Financial Services Authority V: - NE. Derek Sach. q. Global Restructuring Group Royal Bank ofScutland 280 Bishopsgate London EC2M 4RB 30 September 2011 Dear Derek. RBS GLOBAL RESTRUCTURING GROUP REVIEW - ADEQUACY 0F CREDIT DECISIONS AND FROVISIONING: 4 - IS JUNE 20]] We conducted a review focussing on the adequacy ur credit decisions and provisioning within the Global Gmup during June 201 This lcllerr together with the attached reeomrnendalion grid. is intended to proiide feedback on our conclusions and suggested actions, conclusions outlined in Illis report are based on discussions with. and information supplied management, in common with previous reiiens performed b) the Financial Senices Aillhority at The Royal Bank of Scotland Group or "lhe (imup' our comments relate specifically I0 what was obsened during lhe visit For lhe avoidance of doubt omission of am sue from this correspondence should not be taken as indicatitc 01 any panicular stance or \icu (or lack thereon that matter. In short Visit. i| was not practical to cumplele all the checks and tests appropriale for an audit or inspeclion, Our comments should therefore not be relied upon to have identified all weaknesses or failures oi'svstenis and controls in connection URG. [his responsibility remains ""11 the Board tit'nircctors and senior management of R135. We \\ould like to express our ihants for all the help extended by R85 and its Ieanls from Glut Risk and Group Internal Audit during the run-up and execution el'the HSII. Overview of Conclusions The FSA's overall assessment of GRG is that iI is fit for purpose. lhe GRG senior and rclaliunship management personnel are appropriately and experienced. \Vc etidence of reasonable strategies minimising the Group's risk while maximising relums. and. at the account leiel. GRU has an acceptabl) robust frumwurk for managing cases despite the increased \iorkloud resulting from the significant of the (PRU portfolio in recent ietir 'lhcr arc. hovimcr. themcrall hmadli man and Le} lime been identified (st-c Appendix Ii Previous strategic decisions have heavily in?uenced the shape and composition of the GRG portfolios and imply high levels of risk from both an expected and an unexpected loss perspective. Weaknesses in terms of the quantum and quality of the RBS property book. material linked issues with Ulster Bank, long dated swaps and the lumpy nature of the Group?s large problem exposures all serve to underline this contention. philosophical approach is different from that adopted in the work out units of most of peers. This means that it is even more important that the governance and oversight framework over activities clearly articulates, approves and monitors the risk appetite and risk framework under which GRG crates. Consequent to this philosophy, RBS has a wider delta of possible outcomes in problem situations (both positively and negatively) and the ultimate work out of problem situations will tend to take longer to reach an ultimate conclusion. This overall philosophical approach can therefore cause tensions with the ?rm?s Non-Core run-down strategy. The key challenges that we observed from a risk and controls perspective within GRG included the need to fully roll out the GRG model to Ulster Bank, the need to ensure a full consideration of CVAs for derivative exposures in the context of loan provisions raised against problem connections and the need to create and! or im lement risk appetites and In terms of Speci?c provisioning, the relevant accounting standard permits a range of le itimate inte retations. The sample that we reviewed demonstrated that, in most cases, ?ithin the ran e1 of acce table outcomes at the time of our review, but that they wer . hold a lower level of speci?c This was evidenced by the relatively large number of cases (19% of the sample reviewed) where the Bank appeared slow to reach the ultimate level of provision in com arisen to eers andr'or the accountin standardz. It is also evidenced While the review did not identify material issues with individual speci?c provisions in the context of the relevant accounting standards, the implications of less conservative approach to speci?c provisioning are likely to include the following: I When measured against a more prudent view of losses, the detailed analysis suggested that wholesale credit risk losses within GRG could be significantly higher at the time of There were a hand?tl ofcases where the review team disagreed with the provisions taken from an accounting perspective. Some disagreement is inevitable and the degree of divergence was not material within the overall context of the book. latter a loss event. the tiles evidenced that GRG has a tendency to wait for all the facts to be complete before making a speci?c provision as opposed to raising a provision and ?truing this up? once the ?nal details of the revisions to the expected cashflows are known. 