Bk. Cyprus Hldg Regulatory News (BOCH)

Additional Risk and Capital Management Disclosures

30 June 2022

The Group is exposed to risks which it monitors, manages and mitigates through various control mechanisms. Information relating to Group's risks and risk management in relation to credit risk, market risk, liquidity and funding risk as well as capital management is set out in the Notes 29-32 to the Consolidated Condensed Interim Financial Statements (the 'Consolidated Financial Statements'). This report includes additional disclosures on the principal and emerging risks faced by the Group and capital management disclosures. 

The Board of Bank of Cyprus Holdings PLC is responsible to ensure that a coherent and comprehensive Risk Management Framework for the identification, assessment, monitoring and controlling of all risks is in place. The framework provides the infrastructure, processes and analytics needed to support effective risk management. It also ensures that material risks are identified, including, but not limited to, risks that might threaten the Group's business model, future performance, liquidity, and solvency. Such risks are taken into consideration in defining the Group's overall business strategy ensuring alignment with its risk appetite. In setting its risk appetite, the Group ensures that its risk bearing capacity is considered so that the appropriate capital levels are always maintained. To that end, a consolidated risk report and risk appetite dashboard is regularly reviewed and discussed by the Board and the Risk Committee (RC) to ensure the risk profile is within the approved risk appetite. In case violations occur, the Risk Appetite Framework provides the necessary escalation process to analyse the materiality and nature of the breach, notify the appropriate authorities, and decide the necessary remediation actions to address the issue.

1. Credit risk

Credit risk is the risk that arises from the possible failure of one or more customers to discharge their credit obligations towards the Group. Further information relating to Group risk management in relation to credit risk is set out in Note 29 of the Consolidated Financial Statements.

1. Credit risk (continued)

The tables below present the analysis of loans and advances to customers in accordance with the EBA standards.

1. Excluding loans and advances to central banks and credit institutions.

2. The residual fair value adjustment on initial recognition (which relates mainly to loans acquired from Laiki Bank and is calculated as the difference between the outstanding contractual amount and the fair value of loans acquired and bears a negative balance) is considered as part of the gross loans, therefore decreases the gross balance of loans and advances to customers.

3. The analysis shown in lines 'non-financial corporations' and 'households' is non-additive across all categories as certain customers could be in both categories.

1. Credit risk (continued)

4 Excluding loans and advances to central banks and credit institutions

5 The residual fair value adjustment on initial recognition (which relates mainly to loans acquired from Laiki Bank and is calculated as the difference between the outstanding contractual amount and the fair value of loans acquired and bears a negative balance) is considered as part of the gross loans, therefore decreases the gross balance of loans and advances to customers.

6. The analysis shown in lines 'non-financial corporations' and 'households' is non-additive across all categories as certain customers could be in both categories.

2. Liquidity and funding risk

Liquidity risk is the risk that the Group does not have sufficient financial resources to meet its commitments as they fall due. This risk includes the possibility that the Group may have to raise funding at high cost or sell assets at a discount to fully and promptly satisfy its obligations.

Funding risk is the risk that the Group does not have sufficiently stable sources of funding or access to sources of funding may not always be available at a reasonable cost and thus the Group may fail to meet its obligations, including regulatory ones (e.g. MREL)

Further information relating to Group risk management in relation to liquidity and funding risk is set out in Note 31 of the Consolidated Financial Statements.

2.1 Encumbered and unencumbered assets

Asset encumbrance arises from collateral pledged against secured funding and other collateralised obligations. 

An asset is classified as encumbered if it has been pledged as collateral against secured funding and other collateralised obligations and, as a result, is no longer available to the Group for further collateral or liquidity requirements. The total encumbered assets of the Group amounted to €4,719,053 thousand as at 30 June 2022 (31 December 2021: €4,489,424 thousand). 

An asset is classified as unencumbered if it has not been pledged as collateral against secured funding and other collateralised obligations. Unencumbered assets are further analysed into those that are available and can potentially be pledged and those that are not readily available to be pledged. As at 30 June 2022, the Group held €18,120,570 thousand (31 December 2021: €17,468,507 thousand) of unencumbered assets that can potentially be pledged and can be used to support potential liquidity funding needs and €1,322,620 thousand (31 December 2021: €1,324,118 thousand) of unencumbered assets that are not readily available to be pledged for funding requirements in their current form.

The table below presents an analysis of the Group's encumbered and unencumbered assets and the extent to which these assets are currently pledged for funding or other purposes. The carrying amount of such assets is disclosed below:

2. Liquidity and funding risk (continued)

2.1 Encumbered and unencumbered assets (continued)

Encumbered assets primarily consist of loans and advances to customers and investments in debt securities. These are mainly pledged for the funding facilities of the European Central Bank (ECB) and for the covered bond (Notes 20 and 31 of the Consolidated Financial Statements for the six months ended 30 June 2022 respectively). Encumbered assets include cash and other liquid assets placed with banks as collateral under ISDA agreements which are not immediately available for use by the Group but are released once the transactions are terminated. Cash is mainly used to cover collateral required for (i) derivatives and (ii) trade finance transactions and guarantees issued. It may also be used as part of the supplementary assets for the covered bond.

BOC PCL maintains a Covered Bond Programme set up under the Cyprus Covered Bonds legislation and the Covered Bonds Directive of the Central Bank of Cyprus (CBC). Under the Covered Bond Programme, BOC PCL has in issue covered bonds of €650 million secured by residential mortgages originated in Cyprus. The covered bonds have a maturity date on 12 December 2026 and interest rate of 3-months Euribor plus 1.25% on a quarterly basis. On 9 August 2022, BOC PCL proceeded with an amendment to the terms and conditions of the covered bonds following the implementation of Directive (EU) 2019/2162 in Cyprus. The covered bonds are listed on the Luxemburg Bourse and have a conditional Pass-Through structure. All the bonds are held by BOC PCL. The covered bonds are eligible collateral for the Eurosystem credit operations and are placed as collateral for accessing funding from the ECB.

