The following risks were recognized as material in the operations of the Group as of December 2017:

The bank organises credit risk management processes in line with the principles and requirements set out in the resolutions and recommendations of the Polish Financial Supervision Authority (in particular Recommendation S, T and C) and CRR/CRDIV, which address issues related to credit risk management.

Credit risk inherent in financing of mBank Group clients is assessed based on shared statistical models developed for the AIRB (Advanced Internal Rating-Based) approach and uniform tools, and is based on common definitions of terms and parameters used in the credit risk management and rating process. The bank ensures their cohesion at the Group level.

The Group uses different models for particular client segments. The rules governing clear assignment of clients to a system are defined in the bank and the Group subsidiaries internal regulations.

In their credit risk management process, the bank and the Group subsidiaries use the core risk measures defined under the AIRB approach:

• PD – Probability of Default (%),
• LGD (Loss Given Default) – estimated relative loss in case of default (%),

• EAD (Exposure at Default) – estimated exposure at the time of default (amount),
• EL – Expected Loss taking into account the probability of default (amount);

and related measures including:

• RD (Risk Density) – relative expected loss defined as EL to EAD (%),
• LAD (Loss at Default) – estimated loss (amount) in case of default (the product of EAD and LGD).

In the decision-making process, for reporting and communication with business units, PD and EL are expressed in the language of rating classes whose definitions (Masterscale) are uniform across the Commerzbank Group.

In its credit risk management process, the bank also attaches great importance to the assessment of unexpected loss. For this purpose, the bank uses the RWA (Risk Weighted Assets) measure, which is applied, under the AIRB approach, to calculate regulatory capital required to cover credit risk (unexpected loss).

In managing mortgage-secured credit exposures the Group uses the LtV ratio (Loan to Value), i.e. the value of the loan to the market value (or mortgage banking calculated value) of the real estate which secures the loan.

Stress testing is an additional tool of credit risk assessment. Stress testing of the regulatory capital and economic capital required to cover credit risk is carried out quarterly.

In addition to the tools listed above, which are applied both in the corporate and in the retail credit risk measurement, the Group uses tools specific to these areas.

In order to minimise credit risk, the Group uses a broad range of collateral for credit products, which also enable active management of the capital requirement. In the assessment of the quality of collaterals for risk products, mBank and mLeasing use the MRV ratio (Most Realistic Value) reflecting the pessimistic variant of debt recovery from the collateral through forced sale.

In addition, the RORAC ratio (Return on Risk Adjusted Capital) is applied in the decision-making process and the assessment of profitability of a client in the CRM system.

Retail credit risk measures are constructed to reflect the characteristics of this customer segment and, in the case of portfolio measures, the high granularity of the loan portfolio:

• DtI (Debt-to-Income) – i.e. monthly credit payments to the net income of a household (used for individual customers).
• DPD (Days-Past-Due) – a family of portfolio risk measures based on the number of days past due date (e.g. share of contracts which are from 31 to 90 days past due date in the total portfolio by number or by value).
• Vintage ratios, which present the quality of cohorts of loans grouped by disbursement time at a different phase of their lifetime.
• RC LLP (Risk Cost LLP) – cost of risk for a loan portfolio (segment), i.e. increment in loan loss provisions to the performing loan portfolio balance.
• Roll-rates, which measure the migration of contracts between days-past-due brackets (1-30, 31-60, 61-90 DPD, etc.).

Corporate and Investment Banking

In accordance with the Corporate Credit Risk Management Strategy in mBank Group, the main goal in this area is defining a safe level of risk appetite in sales of risk-bearing products to the Group clients and use synergies by integrating the offer of the bank and Group subsidiaries. The Strategy is realised by credit risk policies, including industry policies, limits reducing the risk and the principles of risk assessment of business entities applying for financing. The bank manages credit risk both at the single entity level and the consolidated level. The Strategy as well as the credit risk policies were updated in 2017, taking into consideration particularly risk appetite, present economic trends and prospects for development of sectors, industries and groups of clients being financed by the bank.

