Policy, organisation and structure of risk management
VTB Group-level risk management
The main risks that VTB Group is exposed to are credit risk, market risks (including risks associated with changes in the market prices of financial instruments, interest rates and foreign exchange rates), liquidity risk and operational risks (including legal risks), as well as individual sub-types of concentration risk (risk of credit concentration within a group of borrowers, risk of concentration of financial instruments, risk of concentration of sources of liquidity).
Risk management at the Group level includes risk identification, evaluation and monitoring; control over the size, structure and concentration of risks; identification of effective measures to optimise and minimise risks; and compiling regular risk reports.
One of VTB Group’s key principles of risk management is to take the Group’s risk appetite into account when managing its activities. Risk appetite is determined in accordance with regulatory requirements and international practice. This approach involves the identification and oversight of the Group’s overall target risk level and risk profile in accordance with its strategic objectives and the integration of risk appetite into business planning and risk management procedures.
A high-level risk appetite for the Group includes the following key provisions:
- The size of potential losses on risks accepted by the Group should not reach a level that would lead to the cessation of the Group’s operations, including under stress conditions;
- Group’s companies must have enough capital to secure the interests of creditors in the hypothetical (extremely unlikely) event of unexpected losses as a result of risks taken;
- The structure of the Group’s operational cash flow and liquidity reserves should ensure the timely fulfilment of obligations to clients in the short and long term;
- The structure of assets and liabilities must ensure the efficient use of resources and comply with the Group’s business model;
- The level of risk involved in the decision-making process must be assessed and monitored on an ongoing basis, and the impact of activities must also be assessed on an ongoing basis while taking risks into account;
- As part of its operations, the Group must try to avoid a high degree of concentration of credit risk in counterparties, industries and countries / regions with a high level of risk;
- Sustainable development and economic efficiency in the long term;
- Compliance with the regulatory requirements of the Bank of Russia, the recommendations of international bodies, as well as the requirements of local (foreign subsidiaries) or industry regulators;
- Maintaining an impeccable reputation, avoiding actions that could result in harm to the Group’s reputation;
- Maintaining and improving credit ratings granted by international rating agencies (without state support).
VTB Group’s high-level risk appetite is detailed through the establishment of specific quantitative and qualitative indicators, with corresponding reference values.
Quantitative indicators of risk appetite are divided into operational indicators (they may be passed down to the system of limits established for business lines, VTB Group companies and other allocation levels) and structural indicators (centrally managed at the Group level). Risk appetite indicators limit all significant risks inherent to VTB Group’s operations.
The key principles of the Group’s risk management system also include:
- Compliance with legal and other mandatory requirements;
- Transparency of risk-associated activities for shareholders, investors and other interested parties (primarily by disclosing the relevant information as required), taking into account their interests;
- Analysing and managing risks on a consolidated basis, covering all of the Group’s Russian and foreign banks, as well as its key financial companies;
- Optimal distribution of risks within the Group; minimising exposure and potential losses from risks in markets where the Group operates;
- Developing a risk management culture within the Group’s companies, including improving employees’ skills in terms of identifying and preventing possible risks and losses in their areas of responsibility;
- Providing the risk management function with sufficient resources, introducing modern methods for assessing and monitoring risks and automated risk management systems based on industry best practices.
The Group’s risk management system has a multilayered structure, which includes consolidated (Group-level) and local-level risk management, with a high degree of centralisation of the Group’s risk management function. The risk management system is built around the Group’s global business lines (Corporate-Investment Business, Medium and Small Business, Retail Business) and is based on the harmonisation of approaches to managing risk, including through the coordination of competencies exercised by the Group’s specialised risk divisions.
The standard organisational structure of the Group’s banks and financial companies includes an independent risk assessment and control division that corresponds to the appropriate risk profile, specific features and scale of the business, as well as a senior manager responsible for comprehensive risk management.
The organisational structure of risk management within VTB Group includes the following:
- Collective bodies responsible for coordination within the Group;
- Collective bodies within VTB Bank as the parent bank of the banking group (since the fourth quarter of 2019);
- Headquarters (the Group’s chief risk manager and the Group’s specialised risk divisions);
- Management bodies at the local level, collective working bodies (committees), structural divisions/authorised officers within Group companies.