Unencumbered assets which can potentially be pledged include Cyprus loans and advances which are less than 90 days past due. Balances with central banks are reported as unencumbered and can be pledged, to the extent that there is excess available over the minimum reserve requirement. The minimum reserve requirement is reported as unencumbered not readily available to be pledged.

Unencumbered assets that are not readily available to be pledged primarily consist of loans and advances which are prohibited by contract or law to be encumbered or which are more than 90 days past due or for which there are pending litigations or other legal actions against the customer, a proportion of which would be suitable for use in secured funding structures but are conservatively classified as not readily available for collateral. Properties whose legal title has not been transferred to the Company or a subsidiary are not considered to be readily available as collateral. Non-current assets held for sale are also reported as not readily available to be pledged.

Insurance assets held by Group insurance subsidiaries are not included in the table above or below as they are primarily due to the insurance policyholders.

The carrying and fair value of the encumbered and unencumbered investments of the Group as at 30 June 2022 and 31 December 2021 are as follows:

2. Liquidity and funding risk (continued)

2.2 Liquidity regulation

The Group has to comply with provisions on the Liquidity Coverage Ratio (LCR) under CRD IV/CRR (as supplemented by Delegated Regulations (EU) 2015/61), with the limit set at 100%. The Group has to also comply with the Net Stable Funding Ratio (NSFR) calculated as per the Capital Requirements Regulation II (CRR II), with the limit set at 100%.

The LCR is designed to promote the short-term resilience of a Group's liquidity risk profile by ensuring that it has sufficient high-quality liquid resources to survive an acute stress scenario lasting for 30 days. The NSFR has been developed to promote a sustainable maturity structure of assets and liabilities.

As at 30 June 2022, the Group was in compliance with all regulatory liquidity requirements. As at 30 June 2022, the LCR stood at 299% for the Group (compared to 298% at 31 December 2021) and was in compliance with the minimum regulatory requirement of 100%. As at 30 June 2022 the Group's NSFR was 160% (compared to 147% at 31 December 2021) and was in compliance with the minimum regulatory requirement of 100%.

2.3 Liquidity reserves

The below table sets out the Group's liquidity reserves:

Internal Liquidity Reserves present the total liquid assets as defined in BOC PCL's Liquidity Policy. Liquidity reserves as per LCR Delegated Regulation (EU) 2015/61 present the liquid assets as per the definition of the aforementioned regulation i.e. High-Quality Liquid Assets (HQLA).

Under Liquidity reserves as per LCR, balances in Nostro accounts and placements with banks are not included, as they are not considered HQLA (they are part of the LCR Inflows). 

Liquid investments under the Liquidity reserves as per LCR are shown at market values reduced by standard weights as prescribed by the LCR regulation. Liquid investments under Internal Liquidity Reserves include additional unencumbered liquid bonds and are shown at market values net of haircuts based on ECB methodology and haircuts.

Current available ECB buffer is not part of the Liquidity reserves as per LCR.

2. Liquidity risk and funding (continued)

2.3 Liquidity reserves (continued)

Following the outbreak of COVID-19, the ECB has adopted a broad set of policy measures to mitigate the economic impact of the crisis and to ensure that its directly supervised banks can continue to fulfill their role in funding the real economy.

In March 2022, the ECB announced the steps for the gradual phasing out of the temporary pandemic collateral easing measures. The gradual phasing out is scheduled to be concluded in three steps starting from July 2022 and will be completed by March 2024 and gives banks time to adapt to the adjustments to the collateral framework. In the first step, starting on 8 July 2022, the ECB halved the temporary reduction in collateral valuation haircuts across all assets from the current 20% adjustment to 10%. In the second step, in June 2023, the ECB expects to implement a new valuation haircut schedule based on its pre-pandemic risk tolerance level for credit operations, phasing out the temporary reduction in collateral valuation haircuts completely. In the third step, in March 2024, the ECB will, in principle, phase out the remaining pandemic collateral easing measures.

The package also contained measures that provided liquidity support to the euro area financial system, such as significant favourable amendments in the terms and characteristics of TLTRO III. The favourable TLTRO III borrowing terms were not extended post June 2022. Furthermore, a new series of additional longer-term refinancing operations, called Pandemic Emergency Longer-Term Refinancing Operations (PELTROs), was introduced. The last TLTRO III and PELTROs operations took place in December 2021.

3. Other risks

3.1 Operational risk

Operational risk is defined as the risk of a direct or indirect impact/loss resulting from inadequate or failed internal processes, people actions, systems or external events. The Group includes in this definition compliance, legal and reputational risk.

The Group recognises that the control of operational risk is directly related to effective and efficient management practices and high standards of corporate governance. To that effect, the management of operational risk is geared towards maintaining a strong internal control governance framework and managing operational risk exposures through a consistent set of management processes that drive risk identification, assessment, control and monitoring.

The main objectives of operational risk management within the Group are: (i) raising operational risk awareness and building the appropriate risk culture, (ii) providing adequate and timely information to the Group's management at all levels in relation to the operational risk profile at a company, unit and activity level, so as to facilitate decision making for risk control activities, and (iii) mitigating operational risk to ensure that operational losses do not cause material damage to the Group's franchise and that the impact on the Group's profitability and corporate objectives is contained.

Operational risks can arise from all business lines and from all activities carried out by the Group and are thus diverse in nature. To enable effective management of all material operational risks, the operational risk management framework adopted by the Group is based on the three lines of defence model, through which risk ownership is dispersed throughout the organisation. The first line of defence comprises of management and staff who have immediate responsibility of day-to-day operational risk management and own the risk. Each business unit owner is responsible for identifying and managing all the risks that arise from the unit's activities as an integral part of their first line responsibilities.

3. Other risks (continued)

3.1 Operational risk (continued)

The second line of defence comprises of the Risk Management function whose role is to provide inter-alia operational risk oversight and independent and objective challenge to the first line of defence, supported by other specialist control and support functions including the Group Compliance Division and Information Security functions. The third line of defence comprises of the Internal Audit function, which provides independent assurance over the integrity and effectiveness of the risk management framework throughout the Group.

Business resilience is treated as a priority and as such the Group places significant importance on continuously enhancing the business continuity arrangements, to ensure timely recovery in the case of events, such as the COVID-19 pandemic, that may cause disruptions to the business operations.