1 Source: 3] December 2010 ?nancial statements for HSBC. Harclays. Lloyds. Page 2 of our review. While this does not affect the total capital resources of the Group (since Expected Loss numbers rather than Incurred Loss numbers are used to arrive at the Group?s capital reStream)? (which is a distinct ossibilit iven current ex osure drafts for ?nancial instrument accounting While it is management?s assumption that they will not reach the loss threshold above which the APS protection will be called upon, delays in raising speci?c provisions will impact the timing of claims under the APS (which are effectively triggered at the point at which loans become impaired). At the Group level, the review team found the level of latent loss provision to be adequate, in that this provides coverage against 4 month?s equivalent of the Q1 2011 impairment charge. The overall latent provision is not overly conservative given the sector concentrations and the single name concentrations, the Group?s philosophy to speci?c provisioning one that tends to recognise speci?c impairment charges later than peers) and the modelling challenges faced by RBS. At a legal entity level, it is possible that the latent loss provision is understated. In particular, we note that a relatively high level of provisioning in Citizens Bank1 potentially risks masking a less robust level of latent loss coverage in Ulster Bank (albeit our conclusions were made prior to management taking a c.?700 million half year adjustment to take account of tertiary land values). for key aspects of the project, and has et to deliver on some ob'ectives. Given the retracted timeline, like the A approved individual to be responsible for delivering the necessary improvements in loss data collection in a timely manner. Any response to this letter should include the name of the nominated executive. As mentioned earlier, Appendix I to this letter summarises the issues outlined above and provides suggested actions and timelines. Appendix 11 lists the key risks associated with Loss Data collection. I would be grateful if you would review the material provided and revert in writing with any comments and/or further suggestions for action. While we would not expect this letter to be shared with any third party without prior approval from the FSA, we believe it would be The higher level of latent provision in Citizens is a function of differences in the accounting treatment inherent to US GAAP and the US regulatory requirements on loan loss reserves. 2 First raised as a point in the context of the 2009 ARROW work. GRG Loss Data Project followed up with the GRG COO. Group Risk and CPA modelling team in 2010. Page 3 of 7' APPENDIX I: DETAILED FINDINGS RECOMMENDED ACTIONS In terms of key risks and more speci?c feedback on areas where improvements are required, we have identi?ed the following seven issues and have suggested actions and timelines for R38 to address these matters. Risk Issue Action Timeline Risk One: Problem property exposures are high relative to the RBS Group?s capital base. R35 is particularly exposed to a signi?cant further downturn in property markets. Any such scenario would likely impact property customers in a correlated fashion (to varying degrees across sectors) and the size of potential write downs versus the Group's own capital base is such that the Group?s capital position might itself come under increased strain. The key vulnerability relates to a delayed economic recovery which may have the following impacts: increased tenant risk as leases roll-off, tenants default, and potential increased debt service requirements should interest rates rise all of which are likely to result in lower property values. Relative to its peers. the composition of CRE book leaves the ?rm particularly exposed to negative develo ments across the ran of scale of the Group?s Real Estate exposure could be understated by Real Estate and Real Estate-related exposures that are currently being classi?ed into other industry segments (our Supervisory work elsewhere has highlighted examples ofthis). R38 to ?nalise its current deep dive exercise on the Non-Core Real Estate portfolio and provide this to the FSA. Consideration should be given as to whether this analysis should be extended to the larger exposures in the Core portfolio. GRG to provide metrics summarising the key risks for the entire GRG Real Estate portfolio as at 30 June 201 1. This should segment the portfolio by geography, nature (ie development, investment, primary, secondary, tertiary), extent of forbearance, LTV. DSCR, maturity, provisions, stress loss, expected loss and other key risk metrics. As part of this exercise, GRG should con?rm that all property assets are being correctly identi?ed and captured as property related exposures. A quarterly update to Action 2 above should be provided to the FSA. Non-Core to revert with analysis by 3Di9f2011. GRG to revert with metrics by 3lrl2f201l. Ongoing, within 2 months? of each quarter end. Page 5 of IS Risk Issue I Action Timeline Risk TWO: The capital position of Ulster Bank (and its subsidiary Ulster Bank (Ireland) Ltd) is severely challenged. Both banks would appear likely to require ongoing capital support from the Group. Should losses deviate from management?s base case assumptions the level of support required will also increase. The macro-economic conditions in Ireland (on both sides of the border) are materially worse than those in other main marl-Lets. Ulster Bank (Ireland) breached its minimum capital requirements set by the Central Bank of Ireland in March 201 Given the signi?cant macro-economic challenges with the economy and property markets on both sides of the border and the relatively later adoption of the full GRG Framework by GRGL provisions on both a speci?c and latent basis may not yet adequately reflect the full extent of losses for the Bank. the govemance process has come under tremendous pressure in ORG Ireland over the last two years. While many historic issues are being addressed, and speci?cally with regard to increasing resources, the Ulster Bank GRG team is not yet fully integrated into the GRG