Control over the organisation of risk management and the risk management policy within the Group’s companies is carried out on a systematic basis, primarily through corporate governance (including through the representation of VTB Bank on subsidiaries’ supervisory councils/boards of directors), as well as through the Group’s specialised risk divisions. Key internal regulations of subsidiaries related to risk management are approved by governing bodies, taking into account the contribution of the specialised risk divisions.
During the year, the Group continued implementation of the development strategy of its risk management system for 2017–2019, as well work on the long-term development programme for the Bank for 2014–2019, which was approved by the Bank’s Supervisory Council, including:
- The implementation of measures to ensure the transition to a methodology for assessing credit risk and the level of provisions in accordance with IFRS 9;
- Improvement of a system of indicators and procedures for preparing, approving and cascading the Group’s risk appetite;
- Implementation of internal procedures for assessing capital adequacy at the Group level in accordance with the regulatory requirements of the Bank of Russia;
- Ongoing work on the development of a methodology and procedures for managing certain types of risks (including interest-rate risk);
- Implementation of projects to develop the IT infrastructure for risk management and to prepare risk reports, including taking into account the requirements of the Bank of Russia.
VTB Bank–level risk management
The Bank’s main internal documents specifying key principles of, and approaches to, the organisation and development of its risk management system (including subsidiaries included in the Group’s consolidated risk management) are the following:
- The Regulation on the VTB Bank Risk Management System designed in line with the Procedures endorsed by the Russian Government and approved by the Supervisory Council on 16 November 2015;
- VTB Bank’s Development Strategy for Managing Risk and Capital and the Procedure for Managing VTB Bank’s Most Significant Risks developed in accordance with the regulatory requirements of the Bank of Russia and subject to revision at least once a year to update its provisions.
In 2019, new versions of VTB Bank’s Strategy for Managing Risk and Capital and the Procedure for Managing VTB Bank’s Most Significant Risks were approved by a decision of the Bank’s Supervisory Council on 11 November 2019.
The main strategic objective in risk management is to minimise potential financial losses from exposure to the risks faced by the Bank’s operations, ensuring financial strength and long-term sustainable growth for the Bank in accordance with the strategic objectives specified by the Supervisory Council.
VTB Bank’s Strategy aims to create an integrated risk management system that corresponds to the nature and scale of the Bank’s operations and risk profile, and that enables further business development in line with economic conditions and the Bank’s needs.
The Bank’s risk management is developed and improved in accordance with legal regulations and recommendations of the Bank of Russia, as well as generally accepted international standards and banking best practices.
VTB Bank’s risk management system comprises the Supervisory Council and the Bank’s executive bodies, credit committees, the Retail Risk Committee, the Finance Committee, the Credit and Market Risk Management Committee and other special committees and structural units involved in risk management processes.
The main divisions responsible for developing the risk management system and controlling significant risks assumed by VTB Bank and VTB Group are VTB Bank’s Corporate Credit Risk Department, Integrated Risk Management Department and Retail Credit Risk Department.
Credit risk is the risk of incurring losses should a debtor fail to discharge its financial obligations to the Bank in accordance with the terms of their agreement.
VTB Group–level credit risk management
Credit risk at VTB Group is managed simultaneously at the local level with VTB Group companies and at the Group (consolidated) level.
Within the framework of the local credit risk management system, VTB Group companies assume and manage credit risks independently (including through insurance and hedging of risks), within the scope of their authority and limits with regard to risk indicators, and in accordance with national regulations. VTB Group’s companies are responsible for the results of their lending activities and the quality of their loan portfolios and also for monitoring and controlling the credit risks associated with their portfolios.
The key elements of the Group’s consolidated credit risk management are as follows:
- Harmonisation of credit policies (credit risk management policies) of the Group’s companies;
- Development and adoption of common standards concerning credit procedures, decision-making processes, models and methods for managing credit risk to be used throughout the entire Group (including the methodology for assessing counterparties, pricing credit operations, collateral, monitoring, backup and stress testing);
- Establishing consolidated limits and other restrictions within the Group (including limits on counterparties/groups of related counterparties, large transactions, countries, industry sectors);
- Assessing the capital necessary to cover the Group’s credit risks;
- Maintaining a centralised database of the Group’s borrowers, including those requiring particular attention;
- Preparing regular consolidated financial statements regarding the Group’s credit risk and submitting them to the Group’s governing bodies for review.
