SAFETY AND SOUNDNESS—Interest-Rate Risk; Interagency Advisory

The financial regulators¹ are issuing this advisory to remind institutions of supervisory expectations regarding sound practices for managing interest rate risk (IRR). In the current environment of historically low short-term interest rates, it is important for institutions to have robust processes for measuring and, where necessary, mitigating their exposure to potential increases in interest rates.

Current financial market and economic conditions present significant risk management challenges to institutions of all sizes. For a number of institutions, increased loan losses and sharp declines in the values of some securities portfolios are placing downward pressure on capital and earnings. In this challenging environment, funding longer-term assets with shorter-term liabilities can generate earnings, but also poses risks to an institution’s capital and earnings.

The regulators recognize that some degree of IRR is inherent in the business of banking. At the same time, however, institutions² are expected to have sound risk management practices in place to measure, monitor, and control IRR exposures. Accordingly, each of the financial regulators have established guidance on the topic of IRR management (see Appendix A). Although the specific guidance issued and the oversight and surveillance mechanisms used by the regulators may differ, supervisory expectations for sound IRR management are broadly consistent. The regulators expect all institutions to manage their IRR exposures using processes and systems commensurate with their earnings and capital levels, complexity, business model, risk profile, and scope of operations.³ Effective IRR management processes are particularly important for those institutions experiencing downward pressure on earnings and capital due to lower credit quality and market illiquidity.

This advisory re-emphasizes the importance of effective corporate governance, policies and procedures, risk measuring and monitoring systems, stress testing, and internal controls related to the IRR exposures of institutions. It also clarifies various elements of existing guidance and describes selected IRR management techniques used by effective risk managers. More detailed guidelines on the basic principles of IRR management discussed in this advisory can be found in each regulator’s established guidance.⁴

Importantly, effective IRR management not only involves the identification and measurement of IRR, but also provides for appropriate actions to control this risk. If an institution determines that its core earnings and capital are insufficient to support its level of IRR, it should take steps to mitigate its exposure, increase its capital, or both.

Existing interagency and international guidance identifies the board of directors as having the ultimate responsibility for the risks undertaken by an institution—including IRR. As a result, the regulators remind boards of directors that they should understand and be regularly informed about the level and trend of their institutions’ IRR exposure. The board of directors or its delegated committee of board members should oversee the establishment, approval, implementation, and annual review of IRR management strategies, policies, procedures, and limits (or risk tolerances). Institutions should understand the implications of the IRR strategies they pursue, including their potential impact on market, liquidity, credit, and operating risks.

Senior management is responsible for ensuring that board-approved strategies, policies, and procedures for managing IRR are appropriately executed within the designated lines of authority and responsibility. Management also is responsible for maintaining:

An institution’s IRR tolerance should be communicated so that the board of directors and senior management clearly understand the institution’s risk tolerance limits and approach to managing the impact of IRR on earnings and capital adequacy. IRR reports distributed to senior management and the board should provide aggregate information and supporting detail that is sufficient to enable them to assess the sensitivity of the institution to changes in market rates and important assumptions underlying the metrics used. Institutions with an Asset/Liability Committee (ALCO), or similar senior management committee, should ensure the committee actively monitors the IRR profile and has sufficiently broad representation across major functions that can directly or indirectly influence the institution’s IRR exposure (e.g., lending, investment securities, wholesale and retail funding).

Institutions are expected to have comprehensive policies and procedures governing all aspects of their IRR management process. Such policies and procedures should ensure the IRR implications of significant new strategies, products and businesses are integrated into IRR management process. Policies and procedures also should document and provide for controls over permissible hedging strategies and hedging instruments. Institutions should ensure the assessment of IRR is appropriately incorporated in firm-wide risk management efforts so that the interrelationships between IRR and other risks are understood.

IRR tolerances articulated in an institution’s policies should be explicit and address the potential impact of changing interest rates on earnings and capital from a short-term and a long-term perspective. Well-managed institutions generally specify IRR tolerances in the context of scenarios of potential changes in market interest rates and a target or range for performance metrics. Institutions with significant exposures to basis risk, yield curve risk, or positions with explicit or embedded options should establish risk tolerances appropriate for these risks.