model. The additional pressure has been the result of the signi?cant increase in cases managed by GRG Ireland, over the last two years, primarily due to the global credit crisis and the resultant collapse in the domestic property market in Ireland. RBS to provide the FSA with a timeline for the hill roll out processes and controls to Ulster Bank and the on-boarding of the latest batch of cases transferred into GRGI. Group Internal Audit to review these processes and controls as at 3 December 201 perform the review during 0] 20 I 2). Group Internal Audit to review capital planningfforecasting within UB to include the interaction/??ow of information between GRGI and U8 Finance and the adequacy ofcurrent accounting provisions. Ulster Bank to provide support for the adequacy of the latent loss provision (both for its Core and Non-Core portfolios) as at 30 June 20] . GRG Ireland to revert with timeline by 30t9t20] l. GIA to revert with 30f4i?20l2. report by GIA to revert with report by Ulster Bank to revert with analysis by 30l9t2tll l. Battle {Ireland} breached the regulatory minimum capital requirement by in March 20] I. Ulster Bank was not affected and remained compliant taithough both entities required capital to be down streamed From RES). Page 6 ol? IS Risk Issue Action Timeline Ulster Bank has made a reasonable effort to attempt to analyse its wholesale credit losses and we support the recent decision to value the collateral for tertiary development land exposures at agricultural value. However. the current assessment is premised upon the macro-economic situation in Ireland having reached its nadir. There is inevitably uncertainty around any such forecast. Ulster Bank's track record on provision forecasting has consistently underestimated the severity of the problem. resulting in numerous increased provision forecasts since the crisis started (where base case predictions have frequently trended towards the Firm?s previous stress case projection}. Given the scale of overhanging vacant residential property and likely trends in demand {and availability of mortgage credit), as well as uncertainty in the commercial real estate markets compounded by government fiscal retrenchment, the potential for material additional provisions exists (in addition to the ?70tlm provision increase taken in June 20] l, and over and above what Ulster Bank forecast in their base case}. Page of IS Risk Issue Action Timeline Risk 3: There is a signi?cant potential for unexpected loss associated with the large single name problem situations. This has resultant implications for volatility in earnings and capital position. The aggregate exposure to the top 20 bad book cases represents a third of RBS's core Tier 1 capital. There are [2 cases in the watchlist and bad book where the individual gross exposure exceeds ?l billion. The proportion of single name problem exposures is high in absolute terms and high relative to peers. While the individual speci?c provisions appeared reasonable within the context of the relevant accounting standard, the delta ol'possible outcomes remains wide and, given the size of the exposures. it is possible that unexpected developments on a relatively small number of names could impact materially on the volatility ofthe firm?s FELL. R88 to provide an update on the SNC strategy and iffwhen deals within GRG will also be included on the SNC list GRG to revert with conclusions and proposals by 31f12i?ll. Page 8 ol? IS Risk Issue Action Timeline Risk 4: There is additional volatility and potentially higher losses resulting from long dated derivative exposures (mostly interest rate swaps). 1. R38 to review the process by which CVA discussions are held GRG to revert with conclusions and between Counterpaity Exposure Management and ORG proposals by31fl2111 RMs working on GRG connections. R88 to satisfy the FSA that the . tota mar -to-mar ct va ue erivative transactions level being held is communicated to the GRG RMs and that entered into with all connections transferred to GRG was 132.8 where there is a shortfall between CVA and the potential loss ?'om billion {or close to 5% of the total GRG portfolio). The closing a hedge, this is adequately discussed in or credit existence ofthese exposures creates the following challenges: papers ?'om GRG and that provisions andlor CVAs are adjusted appropriately. 0 The long dated nature of the derivative exposures hampers ability to restructure the associated problematic loan exposures I This also adds volatility to unexpected loss II Credit Valuation Adjustments taken against the derivative exposures are not always considered by RES in conjunction with the level of provisions;f stress losses recognised against the related loan exposures. Page 9 of 15 Action Timeline WR and SIG to revert by 31f12f2011. RBS has historically been more accepting of taking equity stakes and direct holdings of property than some of its peers. Such holdings create a risk with security recovery enforcement actions which is perhaps more acute in certain WR and SIG to revert by 31f12f2011. sensitive em-lo ee or under] in; customer sectors with issues WR and SIG to revert by 3111212011?ll the vacancy for a full time head of WR at the time of our review. This position has now been ?lled In by Helen Gordon post the review date. Page l?oflS Risk Issue Action Timeline The increase in workload since the start of the ?nancial crisis has been considerable .ur senior management an rev1ew various governance documents during the course of our review identi?ed