Consolidated risk management covers all essential assets and off-balance-sheet operations of the Group’s companies that bear credit risk and that require control over their concentration within the Group as a whole. Within the context of consolidated control and reporting, the scope and range of such operations is determined by the Group’s coordinating bodies.
In 2019, specialised units within VTB Bank, including the Non-Core and Bad Assets Department and the Retail Debt Collection Department, dealt with identifying, monitoring and resolving issues of bad debt at the Group level.
In 2019, the corporate credit risks of subsidiary banks were managed by the Corporate Credit Risk Department. As the Group’s specialised risk division for corporate credit risks, the Corporate Credit Risk Department is responsible for developing common approaches and methods for managing corporate credit risks, for evaluating them on a centralised and systematic basis and for developing the optimal structure of corporate credit risk accepted by the Group, including its compliance with the Group’s risk appetite.
In 2019, the centralised management of retail risks at VTB Bank’s subsidiary banks was carried out by the Retail Credit Risk Department. As the Group’s specialised risk division dealing with credit risks, the Retail Credit Risk Department is responsible for developing common approaches and methods for managing retail risks, for evaluating them on a centralised and systematic basis and for developing the optimal structure of retail risk accepted by the Group, including its compliance with the Group’s risk appetite.
VTB Bank–level credit risk management
VTB Bank manages credit risk by:
- Restricting credit risk through the Bank’s existing system of limits, which comply with the Bank of Russia’s mandatory regulations and other requirements. They are reviewed regularly by the Corporate Credit Risk Department and the Integrated Risk Management Department and approved by the authorised collective body;
- Accepting collateral and insurance to cover credit risks, charging adequate fees for the credit risk and establishing provisions for possible loan losses;
- Assessing the level of credit risk assumed by the Bank for each counterparty, as well as regularly monitoring the credit portfolio, individual customers, transactions and collateral (including by ranking borrowers);
- Minimising credit risk at the loan application review stage and taking prompt measures as soon as credit risk factors have been identified through monitoring.
The Bank applies the following main methods of credit risk assessment:
- Determining a customer’s level of creditworthiness by analysing financial and non-financial indicators and conducting an expert assessment (in compliance with the Bank’s internal procedures for ranking); the level at which a customer (or a group of related customers) is ranked is taken into account when determining the cost levels of loan transactions; assessing retail credit risks by means of scoring models and automated credit-related decision-making procedures, as well as verifying/assessing client data (the client’s financial position, social variables, credit history);
- Analysing the level of concentration of the Bank’s credit risk for individual borrowers (or a group of related borrowers), industries, countries, customer segments, types of credit products;
- Estimating possible losses from credit risk in the process of calculating and creating provisions for possible losses (in compliance with the requirements of the Bank of Russia and IFRS);
- Assessing capital adequacy and the scale of credit risk when calculating the required ratios established by the Bank of Russia;
- Determining internal capital needs (capital calculation) for credit risk, taking into account the actual quality of the loan portfolio (as required by the Bank of Russia and the standards set by the Basel Committee on Banking Supervision)Approach based on internal ratings.;
- Conducting stress testing of loan portfolio losses, taking into account different macroeconomic scenarios.
The main tool for credit risk monitoring and mitigation is the system of established credit limits.
The key types of credit risk limits are:
- Limits on the aggregate level of credit risk for the loan portfolio overall and for individual segments;
- Limits restricting the level of risk for a particular customer (or a group of related customers). These limits include limits for operations with a customer (or a group of related customers), including sub-limits for various types of operations with a credit risk / designated purpose (credit limits, documentary limits, limits on trading activities, limits on transactions with debt securities, etc.);
- Limits on the concentration of credit risk (by industry, country, credit products);
- Credit and deposit limits are established for credit organisations (including overdraft sub-limits, nostro accounts, provision of funds), limits on trading operations, limits on transactions with debt securities, and limits on contingent liabilities;
- Limits in accordance with the requirements (mandatory regulations) of the Bank of Russia.