Existing interagency guidance articulates supervisors’ expectations that institutions have robust IRR measurement processes and systems to assess exposures relative to established risk tolerances. Such systems should be commensurate with the size and complexity of the institution. Although institutions may rely on third-party IRR models, they are expected to fully understand the underlying analytics, assumptions, and methodologies and ensure such systems and processes are incorporated appropriately in the strategic (long-term) and tactical (short-term) management of IRR exposures.

Institutions use a variety of techniques to measure IRR exposure. The regulators continue to believe that well-managed institutions will consider earnings and economic perspectives when assessing the scope of their IRR exposure. Reduced earnings or outright losses adversely affect an institution’s liquidity and capital adequacy. Evaluating the impact of adverse changes in an institution’s economic value also is useful as it can signal future earnings and capital problems.⁵

Although simple maturity gap analysis for assessing the impact of changes in market rates on earnings may continue to be a viable analytical tool for small institutions with less complex IRR profiles, many institutions now use some form of simulation modeling to measure IRR exposure. In fact, current computer technology allows even some smaller, less sophisticated institutions to perform comprehensive simulations of the potential impact of changes in market rates on their earnings and capital. Most institutions primarily use simulations to assess the impact of changing rates on earnings. However, many simulation models have the capability of forecasting the impacts on both earnings and capital by generating pro-forma income statements and balance sheets. Most also have capabilities for assessing the impact of changing rates on the market value of the balance sheet. Institutions are encouraged to use the full complement of analytical capabilities of their IRR simulation models.

A key aspect of IRR simulation involves the selection of an appropriate time horizon(s) over which to assess IRR exposures. Simulations can be performed over any time horizon and often are used to analyze multiple horizons identifying short-term, intermediate-term, and long-term risk. When using earnings simulation models, IRR exposures are best projected over at least a two-year period. Using a two-year time frame will better capture the true impact of important transactions, tactics, and strategies taken to increase revenues which can be hidden by viewing projected results within shorter time horizons. However, to fully assess the impacts of certain products with embedded options, longer time horizons of five to seven years are typically needed.

In general, simulation models can be either static or dynamic. Static simulation models are based on current exposures and assume a constant balance sheet with no new growth. In contrast, dynamic simulation models rely on detailed assumptions regarding changes in existing business lines, new business, and changes in management and customer behavior. Both techniques are capable of incorporating assumptions about the future path of interest rates using simple deterministic scenario analysis, more sophisticated stochastic-path techniques, or Monte Carlo simulations.

Dynamic earnings simulation models can be useful for business planning and budgeting purposes. However, dynamic simulation is highly dependent on key variables and assumptions that are extremely difficult to project with accuracy over an extended period. Furthermore, model assumptions can potentially hide certain key underlying risk exposures. As such, when performing dynamic simulations, institutions should also run static simulations to provide ALCO or senior management a complete and comparative description of the institution’s IRR exposure.

Despite their many benefits, both static and dynamic earnings simulations have limitations in quantifying IRR exposure. As a result, economic value methodologies should also be used to broaden the assessment of IRR exposure.⁶ Economic value-based methodologies measure the degree to which the economic values of an institution’s positions change under different interest rate scenarios. The economic-value approach focuses on a longer-term time horizon, captures all future cash flows expected from existing assets and liabilities, and is more effective in considering embedded options in a typical institution’s portfolio.

In general, most economic value models use a static approach in that the analysis typically does not incorporate new business; rather, the analysis shows a snapshot in time of the risk inherent in the portfolio or balance sheet. However, some institutions have started to incorporate dynamic modeling techniques that provide forward-looking estimates of economic value.

Institutions are encouraged to use a variety of measurement methods to assess their IRR profile. Regardless of the methods used, an institution’s IRR measurement system should be sufficiently robust to capture all material on and off-balance sheet positions and incorporate a stress-testing process to identify and quantify the institution’s IRR exposure and potential problem areas.