In 2017 the project of restructuring corporate credit process was continued. The purpose was to improve effectiveness of processes. The process of assessment of small exposures was centralized and the decision-making powers were adjusted to these modifications.

The Group actively manages credit risk aiming to optimise profitability taking into account return on risk. Analyses of the Group’s risks are performed on an on-going basis. Risk management is supported by analyses of the Group’s credit portfolio structure, limits, guidelines and recommendations on the Group’s exposure to selected sectors and geographic markets. In its current credit risk management and determination of concentration risk, the bank performs quarterly portfolio analyses using a Steering Matrix which incorporates PD rating and LAD.

The bank monitors credit portfolio on a quarterly basis including an analysis of the dynamics of change in size and (sector) segmentation of the credit portfolio, client risk (analysis of PD rating), quality of collateral against credit exposures, the scale of change in EL, Risk Density, and default exposures.

In the corporate banking the Group avoids concentration in industries and sectors where credit risk is considered excessively high. The bank uses industry limits to manage the sector concentration risk. In 2017 new methodology of assigning industry limits was introduced and it enhances the existing mechanisms for controlling industry concentration risk by using quantitative factors based on portfolio data while maintaining the importance of expert’s opinions as well.

In compliance with the Recommendation S of the Polish Financial Supervision Authority, the bank has identified a mortgage-secured credit exposure portfolio in retail and corporate banking and applies the Mortgage-Secured Credit Exposure Risk Management Policy. The bank manages the mortgage-secured credit exposure portfolio risk with a focus on defining an optimised portfolio structure in terms of quality (rating), currencies, country regions, tenors, and types of properties.

mBank Group strives to unlock synergies with Commerzbank more broadly in syndicated finance of selected Group clients. For international companies, non-banking financial institutions and biggest corporate clients, mBank Group promotes innovative products with low capital consumption, in particular products of investment banking (ECM, DCM, M&A), transactional banking and financial markets instruments.

mBank promotes financing alternative to banking loans by arranging public and private programmes and club deals for bonds issued by clients with a stable financial position.

Retail Banking

Lending in retail banking is a key segment of the Group’s business model, both in terms of the share in total assets and the contribution to its profits.

The bank’s retail credit offer covers a broad range of products financing the needs of individual customers (OF) and micro-companies (MF). The offered credit products in combination with the constantly upgraded transactional platform, savings and insurance products address all financial needs of clients within the Group.

Apart from the Polish market, the Retail Banking credit products are offered through the foreign branches (OZ) of the bank in the Czech Republic and Slovakia in an online banking model similar to that operating in Poland. The share of the foreign branches’ exposure portfolio was around 10% of the aggregate retail portfolio at the end of 2017 (by value). The bank ensures the coherence of the credit risk management policy on all markets; any differences in specific rules or parameter values in credit policy derive from the specificities of local markets or different goals of business strategies and are at each time subject to approval by the Retail Banking Risk Committee.

As credit exposures are highly granular (more than 2 million active loans), the retail banking credit risk management process is based on a portfolio approach. This is reflected in the statistical profile of risk rating models including the models which fulfil the regulatory requirements of the Advanced Internal Ratings-Based approach (AIRB). The AIRB parameters (PD, LGD and EL) are used widely in order to estimate credit requirements, to determine acceptance criteria and terms of transactions, and to report risks.

Furthermore, the Retail Banking credit risk management has the following characteristics:

• high standardisation and automation of the credit process, including decision-making, both in acquisition, post-sale services, and debt collection;
• little (as compared to Corporate Banking) discretionary competences in the decision-making process (e.g. no discretionary adjustment of clients’ ratings);
• extensive risk reporting system based on portfolio analysis of credit exposure quality, including vintage analysis and roll-rates analysis.

Under the portfolio approach, exposures are classified (separately for each market) as ML (mortgage-secured products) or NML (unsecured products or products with non-mortgage collateral). Furthermore, the segmentation includes products for individuals (ML OF, NML OF) and products for business clients (ML MF, NML MF).