The Bank employs collateral to reduce credit risk.
Liquidity risk means the risk that the Group or a Group company will be unable to finance its activities, i.e., to ensure asset growth and settle liabilities as they become due without incurring losses in an amount that would threaten the financial stability of the Group and/or a Group company.
VTB Group–level liquidity risk management
Liquidity risk management involves a set of measures used to manage the Group’s assets and liabilities with the aim of maintaining the Group’s ability to meet its obligations while ensuring an optimal balance between the level of liquidity risk and profitability of the Group’s operations.
The VTB Group Management Committee and Assets and Liability Management Committee (until 4Q 2019) / VTB Bank’s Finance Committee (since 4Q 2019), and VTB Bank’s Treasury Department and the Market Risk Division of the Integrated Risk Management Department all play a role in the Group’s liquidity risk management process.
The VTB Group Management Committee determines the Group’s general policy in the area of liquidity risk management, sets limits and triggers for VTB Group’s liquidity risk appetite, and also reviews reports on the status of VTB Group’s liquidity risk as part of reports on Group’s risks.
The Group Assets and Liabilities Management Committee (until 4Q 2019) / VTB Bank’s Finance Committee (since 4Q 2019) approves the Regulation on the Procedure for Managing Liquidity Risk in the Group, approves the Group’s liquidity risk assessment methodology, monitors the Group’s liquidity, and makes decisions on measures related to the management of the Group’s assets and liabilities with the aim of ensuring the required level of liquidity and growth of the Group’s assets.
Liquidity management is applied at the Group level based on bylaws approved by the Group’s Management Committee. Within the Group, liquidity management is based on the following principles:
- Each bank/company within the Group manages its own liquidity on a separate basis to meet its obligations and comply with the requirements of the national regulator and the recommendations of VTB Bank;
- VTB Bank manages the Group’s liquidity by centrally controlling and managing the key measures taken by the Group.
Methods for controlling and reducing the Group’s liquidity risk include monitoring compliance with the established appetite for liquidity risk and with the regulatory limit and the net stable funding ratio set by the Bank of Russia for the short-term liquidity of a banking group, as well as calculating the amount of capital needed to cover liquidity risk.
VTB Bank–level liquidity risk management
Liquidity risk management involves a set of measures used to manage the Bank’s assets and liabilities with the aim of maintaining the Bank’s ability to meet its obligations while ensuring an optimal balance between the level of liquidity risk and profitability of the Bank’s operations.
The Bank has current and forecast liquidity risk management in place.
Managing current liquidity entails short-term forecasting and management of cash flows in respect of currencies and terms (time frames) so that the Bank can ensure that it will meet its obligations, complete settlements on behalf of its customers and fund ongoing operations.
Current liquidity management is carried out by the Treasury Department based on a real-time (intraday) determination of the Bank’s current payment position and forecast future payment position, taking into account the payments schedule and other scenarios.
The objective in forecast liquidity management is to develop and implement instruments to manage assets and liabilities to support the Bank’s instant funding capability, and to plan increases in its asset portfolio by optimising the ratio of liquid assets and profitability.
The Bank achieves this by making long-term liquidity forecasts and by adhering to internal liquidity standards (standards for liquid and highly liquid assets and the liquidity standard for the treasury securities portfolio), as formulated by the Assets and Liabilities Management Committee. The liquidity accounting standards of the Bank of Russia are also applied when carrying out forecast liquidity management.
Each forecast includes receivables and payments according to the contractual terms for operations, while also taking into account planned transactions, possible extension of clients’ funds (deposits and promissory notes) and possible outflows of unstable “on-demand” capital (clients’ settlement and current accounts, as well as Loro accounts).
In addition, the Integrated Risk Management Department conducts stress testing to assess risk factors that can have an impact on the Bank’s liquidity forecast. Liquidity gaps are closed through new borrowings and the renewal of existing deposits. The Group’s medium-term liquidity is managed by attracting interbank loans and customer deposits, repo transactions and secured loans from the Bank of Russia. The currency structure of liquidity is managed by conducting “conversion swap” transactions.
