Approach to Risk Management

SDB comprehend the importance of risk management across every aspect of our business operations and has taken a proactive approach to establish risk controls to minimise the risks that can impact Bank’s continued growth. In this regard, we have implemented an Integrated Risk Management Framework clearly defining our governance structure, policies, processes, and procedures that are in place to manage risks that impact our profitability and financial standing. This framework continues to serve the Bank in foreseeing the potential risks thereby taking appropriate measures to evade risks in the current volatile macroeconomic backdrop.

The Board of Directors hold the responsibility for managing risks guiding in formulating policies and setting the risk parameters. The Board of Directors have delegated the oversight of the risk management to the Board Integrated Risk Management Committee (BIRMC) which comprises of Independent and Non-Executive Directors.

The Executive Integrated Risk Management Committee (EIRMC) holds the responsibility for implementing the risk management framework and reviews the Bank’s credit, market, liquidity, and operational risk indicators as well as its internal capital adequacy levels. The Chief Risk Officer reports to the EIRMC and the BIRMC.

The Banks’ Risk Management Framework (IRMF) consists of all the elements set out by the Bank to attain the general objectives of risk management which comprises of;

• Integrated Risk Management Framework is setting the ground rules for the Risk Management Framework, including, without limitation, risk governance, Risk Appetite guidelines, definition of the risk management processes, as well as Risk Management policy documentation and reporting guidelines. The IRMF is also catering for risk categories not captured by risk specific policies. All the other components of the RMF shall be developed consistently with the principles set out in the IRMF.
• Risk Governance lays down the main roles and responsibilities, including levels of authority and reporting lines, of all key stakeholders involved in Risk Management. The Governance elements of the RMF are documented under IRMF (see next section)
• Risk Appetite, Strategy and ICAAP defines the risk strategy of that the Bank in terms of risks the Bank wishes to assume, clear boundaries for each material risk type, integration of risk planning with business planning through ICAAP. Detailed description of governance, processes, methodologies pertaining to Risk Appetite and ICAAP shall be documented in dedicated policies.
• Specific Risk Management Policies and Processes are defined for credit, market & ALM risks, operational risk, and ESG risk following principles set out in the IRMF. All these policies are standalone documents that govern specific segments of the RMF.
• Risk Management Infrastructure consists of all the resources deployed by the Bank to carry out the provisions set out in the risk management policies and procedures, including without limitation, people, systems, data, models and methodologies.
• Day to day Risk Management Activities are the risk policies and procedures in action carried out by all relevant stakeholders.

The Bank has put in place the following policies in supporting risk management;

• Integrated Risk Management Policy
• Credit Risk Management Policy
• Operational Risk Policy
• Asset & Liability Management Policy
• Investment Policy
• IT Security Policy
• Compliance Policy

Risk Environment in 2022

While risk exposures shown above are to a great degree controllable by the Bank, there are external factors, the outcomes of which, the Bank is unable to influence. Given the environment in which a bank operates, economic conditions in the country, government policy, regulatory changes and climate change are some of those aspects which can have an effect on the Bank’s profitability and ability to comply with laws and regulations.

The financial year under review was confronted with heightened macroeconomic uncertainties that resulted in economic contraction recording a negative growth rate. The shortage of foreign exchange and the intensifying economic crisis contributed to the economic contraction leading to a contraction of all key sectors including power outages, fuel shortages, lack of raw material, and increasing cost of production and price hikes in both the local and international markets. The instability of the political environment during the early to mid-part of the year stemming from public demonstrations, changes in the political leadership and government had knock-on effects on the banking industry as a whole.

In this milieu, we remain alert to different risks affecting our operations and developed an overall risk profile for the Bank. Based on the risk profile, we continued to improve our risk management framework and practices to consolidate its ability to abate such downside risks while capitalising on growth opportunities. During the period, a key risk concern remained the risks associated with potential credit portfolio stress in the context of moratorium phaseout for COVID-impacted borrowers. The increased digitisation of our banking systems and processes had increased the potential risk of IT and Cyber security risks.