The regulators remind institutions that stress testing, which includes both scenario and sensitivity analysis, is an integral component of IRR management. In general, scenario analysis uses the model to predict a possible future outcome given an event or series of events, while sensitivity analysis tests a model’s parameters without relating those changes to an underlying event or real world outcome.⁷

When conducting scenario analyses, institutions should assess a range of alternative future interest rate scenarios in evaluating IRR exposure. This range should be sufficiently meaningful to fully identify basis risk, yield curve risk, and the risks of embedded options. In many cases, static interest rate shocks consisting of parallel shifts in the yield curve of plus and minus 200 basis points may not be sufficient to adequately assess an institution’s IRR exposure. As a result, institutions should regularly assess IRR exposures beyond typical industry conventions, including changes in rates of greater magnitude (e.g., up and down 300 and 400 basis points) across different tenors to reflect changing slopes and twists of the yield curve. Institutions should ensure their scenarios are severe but plausible in light of the existing level of rates and the interest rate cycle. For example, in low-rate environments, scenarios involving significant declines in market rates can be deemphasized in favor of increasing the number and size of alternative rising-rate scenarios.

Depending on an institution’s IRR profile, stress scenarios should include but not be limited to:

The regulators recognize that not all financial institutions will require the full range of the scenarios discussed above. Non-complex institutions (e.g., institutions with limited embedded options or structured products on their balance sheet) may be able to justify running fewer or less intricate scenarios, depending on their IRR profile. However, interest rate shocks of sufficient magnitude should be run, regardless of the institution’s size or complexity. Institutions should ensure IRR exposures are incorporated and evaluated as part of the enterprise-wide risk identification and analysis process.

In addition to scenario analysis, stress testing should include a sensitivity analysis to help determine which assumptions have the most influence on model output. Institutions will generally focus more of their efforts in verifying the most influential assumptions. Additionally, sensitivity analysis can be used to determine the conditions under which key business assumptions and model parameters break down or when IRR may be exacerbated by other risks or earnings pressures.

At well-managed institutions, management compares stress test results against approved tolerances limits. Such reviews enable institutions to properly estimate and monitor key variables whose volatility will significantly affect IRR exposure. Moreover, in conducting stress tests, special consideration should be given to instruments or markets in which concentrations exist as such positions may be more difficult to unwind or hedge during periods of market stress.

Proper measurement of IRR requires regularly assessing the reasonableness of assumptions that underlie an institution’s IRR exposure estimates. The regulators remind institutions to document, monitor, and regularly update key assumptions used in IRR measurement models. At a minimum, institutions should ensure the reasonableness of asset prepayments, non-maturity deposit price sensitivity and decay rates, and key rate drivers for each interest rate shock scenario. Assumptions about non-maturity deposits are critical, particularly in market environments in which customer behaviors may not reflect long-term economic fundamentals, or in which institutions are subject to heightened competition for such deposits. Generally, rate-sensitive and higher-cost deposits, such as brokered and Internet deposits, would reflect higher decay rates than other types of deposits. Also, institutions experiencing or projecting capital levels that trigger brokered and high interest rate deposit restrictions should adjust deposit assumptions accordingly.⁸

When dynamic simulations of future growth and business assumptions are used, assessment of consistent replacement growth rate assumptions is particularly important. Customer behaviors can differ in various markets. Financial institutions should perform historical and forward-looking analyses to develop supportable assumptions and models relevant to their market and business plans.

Proper measurement of IRR also requires sensitivity testing of key assumptions that exert the greatest impact on measurement results. When actual experience differs significantly from past assumptions and expectations, institutions should use a range of assumptions to appropriately reflect this uncertainty. When assumptions are adjusted from prior reporting periods, the changes and their effects on model outputs should be documented and clearly identified.

