EFC closure - Regulatory focus on minimum capitalisation

On January 19, 2024, the Central Bank of Uganda (BoU) initiated the liquidation of EFC Uganda Limited (EFC), revoking its licence and mandating the winding up of its operations. At the time of the announcement, EFC had a customer base exceeding 2,400. As of December 2021, the financial position of the company was as follows: Total Assets (TA) amounted to UGX 112.8 billion, Total Liquid Assets (TLA) stood at UGX 21.638 billion, and Customer Deposits (CD) totaled UGX 52 billion.

BoU’s exercise of its powers under Sections 72(1) and 12(1)(d) of the Microfinance Deposit-Taking Institutions (MDI) Act of 2003, as amended, was prompted by the reported undercapitalization deficiencies and issues in EFC's corporate governance structure.

Weeks following this announcement, the central bank and the Deposit Protection Fund (DPF) continue efforts to finalise the processing of payments of protected and unprotected funds to depositors.

The action taken by BoU demonstrates its continued commitment to ensuring that financial institutions maintain adequate high-quality capital to safeguard the interests of depositors, shareholders and other stakeholders. This proactive stance helps shield the regulator from the potential need for substantial bailouts in the event of institutional failures. Banks are required to meet the capital criteria as mandated by the BoU and other banking authorities.

The Basel Accords—Basel I, Basel II, and Basel III—are the most well-known set of regulatory requirements for bank capital. These agreements establish rules and requirements aimed at ensuring that banks maintain adequate capital reserves relative to their risk exposures, enabling them to withstand economic downturns.

As per the BoU circular dated July 6, 2023, current minimum capital requirements mandate that commercial banks and credit institutions maintain a minimum paid up capital of UGX 120 billion and UGX 20 billion, respectively, by December 31, 2022. Additionally, the regulator stipulated that these capital thresholds will be increased further to UGX 150 billion for commercial banks and UGX 25 billion for credit institutions, effective by June 30, 2024. Financial institutions are required to submit their minimum capital requirements to the regulator by June 30, 2024.

A few commercial banks have already opted to have their licences downgraded, perhaps with the anticipation that they would not be able to achieve the minimum requirement by the deadline. In other cases, potential mergers and acquisitions are being considered as a strategy to address any capital gap. The actions of the various institutions suggest a clear appreciation of the regulator’s unwavering stance on the thresholds that it has defined and its commitment to ensuring that supervised institutions are adequately protected against macroeconomic shocks and liquidity challenges.

For institutions that are in a better position in relation to the minimum capital requirement, they must now reflect on and reengineer their Internal Capital and Liquidity Adequacy Assessments (ICAAP & ILAAP) to ensure that they remain compliant. However, beyond compliance, the contributions of ICAAP and ILAAP support an institution's capital sufficiency from various angles and are crucial for its continued existence. The ICAAP process should not be seen as a compliance exercise or a mere document, but rather as a strategic tool and a process for improving operations and risk management practices. When coupled with good corporate governance, this framework empowers financial institutions to drive strategic objectives with the assurance of resilience.

As a way forward for financial institutions given the increased focus on capital adequacy, a combination of strategic, financial, and operational measures will be required, paying close attention to the following areas:

1. Governance framework: It is imperative to have an appropriate governance framework that also forms part of the institution's overall corporate governance framework. This needs to clearly articulate the roles and responsibilities of the Board and Senior Management.The management body should have the overall responsibility for the implementation of the ICAAP and is expected to approve a sound ICAAP framework with clear and transparent assignment of responsibilities, adhering to segregation of function. It is best practice to conduct reviews by three lines of defence, consisting of the business lines and the internal control functions (risk management, compliance, and internal audit). An important aspect of the different inputs into the ICAAP calls for sound governance over data quality and the IT support systems.

2. Risk management: Aspects of the ICAAP should align with the institution's business strategy and risk appetite informed by the risk appetite framework. The institution is expected to use its own processes and methodologies to identify, quantify, and set aside internal capital against the expected losses. As part of the recovery plan, reverse stress testing can be utilised.

The institution should have a well-articulated recovery plan that aims to restore the financial position following a significant deterioration and this plan should be part of the same risk management continuum. The thresholds for early warning signals and recovery indicators, escalation procedures and potential management actions should be included in the related documents and consistently kept up to date.

3. Capital planning and forecasting: The current and forecast capital requirements should be a derivative of the business plan. Capital needs to be quantified for all material risks covering both pillar 1 and pillar 2 risks.

Integrated forecasting, where stress testing and budgeting are linked together, is a key area of improvement from an ICAAP process perspective.  This integration will not only provide banks and MDIs with various business benefits and insights but also offer information on both financial and capital metrics.

Potential ICAAP management actions with material impact are expected to be reflected in the recovery plan, and vice versa, to ensure that the processes and the information included in related documents are consistent and up-to-date.

Credit institutions should consider an evolving economic capital framework. This includes consideration for incorporating additional risks like capitalising for pillar 2 risks and their impact on capital over time as the institution builds up to an economic capital framework (ECF). This can then act as a single measure of risk that can be applied consistently across risk types and business areas.

4. Stress testing: Stress tests should be made as effective as possible by integrating or embedding scenarios into the budgeting and pricing of products to capture a range of risks. In addition, instead of only factor testing per risk type or business unit, plausible to worst-case scenarios should be adopted in the modelling and testing. Investing in technology or solutions that support the integration of such models into the entire business cycle can be a key measure for risk management and compliance.

In the short to medium term, focus should be directed towards establishing an integrated stress testing framework. This framework should encompass multi-factor and dynamic scenarios that show  correlations within and between risks (aggregation and diversification). As part of this journey, the stress testing framework can also be extended to provide insights on any new business decisions, such as entering new sectors or launching new products that the institution is considering. This can help anticipate implications on the risk landscape on a forecasted basis.