Key Highlights during 2022

• We increased the frequency of the BIRMC meetings and had monthly meetings commencing from mid of the year under review to have more focused and proactive risk monitoring and management in light of increased uncertainty in the macro economy.
• We expanded the Capital Adequacy Assessment Process with additional safeguards and additional calculation methods to strengthen risk management stress testing.
• In light of the elevated risks and lower risk appetite in the market, we set up appropriate credit portfolio strategies including more prudent underwriting standards with more focus on net positive risk segments and products.
• We setup a dedicated Remedial and Rehabilitation unit to support the revival of stressed borrowers due to the macroeconomic factors. In this light we have further streamlined the credit portfolio monitoring with dedicated officers assigned to remedial actions in the branch network with more attention and focus on the rehabilitation and revival of the borrowers.
• We initiated a review and revalidation of the impairment models in line with the expected credit stresses and took on additional impairments through management
• Strengthening of the application and behavioural risk scoring methodologies
• We were more prudent in managing the banks liquidity profile while carrying sufficient liquidity buffers and positions to safeguard the bank with the market liquidity was tight. We gave more priority in retaining and growing the deposits within reasonable cost.
• Instituted the Environment, Social and Governance (ESG) risk concerns into our risk framework considering the increased investor deliberation of ESG risks and our response to them.
• We continue to implement appropriate strategies to handle operational risk and IT and Cyber security incidents.

Risk Governance

SDB's risk governance structure is based on the three lines of defence model that separate risk oversight. All material risks as defined in the IRMF shall be based on the principle of three lines of defence:

• 1st line of Defence: Branches, Business and Support Units shall be the primary risk owners and risk takers being responsible to manage risk exposures on a day-to-day basis through controls embedded at business process level or specialized back office functions.
• 2nd Line of Defence: The Risk Management Division as an independent function headed by the CRO. The CRO has direct access to the BIRMC without impediment and reporting functionally to the BIRMC and administratively to the CEO. Compliance is the other independent function headed by the Compliance Officer and with similar reporting line of CRO. One of the key roles of the Risk Management Division under the 2nd line of defence is to ensure that the 1st line adequately applies and complies with risk and control policies and standards and to provide independent oversight of the risk profile of the Bank. On the other hand, the function of the Compliance is to ensure that the 1st line is conducting the respective operations in accordance with industry laws and regulations, internal policies and best practices.
• 3rd line of Defence: Specific to Risk Management, the Internal Audit Department is responsible to assess compliance and adherence to Risk Management Policies and Procedures on an ongoing basis and provide an independent assurance of the robustness of the Risk Management framework, processes and methodologies.

Risk Culture

We have inculcated a risk awareness culture across the organisation continually carrying out training programs for the same. The staff were trained on early detection of credit quality deterioration, operational risk reporting and data capture functions that consist of several mandatory trainings for all employees. In addition, a risk reporting process at multiple levels in the organisation lends weight to its importance in the functions of the Bank.

Risk Appetite

Risk appetite refers to the amount of risk the Bank is willing to take in achieving its strategic objectives and ensuring the maintenance of the desired risk profile. Hence, we have established the risk appetite of the Bank through a clear set of indicators, with limits and triggers, relating to the key risks the Bank is exposed to. These guidelines are reviewed and updated regularly by the Board of Directors in keeping with the evolving developments, strategic objectives, and the corporate plan for the year.

Risk Reporting

We regularly report those factors relating to the exposures we have identified by sending reports to the Board of Directors, the relevant department heads, EIRMC and the BIRMC by the Chief Risk Officer.

Risk Profiling

We establish our key risks through a review process that analyses the risks encountered by SDB, in relation to our strategy and longterm aspirations, reputation and delivery of business plans, in the context of the external and internal environment. Internal risks are managed systematically on a proactive basis while external risks are monitored on an ongoing basis to assess potential impacts on our operations.

Stress Testing

The Bank conducts regular stress testing to identify potential impacts of the fluctuations in market variables and other risk factors could have on the Bank’s risk profile. Stresses in the Bank’s credit, market, and liquidity are evaluated with reference to capital and earnings positions. The Board Integrated Risk Management Committee (BIRMC) conducts regular reviews of the stress testing outcomes, including the major assumptions that underpin them.

Credit Risk

The Bank’s core business model requires the extension of credit to individuals and businesses to enable them to fund their occupations and other personal needs. Credit risk relates to the potential losses that can arise when customers are unable to discharge their obligations for the repayment of loans and advances taken by them.

Risk response: The Board Credit Committee is charged with the responsibility of implementing the Bank’s credit risk management framework. A Board-approved Credit Risk Management policy outlines the responsibilities, tools and techniques for credit risk identification, measurement, mitigation and management. Other key aspects of the Bank’s credit policy include pre-credit sanctioning criteria, delegated approval authority, due diligence, collateral management and post-credit monitoring. The framework is reviewed and updated regularly based on evolving best practices as well as emerging risks and opportunities.