According to the Pandemic Incident Management Plan, which was invoked following the COVID-19 outbreak, Business Continuity arrangements have been put in place, which include splitting the operations of the critical units at separate locations other than their main business sites along with remote access from home capabilities as applicable. BOC PCL has withdrawn the Business Continuity arrangements approach with effect from the end of May 2022. Capabilities to employees that support the critical units is still available and ready to be used if needed.

All the controls are undertaken as usual and no additional losses or incidents have been identified as a result of the pandemic.

Further to the actions taken in response to the COVID-19 pandemic, ongoing activities/initiatives towards further enhancements of Operation Risk Management (ORM), involved inter alia the following: (i) provision of a fraud risk awareness seminar to staff and top-management, (ii) establishment of the specialised Fraud Risk Assessment framework, going beyond the current Risk Control Self-Assessment (RCSA) process, and (iii) ongoing reviews and enhancements of the internal ORM policies, procedures and the ORM database.

As a result of the customers' accelerated shift towards digital channels, the Fraud Risk Management unit further strengthened BOC PCL's current external fraud prevention controls and framework.

Third-Party and Outsourcing risk can arise from a third party's failure to perform as expected due to reasons such as inadequate capacity, technological failure, human error, un-satisfactory quality of service, unsatisfactory continuity of service and/or financial failure. The Group has a dedicated unit under the ORM Function, the Third-Party Risk Management Unit, which is responsible to perform risk assessments on all outsourcing, strategic and intragroup arrangements of the Group. As part of the risk assessment, the team identifies and monitors the effective handling of any potential gaps/weaknesses. The risk assessment occurs prior to signing an outsourcing/strategic/intragroup arrangement, prior to their renewal or annually.

Operational risk loss events are classified and recorded in the Group's Risk and Compliance Management System (RCMS) system, which serves as an enterprise tool integrating all risk-control data (e.g. risks, loss incidents, Key Risk Indicators) to provide a holistic view with regards to risk identification, corrective action and statistical analysis. During the six months ended 30 June 2022, 15 loss events with gross loss equal to or greater than €1,000 each were recorded including incidents of prior years (mostly legal cases) for which losses materialised in the first six months of 2022 (six months ended 30 June 2021: 55 loss events).

The Group strives to continuously enhance its risk control culture and increase the awareness of its employees on operational risk issues through ongoing staff training (both through physical workshops and through e-learning).

The Group also maintains adequate insurance policies to cover for unexpected material operational losses.

3. Other risks (continued)

3.2 Regulatory risk

The Group conducts its business subject to on-going regulation and supervision. The associated regulatory risk is the risk that new laws and regulations enacted or changes in existing ones are not identified, and / or the failure to comply with regulatory requirements. This could lead to, amongst other things, increased operational costs for the Group and limitation on BOC PCL's capacity to lend. Moreover, Regulatory risk could have a material adverse effect on the business, financial condition, results, operations and prospects of the Group.

There is strong commitment by the management of the Group for an on-going and transparent dialogue with the Regulators (amongst others the ECB, CBC etc). A dedicated Executive Steering Group chaired by the CEO has been set up which ensures proper procedures are in place for managing regulatory risk and oversee the Group's regulatory obligations. This is ensured through the Regulatory Affairs department that acts as primary contact point with the Regulators maintaining a holistic view of the regulatory requests and monitors the regulatory agenda to ensure all regulatory matters are handled appropriately and are brought to the attention of management in a timely manner.

3.3 Political risk and geopolitical uncertainty

Cyprus is a small, open, services-based economy, with a large external sector and high reliance on tourism and international business services. As a result, external factors which are beyond the control of the Group, including developments in the European Union and in the global economy, or in specific countries with which Cyprus maintains close economic and investment links, most notably the UK and Russia, can have a significant impact on domestic economic activity. In particular, the Ukraine war poses risks for continued supply disruptions and elevated energy prices, even the risk of the war spreading.

Cyprus' risk profile has been improving as seen in upgrades of its sovereign credit rating and improved economic fundamentals. Higher inflation and tightening monetary policy have a negative impact on spending and consumption and therefore weigh negatively on the overall risk profile of the country. But this is offset by improvements in various fiscal indicators. The budget deficit narrowed in 2021 and the ratio of debt to GDP dropped steeply from its Covid-driven elevated levels of the year before. Financial conditions will be tightening as the ECB will be raising rates further in the foreseeable future in order to tame inflation, but that will be affecting overall debt service costs only gradually. Debt sustainability would depend on growth, the budget balance, but also on interest rates which determine debt service costs. Low average interest rates currently, are the result of large-scale asset purchases by the ECB over a long period of time, and ample liquidity in sovereign bond markets. The tightening of monetary policy, or developments that can lead up to the fragmentation of the euro area sovereign bond market, can increase debt service costs and risk the sustainability of public debt. The risk of bond market fragmentation has increased as a result of the Ukraine crisis and the sanctioning of Russia.

The Cypriot economy, similar to the European and global economy, is facing a variety of headwinds at present. Surging inflation is weighing on consumers' purchasing power and business sentiment. External demand is slowing as the US begins its monetary tightening cycle and China continues its zero-covid policy, while spill-over effects from the war in Ukraine damage growth worldwide via higher commodity prices and disrupted supply chains. On the positive side, tourism sectors benefit from a rebound in tourist inflows and more robust demand for services now that the COVID-19 restrictions from earlier in the year have been rolled back. Nonetheless, there is a risk that the economy will prove less resilient than expected. Russian gas cut-offs to major western European countries prompting further energy price spikes could further negatively impact the economy, or the European Central Bank's monetary tightening from July could hit economic activity and investor sentiment harder than expected. In this scenario, growth will slow abruptly and the probability of dipping into negative territory rises. The winter of 2022/23 could be challenging, with high energy prices coinciding with cold temperatures and the impact of monetary tightening feeding through more strongly. Slower growth would likely be a Europe-wide phenomenon, dampening external demand, and unemployment could rise as firms scale back their ambitions.