the following areas in addition to the risks identi?ed for GRG Ireland. WR and SIG documented earlier:- 0 Credit Quality Assurance The pro?le and focus of 1. RES Group to review the scope of work undertaken by the GRG RES to con?rm the scope of the CQA need to be enhanced, albeit this is understandable CQA team. CQA function by3lr?lO/20] given it is a new function. The majority of CQA reviews currently carried out are on a desktop ?le review basis, 2. GRG Ireland to be included within the GRG CQA team?s remit in RBS to confirm the inclusion of and clearly there would be additional bene?t if the the UK. GRG Ireland in the CQA team?s reviewers could meet and question sanctioners face-to- remit 1. Face. Furthermore, the CQA process appears to focus on the completion of procedural matters rather than the quality ofthe underlying credit decisions. GRG Ireland is also currently excluded from the ORG CQA team scope, and given the number of issues within ORG Ireland, we would recommend that GRGI is included. Page I 0H5 Risk Issue Action Timeline 3. RES. GRG to provide additional training to all RMs globally on GRG to revert with action plan by what the de?nition of ?stressed loss? is. 3019/20] I. All areas There is a risk I at misun erstan mt interpretation of the concept undermine the value of the measurement as a management tool and enhance the risk of speci?c provision being taken somewhat later than appronriate. This risk is somewhat mitigated by the well de?ned quarterly Strategic Credit Review process where the levels of provision and stressed loss against the larger cases are debated in more detail. Hence, our ?nding may well be more relevant for the smaller GRG controlled cases. 4. RES, GRG to implement increased governance around new money GRG to revert with action plan by 0 All areas The new GRG Head of Risk will want to approvals and also additional governance for credit requests for all 30/91'201 I. consider the robustness of the governance framework cases that are SNCS- around new monies and exposure policy for the largest names to better align ORG with the SNC focus ado ted in the rest of the Group. 5. RES, GRG to start rcporting annual review excesses and length of GRG to update MI by 31f10fl l. ancemenfs to anCo? time CHSES are in GRG in GRGE Ml packs for management information pack in respect of the MI may management. be of use to better draw attention to genuine excesses on GRG names. the number of overdue annual reviews, and to indicate the time cases have remained under ORG control. Page 12 of IS Risk Issue Action Timeline Risk Seven: The Bank may not be maximising the lea rnings from problem situations. In addition to the risk that future decisions may be sub-optimal, loss data and hence economic loss calculations may be inaccurate. GRG have a good process for capturing the lessons to be learnt from the ?les that it controls. What was less apparent is the extent to which those lessons are necessarily communicated back to the divisions. and how this alters lending practices and behaviours and structuring of facilities. We will be asking management to formalise this process. Please see Appendix II for further details around the issues identified in respect ofloss data. RBS Group to provide the FSA with details on how loss data information and lessons learned are to be used continually across the Bank to improve lending decisions and inform risk appetites. Given the level of uncertainty that the FSA has around whether the Loss Data project can be accurately delivered on time and the risk of ongoing weaknesses in LGD and EL models. we have identi?ed four primary actions: a. The modelling team should carry out a review ofthe Loss Data Warehouse and how effectively modelling and analytics team are making use of data in the warehouse. This should include a review of LCD values for all industry sectors. an assessment of how frequently these are updated, and whether actual losses observed are leading to changes in LGDs. The results of such a review should indicate whether forecast EL is within an acceptable range. GRG and the Loss Data team to revert to the FSA on how they are aiming to mitigate the matters highlighted in Appendix II (Risks Group Risk to address the point raised in Appendix (Risk (0) and to let the FSA know what I whether any plans currently exist to make use of Loss Data across the Group on an ongoing basis. The FSA to review the progress that RBS have made on the Loss Data Capture programme. RBS have continued that they expect to have a robust BAU operating model in place for the capture of closed and open defaults as well as delivery of system enhancements in by December 201]. The scale of additional RMPS changes have led to some overrun, and the delivery ofthese system enhancements is expected by Ql 2012. The FSA to consider what remedial actions to take ifthe project has not been completed by this date. or if key aspects of the scope have not been delivered. RBS to revert by 3] December 201]. FSA to 30i6f2012. complete review by CEO and Loss Data team to revert with plan by 30f9f20l I. Group Risk to revert by 3(li?9f20l l. FSA to review project progress in Q2 2012. Page I3 of IS Appendix II - Loss Data Warehouse issue was picked up by The collection of complete, accurate and valid loss data for defaulted legal entities is a prerequisite for the development and validation of Loss Given Default models by an AIRB bank. This is also a requirement under BIPRU. In addition, Pillar 3 Market Disclosure requires AIRB banks to