The goal of Comprehensive Risk Management focuses on the identification, measurement, control and disclosure of the different types of risks to which the Institution is exposed (credit, balance-sheet, market, liquidity, non-discretionary and non-quantifiable risks). This is in accordance with regulations established in the General Provisions Applicable to Credit Institutions, issued by the National Banking and Securities Commission (CNBV) and published in the Official Gazette of the Federation on December 2nd 2005 and the best practices in banking established by the Basel Committee.

The CAIR is in charge of authorizing and proposing to the Governing Board the Target Risk Profile, which defines and expresses the risk appetite ensued from the Strategic Plan, which establishes the strategic risk objectives to maintain the Institution’s capital adequacy and financial sustainability.

Capitalization

The Framework for Risk Management draws from the Strategic Asset Management and at all times monitors the regulatory minimum levels, within a safety margin defined and authorized by its CAIR and its CD, that ensures that taking risks is based on the Institution’s capital adequacy and financial sustainability:

The UAIR defines the Institution’s Disposable Assets for every fiscal year, based on the capital formation policy and the institutional business plan. Once the disposable assets have been determined, a capital allocation is carried out on a Strategic Level, in accordance with the policies in force and the risk profile. These limits are authorized by the CD and, ultimately, an allocation is carried out on a Tactical Level, which is authorized by the CAIR and reported to the CD.

The follow-up on the use/ consumption of Capital Limits is periodically carried out and reported along with the business areas and the governing bodies. In the past year said limits have not been breached.

The strategic asset management and the control of risky consumption is carried out so that the Institution’s ICAP remains above the target levels defined by the CD. The ICAP’s performance proves the Institution’s financial soundness and the capital adequacy to withstand the risks assumed.

The risk appetite is expressed by the allocation of regulatory capital, the loan risk being the one with the highest consumption, this way complying with the mandate assigned to the Institution. Likewise, it indicates growth of capital, which is the result of its capital formation policy. The growth of its assets observed in the past years has been backed by the capital formation generated by the Institution.

Loan Risk

By December 2021, the Total Portfolio rose to 266,797 million MXN, with a balance due of 8,500 million MXN, a default rate of 3.19% and a coverage of non-performing portfolio of 1.23 times. This portfolio was mainly made up of loans destined to the private sector and the financial sector, with 96.6% of the portfolio.

The annual average balance by borrower of the Portfolio increased 14.6% in the 2017-2020 period, but it has decreased as share of the Trading Portfolio. In December 2021, the average balance increased 1.9% compared to 2020.

The concentration of the portfolio recorded its highest level in the 2008 crisis, when the Gini Index reached 84.9% due to the implementation of Emerging Loan Programs. The concentration has gradually fallen and reached a Gini Index of 63.1% in December 2021.

Likewise, portfolio concentration measured by the Herfindahl Index shows more granularity in the portfolio in 2020. The number of companies of equal size has grown in relation to the total of companies since 2017; however, in December 2021 this proportion fell.

In the 2017-2020 period, in the concentration of the 20 Highest Exposures from the Private Sector we observed a drop in relation to the Core Capital. In December 2021, the concentration of the 20 Highest Exposures remained steady, mainly due to the effect of the exchange rate.

The Institution uses a nine-level scale for measuring the loan risk on the payment capacity and experience of borrowers (Expected Loss), where Level 1 is “excellent payment capacity” and Level 9 is “null payment capacity”.

Throughout 2020, the balance structure, based on the 1-3 Level rating (R1-R3), dropped from 89% to 75% as a result of the downgrade of the risk level for borrowers affected by the COVID-19 pandemic.

It is worth mentioning that the Institution implemented a support program to said borrowers. In December 2021, the balance structure of the companies rated in R1-R3 remained stable compared to 2020.

The Institution also supports PyMEX (SMEs belonging to an export chain or a currency generation chain) under the protection of a Guarantee Program operated through the network of Financial Intermediaries. The Portfolio of Guarantees, as of December 2021, has a balance of 11,792 million MXN, made up of the Automatic Approval Program and the Transaction Program. In the past three years, the Portfolio of Guarantees has had an average balance of 12,508 million MXN.

Balance-sheet Risk

Banking operations correspond to the credits granted by the Institution and its funding strategy.

The Institution maintains the policy of keeping practically all operations, active (credit) as well as passive (funding), at a reviewable rate, either naturally or by contracting derivative financial instruments based on interest rates. This way, the goal is to minimize the exposure of the Balance sheet in light of movements in the base rate, with the purpose of prioritizing Capital allocation to Credit operations and optimizing Capital requirement due to Market Risk.