3. Other risks (continued)

3.3 Political risk and geopolitical uncertainty (continued)

In the banking sector there has been significant progress since the crisis of 2012-14, in terms of the regulatory framework, balance sheet restructuring, operational and strategic streamlining and capital adequacy. Non-performing loans dropped steeply from more than 48% of gross loans at the end of 2014 to 11.4% at the end of March 2022. Total loans outstanding dropped from near four times GDP to less than one GDP at the end of 2021. However, banking sector risks have been rising in the more recent period as a result of the double shock of the COVID-19 pandemic and the war in Ukraine.

Political risk remains elevated as Cyprus' political landscape is increasingly fragmented and polarised which makes it harder to build consensus for reform. Political risk remains high also because of the continuing division of the island. This risk category evaluates a range of political factors relating to political stability and effectiveness that could affect a country's ability and commitment to service its debt obligations. The political risk rating informs the ratings for sovereign risk, currency risk and banking sector risk.

Geopolitical and macroeconomic uncertainties remain elevated with multiple risks as follows:

· the ongoing Russian-Ukraine war and the sanctioning of Russia will have profound effects on the Russian economy and serious macroeconomic implications for the European Union and the world economy at large. As a result of the crisis in Ukraine and sanctions, supply chains have been disrupted causing shortages in agricultural commodities and metals. Energy prices have risen, and, despite fluctuations, energy markets remain tight, and prices will stay higher for longer. As Russian supplies of natural gas to Europe are cut, while efforts to secure alternative sources take time, the prospect of energy shortages in Europe in the coming winter rises,

· the mobility restriction measures in China and the imbalances in the production process in many industries due to the COVID-19 outbreak,

· a prolongation and/or exacerbation of the ongoing inflationary wave, especially in the energy and food sectors, and its impact on economic growth, employment, public finances, household budgets, firms' production costs, external trade and banks' asset quality,

· the political crisis in Italy following the resignation of prime minister Mario Draghi on July 21, jeopardises future reforms.

However, the risks coming from the geopolitical upheaval could be potentially mitigated with coordinated measures at the European level, as per the pandemic precedent.

Tensions between Cyprus and Turkey can escalate, as long as the Cyprus problem remains unresolved, and the two communities - Greek Cypriots and Turkish Cypriots - fail to find common ground to return to the negotiating table. Cyprus' offshore oil and gas exploration activities in its exclusive economic zone, have met with Turkey's objections, who among other are disputing some of the maritime areas to the west of Cyprus as part of its continental shelf. The risk of escalating tensions and possible confrontation, deters investment in the oil and gas sector. As a result, the required infrastructure investment for the exploitation of Cypriot offshore gas fields which were discovered in 2011, has been slow.

Given the above, the Group recognises that unforeseen political events can have negative effects on the Group's activities, operating results, and financial position.

3.4 Information security and cyber risk

Information security and cyber-risk is a significant inherent risk, which could cause a material disruption to the operations of the Group. The Group's information systems have been and will continue to be exposed to an increasing threat of continually evolving cybercrime and data security attacks. Customers and other third parties to which the Group is significantly exposed, including the Group's service providers (such as data processing companies to which the Group has outsourced certain services), face similar threats.

3. Other risks (continued)

3.4 Information security and cyber risk (continued)

At the same time, the Group has an internal specialised Information Security team which constantly monitors current and future cyber security threats (either internal or external, malicious or accidental) and invests in enhanced cyber security measures and controls to protect, prevent and appropriately respond against such threats to its systems and information.

The Group collaborates with industry bodies, the National Computer Security Incident Response Team (CSIRT) and intelligence-sharing working groups so as to be better equipped with the growing threat from cyber criminals.

In addition, the Group maintains insurance coverage which covers certain aspects of cyber risk and it is subject to exclusion of certain terms and conditions.

Advanced social engineering attacks were used by attackers for credentials stealing and malware dissemination during the COVID-19 pandemic. The Group's cyber security systems have protected the Group from such threats and are continually improved by strengthening detection, response and protection mechanisms in order to continually contain such threats and keep risks within the Group's appetite thresholds.

Current geopolitical tensions may also lead to increased risk of cyber-attack from foreign state actors. In particular, the Russian invasion of Ukraine and the imposition of sanctions on Russia by Switzerland, the US, the EU, the UK and others may result in increased risk of cyber-attacks.

3.5 Business and strategic risk

Business model risk arises from changes in the external environment including economic trends and competition. The Group's performance is dependent on the economic conditions and prospects of Cyprus. A deterioration of the macroeconomic environment stemming from the pandemic or other factors such as the Ukrainian crisis, pose downside risks for the financial performance of the Group.

The Group faces intense competition in the markets in which it operates, primarily originating from other commercial banks, branches and subsidiaries of foreign banks, and insurance companies offering savings, insurance and investment products. It also faces competition from financial technology companies. The Group remains today the biggest local banking organisation in Cyprus and a systemically important institution.

Any intensification of competition as a result of more competitive interest rates being offered on deposits and advances compared to those offered by the Group, may create pressure on Group profitability.

In order to mitigate the business model risk, the Group has a clear strategy with specific objectives, including actions to diversify income sources, developed within the risk appetite of the Group and closely monitored on a regular basis. The Group also closely monitors current and emerging risks within the business environment, while remaining ready to explore opportunities that complement its strategy. In addition, regular stress testing takes place to assess the Group's capital and liquidity adequacy.

3. Other risks (continued)

3.6 Legal risk

The Group may, from time to time, become involved in legal or arbitration proceedings which may affect its operations and results. Litigation risk arises from pending or potential legal proceedings and regulatory investigations against the Group (Note 25 of the Consolidated Financial Statements for 30 June 2022). In the event that legal issues are not properly dealt with by the Group, this may result in financial and/or reputational loss to the Group. The Group has procedures in place to ensure effective and prompt management of Legal risk including, among others, the risk arising from regulatory developments, new products and internal policies.

The Legal Services department monitors the pending litigation against the Group and assesses the probability of loss for each legal action against the Group based on International Accounting Standards. It also estimates the amount of potential loss where it is deemed as probable. Additionally, it reports pending litigation and latest developments to the Board of Directors.