Credit Risk Performance during 2022

Concentration Risk

Concentration risk is the potential for a loss in value of the loan portfolio when an individual or group of exposures move together in an unfavourable direction. The implication of concentration risk is that it can generate such a significant loss when recovery is unlikely. The exposures can be geographical or sector-wise.

Risk response: The credit risk management of the Bank maximise a Bank’s risk-adjusted rate of return by maintaining credit risk exposure within acceptable parameters. We have set risk concentration limits for which the portfolio balances are monitored. These risk limits takes in to account prudent limits based on product type, geographical distribution, single and group borrower limits. The portfolio performance are reviewed at Board Credit Committee and the BIRMC and appropriate mitigants are proposed.

Market Risk

Market risk refers to the risk of losses in the Bank’s trading book due to changes in equity prices, interest rates, credit spreads, foreign exchange rates, commodity prices, and other indicators whose values are set in a public market.

Interest Rate Risk is the risk exposure relating to interest rate changes in the trading portfolio of Government securities, and other investment securities.

Risk response: The Bank has set limits for trading book exposures and is marked to market and measured against the set limits. The Bank carries only a limited trading book with majority of the investment portfolio is held for maturity (HTM). The bank is aware of the implications on its HTM portfolio in light of potential domestic debt restructurings that could materialize with the IMF bailout package and the resultant activities for debt sustainability initiatives.

Foreign exchange rate risk is the possibility of an adverse impact on the Bank's capital or earnings due to fluctuations in the market exchange rates. This risk arises due to the holding of assets or liabilities in foreign currencies. The Bank holds two-dollardenominated FDs with the Bank of Ceylon. These two deposits have been placed from the proceeds from the Subordinated Term Loan of USD 8 Mn received from the Belgian Investment Company for Developing Countries (BIO) and USD 40 Mn, an unsecured senior term loan received from the United States International

Development Finance Corporation (DFC). To mitigate the foreign currency risk, without converting these into Sri Lankan Rupees (LKR), these two loans are kept as two Fixed deposits, matching the dollar repayment schedule of the lender with Bank of Ceylon. The Bank borrows LKR term loans on the strength of dollar deposits, which is used to finance its loan portfolio growth, which can be repaid from the Bank's LKR collection and all dollar borrowing interest repayments can be serviced from USD fixed deposit interest and capital repayment can be made from USD fixed deposit maturity proceeds. This synthetic hedging structure enables the bank to operate smoothly under more volatile economic conditions. Other than these two foreign currency denominated FDs and borrowings, the Bank does not have any exposure to foreign currency in terms of assets and liabilities as of 31st December 2022.

Liquidity Risk

Liquidity risk relates to the possibility that the Bank is unable to meet its financial obligations by settling them in cash or being able to convert a security or hard asset to cash without a loss of capital and/ or income in the process.

Risk response: The Assets and Liabilities Management Committee (ALCO) is responsible for managing the Bank’s liquidity risk. The Committee regularly reviews the Bank’s cash flow positions, projections, funding capabilities and pricing decisions to ensure internal targets and regulatory liquidity requirements are met.

Liquidity Risk Performance during 2022

Interest Rate Risk

Interest rate risk in the banking book (IRRBB) refers more generally to the current or prospective risk to both Bank’s capital and earnings arising from adverse movements in interest rates, which affect the Banks’ banking book exposures.

Risk response: The Assets and Liabilities Management Committee (ALCO) is responsible for monitoring the Bank’s IRRBB exposure. It reviews the impact of interest rate risk on the banking book as well as net interest margin, funding mismatches and the cumulative rate-sensitive gap. The Committee also undertakes stress tests on the net interest margin (NIM) and the equity, under different interest rate scenarios. A comprehensive set of policies is in place to govern all aspects of market risk. These policies are reviewed and updated regularly in view of emerging market risks.

Operational Risk

Operational risk is the potential loss resulting from inadequate or failed internal processes, people and systems or from external events.

Risk response:The risk department together with operations units administer the evaluation, to define operational risk parameters, of all key business units on their exposure. This is a mechanism that enables business units to identify and assess their risks and introduce measures to improve risk control. The Bank also maintains an Operational Risk Loss Data Base in line with Basel guidelines. Processes are also in place to capture all operational loss events which are then categorised in accordance with the guidelines.

It Risks

IT risk is the business risk associated with the use, ownership, operation, and adoption of IT within the Bank. IT risks are part of the overall operational risks due to IT-related events such as system interruptions/failures, errors, frauds through system manipulations, cyber-attacks, and obsolescence in applications. With the high adoption of IT-related business models and digital channels, there are heightened risks and emerging risks associated with IT. There are challenges to identifying and quantifying the uncertainty of the likelihood of occurrence and the impact or magnitude of IT-related risk incidents.

