Pillar 3 - Disclosure of Financial Information 2024
Contents
Introduction 3
Capital Adequacy and adaption to the Captial Adequacy Regulations 4
Organization, Responsibility, Management and Control 8
Credit Risk 13
Counterparty Risk 17
Market Risk 18
Liquidity Risk 19
Operational risk 20
Compliance Risk 23
Other Risks 24
Contingency / Recovery plan (Henning) 25
Appendix 26
Morrow Bank ASA / Pb. 448 / 1327 Lysaker / Org.nr.: 998997801 / morrowbank.com
-
INTRODUCTION
Morrow Bank ASA ("the Bank") is a specialized consumer finance bank with an ambition for long-term value creation, offering consumer loans and credit cards in Norway, Sweden and Finland, and high-interest accounts to private individuals in Norway, Sweden and Germany. The Bank also offers point of sales finance products in Norway and Sweden in collaboration with the Komplett Group.
The Bank is headquartered at Lysaker Brygge 35, 1366 Lysaker, Norway.
Morrow Bank ASA's report on risk and capital management (Pillar 3) has been prepared to provide information about risk management, risk measurement and capital adequacy in accordance with the disclosure requirements under "Regulation on capital requirements and national adaption of CRR/CRD IV" and the guidelines issued by the European Banking Authority (EBA) in "Final report on the disclosure requirements Guidelines under Part Eight of Regulation 575 2013 (EBA-GL-2016-11)". The report is updated at least annually. Information about capital adequacy and the minimum requirements for own funds will be updated quarterly and published in a separate appendix to the report (Pillar 3 Appendix). The methods used to calculate capital requirements as well as information about the Bank's internal risk measurement and management are explained in the report. See the tables in the Pillar 3 Appendix for additional quantitative information. The Risk and Capital Management report provides a good and accurate description of the risk situation in Morrow Bank. It outlines how risk is measured, managed, and reported in the Bank.
The methods used to calculate capital requirements are shown in the table below.
Risk type
Reporting method
Credit risk
Standardized approach
Counterparty risk
Market value approach
Operational risk
Standardized approach
Market risk
N/A
Risk of credit valuation adjustment (CVA)
Standardized approach
The Bank has no trading portfolio or exposure requiring the Bank to include a capital requirement for market risk.
-
CAPITAL ADEQUACY AND ADAPTION TO THE CAPTIAL ADEQUACY REGULATIONS
-
Regulatory matters and Capital requirements
Capital adequacy is calculated in accordance with the EU capital adequacy regulations for banks and investment firms (CRR/CRD IV), which was implemented in Norway from 31 December 2019.
Under the capital requirements regulations, the Bank must meet Pillar 1 requirements, buffer requirements and Pillar 2 requirements. The minimum requirement for capital adequacy under Pillar 1 is that primary capital constitutes at least 8.0 per cent of the institution's risk weighted assets (RWA). The capital adequacy requirement must be fulfilled by at least 4.5 per cent common equity Tier 1 (CET1) capital and at least 6.0 per cent Additional Tier 1 capital (AT1). The rest can be fulfilled by Tier 2 capital (T2). In addition to the minimum requirements for own funds, the Bank must have capital buffers consisting of CET1 capital.
Pillar 1 req.
31.12.2024
Buffer req.
31.12.2024
CET1
4.5%
Countercyclical *
0.9%
AT1
1.5%
Capital conservation
2.5%
T2
2.0%
Systemic risk **
1.2%
Buffers
4.6%
Regulatory buffers
4.6%
Total
12.6%
Management buffer
2.0%
Table 1: Pillar 1 requirements Table 2: Buffer requirements
* The countercyclical capital buffer requirement will vary according to the proportion of loans to Norwegian, Finnish and Swedish customers. The Norwegian authorities require countercyclical capital requirement of 2.5% as at 31 December 2024 while the Swedish authorities require 2 %. The Finnish authorities don't require countercyclical capital buffer for the Bank's exposure in Finland.
The table shows the various elements that together constitute the capital adequacy requirements for Morrow Bank. Morrow Bank should have a margin of at least 2.0 %-point to the overall regulatory requirement for total capital requirement (management buffer). The objective of the management buffer is to cushion fluctuations in risk-weighted assets and earnings that could arise from changes in exchange rates or credit spreads, to enable the Bank to maintain a normal balance growth.