3.7 Insurance risk and re-insurance risk

Insurance risk is the risk that an insured event under an insurance contract occurs and there is uncertainty with respect to the amount to be paid and the timing of the resulting claim. By the very nature of an insurance contract, this risk is largely random and therefore unpredictable.

The Group, through its subsidiaries EuroLife Ltd ('EuroLife') and General Insurance of Cyprus Ltd ('Genikes Insurance' or 'GI'), provides life insurance and non-life insurance services, respectively, and is exposed to certain risks specific to these businesses. Insurance events are unpredictable and the actual number and amount of claims and benefits will vary from year to year from the estimate established using actuarial and statistical techniques.

The above risk exposure is mitigated by the Group through the diversification across a large portfolio of insurance contracts. The variability of risks is also reduced by careful selection and implementation of underwriting strategy guidelines, as well as the use of reinsurance arrangements. Although the Group has reinsurance coverage, it is not relieved of its direct obligations to policyholders and is thus exposed to credit risk with respect to ceded insurance, to the extent that any reinsurer is unable to meet the obligations assumed under such reinsurance arrangements.

For that reason, the creditworthiness of reinsurers is evaluated by considering their solvency and credit rating and reinsurance arrangements are monitored and reviewed to ensure their adequacy as per the reinsurance policy. In addition, counterparty risk assessment is performed on a frequent basis.

Both EuroLife and Genikes Insurance perform their annual stress tests (ORSA) which aim to ensure, among others, the appropriate identification and measurement of risks, an appropriate level of internal capital in relation to each company's risk profile, and the application and further development of suitable risk management and internal control systems.

3.8 Digital transformation and technology risk

Technology risk arises from system downtimes impacting customer service which may be due to inadequate, failed, or unavailable systems, use of outdated, obsolete and unsupported systems, or systems which do not fully support the requirements of business. The Group is implementing its Digital Transformation Programme, involving changes to, or replacement of critical and/or outdated systems.

Digital transformation risk arises as banking models are rapidly evolving both locally and globally and available technologies have resulted in the customers' accelerated shift towards digital channels. Money transmission and data driven integrated services are also forecast to rapidly evolve in the coming years. How the Group adapts to these developments could impact the realisation of its market strategies and financial plans.

In the context of the overall business strategy, the Group assesses and develops its complementary technology strategy to support operations and mitigate these risks. The Group's policies, standards, governance and controls undergo ongoing review to ensure continued alignment with the Group's strategy for digital transformation. In order to achieve this, the Group engages with appropriate external experts.

3. Other risks (continued)

3.9 Climate Risks

Climate-related and environmental (C&E) risks may impact the financial services sector to varying degrees over the short, medium and long term. The extent to which physical and transition risk might impact a financial services firm will vary depending on firm business model, customer base, location as well as the transition process to a low-carbon economy.

• Physical risk refers to the financial impact of a changing climate, including more frequent extreme weather events and gradual changes in climate, as well as of environmental degradation, such as air, water and land pollution, water stress, biodiversity loss and deforestation. Physical risk is categorised as 'acute' when it arises from extreme events, such as droughts, floods and storms, and 'chronic' when it arises from progressive shifts, such as increasing temperatures, sea-level rises, water stress, biodiversity loss, land use change, habitat destruction and resource scarcity. This can directly result in, for example, damage to property or reduced productivity, or indirectly lead to subsequent events, such as the disruption of supply chains.

• Transition risk refers to an institution's financial loss that can result, directly or indirectly, from the process of adjustment towards a lower-carbon and more environmentally sustainable economy. This could be triggered, for example, by a relatively abrupt adoption of climate and environmental policies, technological progress or changes in market sentiment and preferences.

The Group has a dedicated team involved in developing the Group's Sustainability agenda considering the Group's approach to environmental, social and governance (ESG) issues, and the Risk Management Function is closely aligned with this initiative. 

Managing C&E risks is a key area of focus under the 'Environment' Pillar of BOC PCL's ESG strategy. In the EU, the ECB released guidance in November 2020 on how banks should manage C&E risks. The guidance sets out 13 supervisory expectations for institutions when formulating and implementing their business strategy, governance and risk management frameworks with the ultimate aim of encouraging greater transparency in C&E risk disclosures. In 2021, the Group has developed a C&E Risks Implementation Plan, which is being updated, covering each of the ECB's priorities, including actions to address gaps highlighted in the self-assessment, across a multi-year timeline. This plan was developed following engagement with key stakeholders from across the Group.

A number of actions have been initiated and are to be initiated for implementation in 2022 as part of the Group's implementation plan including:

· Risk identification and materiality assessment - an initial exercise has been completed which:

- Identified the parts of BOC PCL's Corporate and SME portfolios that might be sensitive to transition risks,

- Identified and qualitatively assessed the C&E risks that are relevant for Cyprus and BOC PCL.

· Data gap analysis: the analysis focused primarily on the immediate gaps in relation to the 2022 ESG Pillar III disclosures. Actions have been planned for the second half of 2022 to create the necessary fields in core systems and initiate data collection. It is expected that additional data needs will arise in relation to the incorporation of C&E risks in the credit underwriting process as well as the evolving ESG Pillar III disclosure requirements

· Carry out further ESG relating training across all levels of BOC PCL.

· Incorporation of C&E risks in the credit underwriting.

· The introduction of a suite of Climate Risk metrics.

· Development of an approach to measure the impact assessment of climate risk (including data requirements and identification of data proxies from external sources and/or data gathering from clients) on the business model.

3. Other risks (continued)

3.9 Climate Risks (continued)

The Group successfully completed the 2022 ECB supervisory Climate Risk Stress Test. The objective of the exercise was to assess how prepared banks are for dealing with financial and economic shocks stemming from climate risk. ECB considers the test as a learning exercise for banks and supervisors alike. It aims to identify vulnerabilities, best practices and challenges banks face when managing climate-related risk. This is not a pass-or-fail exercise, nor does it have direct implications for banks' capital levels. The results will feed into the Supervisory Review and Evaluation Process (SREP) from a qualitative point of view. Lessons learned will be integrated into the development of BOC PCL's internal stress tests capabilities going forward.