The main point of reference in the retail banking credit risk management process is risk appetite defined in correlation with the strategy of the mBank Group. The general principle underlying the lending strategy of the Group in terms of sales of retail loans is to address the offer to clients who have an established relationship with the bank or to address it to new clients for whom the loan is a product initiating a long-term relationship of highly transactional nature. Consequently, the bank continues to focus its NML policies on lending to existing clients with a high creditworthiness while systematically growing the acquisition of external clients. To achieve this growth bank provides financing to clients doing shopping online. To reduce risks of accepting new clients, the bank develops its credit policy using, among others, credit testing and is actively developing its fraud prevention system.

mBank decided to restore acquisition of mortgage products for private individuals in mBank effective on July 22, 2017. Until that day, the sale of loans for financing residential real estate took place in mBank Hipoteczny. The new acquisition will be still restricted to products which may be financed with issue of mortgage bonds – non-purpose mortgage loans and loans to finance cooperative ownership right to premises are withdrawn from the offer. Those exposures will then be transferred to mBank Hipoteczny in the pooling process to enable the issue of mortgage bonds. The conservative policy of assessing borrowers’ reliability and creditworthiness is maintained; taking into account, inter alia, current, historically lowest, levels of interest rates, the Group attaches special attention to the application of long-term estimates of interest rate while assessing creditworthiness.

Additionally, in order to mitigate the risk associated with a decrease in the value of mortgage collateral in relation to the value of credit exposure, the Group’s credit offer is (and will be) directed mainly to clients who buy properties within large urban areas.

Quality of the mBank Group loan portfolio

As of December 31, 2017, the share of impaired exposures in the total (gross) amount of loans and advances granted to clients decreased to 5.2% from 5.4% at the end of 2016.

Provision for loans and advances to customers increased from PLN 2,817.5 million at the end of December 2016 to PLN 2,911.9 million at the end of December 2017. The IBNI (Incurred But Not Identified) loss provision increased from PLN 226.4 million to PLN 243.8 million in that period.

The ratio of provisions to non-performing loans increased to 59% from 57% in 2016.

In 2017 the demands for payment for corporate clients amounted to 37 compared to 7 a year earlier. In 2017 in Retail Banking segment above 26 thousand actions were brought in order to obtain enforceable title for non-mortgage loans in comparison to 14.5 thousand actions brought a year earlier. For mortgage loans the number of actions amounted to 161 compared to 168 in 2016.

The manner of identifying evidence of default is based on all available credit data of a given client and encompasses all of the client’s liabilities towards the bank.

At the end of December 2017, the loans and advances (net) to customers rose by 3.3%. The increase was driven mainly by the rising volume of corporate portfolio loans.

In the portfolio of individuals, the decrease of term loans was nearly offset by the increase in current accounts.

The table below presents the quality of mBank Group loan portfolio as at the end of December 2017 compared to the end of 2016.

mBank organises market risk management processes in line with the requirements resulting from the law and supervisory recommendations, in particular the PFSA Recommendations (among others A, C, G and I) and EBA guidelines, concerning market risk management.

In its business, mBank is exposed to market risk, i.e. the risk of unfavourable changes in the present value of financial instruments in the bank’s portfolios due to changes in market risk factors: interest rates, FX rates, stock prices and index value, the implied volatility of options, and credit spreads. In terms of the banking book mBank identifies interest rate risk, which is defined as a risk of adverse change in both valuation of banking book positions and net interest income arising from adverse movements in interest rates.

The bank identifies market risk related to positions of the trading book measured at fair value (using the direct measurement method or the model measurement method) which may materialise in the form of losses reflected in mBank’s financial performance. Moreover, the bank attributes market risk to the banking book positions, regardless of the methods for calculating earnings generated from those positions used for the purpose of accounting reporting. In particular, in order to measure the interest rate risk of Retail and Corporate Banking products without a fixed interest revaluation date or with rates administered by the bank, the bank uses replicating portfolio models. The bank uses the capital modelling concept, which is reflected in market risk measurement at the level of the bank’s internal organisational structures. Market risk measures of the interest positions of the banking book are calculated with the use of net present value (NPV) models.

