such as notional limits to highlight potential concentration of risks.

The main advantage of these simple measures is that they do not depend on assumptions and give a simpler perspective on the potential scale of the risks.

(c) AIs which are active in trading CRT products should assess the extent to which their trading/hedging strategies in CRT products may leave them exposed to

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

risks that are not routinely captured in their risk measurement system (e.g. jump-to-default risk or other issuer-specific risks and basis risk). They should monitor the extent of potential build-up of such risks, incorporate the results of such monitoring into their risk management approach, and regularly evaluate the need to incorporate such risks into their routine risk measurement calculations.

(d) AIs should understand the underlying assumptions and constraints of the risk measures chosen. They should also satisfy themselves as to the adequacy and appropriateness of the key assumptions, data sources and procedures used to measure risks. Limitations of risk measures should be addressed by qualitative means, including expert judgment.

Key considerations in VaR

(e) AIs engaged in trading of CRT products may use the same system to manage the market risk of both CRT and non-CRT exposures. AIs adopting such an approach should note that market risk methodologies, such as VaR, are not as fully developed for credit risk as they are for equity, interest rate and currency risks. AIs are therefore expected to have the ability to recognize the particular risks associated with credit events (e.g.

non-normal loss distribution curves) and put in place procedures to address them.

(f) The following paragraphs highlight certain issues which should be taken into consideration when applying VaR to CRT exposures—

(i) AIs should note that issues such as lack of relevant historical data, inadequate volatility estimates, difficulties in marking-to-market complex or illiquid CRT products, inadequate estimates for basis risk and correlation risk may undermine the accuracy and usefulness of VaR in measuring CRT exposures. These issues should be explicitly addressed by AIs when adapting their VaR methodologies to CRT exposures.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

(ii) If securitization exposures or nth-to-default credit derivative contracts are included in the VaR measure, the VaR model must capture nonlinearities inherent in certain CRT exposures (e.g. mortgage-backed securities, tranched exposures or nth-to-default credit derivative contracts), correlation risk and basis risk (e.g.

between CDSs and bonds).

(iii) AIs should be able to present the results of the VaR model (e.g. the high, low and average value of VaR at a specified confidence level) with the risks of CRT products separated from the risks of other products such as interest-rate and foreign exchange products.

(iv) When an AI’s position in certain CRT products has become illiquid, or the valuation of the position is subject to considerable uncertainty, the AI should consider whether such position should be excluded from the VaR measure and related limits, and subject to alternative measures and controls which are less dependent on liquidity and valuation.

2.5.3 Valuation

(a) Certain characteristics of CRT products, especially those of complex products like CDOs, make valuation of these products a highly challenging task. These characteristics include a lack of an active and liquid secondary market, insufficient transparency in the over- the-counter market, complex and unique waterfalls of cash flows, and complex interactions between valuation and underlying risk factors. AIs having exposures to complex or illiquid CRT products should apply appropriate expert judgment and discipline in valuing these products, making use of all available modelling techniques and external and internal inputs such as consensus-pricing services while recognizing and managing their limitations. In particular, AIs should consider how, under stressed conditions with little or no market liquidity, an informed judgement on the value of their CRT positions will be made.

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

(b) AIs should avoid excessive reliance on indicative dealer quotes. It should be noted that dealer quotes may not reflect prices at which transactions could occur, especially during periods of low liquidity. Similarly, the transaction prices of small, isolated or dated trades may be misleading in many circumstances. Hence, AIs should conduct, at least for material positions, their own analysis to check the valuations made on such bases and make valuation adjustments where appropriate.

(c) For assets in a warehouse or pipeline which are likely to be securitized and are measured at fair value based on their intended use rather than their current quality, there should be additional internal monitoring of the valuation at which they could be disposed of in their current status if securitization is not carried out.

(d) AIs should have procedures in place to ensure that the values used to measure and manage risks in CRT positions are consistently reflected in the accounting process, especially for positions which are reported at fair value.

(e) Also see CA-S-10 for other relevant supervisory requirements.

2.5.4 Credit model risk

(a) AIs which rely on models to assess the valuation and risks of CRT products should properly understand the assumptions and limitations of those models, and manage their usage appropriately.

(b) One of the key assumptions in credit risk models for pricing CRT products is correlation of defaults among the exposures in a pool of underlying exposures. The use of these models for valuation and risk management of CRT products should be accompanied by a thorough understanding of the sources and roles of correlation assumptions in these models. Moreover, there should be regular assessments of the impact of changes in correlation assumptions on model outputs (e.g. via stress-testing).

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

(c) The accuracy and reliability of a model should be subject to regular validation (e.g. back-testing and review of related fundamental analyses) performed by independent parties, including independent audits conducted by capable internal or external auditors. The model should also be subject to periodic updates to reflect changing market conditions. AIs should regularly compare model-based valuations with available market proxies and/or valuations of similar instruments produced by other institutions.