Risk response:The Bank has developed policies and procedures for the management of IT risks which would be implemented to ensure that the Bank is not exposed to undue risks. IRMD has used the Risk & Control Self-Assessment (RCSA) for IT risk identification and assessment and would continuously track and monitor the potential risk incidents and the control effectiveness. Results of independent audit findings (both internal and external), analysis of information security incidents, external loss data and information are also employed for IT risk identification and assessment purposes. Regular risk reporting is done to the EIRMC and BIRMC on IT-related risks.

Legal Risks

Legal risk is the risk of financial or reputational loss that can result from lack of awareness or misunderstanding of, ambiguity in, or reckless indifference to, the way law and regulation apply to your business, its relationships, processes, products and services.

Risk response:All legal documents executed on behalf of the Bank are vetted by the Legal Department of the Bank. Services of external lawyers are obtained whenever required. Internal processes described in previous sections, relating to compliance with regulatory provisions, are in place to mitigate potential losses and harm to the Bank.

Strategic Risk

Strategic risk relates to the possibility that the strategic direction the Bank is taking does not lead to the desired outcome or results in losses. This may be due to external or internal factors which are responded to inadequately or ineffectively.

Risk response:SDB bank in formulating its medium-term strategic plan has put in place performance indicators and set milestones in terms of achieving the required outcomes. The Board of Directors plays an active role in adopting relevant policies, monitoring progress through several reporting formats and helping the Bank maintain its focus on the end goals.

Reputational Risk

Strategic risk relates to the possibility that the strategic direction the Bank is taking does not lead to the desired outcome or results in losses. This may be due to external or internal factors which are responded to inadequately or ineffectively.

Risk response:Events that could lead to reputational risk are closely monitored, utilising an early warning system that includes inputs from frontline staff, media reports, and internal and external market survey results. Though all policies and standards relating to the conduct of the Bank’s business have been promulgated through internal communication and training, a specific policy was established to take action in case of an event which may affect the reputation. The Bank has zero tolerance for knowingly engaging in any business, activity, or association where foreseeable reputational damage has not been considered and mitigated. While there is a level of risk in every aspect of business activity, appropriate consideration of potential harm to the Bank’s good name is a part of all business decisions.

The complaint management process and the whistle-blowing process of the Bank include a set of key tools to recognize and manage reputational risk. Based on the operational risk incidents, any risks which could lead to reputational damage are presented to the Board and suitable measures are taken by the Bank to mitigate and control such risks.

Compliance Risk

Compliance from a banking perspective can be defined as acting in accordance with a law, rule, regulation or a standard. Basel Committee on Banking Supervision in 2005 defines “compliance risk” as “the risk of legal or regulatory sanctions, material financial loss, or loss to reputation a bank may suffer as a result of its failure to comply with laws, regulations, rules related self-regulatory organisation standards, and Codes of Conduct applicable to its banking activities”.

Risk response:Bank's governing principles on compliance ensure that compliance starts from the top, emphasising standards of honesty and integrity and holding itself to high standards when carrying on business at all times striving to observe the spirit as well as the letter of the law. Further, it sets compliance as an integral part of the Bank’s business activities and part of the culture of the Organisation and at all times will be observing proper standards of market conduct, managing conflicts of interest, treating customers fairly, and ensuring the suitability of customer advice. The Compliance Governance Structure of the Bank has been set up to manage the compliance risk of the Bank independently.

The Compliance Officer independently reports to the Board Integrated Risk Management Committee through which the Board of Directors of the Bank are updated on compliance matters frequently. The Bank’s Board of Directors are responsible for overseeing the management of the Bank’s compliance risk. Accordingly, the Board has delegated its powers to the Board Integrated Risk Management Committee which takes appropriate action to establish a permanent, independent and effective compliance function in the Bank, ensuring that compliance issues are resolved effectively and expeditiously by the Senior Management of the Bank with the assistance of the compliance function and assess the extent to which the Bank is managing its compliance risk effectively. The Bank’s Corporate/ Senior Management is responsible for the effective management of the Bank’s compliance risk and an independent robust compliance culture has been established within the Bank with processes and workflows designed with the required checks and balances to facilitate compliance. The compliance function works closely with the business and operational units to ensure consistent management of compliance risk. The Compliance Policy defines how this key risk is identified, monitored and managed by the Bank in a structured manner. The Bank's culture and the Code of Ethics to play a key role in managing this risk.