4. Capital management

The primary objective of the Group's capital management is to ensure compliance with the relevant regulatory capital requirements and to maintain healthy capital adequacy ratios to cover the risks of its business and support its strategy and maximise shareholders' value.

The capital adequacy framework, as in force, was incorporated through the Capital Requirements Regulation (CRR) and Capital Requirements Directive (CRD) which came into effect on 1 January 2014 with certain specified provisions implemented gradually. The CRR and CRD transposed the new capital, liquidity and leverage standards of Basel III into the European Union's legal framework. CRR establishes the prudential requirements for capital, liquidity and leverage for credit institutions. It is directly applicable in all EU member states. CRD governs access to deposit-taking activities and internal governance arrangements including remuneration, board composition and transparency. Unlike the CRR, member states were required to transpose the CRD into national law and national regulators were allowed to impose additional capital buffer requirements.

On 27 June 2019, the revised rules on capital and liquidity (Regulation (EU) 2019/876 (CRR II) and Directive (EU) 2019/878 (CRD V)) came into force. As an amending regulation, the existing provisions of CRR apply, unless they are amended by CRR II. Certain provisions took immediate effect (primarily relating to Minimum Requirement for Own Funds and Eligible Liabilities (MREL)), but most changes became effective as of June 2021. The key changes introduced consist of, among others, changes to qualifying criteria for Common Equity Tier 1 (CET1), Additional Tier 1 (AT1) and Tier 2 (T2) instruments, introduction of requirements for MREL and a binding Leverage Ratio requirement (as defined in the CRR) and a Net Stable Funding Ratio (NSFR).

The amendments that came into effect on 28 June 2021 are in addition to those introduced in June 2020 through Regulation (EU) 2020/873, which among other, brought forward certain CRR II changes in light of the COVID‑19 pandemic. The main adjustments of Regulation (EU) 2020/873 that had an impact on the Group's capital ratio relate to the acceleration of the implementation of the new SME discount factor (lower RWAs), extending the IFRS 9 transitional arrangements and introducing further relief measures to CET1 allowing to fully add back to CET1 any increase in ECL recognised in 2020 and 2021 for non-credit impaired financial assets and phasing in this starting from 2022 and advancing the application of prudential treatment of software assets as amended by CRR II (which came into force in December 2020). In addition, Regulation (EU) 2020/873 introduced a temporary treatment of unrealized gains and losses on exposures to central governments, to regional governments or to local authorities measured at fair value through other comprehensive income which the Group elected to apply and implemented from the third quarter of 2020. 

In October 2021, the European Commission adopted legislative proposals for further amendments to CRR, CRD IV and the BRRD (the '2021 Banking Package'). Amongst other things, the 2021 Banking Package would implement certain elements of Basel III that have not yet been transposed into EU law. The 2021 Banking Package includes:

· a proposal for a Regulation (sometimes known as 'CRR III') to make amendments to CRR with regard to (amongst other things) requirements on credit risk, credit valuation adjustment risk, operational risk, market risk and the output floor;

· a proposal for a Directive (sometimes known as 'CRD VI') to make amendments to CRD with regard to (amongst other things) requirements on supervisory powers, sanctions, third-country branches and ESG risks; and

4. Capital management (continued)

· a proposal for a Regulation to make amendments to CRR and the BRRD with regard to (amongst other things) requirements on the prudential treatment of G-SII groups with a multiple point of entry resolution strategy and a methodology for the indirect subscription of instruments eligible for meeting the MREL requirements.

The 2021 Banking Package is subject to amendment in the course of the EU's legislative process; and its scope and terms may change prior to its implementation. In addition, in the case of the proposed amendments to CRD and the BRRD, their terms and effect will depend, in part, on how they are transposed in each member state. As a general matter, it is likely to be several years until the 2021 Banking Package begins to be implemented (currently expected in 2025); and certain measures are expected to be subject to transitional arrangements or to be phased in over time. 

The CET1 ratio of the Group as at 30 June 2022 stands at 14.59% and the Total Capital ratio at 19.49% on a transitional basis. The ratios as at 30 June 2022 include reviewed profits for the six months ended 30 June 2022.

The minimum CET1 and Total Capital requirements are set out in the tables below.

* Fully phased in as of 1 January 2019

* Fully phased in as of 1 January 2019

The ECB has also provided non-public guidance for an additional Pillar II CET1 buffer (P2G).

The minimum Pillar I total capital requirement ratio is 8.00% and may be met, in addition to the 4.50% CET1 requirement, with up to 1.50% by AT1 capital and with up to 2.00% by T2 capital.

The Group is also subject to additional capital requirements for risks which are not covered by the Pillar I capital requirements (Pillar II add-ons). Applicable Regulation allows a part of the said Pillar II Requirements (P2R) to be met also with AT1 and T2 capital and does not require solely the use of CET1.

4. Capital management (continued)

In the context of the annual SREP conducted by the ECB in 2021 and based on the final 2021 SREP decision received in February 2022, the P2R was set at 3.26%, compared to the previous level of 3.00%. The additional P2R add-on of 0.26% relates to ECB's prudential provisioning expectations as per the 2018 ECB Addendum and subsequent ECB announcements and press release in July 2018 and August 2019. This component of the P2R add-on takes into consideration Project Helix 3. It is dynamic and can vary on the basis of in-scope NPEs and level of provisioning. The ECB has also provided revised lower non-public guidance for an additional Pillar II CET1 buffer. The new SREP requirements are effective from 1 March 2022.

The Group is subject to a 3% Pillar I Leverage Ratio requirement.

The above minimum ratios apply for both BOC PCL and the Group.

The capital position of the Group and BOC PCL as at 30 June 2022 exceeds both their Pillar I and their Pillar II add-on capital requirements. However, the Pillar II add-on capital requirements are a point-in-time assessment and therefore are subject to change over time.

