Risk management

The Group’s core business activities focus on financial products offered to Customers: individuals, entrepreneurs and enterprises, public and budgetary entities, non-bank financial institutions. On the liabilities side, short-term fixed-rate deposits as well as current and savings accounts dominate. On the asset side, the Group offers the following credit products: housing loans, cash loans, credit cards, overdrafts, investment and working capital loans, preferential loans with subsidies, factoring, leasing, guarantees, foreign trade finance transactions (e.g. letters of credit) – the vast majority of credit products are medium and long-term instruments, bearing interest based on short-term market rates.

The Group uses financial market instruments primarily to manage liquidity, interest rate and currency risks arising in its core business, in line with its internally adopted risk appetite and medium and long-term market trends.

The Group also offers access to financial market instruments to its Customers to hedge market risks – currency, interest rate or commodity price – that exist in their core business activities.

The principles of the Bank’s supervision over the credit risk generated by the activity of subsidiaries is specified in the Credit Policy of BNP Paribas Bank Polska S.A.

The Bank recommends, reviews and accepts policies, principles and methodologies applied by its subsidiaries in terms of credit risk management.

In the Bank and its subsidiaries, parallel credit risk management methods are applied, including:

• a rating system for Corporate Banking Customers and Small and Medium Enterprises Banking;
• risk classification system according to IFRS standards;
• assessment of the creditworthiness of the Bank’s joint Clients and companies;
• a model for making credit decisions;
• the Bank’s internal limits system for concentration risk, including limits on the subsidiaries’ portfolios of receivables.

Due to the outbreak of the COVID-19 pandemic in 2020, the Bank has taken a number of actions regarding, i.a.

• the possibility for Customers to request temporary deferrals of principal and interest payments on loans under non-statutory and statutory moratoria,
• review of the credit portfolio with special attention paid to sensitive industries, particularly strongly affected by the consequences of the pandemic.

The Bank actively participated in the work of the banking sector, regulators and arrangers of government aid directed at entrepreneurs, launched a number of solutions allowing Customers to electronically apply to the Bank and benefit from aid programmes related to the consequences of the pandemic, and carried out ongoing monitoring of the number of Customers and credit exposures affected by the consequences of the pandemic, including ongoing decisions regarding individual Customers as to the type and structure of Customer financing adequate to their current situation and available aid programmes.

The Bank also cooperated with Bank Gospodarstwa Krajowego with regard to liquidity guarantees offered to the Bank’s Customers and loan interest subsidy programmes.

As a partner of the Polish Development Fund programme, the Bank provided Customers with the technical possibility to apply for financing from these programmes via electronic banking.

In the period until 30 September 2020 the Bank focused on making the fullest possible use of available assistance programmes for Customers (non-statutory/private and statutory moratoria), including granting temporary deferment of instalment payments on loans, processing Customer requests in this regard on an ongoing basis. After 30 September 2020 until the end of 2020, Customer requests for deferment of instalments could be submitted and processed, but only in case of statutory moratoria. Since mid-January 2021, the Bank again has offered Customers non-statutory moratoria.

The Bank has monitored the behaviour of exposures covered by moratorium support. Exposures subject to statutory credit holidays are transferred to Phase 3. For exposures subject to non-statutory credit holidays the Bank applies stricter criteria for classification into Phase 2. For this pool of exposures, overdue more than 3 days within a horizon of 3 months after the end of the moratorium is an indication of a significant increase in credit risk (Phase 2), which results in the calculation of write-downs over the life horizon of the exposure.

As at 31.12.2020, the total gross value of loans and advances covered by the Group’s ongoing and expired moratoria amounted to PLN 7,251,102 thousand of which statutory moratoria amounted to PLN 135,935 thousand. The balance of expired moratoria at the end of 2020 amounted to PLN 6,949,777 thousand and the balance of active moratoria amounted to PLN 301,325 thousand.

Details of moratoria granted by the Bank and the Group are presented in the Note on Credit Risk of the Standalone and Consolidated Financial Statements for the year ended 31 December 2020.

In 2020, a total of PLN 829.0 million of receivables were collected, of which:

• PLN 287.7 million – as a result of collection activities (corporate entities PLN 26.2 million, SMEs PLN 21.4 million, micro-enterprises PLN 103.2 million, individual Customers PLN 104.3 million, mortgage loans PLN 32.6 million),
• PLN 417.2 million – as a result of portfolio restructuring (corporate entities PLN 243.2 million, SME PLN 174.0 million),
• PLN 124.1 million – as a result of sale of impaired portfolio.

