1. # !@ 1 Implementation of Basel II in Romania Progress to date and insights 22 nd February 2006 Progress to date and insights 22 nd February 2006 Business & Technology Risk Services

2. 2 www.ey.com/ro Overview and Introductions Basel II represents one of the biggest challenges facing the Romanian Banking Industry today, potentially changing the competitive dynamics of the industry within 3 yearsBasel II represents one of the biggest challenges facing the Romanian Banking Industry today, potentially changing the competitive dynamics of the industry within 3 years To compete, an average sized Bank in Romania will need to invest between 1-3 million euro’s for standardized approaches and between 5-10 million to implement more sophisticated approaches of the Basel AccordTo compete, an average sized Bank in Romania will need to invest between 1-3 million euro’s for standardized approaches and between 5-10 million to implement more sophisticated approaches of the Basel Accord A typical medium sized bank has between 15-25 initiatives to complete for standardized, and between 35-50 initiatives for advanced approachesA typical medium sized bank has between 15-25 initiatives to complete for standardized, and between 35-50 initiatives for advanced approaches BII leaders have a rigorous implementation approach, business buy-in and ownership, senior sponsorship and ready access to scarce resourcesBII leaders have a rigorous implementation approach, business buy-in and ownership, senior sponsorship and ready access to scarce resources Basel II represents one of the biggest challenges facing the Romanian Banking Industry today, potentially changing the competitive dynamics of the industry within 3 yearsBasel II represents one of the biggest challenges facing the Romanian Banking Industry today, potentially changing the competitive dynamics of the industry within 3 years To compete, an average sized Bank in Romania will need to invest between 1-3 million euro’s for standardized approaches and between 5-10 million to implement more sophisticated approaches of the Basel AccordTo compete, an average sized Bank in Romania will need to invest between 1-3 million euro’s for standardized approaches and between 5-10 million to implement more sophisticated approaches of the Basel Accord A typical medium sized bank has between 15-25 initiatives to complete for standardized, and between 35-50 initiatives for advanced approachesA typical medium sized bank has between 15-25 initiatives to complete for standardized, and between 35-50 initiatives for advanced approaches BII leaders have a rigorous implementation approach, business buy-in and ownership, senior sponsorship and ready access to scarce resourcesBII leaders have a rigorous implementation approach, business buy-in and ownership, senior sponsorship and ready access to scarce resources

3. 3 www.ey.com/ro E&Y believes Basel II/CRD will give a new competitive dynamic to the Banking Industry in Romania “Capital release” will allow largest players to price aggressively for market share as competition intensifies Sophisticated risk management capabilities will act as a major market entry barrier Non-Banks, which are not subject to Basel II will see opportunities to serve niche segments Secondary markets will emerge as more portfolios are rated “Data starvation” for risk modelling will lead to divesture of non- core portfolio’s Capital / efficiency advantages allow early adopters healthy margins amidst increased competition Capital advantage Data advantage Non-bank competition Margin enhancement New entry barriers Active portfolio management Risk based competition Op. Risk Advantage IRB Compliance likely to be a minimum to compete effectively within 5 years Leaders with ORM will be able to better manage profitable growth

4. 4 www.ey.com/ro Romania Basel II Readiness- E&Y Assessment Main implementation challenges 1.Assessment of Operational Risk Collect and organize internal loss data and supplement with external sourcesCollect and organize internal loss data and supplement with external sources Comply with qualitative criteria for Standardized represents the key challengeComply with qualitative criteria for Standardized represents the key challenge 2. Data Collection and Disclosure of Risk Across All Risk Types Implement IT infrastructure in order to report consistently across all risk types and business unitsImplement IT infrastructure in order to report consistently across all risk types and business units 3. Credit Risk Collect, organise and warehouse internal credit-loss experience required for chosen sophistication level, on a uniform basisCollect, organise and warehouse internal credit-loss experience required for chosen sophistication level, on a uniform basis Ensure internal credit rating processes, governance and systems are aligned with requirements outlined in the Accord.Ensure internal credit rating processes, governance and systems are aligned with requirements outlined in the Accord. Basel II Requirements: = Satisfied by most banks X = Further work required for most banks ? = Further work required for some banks Risk Management Methodology ?X Senior Management Overview / Audit XX Data and systems XX Policies and procedures ?X Models and methodology ?X Organisation and governance ?X Disclosure XXX Risk integrated into core business XX Basel II Requirements Credit Risk Market Risk Operational Risk

5. 5 www.ey.com/ro E&Y insights into Basel II implementation in Romania Bank’s are awaiting clear guidance from NBR in a number of areas to assist their BII preparation activities Role of Risk Management is changing but still requires further alignment Pillar II and the role of the Board still needs to be addressed Data quality and availability remains a key concern Key Romanian Basel II implementation insights