The CBC, in accordance with the Macroprudential Oversight of Institutions Law of 2015, sets, on a quarterly basis, the CCyB rates in accordance with the methodology described in this law. The CBC has set the level of the CCyB rate for risk weighted exposures in Cyprus at 0.00% for the year 2021 as well as for the nine months up to September 2022. The CCyB for the Group as at 30 June 2022 has been calculated at 0.00%.

In accordance with the provisions of this law, the CBC is also the responsible authority for the designation of banks that are Other Systemically Important Institutions (O-SIIs) and for the setting of the O-SII Buffer requirement for these systemically important banks. BOC PCL has been designated as an O-SII and the CBC initially set the O-SII Buffer at 2.00%, revised to 1.50% in November 2021 with effect from 1 January 2022. This buffer is being phased in gradually, having started from 1 January 2019 at 0.50% and increasing by 0.50% on 1 January 2020 and by 0.25% on 1 January 2022, until being fully implemented on 1 January 2023 with the phasing-in by another 0.25%.

The EBA final guidelines on SREP and supervisory stress testing and the Single Supervisory Mechanism's (SSM) 2018 SREP methodology provide that the own funds held for the purposes of Pillar II Guidance (P2G) cannot be used to meet any other capital requirements (Pillar I, Pillar II requirements or the combined buffer requirement), and therefore cannot be used twice.

As part of the relaxation measures following the COVID-19 outbreak, on 12 March 2020, the ECB and the EBA also announced that banks are temporarily allowed to operate below the level of capital defined by Pillar II Guidance (P2G), the CCB and the CCyB. In July 2020, the ECB committed to allow banks to operate below P2G and the CBR until end of 2022, without automatically triggering supervisory actions. In February 2022, the ECB announced that it will not allow banks to operate below the level of capital defined by their P2G beyond December 2022.

4. Capital management (continued)

The capital position of the Group and BOC PCL as at the reporting date (after applying the transitional arrangements) is presented below:

The capital ratios of the Group and BOC PCL as at the reporting date on a fully loaded basis are presented below:

During the six months ended 30 June 2022 CET1 ratio was negatively affected mainly by the phasing in of IFRS 9 and other transitional adjustments on 1 January 2022, provisions and impairments, the payment of AT1 interest, the movement in the fair value through OCI reserves and other movements and was positively affected by pre-provision income. As a result, the CET1 ratio has decreased by 55 bps during the six months ended 30 June 2022.

The ECB, as part of its supervisory role, completed an onsite inspection and review on the value of the Group's foreclosed assets with reference date 30 June 2019. The findings relate to a prudential charge which will decrease based on BOC PCL's progress in disposing the properties in scope. The amount is being directly deducted from own funds since 30 June 2021. There was no significant movement in the amount deducted since 31 December 2021. As a result of the prudential charge deducted from own funds as at 30 June 2022, the impact on the Group's CET1 ratio is 36 bps.

7. Includes reviewed profits for the six months ended 30 June 2022.

8. As per 2021 Annual Financial Report and Pillar III Disclosures for the year ended December 2021.

9. Includes unaudited/unreviewed profits for the six months ended 30 June 2022.

10. CET1 includes regulatory deductions, comprising, amongst others, intangible assets amounting to €29,541 thousand for the Group and €25,072 thousand for BOC PCL as at 30 June 2022 (31 December 2021: €30,032 thousand for the Group and €26,452 thousand for BOC PCL). As at 30 June 2022 an amount of €13,024 thousand is considered prudently valued for CRR purposes and it is not deducted from CET1 (31 December 2021: €15,394 thousand).

11. Includes Credit Valuation Adjustments (CVA).

12. IFRS 9 and application of the temporary treatment of certain FVOCI instruments in accordance with Article 468 of CRR fully loaded.

4. Capital management (continued)

In April 2021, the Company issued €300 million unsecured and subordinated Tier 2 Capital Notes (the 'New T2 Notes') and immediately after, the Company and BOC PCL entered into an agreement pursuant to which the Company on-lent to BOC PCL the entire €300 million proceeds of the issue of the New T2 Notes on terms substantially identical to the terms and conditions of the New T2 Notes. At the same time, BOC PCL invited the holders of its €250 million Fixed Rate Reset Tier 2 Capital Notes due January 2027 (the 'Old T2 Notes') to tender their Old T2 Notes for purchase by BOC PCL, after which Old T2 Notes of €43 million remained outstanding.

At a meeting held on 30 November 2021, the Board of Directors resolved to exercise BOC PCL's option to redeem the remaining nominal amount outstanding of the Old T2 Notes. The outstanding Old T2 Notes were redeemed on 19 January 2022.

Transitional arrangements

The Group has elected in prior years to apply the 'static-dynamic' approach in relation to the transitional arrangements for the initial application of IFRS 9 for regulatory capital purposes, where the impact on the impairment amount from the initial application of IFRS 9 on the capital ratios is phased in gradually. The 'static-dynamic' approach allows for recalculation of the transitional adjustment periodically on Stage 1 and Stage 2 loans, to reflect the increase of the ECL provisions within the transition period. The Stage 3 ECL remains static over the transition period as per the impact upon initial recognition.

The amount added each year for the 'static component' decreases based on a weighting factor until the impact of IFRS 9 is fully absorbed back to CET1 at the end of the five years. The cumulative impact on the capital position as at 31 December 2021 was 50% and since 1 January 2022 at 75% of the impact on the impairment amounts from the initial application of IFRS 9. This will be fully phased in (100%) by 1 January 2023.

Following the June 2020 amendments to the CRR in relation to the dynamic component a 100% add back of IFRS 9 provisions was allowed for the years 2020 and 2021, reducing to 75% in 2022, to 50% in 2023 and to 25% in 2024. This will be fully phased in (100%) by 1 January 2025. The calculation at each reporting period is made against Stage 1 and Stage 2 provisions as at 1 January 2020, instead of 1 January 2018. The calculation of the 'static component' has not been amended.

In relation to the temporary treatment of unrealized gains and losses for certain exposures measured at fair value through other comprehensive income, Regulation EU 2020/873 allows institutions to remove from their CET1 the amount of unrealized gains and losses accumulated since 31 December 2019, excluding those of financial assets that are credit-impaired. The relevant amount is removed at a scaling factor of 100% from January to December 2020, reduced to 70% from January to December 2021 and to 40% from January to December 2022. The Group applies the temporary treatment from the third quarter of 2020.