Concentration risk is an inherent risk taken by the Bank within the framework of its statutory activity and is subject to a specific management process and rules.

The Management Board assesses the adopted concentration risk management policy in terms of the way it is applied, in particular as regards its effectiveness and adequacy of rules implementation in the context of current and planned activities and taking into account the risk management strategy. In the event of significant changes in the Bank’s operating environment or risk management strategy, the review of the adequacy of the concentration risk management process is carried out immediately after the occurrence of such circumstances. Proper assessment of the concentration risk incurred by the Bank significantly depends on correct and complete identification of key risk factors that affect the concentration risk level. In justified cases, the Bank identifies the concentration risk in the process of planning a new business, including the introduction and development of new products, services and presence on the markets, and significant changes to the existing products, services and changes on the markets.

Diversification of the credit portfolio is one of the most important tools for credit risk management. Excessive credit concentration is undesirable for the Bank, as it increases risk. Potential losses related to a significant threat – thus, the degree of concentration should be monitored, controlled and reported to the Bank’s management. The basic tools of concentration risk mitigation are mechanisms of identification and measurement of concentration risk and limits of exposures in particular segments of the Bank’s portfolio and in subsidiaries. These tools enable diversification of the credit portfolio and reduction of negative effects related to unfavourable changes in particular areas of the economy.

One of the potential sources of credit risk is a high concentration of the Bank’s credit exposures in particular entities or groups of entities related by capital and organisation. In order to limit it, Regulation (EU) No. 575/2013 defines the maximum exposure limit for the Bank. Pursuant to Article 395 of Regulation (EU) No. 575/2013: An institution shall not incur an exposure, after taking into account the effect of the credit risk mitigation in accordance with Articles 399 to 403, to a Client or group of connected Clients the value of which exceeds 25% of its eligible capital. Where that Client is an institution or where a group of connected Clients includes one or more institutions, that value shall not exceed 25% of the institution’s eligible capital or EUR 150 million, whichever the higher, provided that the sum of exposure values, after taking into account the effect of the credit risk mitigation in accordance with Articles 399 to 403, to all connected Clients that are not institutions does not exceed 25% of the institution’s eligible capital.

The Bank monitors concentration limits in accordance with Article 387 of the EU Regulation No. 575/2013. As at the end of 2020, the limits specified in Article 395 of the EU Regulation No. 575/2013 were not exceeded. As at the end of 2020, the Bank’s exposure to financing ustomers / groups of Customers with capital or organisational links does not exceed the exposure concentration limit. The total of exposures equal to or exceeding 10% of the Bank’s own funds represented 15%.

The concentration risk tolerance is defined in the Bank through a system of internal limits, which take into account both the directions and dynamics of business development assumed by the Bank, the acceptable level of credit risk and liquidity, as well as external macroeconomic and sectoral conditions and prospects. Internal limits for credit concentration risk are set for, i.a.:

• selected economic sectors/ industries,
• exposures denominated in foreign currency,
• Customer segment (the Bank’s internal segmentation),
• loans secured by a given type of collateral,
• geographical regions,
• the average probability of default,
• exposures with a specific rating (the Bank’s internal rating scale),
• exposures with a specific debt-to-income ratio,
• exposures with a specific loan-to-value ratio.

Actions reducing the Bank’s exposure to concentration risk may include systemic actions and case-by-case actions related to a single / specific decision or transaction. Systemic actions limiting the concentration risk include:

• limiting the scope of lending to specific types of Customers by modifying the credit policy,
• reducing the concentration risk limits,
• diversification of asset types at the level of the Bank’s statement of financial position,
• changing the business strategy in such a way that it prevents excessive concentration,
• diversification in the types of collateral received.

Case-by-case actions (related to a single / specific decision or transaction) limiting the concentration risk include:

• limiting new transactions with a given Customer or group of connected Customers,
• sale of selected assets / loan portfolios,
• securitisation of assets,
• establishment of new collateral (e.g. credit derivatives, guarantees, subparticipation, insurance contracts) for existing or new credit exposures.

The Bank’s industry concentration analysis covers all the Bank’s credit exposures to institutional Customers. The Bank defines industries based on the Polish Classification of Activities (PKD 2007 code). The structure of the Bank’s exposure to industries analysed at the end of 2020, similarly as at the end of 2019, is characterised by concentration towards such industries as: Agriculture, Forestry, Hunting and Fishing (in accordance with the section defined in the PKD). As at the end of 2020, they accounted for 26% of the Bank’s exposure towards institutional Clients, while in at the analogical period-end of the previous year they constituted 28% of the Bank’s exposure.

