Minimum Capital Requirements for Credit Risk

Banks must document in writing their rating systems’ design and operational details. The documentation must evidence banks’ compliance with the minimum standards, and must address topics such as portfolio differentiation, rating criteria, responsibilities of parties that rate borrowers and facilities, definition of what constitutes a rating exception, parties that have authority to approve exceptions, frequency of rating reviews, and management oversight of the rating process. A bank must document the rationale for its choice of internal rating criteria and must be able to provide analyses demonstrating that rating criteria and procedures are likely to result in ratings that meaningfully differentiate risk. Rating criteria and procedures must be periodically reviewed to determine whether they remain fully applicable to the current portfolio and to external conditions. In addition, a bank must document a history of major changes in the risk rating process, and such documentation must support identification of changes made to the risk rating process subsequent to the last supervisory review. The organization of rating assignment, including the internal control structure, must also be documented. 16.35 Banks must document the specific definitions of default and loss used internally and demonstrate consistency with the reference definitions set out in paragraphs 16.67 to 16.75 . 16.36 If the bank employs statistical models in the rating process, the bank must document their methodologies. This material must: (1) Provide a detailed outline of the theory, assumptions and/or mathematical and empirical basis of the assignment of estimates to grades, individual obligors, exposures, or pools, and the data source(s) used to estimate the model; (2) Establish a rigorous statistical process (including out-of-time and out- of-sample performance tests) for validating the model; and (3) Indicate any circumstances under which the model does not work effectively. 16.37 Use of a model obtained from a third-party vendor that claims proprietary technology is not a justification for exemption from documentation or any other of the requirements for internal rating systems. The burden is on the model’s vendor and the bank to satisfy SAMA. 64 For each pool where the banks estimate PD and LGD, banks should analyze the representativeness of the age of the facilities (in terms of time since origination for PD and time since the date of default for LGD) in the data used to derive the estimates of the bank’s actual facilities. In certain market conditions, default rates peak several years after origination or recovery rates show a low point several years after default, as such banks should adjust the estimates with an adequate margin of conservatism to account for the lack of representativeness as well as anticipated implications of rapid exposure growth. Section 4: Risk Rating System Operations Coverage of ratings 16.38 For corporate, sovereign and bank exposures, each borrower and all recognized guarantors must be assigned a rating and each exposure must be associated with a facility rating as part of the loan approval process. Similarly, for retail, each exposure must be assigned to a pool as part of the loan approval process. 16.39 Each separate legal entity to which the bank is exposed must be separately rated. A bank must have policies acceptable to its supervisor regarding the treatment of individual entities in a connected group including circumstances under which the same rating may or may not be assigned to some or all related entities. Those policies must include a process for the identification of specific wrong way risk for each legal entity to which the bank is exposed. Transactions with counterparties where specific wrong way risk has been identified need to be treated differently when calculating the EAD for such exposures (see paragraph 7.48 in the CCR framework ). Integrity of rating process: standards for corporate, sovereign and bank exposures