The Pillar 2 requirement is established on the basis of Morrow Bank ASA's own risk and capital needs assessment referred to as the Internal Capital Adequacy Assessment Process (ICAAP ), and the discretionary assessments with support for methodology in accordance with the Financial Supervisory Authority of Norway (NFSA) circular 12/2016 and on the basis of an overall assessment of the Bank's risk and capital conditions, through the Supervisory Review and Evaluation Process (SREP) by the Financial Supervisory Authority of Norway.
Finanstilsynet (the Norwegian Financial Services Authority - NFSA) has on 19 December 2024 informed Morrow Bank ASA (the "Bank") that the Bank's Pillar 2 requirement ("P2R") no longer needs to consist of 100% CET1 capital, as per the Bank's latest SREP letter (23 May 2024), but may consist of a minimum of 56.25% common equity tier 1 (CET1) capital and 75% core capital. Total capital shall fully cover 100% of P2R. The Bank's P2R remains at 5.4%.
The requirement is intended to cover the risks the enterprise is exposed to, and which is not, or only partially, covered by the minimum requirement under Pillar 1. The Pillar 2 requirement must be covered by CET1 capital by 56.25%, tier 1 capital by 75% and 100% by total capital.
Total capital requirement
31.12.2024
CET1 capital requirement
31.12.2024
CET1
4.5%
CET1
4.5%
AT1
1.5%
AT1
-
T2
2.0%
T2
-
Regulatory buffers
4.6%
Regulatory buffers
4.6%
Total Pillar 1 req
12.6%
Total Pillar 1 req
9.1%
Pillar 2 requirement
5.4%
Pillar 2 requirement
3.0%
Total capital requirement
18.0%
CET1 capital requirement
12.1%
Management buffer
2.0%
Management buffer
2.0%
Total capital target
20.0%
CET1 capital target
14.1%
Table 3: Total capital requirements
At the end of 2022, the Bank's total regulatory requirement for common equity Tier 1 was approximately 12.1 percent. (9.1 percent pillar 1 requirement plus 3.0 percent pillar 2 requirement). The requirement will vary due to the countercyclical buffer determined by the magnitude of exposure per country.
-
Own funds
Calculation of own funds (figures in NOK million):
Table 4: Own funds
The Bank has opted to use the phasing-in rules for own funds linked to the implementation of IFRS 9 as of 1 January 2018, and its impact on the Bank's expected losses on loans. This is indicated in table 4 as "Phase-in impact of IFRS 9". Consequently, common equity tier 1 capital, tier 1 capital and own funds are also presented with and without the transitional rule in the table above.
The Bank's total capital consists of a subordinated bond (ISIN NO 001 0886542) with interest payment agreed at 8.0% plus 3 months NIBOR.
-
Calculation basis
Distribution of the calculation basis (figures in NOK million):
Table 5: Calculation basis
-
Current capital situation and future plans
As of the end of 2024, the Bank had the following capital adequacy ratios:
Common equity tier 1 capital
17.5%
Tier 1 capital
19.1%
Total capital
21.2%
Table 6: Capital adequacy ratios
As of the end of 2024, Morrow Bank was well-capitalized, with a common equity tier 1 capital ratio of 17.5%, well above the authorities' minimum requirement of 12.1%. The total capital ratio was 21.2%, down from 23.6% at the end of 2023. This is well above the minimum requirement of 18.0%, and the Bank's target when an addition is made for the management's management buffer. Perpetual tier 1 bond (AT1 capital) and supplemental capital (T2 capital) amounted to 1.6% and 2.1% respectively.
-
Capital assessment / ICAAP - Pillar 2
The ICAAP process is implemented to ensure that the Bank has sufficient capital in relation to the overall risk profile. The Board ensures that there are established routines to ensure that risk and capital level assessments are updated as needed, and the Board regularly reviews the Capital Plan/ ICAAP/ ILAAP in conjunction with updates of the Bank's plans and forecasts, or more frequently if required. The capital perspective is an integral part of the Bank's work on governance, control and strategy.
The capital assessment process should:
Cover all significant risks the Bank has,
take into account the minimum requirements arising from the capital adequacy regulations and calculate any additional needs as a result of risks that are not adequately covered by the minimum requirements.
cover risks associated with the quantification of risk and capital requirements based on methods and data containing uncertainty.
consider assessments of the Bank's capital situation under stress and
be forward-looking.
As an independent third party, the Bank's internal auditor conducts an annual review of the Board's ICAAP / ILAAP document. The Board believes that the establishment of the Audit and Risk Committee in Q4 2018 has strengthened the Bank's assessments of risk exposures and capital levels.