The operations that are not handled with a reviewable rate refer to Long-Term Funding Lines contracted with Foreign Development Institutions for specific projects.

The structure with bands has not reported any significant changes by virtue of the policy established for optimizing the use of Capital assigned to Market.

It is worth mentioning that the credit granted by the Institution is generally medium- and long-term, which is why the duration gap between Assets and Liabilities is managed and controlled. Given that the Institution is backed by the Sovereign Guarantee, it can access competitive resources in the domestic and foreign markets in the short-, medium- and long-term, which is why on a regular basis it issues debt securities or contracts maturity-based financing lines. These issuances have the purpose of searching for stability in their funding to manage to position themselves on the maturity-based credit market.

In the Institution’s balance sheet, approximately 60% of the credit portfolio is denominated in US dollars, which is why strict management and control are applied in terms of the Foreign Currency Position.

In general terms, a levelled Exchange Risk Position is maintained, very much below the Regulatory Limit established by Banco de México (15% of the Core Capital).

The previous levelling is achieved in a natural manner by contracting funding in foreign currency and by contracting derivative financial instruments based on the exchange rate.

Liquidity Risk

The monitoring of the Liquidity Risk is carried out through indicators that seize the exposure to this risk, along with stress tests designed in accordance with the Institution’s Liquidity Profile:

• Cash Flow Index (CFI): its objective is to establish the level of cash inflows in USD sufficient to cover cash outflows in USD.
• Adjusted Liquidity Coverage Ratio (Adj. LCR): its objective is to establish the level of Liquid Assets sufficient to cover Net Cash Outflows of the next 30 days, considering the Institution’s refunding capacity.
• Liquidity Risk Index (IRL for its acronym in Spanish): its objective is to establish the level of assets in USD that can be converted into cash to cover outflows of resources in USD during the next 5 days.
• Refunding Risk Index (IRR for its acronym in Spanish): its objective is to establish a control on the refunding risk based on the maturity profile, which has an impact on the financial margin in US dollars and Mexican pesos.
• Prudential Liquidity Ratio: its objective is to establish the optimal cash level with the purpose of not incurring a liquidity cost and facing the daily needs of the Institution’s Treasury.

Management and control is carried out by following up on the compliance of the indicators based on authorized thresholds.

Throughout 2021, the Institution has implemented various strategies, such as the increase in the position of liquid assets and the substitution of short-term deposit-taking with long-term deposit-taking, to keep the Liquidity Risk under control and so that the indicators remain withing the levels established.

Market and Counterparty Risk

The business portfolios have less than 4% of the Institution’s Core Capital assigned to Market and Counterparty Risk, thus favoring the use of Capital for credit operations, which is the Institution’s main activity. By the end of December 2021, the Capital requirement for these risks represents less than 12% of the Institution’s total capital requirement.

The Market and Counterparty Risk is under control in the Portfolios managed in the Institution:

Money Desk

This is the main portfolio, and it is made up of operations on repurchase agreements maturing in less than three days with debt securities; most of them are reviewable government securities, which is why the exposure to Market and Counterparty Risk is low.

The Market Risk profile is determined by the Investment Regime, which was approved by the Governing Board and the CAIR and has not reported any changes in the past two years.

The structure of the portfolio, as of December 2021, was the following:

Risk positions have remained within the authorized Market and Counterparty Risk Limits. The portfolio has shown a favorable performance, with a return higher than the institutional minimum return.

Currencies

The Currency portfolio corresponds to foreign currency trading. The operation is subject to Risk Limits, and consumption has remained within the levels authorized. This business unit has generated enough earnings so that its return is above the institutional minimum return. As to the counterparty risk, these operations do not incur in said risk, given that they are spot transactions.

Derivatives

This portfolio is made up of swaps and interest rate and foreign currency options, which are sold to the Institution’s customers, so that they cover its Balance sheet’s exposures to risk factors such as interest rates or exchange rates.

With the purpose of mitigating these operations’ exposure to the Market Risk, the Institution acquired a coverage with Financial Institutions with high credit quality and with the same financial characteristics. The policy of acquiring coverage has been in force since the start of operations, which is why the consolidated position has been fully compensated during the past five years. As a result, the Market Risk from this portfolio is entirely neutralized and within the established Risk Limits.

The derivative financial instruments for Coverage Strategies entail a low counterparty risk given that:

• Transactions with derivatives are carried out with Institutions with First-rate loan risk that comply with eligibility criteria and selection of counterparties.
• Financial Institutions have a credit line authorized by the corresponding Internal bodies.
• Daily margin calls are established due to institutional policy in the credit annex of the ISDA agreement signed with the counterparties.