As at the end of 2020, the largest share of non-performing loans was observed in the following industries: Entertainment and Recreation activities (21%), Accommodation and food service activities (20.5%).

Country risk comprises all risks related to conclusion of financial agreements with foreign parties, where it is possible that economic, social or political events will have an adverse effect on creditworthiness of the Bank’s obligors in a given country or where intervention of a foreign government could prevent the obligor (which could also be the government itself) from discharging its liabilities.

During 2020, the Bank continued its conservative policy concerning country risk. Country limits have been reviewed periodically and the limit level modified to match precisely the anticipated business needs and risk appetite of the Bank.

As at year-end 2020, transactions related to foreign credit activity of the Bank represented 54% of the Bank’s exposure toward countries, treasury transactions (including deposits and derivatives) represented 14%, while the remaining part, i.e. 32%, was related to international trade transactions (letters of credit and guarantees). France accounted for 33% of the exposure, the Netherlands and Luxembourg for 11% each, Czech Republic for 8% and Switzerland for 7%. The remaining exposures were concentrated in Belgium, Germany, Turkey and Austria.

The Bank limits the risk of financing, which is associated with the risk of having insufficient stable sources of financing in the medium- and long-term and with the necessityto incur an unacceptable level of losses.

The Bank’s loans are financed mainly with the use of Customers’ current and term deposits and it is the Bank’s intention to maintain a stable relationship between these items and the funds deposited in the accounts of non-banking institutions, which is presented in the table below:

As at the end of 2020, compared to December 2019, the amount of wholesale funding received from the BNP Paribas Group remained at the same level. The Bank finances its foreign currency loans with deposits accepted from Customers using, if necessary, foreign exchange transactions. In case of a necessity, the Bank may use funds from medium and long-term loans from the BNP Paribas Group, which provides stable financing to cover currency shortages in EUR, USD or CHF. At the end of 2020, the Bank has raised a 2.3 PLN billion subordinated loan to meet the MREL requirement.

As at 31 December 2020, the structure of open long-term lines of credit was as follows:

The net liquidity coverage ratio (LCR) for the Bank at the end of 2020 equaled 181%, which constitutes an increase of 19 p.p. as compared to the end of 2019 (162%).

In addition, in the process of securitisation of the loan portfolio, the Bank received financing of the total amount of PLN 1,390 million.

The Bank maintains and develops an operational risk management system that comprehensively integrates the management of individual types of operational risk in all areas of the Bank’s operations. The objective of the operational risk management system is to ensure the safety of the Bank’s operations by implementing effective mechanisms for identification, assessment and quantification, monitoring, control, reporting and taking actions aimed at reducing operational risk. Such measures take into account the structures, processes, resources and scopes of responsibilities for the aforementioned processes at various organisational levels within the Bank.

The operational risk management strategy is described in the “Operational Risk Management Strategy of BNP Paribas Bank Polska S.A.”, approved by the Management Board of the Bank and endorsed by the Supervisory Board. “The Operational Risk Policy BNP Paribas Bank Polska S.A.”, adopted by the Management Board of the Bank, includes the organisational framework and standards for operational risk management. These documents address all areas of the Bank’s operations as well as define the Bank’s objectives and methods achieving them with regard to the quality of operational risk management and compliance with legal requirements set out in the recommendations and resolutions issued by local banking supervision authorities.

The Bank’s operational risk management objectives include, in particular, compliance with high operational risk management standards that guarantee security of Customer deposits, the Bank’s equity, stability of its financial result as well as maintenance of the operational risk level within the range of the operational risk appetite and tolerance defined by the Bank. While developing the operational risk management system, the Bank complies with the applicable legal requirements, in particular the recommendations and resolutions of the national financial supervision authorities and the standards adopted by the BNP Paribas Group.

In accordance with the “The Operational Risk Policy BNP Paribas Bank Polska S.A.”, the Bank’s operational risk management instruments include:

• tools used to record operational events, together with the principles of their recording, allocation and reporting;
• operational risk analysis, its monitoring and ongoing control;
• counteracting elevated operational risk levels, including risk transfer;
• calculation of the capital requirement related to operational risk.

Compliance with the operational risk policy is verified by the Bank’s Management Board periodically and, if necessary, the required adjustments are made in order to improve the system. To that purpose, the Management Board of the Bank is regularly provided with information concerning the scale and types of operational risk to which the Bank is exposed, its effects and management methods.