The Bank employs stress testing as an aid to identify the capital required over and above the regulatory minimum requirement and to evaluate the Bank's capital adequacy target. Stress testing is performed in connection with ICAAP and ILAAP.
- Unweighted tier 1 capital ratio
The minimum regulatory requirements for the unweighted core capital ratio for Norwegian banks are 3.0%, as well as a buffer requirement of 2.0%. Hence, he minimum requirement for Morrow Bank's unweighted Tier 1 capital ratio is therefore 5.0%. Morrow Bank is significantly above its future requirements and internal framework with an unweighted core capital ratio of 11.2% at the end of 2024. The calculation of this component includes unweighted asset items and unpaid loan commitments. Unutilized credits are also included.
-
Own funds
-
Regulatory matters and Capital requirements
-
ORGANIZATION, RESPONSIBILITY, MANAGEMENT AND CONTROL
-
Principles for risk management and internal control
The Board of Directors has established a framework for risk management and internal control adapted to the Bank's business, size and complexity.
The principles described in this chapter ensure the adequacy of risk management arrangements of the Bank and provide an assurance that the risk management systems put in place are adequate regarding the Bank's risk profile and strategy.
Risk management and internal control shall be carried out according to the following general principles:
The Bank's risk tolerance and limits are set by the Board of Directors. Risk is to be measured and managed through systematic assessments of the risk situation against the board's established framework. Identifying and assessing relevant improvement measures is considered central to the work of measuring and managing risk.
Appropriate and effective procedures must be available for identifying, measuring and reporting risks the Bank is exposed to for all departments and processes. This includes establishing follow-up, reporting and control routines that test and document whether internal control has been carried out with the desired result.
A good understanding of the risks to which the Bank's operations are exposed. The Bank shall develop, implement and maintain a framework for measuring and managing relevant risks. The framework must be fully integrated into the business's overall risk management process and should form an integral part of the Bank's decision-making process.
The Bank will implement processes to regularly monitor risks and exposures. Appropriate reporting mechanisms that support proactive risk management should be established in the board, management and business units.
The Bank shall have the necessary expertise, capacity and system support to carry out and follow up internal and external processes in an appropriate and satisfactory manner.
Through work on identifying and managing significant risks, unexpected individual events able to materially damage the Bank's financial position, should be avoided.
Central risks must be identified and monitored on an ongoing basis. Procedures must be established for follow-up and reporting to the Bank's management and to the Board of Directors.
A clear organizational structure with clearly defined areas of responsibility which contribute to the overall management of the Bank 's operations.
Processes and authorizations should be designed in a way that facilitates transparency and duality. Appropriate procedures shall be established to ensure that authorizations are not exceeded and to prevent fraud. Such checks must be documented.
All employees must have sufficient information, expertise and capacity to handle the tasks and responsibilities they are assigned in a responsible manner.
Effective information channels must be established to ensure that all employees have full insight into and understand the policies, instructions, etc. affecting the tasks and responsibilities they are assigned.
Systematic registration and follow-up of customer complaints shall be carried out in accordance with the rules in force at any given time, including requirements in the Norwegian Financial Supervisory Authority's circular 4/2019, and to uncover the improvement potential in the Bank's routines and processes, and to facilitate high customer satisfaction. A separate written procedure for complaint handling shall be established.
The risk management and internal control shall be documented in a systematic manner and shall be available for internal or external control, audit or supervision.
The Bank has established Principles for Corporate Governance as part of the management system. The principles have been further specified and incorporated the Bank 's articles of association, strategies, board instructions, policies, ethical guidelines and other management and control frameworks. The principles are available on the Bank's website: https://ir.morrowbank.com/corporate-governance
Principles for recruitment policy for the selection of members of the management body and their actual knowledge, skills and expertise and the policy on diversity with regard to selection of members of the management body, its objectives and any relevant targets set out in that policy, and the extent to which these objectives and targets have been achieved are available on the Bank's website: https://ir.morrowbank.com/reports-presentation
The Bank's risk management includes the identification, measurement and assessment of all risks that may affect the Bank's objectives. Risk management and risk control is a central function of the organization and encompasses the entire business and all employees. The overall purpose of risk management is to ensure that the Bank achieves the set objectives, securely efficient operation, management of risks that can hinder the achievement of business objectives, ensure high quality internal and external reporting, and ensure that the Bank operates in accordance with relevant laws, regulations and internal guidelines. Risk-taking is the foundation of all banking operations, and it is therefore important that profitability is assessed in relation to risk.