Legal Risk

The Institution establishes and maintains an environment of internal control that ensures in a reasonable manner that the activities carried out are regulated in accordance with the applicable Legal Framework. Before conducting legal acts, their legal validity and their adequate legal application are analyzed.

For the purpose of Legal Risk management, the Expected Loss is used to estimate total potential losses due to unfavorable judicial or administrative resolutions; this allows to progressively build reserves according to the procedural stage of every trial and the ruling by the Authority. The following is monitored and reported on a monthly basis:

• The Handling by the Legal Department of the current 10 top trials with the largest amount in reserves.
• The Coverage Index for Trials.
• The Concentration of Lawsuits by Geographical Area.
• The Concentration of current trials addressed by External Lawyers.

As of December 2021, the Legal Risk is at a Low Risk Level, if we take into account that the reserves are sufficient to cover all legal contingencies due to unfavorable judicial or administrative resolutions for the Institution according to their procedural stage and the possibility of losing the case.

Operational Risk

The Institution has an organizational model that enables the communication between the three lines of defense, with the purpose of mitigating risks in a reasonable manner by implementing and executing internal controls.

The Institution has a solid experience in operational risk management represented by:

• The capacity of processes, since these are standardized and linked.
• The expertise of personnel, complying with the person-job profile, trained and evaluated in its performance.
• The state of IT, given that the interaction of technological applications ensures the correlation between the processes involved.
• The handling of the First Line of Defense, the supervision of the Second Line of Defense and the evaluation of the Third Line of Defense.

The design and management of the Comprehensive Operational Risk Methodology takes into account the best practices in this field:

• Good practices for the management and supervision of the operational risk, issued by the Basel Committee on Banking Supervision in February 2003.
• ISO 31000:2018, issued by the International Organization for Standardization, which provides the principles and guidelines for Risk Management.
• ISO/IEC 31010:2019 – Risk Evaluation Techniques, issued by the International Organization for Standardization and the International Electrotechnical Commission (IEC).
• ISO/IEC 27001, issued by the International Organization for Standardization, which provides the principles and guidelines for Information Security Management.

Likewise, the following is monitored and reported on a monthly basis:

• The Operational Risk Profile.
• The Indicators for Strategic Risk that allow measuring the evolution of each one of the risks defined as priority.
• The Management carried out by the People responsible for Critical Processes in relation to Risk scenarios.
• Given the case, the Corrective measures implemented by the People responsible for the Processes in relation to events that occurred.
• The Capital requirement due to Operational Risk
• The reserve due to Operational Risk and/or requirements of Resources assigned to protecting Issuer Customers of the Interbanking Electronic Payment System (SPEI for its acronym in Spanish) by Banco de México

Technological Risk

The Institution has a Methodology for Technological Risk and Information Security Profile (PRTySI for its acronym in Spanish), based on international standards and good practices in this field. This methodology allows to know the risk level to which the Institution is exposed in terms of Information Technologies and Security (ISO 27001, 27002, 27005, 27032, 31000, etc.), as well as the level of experience in said matter. In addition, it carries out technological risk management by tracking indicators on IT Availability and Security.

Based on the methodology, Technological Risks are classified as follows:

On the other hand, there is a Management System for the Business Continuity Plan, whose goal is to ensure the continuity of operations and minimize the impacts when facing different contingencies that may occur. Said plan is based on the methodologies for Business Impact Analysis, whose objective is to identify and prioritize the Institution’s critical processes to reestablish services during a contingency; and on the Risk Analysis methodologies, whose objective is to estimate the impacts in the critical processes when facing different threats to determine the lines of action. These methodologies are based on the ISO 22301 and 22317 standards.

Throughout 2020, the Management System for the Business Continuity Plan SG – PCN (for its acronym in Spanish) was activated for the pandemic scenario. The remote work model was implemented, which has the technological and control tools to carry out banking functions. To date, the services have remained available within the committed thresholds and there have been no incidents that breach the Institution’s information security.

Reputation Risk

The Institution has a methodology that follows best practices and that evaluates the gap between the behavior of the entity (reality) and the perception of stakeholders by monitoring sources of threat and news. The Institution develops prevention strategies and has a communications plan for events that may lead to the reputation risk. The following is monitored and reported on a monthly basis:

• Financial results to guarantee and generate trust with interest groups as to the entity’s solvency and viability.
• The rating of Rating Agencies.
• The Demand for Bank Credit survey (BANXICO, short for Banco de México).
• The Work Environment and Organizational Culture survey.
• The evaluation on Information Quality by BANXICO and CNBV.
• The Monthly monitoring of News about the Entity.
• The annual report of the companies in Mexico in relation to the existence and publicity of corporate integrity policies.