report on predicted and observed default rates, as well as LGD and EAD measures. In early 2010, R38 put a plan in action to start collecting loss data accurately. The FSA had initially been informed that the project to collect loss data from all of cases globally would be completed by July 2010. This was also the date by when GIA would come back and assess the adequacy of loss data collection process. GIA closed their major issue around this at the end of 2010. RBS have since continued that the July 2010 goal was to cover UK Recoveries closed cases only, albeit that delivery of this was itself delayed until 2011. Until fully remediated, the Group is exposed to the following risks! challenges: ?Given the delay in completing the loss data ca ture project, it is not a? This has resulted in sudden and unexpected increases in LGD values. An example of this has been the recent capital breach experienced by Ulster Bank Ireland (March 2011). This was partly caused by RBS having to increase average LGD values for cases transferred into GRG. While the average LGD for these cases rose by from 54-57%, there were instances where LGDs had to be increased from below 10% to 50-65%. Group Internal Audit have also raised similar instances of incorrect LGDs for GRG cases in their recent audits of various countries including Amsterdam and Germany. a) b) The data collection process is currently critically reliant on RMs both correctly populating the Excel template and submitting it in a timely manner to the loss data collection team. If either the data is not submitted, submitted incorrectly or subject to long delays before being submitted, then it will affect the quality of data in the warehouse. The Loss Data team have rolled out a series of training and awareness pregrammes to We and have said they are confident that the majority of RMs now understand the requirements. The FSA were informed during the visit that there was no way at present to assess or check whether RMs are correctly ?lling in templates and that notify the Loss Data team when the ?nal mite-off has taken place. RBS have since clari?ed that LDC case handlers review all closed defaults against source data and case ?les (where appropriate) to ensure that Loss experience reconciles. Page of IS d) Capacity of the IT team to deliver the new loss data systems in the required timeframe: The IT team have yet to agree to the delivery plans for the enhancements to systems that the Loss Data team have planned. IT resource within RBS is greatly stretched. with a number of major projects to enhance systems being run concurrently. There is therefore a clear risk that the project will be further delayed (from the end Dec 20]] deadline currently set), if the RBS IT team do not have the ability to deliver on time, either due to resource and/or budget constraints, or because of competing priorities. RBS have confirmed since the visit that they do not expect IT delays to impede on their ability to deliver the ?nal Loss Data Capture project. The collection of closed default loss data pro-2011 is not part of the loss data capture program: Given the large level of losses experienced by RBS during 2008-10, this should have been a key focus of the collection of loss data. It is surprising that this is not one of the objectives of the project. Although there is a plan to capture this data, it has been left to the Remediation team to collect it. The back-?ll exercise represents a signi?cant level of work, due to the very large amounts of data that needs to be collected. As it has been left outside the scope of the project. it will be dif?cult for senior management to monitor how successfully this work is being undertaken. We were informed that the Remediation team had now input 2010 loss data into the warehouse. However, we have not been able to assess the validity of this statement. There is therefore a risk that the project may be delayed further than envisaged, in order to complete the back fill exercise. Additionally, there is a risk that RBS can claim that the loss data capture program has been successful, without the back fill exercise being fully completed. This would mean that the warehouse does not contain all the loss data available to RBS. Poor underlying data quality will make it dif?cult to accurately define what an open I closed default is: The quality of underlying data needed to feed into the loss data templates is itself weak. This primarily concerns security and recovery data, which is not being captured accurately on current systems. The issue is compounded by reconciliation problems between different systems. As a result, the plan to automate the capture of loss data is made signi?cantly more dif?cult, and it is likely that manual intervention from GRG RMs will continue to be necessary, in order to complete security and recovery details. Whilst RBS acknowledge that this is a major risk. they are still working on how it can be resolved (currently a working party has been set up to look into the matter). Lack of ownership of the Loss Data across RBS by Group Risk: We were not able to suf?ciently ascertain to what degree Group Risk intend to use the loss data to drive credit policy and strategy. Given the rich source of loss information that the warehouse will contain, the Group can potentially spot trends in losses and therefore adapt lending policies and limits accordingly. However, there is currently a risk that Group have not set up a formal means of making use of this data on an ongoing basis. Page :5 of