Limit controls should be in place to ensure positions that exceed certain predetermined levels receive prompt management attention. An appropriate limit system should permit management to identify IRR exposures, initiate discussions about risk, and take appropriate action as identified in IRR policies and procedures. Further, a well-managed institution will find a balance between establishing limits that are neither so high that they are never breached nor so low that exceeding the limits is considered routine and not worthy of action.

Should IRR exposure exceed or approach these limits, institutions can mitigate their risk through balance sheet alteration and hedging. The most common way to control IRR is through the balance sheet mix of assets and liabilities. This involves achieving an appropriate distribution of asset maturities or repricing structures, with the maturity or repricing mix of liabilities that will avoid the potential for severe maturity or duration mismatches between assets and liabilities.

Using derivative instruments to mitigate IRR exposures may be appropriate for institutions with the knowledge and expertise in these instruments. Hedging with interest rate derivatives is a potentially complex activity that can have unintended consequences, including compounding losses, if used incorrectly.⁹ Each institution using derivatives should establish an effective process for managing interest rate risk. The level of structure and formality in this process should be commensurate with the activities and level of risk approved by senior management and the board. Institutions should not undertake this activity unless the board and senior management understand the institution’s hedging strategy when using these instruments, including the potential risks and benefits of the strategy. Reliance on outside consultants to assist in the establishment of such a strategy does not absolve the board and senior management of their responsibility to fully understand the risks of the derivatives hedging strategy. Hedging strategies should be designed to limit downside earnings exposure or manage income or economic value of equity (EVE) volatility.

The regulators expect institutions to have an adequate system of internal controls to ensure the integrity of all elements of their IRR management process, including the adequacy of corporate governance, compliance with policies and procedures, and the comprehensiveness of IRR measurement and management information systems. These controls should be an integral part of the institution’s overall system of internal controls and should promote effective and efficient operations, reliable financial and regulatory reporting, and compliance with relevant laws, regulations, and institution policies.

Validating IRR models is a fundamental part of any institution’s system of internal controls. An important element of model validation is independent review of the logical and conceptual soundness. The scope of the independent review should involve assessing the institution’s measurement of IRR, including the reasonableness of assumptions, the process used in determining assumptions, and the backtesting of assumptions and results. Management also should implement adequate follow-up procedures to monitor management’s corrective actions. The results of these reviews should be available for the relevant supervisory authorities.

Smaller institutions that do not have the resources to staff an independent review function should have processes in place to ensure the integrity of the various elements of their IRR management processes. Often, smaller institutions will use an internal party that is sufficiently removed from the primary IRR functions or an external auditor to ensure the integrity of their risk management process.

Institutions that use vendor-supplied models are not required to test the mechanics and mathematics of the measurement model. However, the vendor should provide documentation showing a credible independent third party has performed such a function.¹⁰ Large and complex institutions, or those with significant IRR exposures, may need to perform more in-depth validation procedures of the underlying mathematics. Validation practices could include constructing an identical model to test assumptions and outcomes or using an existing, well-validated “benchmark” model, which is often a less costly alternative. The benchmark model should have theoretical underpinnings, methodologies, and inputs that are as close as possible to those used in the model being validated. Large and more complex institutions have used “benchmarking” effectively to identify model errors that could distort IRR measurements. The depth and extent of the validation process should be consistent with the materiality and complexity of the risk being managed.

The adequacy and effectiveness of an institution’s IRR management process and the level of its IRR exposure are critical factors in the regulators’ evaluation of an institution’s sensitivity to changes in interest rates and capital adequacy. When evaluating the applicability of specific guidelines provided in this advisory and the level of capital needed for the level of IRR, the institution’s management and regulators should consider factors, such as the size of the institution, the nature and complexity of its activities, and the adequacy of its level of capital and earnings in relation to its overall IRR profile. Material weaknesses in risk management processes or high levels of IRR exposure relative to capital will require corrective action. Such actions could include recommendations or directives to:

IRR management should be an integral component of an institution’s risk management infrastructure. Management should assess the need to strengthen existing IRR practices by incorporating the supervisory expectations and management techniques highlighted in this advisory.