6. 6 www.ey.com/ro Basel II implementations are raising a number of questions which now require proactive NBR guidance NBR has rolled out a industry support program in preparation of Basel 2 implementation: ARB roundtables Translation of the European text Drafted the “national options” Began work on the model validation manuals NBR has rolled out a industry support program in preparation of Basel 2 implementation: ARB roundtables Translation of the European text Drafted the “national options” Began work on the model validation manuals Our clients expressed the need for increased NBR support on: Guidelines on the “qualitative” requirements of Basel II (i.e. Pillar II requirements) Setting up a “help desk” specialized in helping banks out throughout implementation on specific issues (e.g. how is financial insurance recognised as a risk mitigant) Provide guidance on internal model development and validation, including how to tackle the historic data shortage

7. 7 www.ey.com/ro Data quality and availability remains a key concern and constraint for most banks Issues Progressive Banks are adopting a two- pronged Basel II strategy incorporating changes for both: –Standardized as an immediate priority –IRB as a medium term objective Data audits have identified a number of constraints: –Lack of default experience and data surrounding the default event –Lack of a market representative sample –Immature portfolio’s create uncertainty regarding predictive qualities –Insufficient data in specific areas such as collateral, recoveries and overall loss experience –Lack of external or internal ratings captured Issues Progressive Banks are adopting a two- pronged Basel II strategy incorporating changes for both: –Standardized as an immediate priority –IRB as a medium term objective Data audits have identified a number of constraints: –Lack of default experience and data surrounding the default event –Lack of a market representative sample –Immature portfolio’s create uncertainty regarding predictive qualities –Insufficient data in specific areas such as collateral, recoveries and overall loss experience –Lack of external or internal ratings captured Potential Solutions Perform data review for IRB as well as standardized Use external data from vendors and adjust for Romanian circumstances, but difficult to prove applicability to NBR Leverage a Group model and adjust for Romanian circumstances Develop judgmental models to start collecting the data, calibrate based upon observations over time Adopt a test-and-learn approach particularly for immature segments e.g. SME

8. 8 www.ey.com/ro Pillar II and the role of the Board in “Risk Governance” still needs to be addressed Issues Many Bank’s believe Norm 17 compliance is a proxy for Basel II compliance when it comes to governance requirements of the Accord Banks need to shift from formal compliance to really embedding the changes into the organization and decision-making processes Governance changes often left out of Basel II programs due to “political sensitivities” Most Boards currently do not demonstrate that they have effective processes for capital adequacy assessment and management Some need to revisit the mix of skills and experience on the Board Issues Many Bank’s believe Norm 17 compliance is a proxy for Basel II compliance when it comes to governance requirements of the Accord Banks need to shift from formal compliance to really embedding the changes into the organization and decision-making processes Governance changes often left out of Basel II programs due to “political sensitivities” Most Boards currently do not demonstrate that they have effective processes for capital adequacy assessment and management Some need to revisit the mix of skills and experience on the Board Potential Solutions Hold Board Risk Management Training Perform a formal governance review against leading practices and BIS/ CEBS guidelines Establish Board Level committees (e.g. risk committee) to focus on the risk profile of the Bank

9. 9 www.ey.com/ro The role of risk management within the organisation is changing, but still requires further work to comply with Basel II Issues Risk management functions in many banks are still young and finding their mandate within the organization, particularly for credit and operational risk Traditional model of risk management often observed, with risk management being part of the credit process in full or in part leading to a lack of independence Often a lack of transparency and awareness within the organization as to what RM’s role is Skills often lacking with a lack of experience and background for key risk mgt roles Operational risk units often do not have mandates or a clear role within the organization Issues Risk management functions in many banks are still young and finding their mandate within the organization, particularly for credit and operational risk Traditional model of risk management often observed, with risk management being part of the credit process in full or in part leading to a lack of independence Often a lack of transparency and awareness within the organization as to what RM’s role is Skills often lacking with a lack of experience and background for key risk mgt roles Operational risk units often do not have mandates or a clear role within the organization Potential Solutions Establish a clear charter for risk management and communicate across organization Modify credit processes to remove RM from decision-making/ approvals Review skills and recruit externally as required Establish an operational risk framework, including an operational risk policy, with clear governance and reporting structures defined

10. 10 www.ey.com/ro Final thoughts … Keep the Board and NBR notified as to progress towards Basel II Manage the dependencies and risks in implementation Use the opportunity to question the role of risk management across the organization Tackle the “softer” areas of the Accord (e.g. governance) as well as the “hard” (e.g. IT systems) Keep the Board and NBR notified as to progress towards Basel II Manage the dependencies and risks in implementation Use the opportunity to question the role of risk management across the organization Tackle the “softer” areas of the Accord (e.g. governance) as well as the “hard” (e.g. IT systems)

11. # !@ 11 Thank you! Andrew McCartney, Principal Ernst & Young Southeast Europe Andrew.McCartney@ro.ey.com Andrew McCartney, Principal Ernst & Young Southeast Europe Andrew.McCartney@ro.ey.com Ernst & Young Romania Phone: (21) 402 4000 Fax : (21) 410 7046 Ernst & Young Romania Phone: (21) 402 4000 Fax : (21) 410 7046