A significant proportion of VTB Group’s liabilities is represented by customer deposits (deposits, promissory notes, current accounts of corporate and retail customers), resources from the Bank of Russia and interbank deposits.
Although a considerable portion of customer liabilities are short-term deposits and “on-demand” accounts, the diversification of these liabilities and VTB’s past experience indicate that these liabilities are consistently refinanced by customers, and they are, for the most part, a stable source of funding. The stable element of short-term customer liabilities is determined for various currencies using a statistical trend analysis of the cumulative balances of these accounts over time.
Money-market instruments (interbank loans and deposits, repurchase agreements) are used to control short-term liquidity and are not considered as a source of funding for long-term assets.
Methods for controlling and reducing liquidity risk include:
- Monitoring compliance with established internal limits and regulations, including appetite for liquidity risk;
- Analysing liquidity risk using a set of quantitative and qualitative indicators;
- Implementing forecasting, situational modelling and stress testing of the Bank’s liquidity;
- Calculating the amount of capital needed to cover liquidity risk;
- Monitoring calculated gaps taking into account the scenario analysis of the Bank’s liquidity for various time periods to identify disparities between receivables and payables;
- Identifying and analysing the impact of internal and external factors on the Bank’s liquidity, and the forecast for changes;
- Adopting and implementing solutions for management of the Bank’s assets and/or liabilities to maintain liquidity risk at a level that complies with internal and regulatory liquidity ratios;
- Developing a detailed plan of action for mobilisation of liquid assets by the Bank in the event of insufficient liquidity;
- Ensuring compliance with the Bank of Russia’s mandatory liquidity ratios by monitoring actual and forecast values of intra-bank maximum permissible indicators for mandatory ratios.
Market risk is the risk of downward pressure on the Group’s financial results or its capital base due to adverse changes in the value of the Group’s assets/liabilities (claims/obligations) as a result of market conditions, i.e., risk factors.
VTB Group has a standing collective body within the Group Management Committee as part of its system for managing the Group’s consolidated assets and liabilities: the Assets and Liabilities Management Committee (until 4Q 2019) / VTB Bank Finance Committee and Credit and Market Risk Management Committee (since 4Q 2019). The main objectives of the Assets and Liability Management Committee were to address the following issues:
- Management of VTB Group’s assets and liabilities;
- Management of VTB Group’s treasury risks;
- Determining the principles for internal and external pricing within VTB Group;
- Determining approaches to capital allocation within VTB Group according to different types of risks;
- Determining approaches to the redistribution of capital among VTB Group companies.
The main objectives of the Finance Committee in terms of managing the Group’s risks are as follows:
- Improving the risk and capital management system;
- Capital management;
- Managing the currency risk of a structurally open currency position, the interest-rate risk of the bank book, the market risk of the treasury debt securities portfolio, and liquidity risk (including the risk of liquidity sources concentration);
- Determining policies in terms of internal and external pricing and establishing principles for the system for funding operations.
The main objectives of the Credit and Market Risk Management Committee in terms of the Group’s risk management are:
- Improving the system for managing core risks;
- Managing the market risk of the trading book;
- Managing credit risk;
- Managing model risk in terms of credit risks and market risks of the trading book;
- Managing concentration risks (excluding the risk of the concentration of sources of liquidity).
The Regulation on the Procedure for Managing Market Risk (approved by VTB Group’s Market Risk Management Committee, Minutes No 31 as of 7 December 2018) in VTB Group establishes procedures for identifying and monitoring market risks, the structure and hierarchy of market risk limits from the level of VTB Group to the level of Group companies and individual divisions, procedures for monitoring compliance with limits and restrictions and for responding in case they are exceeded, and it also specifies the procedure for preparing reports on the Group’s market risk.
According to this Regulation, market risk is assessed and managed in the context of the following types of books:
- A trading book consisting of operations carried out in order to extract profits through their revaluation or hedging of other elements of the trading book;
- A portfolio of treasury debt securities consisting of transactions conducted by the Treasury Department and revalued at fair value;
- A bank book consisting of interest-sensitive instruments that are revalued at amortised cost or instruments used to hedge elements of the bank book. Loans that do not pass the SPPI test are counted in the bank book.