(d) Locally incorporated AIs using internal models for capital adequacy purposes must meet the applicable requirements set out in the BCR (including Schedules 2 and 3 to the BCR), the requirements set out in CA-G-3

“Use of Internal Models Approach to Calculate Market Risk”, CA-G-4 “Validating Risk Rating Systems under the IRB Approaches” or Schedule 2A to the BCR, as the case may be. In the case of AIs incorporated outside Hong Kong, all or part of their models may be centrally developed and monitored on a group basis. The HKMA will generally rely on the home supervisors of the AIs to ensure that models used by the AIs are robust and subject to proper validation procedures unless the HKMA has concern over the scope and approach of the home supervisors’ supervision in this regard.

2.6 Risk monitoring and control

2.6.1 CRT activities should be subject to ongoing monitoring and control performed by a control function which is independent of the business or risk-taking units and resourced in a manner commensurate with the complexity and volume of the CRT activities of the AIs. As mentioned in paragraph 2.1.2, the control function should be able to monitor CRT exposures on a firm-wide basis as well as on aggregate bases (i.e.

aggregated, say based on risk categories, with other non- CRT exposures).

2.6.2 The control function typically performs the following functions –

(a) Independent risk assessment, approval (within delegated authorities) and regular review of CRT

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

activities. In the case of securitization exposures, the review should cover performance of underlying exposures, compliance with covenants and the status of various trigger measurements/ratios (e.g. early amortization trigger, excess spread level and asset quality test);

(b) Design and implementation of risk management systems for CRT activities, including initial and ongoing valuation, design of scenarios for stress-testing and sensitivity analysis, regular review/validation of valuation methodologies and models (where applicable). In the case of AIs incorporated outside Hong Kong, these could be done at head office level where appropriate;

(c) Daily monitoring of CRT activities and exposures, usage of and compliance with established limits, and identification and resolution of exceptions;

(d) Measurement and valuation of CRT exposures;

(e) Design and preparation of management reports for monitoring such aspects as composition of CRT portfolios, trend of aggregate CRT exposures relative to defined risk appetite, risk/return information and performance of underlying exposures;

(f) Conducting of stress tests and sensitivity analyses;

(g) Regular review of effectiveness of hedges (e.g. changes in the correlation of default risk between the protection seller and the exposure hedged, basis risk); and

(h) Collateral management (e.g. monitoring of margin level of derivative position).

2.6.3 In particular, AIs should review regularly (and not, in any event, less than once a year) all material potential exposures to securitization transactions (including off-balance-sheet SPEs), broken down by

(a) product;

(b) underlying exposures;

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

(c) role played by the AIs (e.g. originator, servicer, distributor, trustee); and

(d) exposures held by the AIs as investors.

The nature of the exposures should be reflected in the review accurately.

Monitoring specific to originating AIs

2.6.4 An originating AI of a securitization transaction should monitor, on an ongoing basis over the life of the transaction, the quality and performance of the underlying exposures of the transaction, taking into consideration any possible impacts on the risk profile of the AI. The monitoring process should impose duties on relevant business units and the risk management function to identify early-warning signals and ensure prompt management attention to such warnings.

Although the ownership rights and control of the underlying exposures may have been sold or the credit risk of the underlying exposures may have been significantly transferred, such monitoring is necessary because the reputation of the AI as an originator or servicer remains exposed. Moreover, if the AI has securitized its highest quality assets or provided support (e.g. liquidity facilities and reserve funds) to the transaction, it may have put itself and its unsecured creditors in a weaker position in relation to the investors in the transaction, and should be alert to any potential impacts on its financial position such as funding costs, credit standing and capital position.

2.6.5 The following are examples of items which would be expected to be included in the monitoring reports of originating AIs—

(a) Reports on securities backed by revolving credit facilities (e.g. credit cards) would typically monitor—

(i) portfolio’s gross yield;

(ii) delinquencies;

(iii) charge-off rate;

(iv) base rate (i.e. coupon rate paid on investor certificates plus servicing fee);

Supervisory Policy Manual

CR-G-xx Credit Risk Transfer Activities

(v) monthly excess spread;

(vi) rolling three-month average excess spread; and (vii) monthly payment rate.

(b) Reports on securities backed by instalment loans (automobiles, mortgages, etc.) would typically monitor—

(i) charge-off rate;

(ii) net portfolio yield (portfolio yield minus charge-offs);

(iii) number and status of restructured accounts;

(iv) delinquencies (aged);

(v) loan-to-value ratio (if applicable);

(vi) principal prepayment speeds; and

(vii) outstanding principal compared to original security size.

2.7 Management information system and reporting

2.7.1 The management information system (“MIS”) of an AI should provide the Board and senior management with timely and relevant information on the risk profile, volume and nature of the CRT activities undertaken in an accurate, easily understandable and concise manner. This information should include all CRT exposures (whether on- or off-balance sheet) and performance data in respect of underlying exposures.

See paragraph 4.3.5 of CA-G-5 for general guidance.

2.7.2 To facilitate review of the credit risk profile of CRT products, the MIS of an AI which has active participation⁶ in CRT

6 For the purposes of this module, “active” would usually be assessed by reference to the frequency and turnover / scale of an AI’s CRT activities. AIs acting as originators are deemed to have active participation in CRT activities. AIs which only hold a small amount of credit-linked notes or mortgage / asset backed securities in the banking book with an intention to hold such notes / securities until their maturity, and AIs which hold a small amount of credit derivative contracts solely for the purpos es of hedging banking book exposures, would not, in general, be regarded as having active participation in CRT activities.