Cross currency basis risk of CIRS transactions position, resulting from realization of funding strategy assumptions regarding CHF mortgage portfolio, is limited as part of stress test scenarios and within Value at Risk calculation.

The implementation of market risk management strategy involves managing the bank’s positions in a way enabling to maintain market risk profile within the risk appetite defined by the bank.

The bank is focused on meeting customers’ business needs, while reducing trade in derivatives in terms of currency, currency pairs, nominal values and tenors of transactions, as well as applying the principle of lack of commodity open positions. The bank conducts trading activity on well-known markets using financial instruments the bank has adequate expertise in and that have been approved for trading.

Bank stabilizes interest income using long-term fixed-rate assets and derivatives and assuming – for stable parts of equity and current accounts – the maximum modelled maturity profile of 5 years. Managing interest rate risk of the banking book takes into account the economic and accounting perspectives, and the financial instruments used for hedging are adequate to the bank’s expertise and have been approved for trading.

The market risk profile is derived from the strategic goals of business units, the policy of the Committee (ALCO) in charge of shaping the structure of the Group’s assets and liabilities and the limits on market risk exposure established by the Financial Markets Risk Committee (KRF) at the bank level, and by the Management Board and Supervisory Board at the Group level. The system of limits reflects in a quantitative manner the defined risk appetite.

In accordance with the previously described general principles of risk management, market risk management is organized under so-called three lines of defence. The main principle of organisation of the market risk management process stipulates separation between the market risk monitoring and control function and the functions related with opening and maintaining open market risk positions.

In addition, the bank applies the rule of organizational separation between managing banking book operations (including portfolios of Treasury Department, Debt Securities Issue Department and Structured and Mezzanine Finance Department) and trading book operations (including portfolios of Financial Markets Department and Own Transactions Division in Brokerage Bureau).

The main sources of market risk of the Group are mBank’s positions. The table below shows VaR statistics (VaR at a 97.5% confidence level for a one-day holding period) for mBank Group in 2017 for individual members of the Group in which market risk positions were identified (i.e. portfolios of mBank, mBank Hipoteczny, mLeasing) and their decomposition to the VaR corresponding to the main risk factor types – interest rate risk (VaR IR), foreign exchange risk (VaR FX), stock prices/index value risk (VaR EQ), and credit spread risk (VaR CS).

The table below presents VaR statistics in 2017:

For comparison, at the end of 2016, VaR for mBank Group was PLN 28,438 thousand, including VaR of mBank at PLN 28,037 thousand, mBank Hipoteczny – PLN 459 thousand and mLeasing – PLN 212 thousand.

The graph below presents changes in VaR for mBank Group in 12 months to 31.12.2017 (PLN million):

VaR for mBank Groupby risk factors

Stress testing

The result of stress tests for mBank Group in 2017 is presented in the table below:

In 2017, the average utilisation of the stress test limit for mBank Group without capital modelling was 59% (PLN 791.9 million) and with capital modelling was 61% (PLN 870.4 million).

mBank organises liquidity risk management processes in line with the requirements resulting from the law and supervisory recommendations in particular the PFSA Recommendations (among others P, C, H and S) as well as EBA guidelines concerning liquidity risk management.

In its operations, mBank is exposed to liquidity risk, i.e. the risk of being unable to honour its payment obligations, arising from the bank’s balance-sheet and off-balance-sheet positions, on terms favourable to the bank and at a reasonable price.

In terms of its sources, liquidity risk may result from internal factors (reputation risk resulting for instance in excessive withdrawal of cash by bank clients, materialisation of credit risk) and external factors (turbulences and crises in the financial markets, country risk, turbulences in the operation of clearing systems).