Based on an analysis of VTB Group’s portfolio, the following areas of market risk can be identified:
- Interest rate risk of the bank book;
- Currency risk of the bank book and the treasury debt securities portfolio;
- Depending on the nature of the operations bearing currency risk, the Group’s entire currency position is attributed to either the trading book or the bank book;
- Market risk for the trading book and the treasury debt securities portfolio.
Interest rate risk of the Bank book
Interest rate risk management is based on VTB Group’s bylaws and includes:
- Setting standard interest rates for deposits and internal rates for financing, taking into account current market conditions;
- Calculating interest-rate risk indicators;
- Setting capital limits for covering the interest rate risk for the Group and individual banks;
- Establishing an indicator for the bank book’s appetite for interest rate risk ‒ the indicative value of the sensitivity of net interest income to a change in interest rates.
The main parameters used to assess interest rate risk are:
- the sensitivity of the Group’s interest position to a change in interest rates, measured in terms of the size of the reduction in the net present value of the interest position and the net interest income under an unfavourable change in interest rates, as well as a parallel movement of the yield curves by 100 and 400 basis points; and
- the capital to cover interest rate risk, measured by assessing reductions in the net current value of the Bank’s interest-rate position in the event of likely unfavourable interest-rate movements.
Currency risk of a structural open currency position
The Group uses internal regulations adopted by the Group’s Management Committee to manage its currency risk. It also ensures that the currency of its assets matches that of its liabilities and maintains an open currency position (OCP) in each of the Group’s banks within established limits, including internal OCP limits and the capital limit to cover the currency risk of structural OCP, as well as regulatory OCP limits.
Approved stress scenarios are used to calculate the capital required to cover VTB Bank’s currency risk stemming from structural OCP.
The following are the main parameters for assessing the currency risk of the Group’s structural OCP:
- Calculation of open currency positions in the context of individual currencies and VTB Group companies;
- Calculation of the OCP sensitivity to changes in foreign currency exchange rates of 1 RUB and by 1 %;
- Capital to cover the currency risk of structural OCP.
Market risk of trading operations
VTB Group is exposed to market risk through its trading book and its treasury debt securities portfolio associated with a negative revaluation of instruments due to changes in the values of various risk factors, including bond prices, stocks, commodity instruments, exchange rates, interest rates, credit spreads, risk volatility factors and correlations between them.
Although the treasury bond portfolio is separate from the trading book due to the different objectives in conducting transactions involving these portfolios, market risk management for treasury debt instruments is managed in the same way as for the trading book.
To limit market risk within VTB Group, a set of limits is used. All limits can be divided into the following two groups: portfolio limits (VaR limits, stop-loss limits and stress limits) and operational limits that limit the concentration of individual indicators or types of assets in the portfolio.
The Integrated Risk Management Department performs the following market risk management functions for trading operations:
- Evaluates and reports on the Group’s market risk profile, reviews the structure of limits and prepares proposals for reducing and managing market risk for the trading book and the treasury debt securities portfolio;
- Monitors on a daily basis compliance with the Group’s market risk limits; local market risk limits are monitored by the risk divisions of subsidiary banks also on a daily basis;
- Informs business units on a daily basis about compliance with the Group’s limit discipline.
The results of stress testing are used to assess the market risk of the trading book and the treasury securities portfolio. The methodology used to assess these risk metrics is submitted to the Credit and Market Risk Management Committee for consideration and communicated to VTB Group companies.
The result of the revaluation of the Group’s trading book and treasury debt securities portfolio is modelled on the basis of historical changes in risk factor values (observed under conditions of significant changes in macroeconomic indicators), as well as hypothetical changes in risk factors.
A scenario analysis showed that, in 2019, the greatest impact on market risk would have corresponded with a significant increase in risk-free, rouble-denominated interest rates and the widening of credit spreads.
VaR is calculated based on the following parameters:
- Historical period: two years;
- Forecasting horizon: one trading day;
- Confidence interval: 95 %;
- The method used is historical modelling.
Operational risk is the risk of loss resulting from flaws in the type and scale of the Group’s operations, internal processes and procedures for carrying out banking operations and other transactions, the violation thereof by staff or other individuals (due to unintentional or intentional acts or omissions), the inadequacy or lack of functionality of IT and other systems and/or the failure (breakdown) thereof, as well as damaging external events.