The Bank precisely defines the roles and responsibilities in the operational risk management process, considering its organisational structure. The Operational Risk Department is responsible for day-to-day operational risk analysis in addition to development of appropriate risk control and mitigation techniques and their improvement. Development and implementation of the Bank’s strategy with respect to insurance as a risk mitigation technique is the responsibility of the Real Estate and Administration Department, while the Security and Continuity of Business Management (CoB) Department focuses on management of continuity of business.

As part of the legal risk management process, the Legal Division monitors, identifies and performs analyses of changes to laws of general application and their effect on the Bank’s operations, in addition to court and administrative proceedings which affect the Bank. The Compliance Department is responsible for day-to-day compliance risk analysis as well as development of appropriate risk control techniques and their improvement.

Considering the elevated level of external and internal risks related to fraud and offence against the assets of the Bank and its Customers, the Bank has extended the scope of and improved its processes aimed at counteracting, detecting and examining such cases, which is the responsibility of the Fraud Management Department.

The Bank places a strong focus on identification and assessment of the factors that trigger its present exposure to operational risk in relation to banking products. It is the Bank’s objective to reduce the operational risk level through improvement of its internal processes as well as mitigating the risk inherent in the process of launching new products and services and outsourcing operations to third parties.

In accordance with the “The Operational Risk Policy BNP Paribas Bank Polska S.A.”, operational risk analysis is aimed at acquiring an understanding of the interdependence between the risk generating factors and operational event types, and it is performed primarily with the objective to define the operational risk profile.

The operational risk profile is the assessment of materiality of the risk, which is understood as the scale and structure of the operational risk exposure, defining the degree of exposure to the operational risk (operational losses), within the structural dimensions selected by the Bank (key process areas) and the scale dimensions. Periodic assessment and review of the Bank’s operational risk profile is based on an analysis of the Bank’s current risk parameters, changes and risks occurring in the Bank’s environment, implementation of the business strategy, as well as the adequacy of the organisational structure and the effectiveness of the risk management and internal control system.

Keeping a track record of operational events enables efficient operational risk analysis and monitoring. The process of operational event recording is overseen by the Operational Risk Department, which is responsible for verification of the quality and completeness of data concerning operational events recorded in dedicated tools available to all organisational units of the Bank.

The purpose of internal control is effective risk control, including risk prevention or early detection. The role of the internal control system is to achieve general and specific objectives of the internal control system, which should be considered at the design stage of control mechanisms. The principles of the internal control system are described in the „Policy on internal control at BNP Paribas Bank Polska S.A.”, approved by the Bank’s Management Board. This document describes the main principles, organisational framework and standards for the functioning of the control environment in the Bank, complying with the PFSA’s requirements provided in Recommendation H. Detailed internal regulations concerning specific areas of the Bank’s activity are adapted to the specifics of the Bank’s operations. The appropriate organisational units of the Bank, in accordance with the scope of the tasks assigned to them, are responsible for developing detailed regulations relating to the area of internal control.

The internal control system in the Bank is based on the 3 lines of defence model, which consists of:

• 1st line of defence, which are organisational units from particular areas of banking and support areas,
• 2nd line of defence, which are organisational units responsible for risk management, regardless of the risk management related to the first line of defence, and the compliance unit,
• 3rd line of defence, which is the independent and impartial internal audit unit.

The Bank ensures internal control through independent monitoring of compliance with control mechanisms, including ongoing verification and testing.

The Bank periodically monitors the efficiency of the operational risk management system and its appropriateness for its current risk profile. The organisation of the operational risk management system is reviewed as part of periodic control exercised by the Internal Audit Division, which is not directly involved in the operational risk management process but provides professional and independent opinions supporting achievement of the Bank’s objectives. The Supervisory Board oversees the control of the operational risk management system and assesses its adequacy and effectiveness.

In accordance with the applicable regulations, the Bank determines regulatory capital to cover the operational risk. The Bank uses the standardised approach (STA) for calculation of the capital requirement. Subsidiaries of the Bank, on a consolidated basis, determine the capital requirements according to the basic indicator approach (BIA).

In accordance with supervisory regulations, the Bank supervises the operational risk related to the operations of its subsidiaries. Operational risk management in subsidiaries is carried out within dedicated units / persons appointed for this purpose. The manner and methods of operational risk management in subsidiaries are organised adequately to the scope of operations of the entity and its business profile, in accordance with the principles in force at the Bank.