For this purpose, the bank has defined a set of liquidity risk measures and a system of limits and warning thresholds which protect the bank’s liquidity in the event of unfavourable internal or external conditions. Independent measurement, monitoring and controlling of liquidity risk is performed daily by the Integrated Risk and Capital Management Department. The main measures used in liquidity risk management of the bank include measures based on liquidity gap calculation in LAB methodology in force since December 6, 2017, ANL (Available Net Liquidity) measures until December 5, 2017, the regulatory measures (M1, M2, M3, M4), LCR, and also NSFR (Net Stable Funding Ratio) for analysis only. LAB/ANL measures reflect the projected future cash flow gap of assets, liabilities and off-balance-sheet commitments of the bank, which represent potential risk of being unable to meet liabilities within a specific time horizon and under a certain scenario.

The methodology for measuring the liquidity gap (LAB) includes normal conditions scenario LAB Base Case, stress scenarios subject to limits:

• LAB Bank Stress (short-term) – short-term scenario (up to 2 weeks) of the idiosyncratic stress,
• LAB Market Stress (long-term) – long-term scenario (up to 2 months) of the market crisis,
• LAB Combined Stress I – combined stress scenario that presents the effects of the simultaneous occurrence of short-term idiosyncratic stress and long-term market related stress,

as well as stress scenarios which are not limited:

• LAB Bank Stress (long-term),
• LAB Market Stress (short-term),
• LAB Combined Stress II.

ANL scenarios included base scenario (ANL Base), and three liquidity stress test scenarios: internal (ANL Stress), systemic (ANL Stress Market) and a combination of both (ANL Stress Combined).

Cash flow projections used in LAB/ANL measures are based on crisis scenarios, which include excessive withdrawal of cash by the bank’s clients and being unable to liquidate some assets due to an external crisis occurring to various extent dependent on assumed scenario.

Moreover, the bank has a process of reporting and monitoring of intraday liquidity position including crisis scenario for intraday liquidity. The reverse stress scenario is the complement of the liquidity stress testing system.

In order to support the process of liquidity risk management, the bank has a system of early warnings indicators (EWI) and recovery indicators. It is composed of indicators monitoring the level of regulatory and internal limits and additionally, indicators monitoring significant changes of market factors, as well as changes in the bank’s balance sheet. Exceedance of thresholds by defined indicators may be a trigger for the launch of the Contingency Plan or the Recovery Plan.

LCR calculation and reporting is carried out in accordance with the Delegated Commission Regulation (EU) 2015/61 of October 10, 2014, which has been in force since October 2015.

With the respect of NSFR, the bank reports to the NBP according to the standards established by EBA in 2014, and reports to the PSFA in the form of a dedicated questionnaire.

The liquidity strategy is pursued by active management of the balance sheet structure and future cash flows as well as maintenance of liquidity reserves adequate to liquidity needs depending on the activity of the bank and the current market situation as well as funding needs of the Group subsidiaries.

The bank manages liquidity risk at two levels: strategic (within committees of the bank) and operational (Treasury Department).

Liquidity risk limiting covers supervisory and internal measures.

The first category includes four liquidity measures determined by the Polish Financial Supervision Authority: M1, M2, M3, M4 and LCR measure, which is additionally reported to the National Bank of Poland. NSFR measure is monitored.

The liquidity risk internal limit system is based mainly on defining acceptable level of gaps in stress conditions in specific time horizons and for different liquidity risk profiles (for all currencies in aggregate converted to PLN) and for specific foreign currencies.

The bank has a centralised approach to the Group’s funding management in order to increase the efficiency of liquidity resources used. Financing of subsidiaries is done from mBank via the Treasury Department, with the exception of mBank Hipoteczny and mLeasing. mBank Hipoteczny raises funding in the market by issuance of covered bonds, short-term debt securities and from mBank, mLeasing raises funding by issuance of short-term debt securities and from mBank, while other subsidiaries raise all of their funding from mBank.

The bank has the Contingency Plan in case of a threat of losing financial liquidity, which sets the strategy and procedures to be implemented in the event of a situation connected with the risk of losing liquidity by the mBank Group and aimed at neutralising this threat. The document defines the division of responsibility for monitoring and identifying threats, and actions during the emergency situation. The Contingency Plan is tested at least annually.