-
Organization and responsibility
The Bank's Board of Directors are responsible for ensuring that the operation is appropriately organized. The Board of Directors adopts plans and budgets, as well as guidelines for the Bank's activities, and is responsible for ensuring that the enterprise has appropriate systems in place for risk management and internal control. The Board of Directors keeps itself informed of the Bank 's financial position at all times by reviewing and approving quarterly and annual reports, as well as monthly reviews of Morrow Bank's financial position and development. The Board of Directors is responsible for monitoring and managing the Bank's overall risk. The Board of Directors must also regularly consider whether the Bank's governance and control arrangements are appropriate for the risk level and the scope of the business.
The Board of Directors have drawn up a set of instructions for the Board's responsibilities and
duties, matters which must be considered by the Board, rules regarding case handling, etc. The Board's work and competence is evaluated annually. The Board also establishes an annual plan for its work. The Board of Directors has also established instructions for the general management of the Bank. The Board of Directors decided on 11 February 2020 to appoint a remuneration committee. The remuneration committee is responsible to prepare and propose the Morrow Bank's remuneration scheme for the Board of Directors and, in particular, for ensuring that the scheme promotes and offers incentives for good management and control of the Bank's risks, discourages high risk-taking and helps to avoid conflicts of interest. The remuneration scheme Corporate governance is formulated in accordance with the statutory and regulatory requirements applicable to financial enterprises. Pursuant to Section 6-16(a) of the Public Limited Companies Act, the Board of Directors issues a statement concerning the setting of the salaries of the CEO and other senior executives.
On 23 June 2018, the Board of Directors decided to set up an independent audit and risk committee consisting of two external Board members, with the CEO and CFO from the senior management team. The committee conducts thorough evaluations of the Bank's risk management and internal control, as well as the Bank's financial position, including financial reporting. The audit and risk committee is also responsible for ensuring that the Bank has an independent and effective external and internal audit, as well as satisfactory financial reporting in accordance with applicable laws and regulations.
The CEO is responsible for adapting the business to the risk profile determined by the Board of Directors and preparing for a result which corresponds to the Board's performance targets. The CEO is responsible for establishing sound risk management and internal control based on strategies and guidelines set by the board. The CEO is responsible for ensuring that a robust control environment is established at all levels of the Bank and ensures continuous monitoring of changes in the Bank's risks so that these are properly safeguarded in accordance with the Board's guidelines. CEO further ensures that the Bank's risk management and internal control are documented in accordance with laws, regulations, regulations and statutes.
Senior management are responsible for establishing sound risk management and internal control in their areas. All activities must be carried out within the framework, regulations, guidelines, etc. as shown in the Bank's management system.
The 1stline defense is exercised by the Bank's Operations department, Credit Risk department and Finance department. The functions are responsible for day-to-day operations and follow-up of current routines, including AML activities. Credit risk and Operations must actively consider whether risk management and internal control are carried out as intended within their respective responsibilities. The same applies to funding the Bank's operations, as
well as placement of surplus liquidity and buffer capital.
The 2ndline defense consists of risk control and compliance. The Bank's risk control function is independent and shall not be involved in the performance of services and activities which are controlled. The risk control function has the responsibility for monitoring the overall risk situation and the framework for risk management, including internal control and aggregation of risk. Furthermore, risk control is responsible for controlling the Bank's risk strategy and other risk management guidelines are followed up, so that methods and tools related to risk management are further developed.
The Bank's compliance function is also independent and not involved in the performance of certain services and activities. The compliance function monitors that the Bank fulfills its obligations under the current regulations, undertakes regular checks to ensure that internal policies, procedures and measures are sufficiently effective; considers any measures that must be taken to remedy non-compliance with the regulations, ensuring that relevant changes to the regulations are captured and that changes are made known within a reasonable time before they come into force for relevant employees and union representatives in the Bank, and that the Bank's operations are adapted to the change. When introducing new products or significant changes in organization, routines, etc., the compliance function assesses that the changes are in line with current regulations.
The 3rdline defense consists of the internal audit and is contracted out to EY. Internal Audit conduct
systematic risk assessments and internal control investigations to ensure that it works on one appropriate and reassuring manner and operates independently of the administration. Internal auditor has right of meeting in board meetings. The Internal auditor prepares an annual plan based on their own risk assessment. The internal auditor reports to the Board.