Capital requirements of subsidiaries

The insurance subsidiaries of the Group, the General Insurance of Cyprus Ltd and Eurolife Ltd, comply with the requirements of the Superintendent of Insurance including the minimum solvency ratio. The regulated UCITS management company of the Group, BOC Asset Management Ltd, complies with the regulatory capital requirements of the Cyprus Securities & Exchange Commission (CySEC) laws and regulations. The regulated investment firm (CIF) of the Group, The Cyprus Investment and Securities Corporation Ltd (CISCO), complies with the minimum capital adequacy ratio requirements. From 2021 the new prudential regime for Investment Firms ('IFs') as per the Investment Firm Regulation (EU) 2019/2033 ('IFR') on the prudential requirements of IFs and the Investment Firm Directive (EU) 2019/2034 ('IFD') on the prudential supervision of IFs came into effect. Under the new regime CISCO has been classified as Non-Systemic 'Class 2' company and is subject to the new IFR/IFD regime in full. The payment services subsidiary of the Group, JCC Payment Services Ltd, complies with the regulatory capital requirements.

4. Capital management (continued)

Minimum Requirement for Own Funds and Eligible Liabilities (MREL)

The Bank Recovery and Resolution Directive (BRRD) requires that from January 2016 EU member states shall apply the BRRD's provisions requiring EU credit institutions and certain investment firms to maintain a minimum requirement for own funds and eligible liabilities (MREL), subject to the provisions of the Commission Delegated Regulation (EU) 2016/1450. On 27 June 2019, as part of the reform package for strengthening the resilience and resolvability of European banks, the BRRD ΙΙ came into effect and was required to be transposed into national law. BRRD II was transposed and implemented in Cyprus law in early May 2021. In addition, certain provisions on MREL have been introduced in CRR ΙΙ which also came into force on 27 June 2019 as part of the reform package and took immediate effect.

In December 2021, BOC PCL received notification from the SRB and CBC of the final decision for the binding MREL for BOC PCL, determined as the preferred resolution point of entry. As per the decision, the final MREL requirement is set at 23.74% of risk weighted assets and 5.91% of Leverage Ratio Exposure (LRE) (as defined in the CRR) and must be met by 31 December 2025. Furthermore, BOC PCL must comply since 1 January 2022 with an interim requirement of 14.94% of risk weighted assets and 5.91% of LRE. The own funds used by BOC PCL to meet the Combined Buffer Requirement (CBR) are not eligible to meet its MREL requirements expressed in terms of risk weighted assets. BOC PCL must comply with the MREL requirement at the consolidated level, comprising BOC PCL and its subsidiaries. The decision is subject to annual review by the competent authorities, updated also as changes in capital requirements become effective. 

The MREL ratio calculated according to the SRB's eligibility criteria currently in effect, and based on internal estimate, stood at 18.61% of RWAs as at 30 June 2022 and at 9.28% of LRE as at 30 June 2022. The ratios as at 30 June 2022 include unaudited/unreviewed profits for the six months ended 30 June 2022. The MREL ratio expressed as a percentage of RWAs does not include capital used to meet the CBR amount which stood at 3.75% as at 30 June 2022 and is expected to increase to 4.00% on 1 January 2023.

The MREL requirement is in line with BOC PCL's expectations and funding plans.

5. Internal Capital Adequacy Assessment Process (ICAAP), Internal Liquidity Assessment Process (ILAAP), Pillar II and Supervisory Review and Evaluation Process (SREP)

The Group prepares annual ICAAP and ILAAP packages. Both reports for 2021 have been completed and submitted to the ECB at the end of April 2022 following approval by the Board of Directors.

The Group also undertakes quarterly reviews of its ICAAP results (with reference date 30 June and 30 September) as well as on an ad-hoc basis if needed, which are submitted to the ALCO and the Risk Committee of the Board of Directors, considering the latest actual and forecasted information. During the quarterly review, the Group's risk profile and risk management policies are reviewed and any material changes/developments since the annual ICAAP exercise are assessed in terms of capital adequacy. The annual ICAAP for 2021, the quarterly ICAAP reviews undertaken in 2021 and a review performed in the first quarter of 2022, indicated that the Group has sufficient capital and available mitigants to support its risk profile and its business and to enable it to meet its regulatory requirements, both under a baseline and stress conditions scenarios.

The Group also undertakes a quarterly review for the ILAAP through quarterly stress tests submitted to the ALCO and the Risk Committee of the Board of Directors. Any material changes since the year-end are assessed in terms of liquidity and funding. The quarterly review identifies whether the Group has an adequate liquidity buffer to cover the stress outflows. The Group's ILAAP analysis demonstrates that the volume and capacity of liquidity resources available to the Group are adequate. Both the annual ILAAP for 2021 and the quarterly ILAAP reviews, undertaken in 2021 and 2022, indicated that BOC PCL's liquidity position is at a very comfortable level. BOC PCL maintains liquidity resources which are adequate to ensure its ability to meet obligations as they fall due under ordinary and stressed conditions.

5. Internal Capital Adequacy Assessment Process (ICAAP), Internal Liquidity Assessment Process (ILAAP), Pillar II and Supervisory Review and Evaluation Process (SREP) (continued)

The ECB, as part of its supervisory role, has been conducting the SREP and other inspections (onsite/ off-site/ targeted reviews/ deep-dives) on the Group. SREP is a holistic assessment of, amongst other things, the Group's business model, internal governance and institution-wide control arrangements, risks to capital and adequacy of capital to cover these risks and risks to liquidity and adequacy of liquidity resources to cover these risks. The objective of the SREP is for the ECB to form an up-to-date supervisory view of the Group's risks and viability and to form the basis for supervisory measures and dialogue with the Group. As a result of these supervisory processes, additional capital and other requirements could be imposed on the Group, including a revision of the level of Pillar II add-ons, as the Pillar II add-ons capital requirements are a point-in-time assessment and therefore subject to change over time.