The bank has developed the Recovery Plan of mBank Group, functioning in parallel with the Contingency Plan and covering situations where a broader range of actions, than those defined in the Contingency Plan, is required.

Bank limits the volume and term concentration of foreign currency funding of mBank with FX swaps and CIRS. The limit is set in order to determine the relevant risk appetite accepted by the bank in this respect. In addition, the limit is decomposed into individual limits for CIRS and FX swaps as well as limits for funding in EUR and CHF. The limit structure reflects the bank’s preference for currency funding with long tenors.

In the bank the review of internal liquidity adequacy assessment process (ILAAP) is conducted. The process covers the bank and the mBank Group. The results of the review are presented to the Management Board and the Supervisory Board.

The Group’s liquidity risk measurement includes in addition mBank Hipoteczny and mLeasing. mBank monitors liquidity risk of the subsidiaries so as to protect liquidity also at the Group level in the event of adverse events (crises).

The Group’s liquidity was at a safe level in 2017, as reflected in the high surplus of liquid assets over short-term liabilities in the LAB, ANL measures and the LCR calculated at the Group level.

The table below presents the LAB, ANL gaps for tenors up to 1M and 1Y and the LCR at the mBank Group level:

mBank organises the operational risk management process taking into account the rules and requirements set out in external regulations, in particular in the Recommendations M, H and D of the Polish Financial Supervision Authority, which constitute a starting point for the framework of the operational risk control and management system in mBank Group.

Operational risk accompanies all processes at banks and its consequences can be often very harmful. It is characterized by an asymmetric distribution of losses; overwhelmingly, these are small value losses. Large losses are rare but the size of such a loss may exceed the sum of all the remaining operational losses in a given reporting period.

The basic qualitative tool is the internal control system self-assessment carried out once a year by the bank’s organizational units and the Group subsidiaries. The aim of the process is to increase the awareness of operations risk in mBank Group, to ensure communication about the necessity of changes and improvements in control processes, and thus a more active approach to operational risk management. The end result of the self-assessment is the assessment of risks and control mechanisms as well as the creation of recovery plans aimed at changing the structure or the optimization of the control mechanisms in order to improve the adequacy and effectiveness of internal control system.

The bank prepares also scenario analyses describing risks associated with rare operational risk events with potentially very serious consequences.

In accordance with the requirements of Recommendation M, the bank has a process for identifying threats associated with operational risk in all relevant areas of the bank’s operations and for creating new and modifying existing products, processes and systems, as well as for changes in the organizational structure.

Quantitative tools of the operational risk methodology include mainly collection of data on operational events and effects. With the use of the database available at the mBank Group, data on operational risk losses are recorded with an emphasis on the cause. Recorded data are analysed by the Integrated Risk and Capital Management Department and at organizational units, which allows organizational units to carry out ongoing monitoring of their current risk profile. mBank has an access to external operational loss databases and applies them to analyse operational risk and potential threats, that institutions operating in the financial sector are exposed to.

The key risk indicators (KRI) are another tool. Ongoing monitoring of risk factors recognized as key at the given moment will allow for prediction of an increased level of operational risk and adequate response by the organizational units in order to avoid the occurrence of operational events and losses.

The operational risk control and management system, forms an organisational basis in order to enable effective control and management of operational risk at every level of mBank’s organisational hierarchy. The structure of operational risk control and management covers in particular the role of the Management Board of the bank, the Business and Risk Forum, the Chief Risk Officer, the Integrated Risk and Capital Management Department, and the tasks assigned to persons managing operational risk in particular organisational units and business areas of the bank.

The operational risk control and management process at mBank is developed and co-ordinated by the central operational risk control function while operational risk management takes place in every organisational unit of the bank and in every subsidiary of mBank Group. It consists in identifying and monitoring operational risk and taking actions aimed to avoid, mitigate or transfer operational risk.

The entire operational risk control process is supervised by the Supervisory Board of the bank through its Risk Committee.