- The scope and nature of risk reporting
The table below summarizes the scope, nature, frequency of risk reporting:
Report (content)
Frequency
Report to
Responsible
Risk and internal control report:
Annually
The Board* CEO
CEO
Senior management
Independent confirmation of internal control
Annually
The Board*
Internal Auditor (Manager Risk Control Coordinates)
Summary of internal control
Assessment of risk situation
Assessing the need for new measures
Compliance and risk control report
Monthly Quarterly
The Board* CEO
CRO/CCO
Customer Complaint Report
Annually
The Norwegian FSA
COO
Capital Assessment (ICAAP)
- The basis material and recommendation for the Board's overall assessment, including stress tests
Annually Or more frequently if required
The Board*
CRO/CFO
Review of risk management and internal control policy with any proposed changes
Annually
The Board*
CCO/CRO
Management Report
Monthly
The Board*
CFO/CRO/CCO/CRO
Compliance with current regulations in accordance with concession
Compliance with frameworks set in policies, etc.
Violation of regulations in the management system
Event Registration
Follow-up of customer complaints received
Spread risk
Interest risk
Currency exposure
Capital adequacy
Credit risk report
* Reports prepared and distributed to the board shall also be reported to the board's subcommittees
The employee responsible for the individual report shall ensure that routines are established for quality assurance of the reporting data and reporting systems, both for internal and external reports. The form, content and frequency of reports must be reassessed regularly.
-
Principles for risk management and internal control
-
CREDIT RISK
-
Definition of credit risk
Credit risk is the risk of default on a debt that may arise from a borrower failing to make payments. Credit risk is most simply defined as the potential that the Bank's borrowers or other counterparties will fail to meet its obligations in accordance with agreed terms.
Credit risk is the most significant risk category for the Bank. The Bank meets this with a combination of analytical approaches for credit assessment, product customization and good and close customer follow-up during the loan period as well as the recovery phase.
-
Credit policy
The Board has adopted a credit policy with guidelines for credit approval, risk limits, monitoring and reporting in the area. The guidelines are reviewed by the Board at least annually. The Board receives regular reports on developments in the Bank's credit risk.
The Bank provides loans, credit cards and products to private individuals. A credit assessment is carried out covering debt servicing capacity and willingness. The credit decision concerning individual loan applications is based on an assessment of available external and internal information pertaining to the applicant. A combined process is carried out using an application score and specific credit rules. All loan applications are assessed using automatic processes in combination with manual credit ratings. The credit card loan application process is fully automated, regardless of credit limits. The Bank uses risk-based pricing in accordance with the assessment carried out in connection with the establishment of the individual loan.
Lending activities are aimed at unsecured consumer loans to private individuals. This is a product area characterized by higher default and loss risk compared to other lending segments. At the same time, there are a number of factors that help to keep the overall risk to the Bank at a moderate level:
The loan portfolio consists of a portfolio with many relatively small individual commitments
The Bank does not have business commitments
The Bank's lending customers are spread geographically, across different age groups and different occupational groups, as well as over 2 main products: consumer loans and credit cards.• Interest rates are in accordance with risk level
Overall, this means that the Bank achieves good control of the actual level of credit risk.
-
Risk profile
The Bank's targeted credit risk profile is defined to be moderate, and comparable with similar banks. Although the Bank underwent rapid expansion since its inception in 2014, its product offerings and market presence have since matured. Consequently, while credit risk remained moderate to high in the short term during the early stages of growth, it has gradually transitioned to a more moderate level in line with the Bank's evolving risk management strategies. As the bank has gained experience and established robust policies and models, the long-term risk profile objective has been successfully lowered to a moderate level, aligning with the Bank's evolving maturity.
The bank closely monitors macroeconomic indicators for their impact on credit risk, integral to the loan loss model. A dedicated committee meets quarterly to assess inputs, focusing on key indicators like unemployment, interest rates and economic growth. This ensures adaptation to evolving economic landscapes.
-
Implementation of credit risk management
Credit risk management is implemented according to the following general principles:
At the time of loan application:
All customers are credit rated. Both external credit data (such as the debt register) and
internally available data are used if available.
In addition to credit score rules, the customer must also be accepted in accordance with the Bank's policy rules, the Bank's requirements for serviceability and payment capacity, as well as requirements in applicable laws, regulations and circulars.
