Risk Management Risk Management Case Study at Wellfleet Bank Xx April 2011

2 Wellfleet Bank’s Practice Group Risk Committee Board Audit & Risk Committee Reputational Risk Committee Country Risk Committee Operational Risk Committee Group Credit Committee Market Risk Committee Business Risk Committee (Consumer Bank) Business Risk Committee (Corporate Bank) Credit Officer

3 Wellfleet Bank’s Practice The board of directors and top management demand a “no-surprises” culture. The board hold ultimate responsibility for the effective management of risks. The board delegates the management of risks to the Group Risk Committee (which includes all the executive directors), while the board’s Audit and Risk Committee (consisting of non-executive directors) reviews specific risk areas and monitors the activities of the Group Risk Committee Observation from the Case Study The Corporate Banking Group has been aggressively pursuing large-scale transformational deals in line with the Bank’s strategic intent but there isn’t any Risk Appetite Statement which states the associated tolerance level. The Board, CEO and Group CRO have no direct involvement with the loan approval process, apart from their periodic review of the corporate loan portfolio after decision has been made. Board of Directors

4 Wellfleet Bank’s Practice This Group Risk Committee questions and approves proposed lending policies, guidelines, and limits for both the retail and the corporate banking business and monitors newly accepted mega-deals from the Corporate Banking Group to be sure they are compliant and have been approved at the right level of authority. Observation from the Case Study There is no limits to be questioned or approved as there is no explicit upper limit delegated to the Group Credit Committee’s authority. The Group Credit Committee can approve loans of any size within the bank’s regulatory limits. This means that the board has no oversight of the loan approval process as the Group Risk Committee which the Board has delegated risk management authority to, does not have any control over the decision made in the Group Credit Committee. The CEO as well as the Group CRO, who sits in the Board Risk committee will have no direct involvement with the loan approval process, apart from their periodic review of the corporate loan portfolio after decision has been made as the Group Credit Committee doesn’t report to Group Risk Committee nor the Board. Group Risk Committee

5 Wellfleet Bank’s Practice Group Credit Committee is the highest forum of credit approval. There is no explicit upper limit to the Group Credit Committee’s authority. It can approve loans of any size within the bank’s regulatory limits. Observation from the Case Study The Group Credit Committee is made up of the group chief credit officer, who served as chair, the deputy chief risk officer, and the group head of client relationships, who represented the business viewpoint. If the deputy CRO and the Group Head of Client Relationships disagree with a particular proposal (may be a mega-risk which can bring the Bank down), the decision will fall on the group CCO. In other words, the CCO holds the ultimate decision in approving loans. There is an element of operational risk here for granting someone with such ultimate authority. Group Credit Committee

6 Observation from the Case Study Group Risk Committee Board Audit & Risk Committee Reputational Risk Committee Country Risk Committee Operational Risk Committee Market Risk Committee Business Risk Committee (Consumer Bank) Business Risk Committee (Corporate Bank) Group Credit Committee Chief Credit Officer There is no risk appetite statement to set the tolerance for corporate banking loans There is no oversight from the Board and Board committees as the Group Credit Committee has the ultimate authority to approve loans with no limits The Chief Credit Officer has the final say

7 Wellfleet’s asset is very much concentrated on the Corporate Banking Group. Wellfleet had two core businesses: corporate banking, responsible for 58% of pre-tax profits and 72% of assets employed in 2007, and consumer banking, which contributed the remaining 42% of after-tax profits and 28% of assets employed. The Consumer Banking Group accounted for most of Wellfleet’s bad debt provisions of $214 million in 2004, $266 million in 2005, $611 million in 2006, and $761 million in However, the credit amount from the Corporate Banking Group is nearing $ 1 billion each. According to the mantra of the bank, “if a billion dollar deal went wrong, it could sink the ship”. In addition, the projected credit proposals of 220 for 2008 has expected to increase to a total of 300 submissions. In conclusion, the Bank’s assets are very highly concentrated on its Corporate Banking Group. Concentration Risk