Operational risk includes legal risks but does not include strategic or reputational risks.
VTB Bank’s operational risk management system is designed to minimise incidents of operational risk, including reducing the likelihood of business process failures, the inability to provide high-quality services to the Bank’s clients caused by staff errors, system breakdowns, internal or external fraud, breaches of client obligations or violations of contractual obligations or of the law, and incurring possible losses from taking on such risk.
In managing operational risk, the Bank adheres to the Bank of Russia’s regulations, as well as the recommendations of the Basel Committee on Banking Supervision. To implement its operational risk strategy, VTB carries out regular procedures to identify, assess, monitor, control and minimise operational risk. All significant deficiencies from a risk perspective that are identified within the internal control system are subjected to detailed analysis. Based on this analysis, measures are taken in order to eliminate the causes and sources of the risk.
To manage operational risk, the Bank has implemented the following unified mechanisms to identify, assess and monitor the level of operational risk: a centralised process to collect information on incidents of operational risk and related consequences; control over the level of key indicators related to operational risk, procedures to minimise operational risk, an operational risk self-assessment and scenario analysis.
The application of the above mechanisms makes it possible to carry out a quantitative and qualitative assessment of operational risk indicators in relation to the Bank’s products, processes and systems, including in the context of individual risk categories and the Bank’s activities, the identification of sources of risk, the development and adoption of mitigating measures and the generation of management reports.
The Bank uses the following methods to respond to operational risks:
- Minimising risk: developing and implementing the necessary corrective measures to reduce identified risks;
- Taking risk: questions related to whether or not to take a certain risk are subject to approval by the authorised bodies/individuals within the Bank in the event that measures aimed at minimising the risk are not economically feasible;
- Avoiding risk: refusal to carry out a business operation subject to an identified risk if the potential losses as a result of the risk would be critical for the Bank and/or if carrying out the operation in question could jeopardise the economic feasibility of the activity associated with the risk, and if measures aimed at minimising the risk are not economically feasible;
- Transferring risk (risk insurance): risk insurance involves those operational risks that the Bank is unable to manage and that exceed the Bank’s direct control (including the risk of the loss of collateral pledged to the Bank to secure credit, the risks associated with the transportation and storage of valuables and cash, property risks, etc.).
The Bank uses the following key methods to reduce and limit its operational risk:
- Maintaining an integrated system of ongoing and follow-up internal controls that cover all of the Bank’s divisions and operations;
- Regulating all key operations using internal standards and codes of practice;
- Registering and documenting banking operations and transactions, and maintaining consistent control over primary documents and operating accounts;
- Applying the principles of dividing and limiting employees’ functions, authority and responsibilities; implementing dual controls; collective decision-making; setting limits on the terms and scale of operations;
- Automating banking operations using high-performance IT systems that are constantly monitored and repaired promptly in case of breakdown;
- Operating a well-managed HR policy, good staff training and education;
- Taking preventive steps to ensure the continuity and recovery of activities related to banking operations and transactions by setting up alternative communications channels; geographically distributed server rooms; independent sources of power, heat and water supply; and by taking fire protection measures.
The insurance programmes covering risks related to the Bank’s professional activities in 2019 were provided by insurance against crime under the Financial Institution’s Blanket Bond scheme (including electronic and computer crimes), liability insurance for directors and officers of the Group’s companies, insurance for funds and valuables while in storage and during transit, and ATM insurance. VTB Bank also insures against risks related to business activities (including buildings, equipment and vehicles).
In 2019, the Group took the following steps to develop its system for managing operational risk:
- Development of mechanisms to monitor the level of operational risk at the level of the Bank and the Group’s companies as part of the management of risk appetite;
- Unification of methodological approaches to operational risk management at the Group level, including risk management of risks related to fraud, IT and information security;
- Further development of the methodology for a unified system of tools to be used for operational risk management at the VTB Group level (collection of data on the occurrence of operational risks and related consequences, self-assessment, key risk indicators, corrective action plans to reduce risks and the consequences thereof, scenario analysis);
- Improving regular reporting on the Group’s operational risks.
Operational risk did not have a significant impact on the Bank’s performance in 2019.