The maximum credit granted is a function of the customer's wish and the Bank's assessment
based on the above rules where the Bank's assessment takes precedence.
Customer management
The customer's ability to serve and pay is assessed at regular intervals to give the Bank a
better basis for customized customer follow-up.
In case of payment default, the Bank implements pre-collection measures early and, if necessary, debt collection. The Bank is actively working to achieve a high recovery rate from non-performing loans.
The sale of non-performing portfolios will also be a measure to refine and clarify the Bank's credit risk, both as forward flow (current sales) and spot sales (single sales. The current loss level in the Bank´s overall lending portfolio is currently relatively low compared to peers.
Analysis and monitoring
Data is analyzed at the portfolio level to provide a basis for improving credit rating
methodology (scoring and policy rules) and for adjusting customer follow-up.
The portfolios are analyzed to monitor the development of credit risk in the various products and markets. Certain indicators are monitored closely and measures will be implemented if set levels are broken.
To ensure objective credit rating based on statistical selection criteria, the Bank uses automated credit rating processes to the greatest extent possible.
Developments in credit risk over time are followed up and scorecards are adapted to ensure the best possible prediction and control of credit risk over time for the individual market channels the Bank uses.
The Bank uses vintage analysis to monitor developments in, among other things, credit risk over time and for different years (cohorts) of the Bank's total lending. Such analyses are suitable for early identification of shifts in behavior and allow the Bank to take corrective action at an early stage in case of unwanted shifts, and to assess the impact of measures the Bank has implemented. This also helps to give the Bank a basis for assessing whether changes in
defaults or similar are due to circumstances on the Bank's side (changed market channel mix, customer mix, etc.) or whether it relates to macro-level developments.
-
The Bank's loss model (IFRS 9)
The Bank makes provisions for expected losses on assets which are recognized at amortized cost. Where the credit risk of an asset has not increased significantly (loans in Stage 1), the Bank makes provisions for expected losses from default events which could arise within either the expected lifetime of the asset or 12 months from the balance sheet date, whichever occurs first. For other assets (loans in Stages 2 or 3), the Bank makes provisions for expected losses over the remaining expected lifetime of the asset. The Bank defines 'expected lifetime' as the anticipated time horizon linked to default or full payment of interest and instalments on the claim, whichever occurs first.
The Bank considers the change in the risk of default since initial recognition in order to decide whether the credit risk for an asset has increased significantly. The Bank considers a commitment to have been defaulted (impaired) in cases where the loan is more than 90 days overdue, the customer has been referred to a debt collection agency for recovery of the claim, the customer dies or fraud is suspected.
Amongst other things, the model that the Bank uses to calculate loss impairment will include the probability of default (PD), the discount rate, exposure at default (EAD rate and loss given default (LGD).
The Bank uses a number of indicators to assess whether the risk of default for an asset has increased significantly. This information is based on the actual behavior of customers, for which Morrow Bank has established a number of rules which the Bank has identified as triggers for a significant increase in credit risk. Examples of such rules are high drawdown share for customers combined with the fact that they are in arrears, new customers who do not pay their first bill and customers who have historically had loans that have been more than 30 days overdue and which are again in arrears. In all cases where customers are more than 30 days overdue, the credit risk is defined as having increased significantly since initial recognition.
Any customer who has missed payments for 90 days as of the balance sheet date will be referred to a debt collection agency a few working days after the balance sheet date.
Customers who have been referred for debt collection cannot subsequently be moved to Stage 2 or 1, i.e., such engagements will be placed in Stage 3 until the asset is deducted. Customers who have missed payments for 90 days as of the balance sheet date and who pay an amount corresponding to or above the minimum amount before referral to the debt collection agency may be moved to Stage 2 or 1. Engagements which have previously been at least 30 days in arrears against the agreed payment schedule and which are once again in arrears will be placed in quarantine in Stage 2 for three months. The quarantine does not impose any restrictions on such customers being transferred to Stage 3 during the quarantine period. Recovery from Stage 2 to Stage 1 will otherwise occur in cases where the customer pays at least one minimum amount.
In order to calculate expected losses in Stage 1 and Stage 2, the Bank discounts the value of the expected loss as of the balance sheet date by using the effective interest rate on the engagements as the discount rate. The Bank considers the time at which the expected default is expected to occur in order to determine the time period for discounting.
The Bank's loss model also uses forward-looking factors. The Bank's total loss level is adjusted by considering a number of macro variables. The loss level is adjusted at portfolio level, based on the expected development of the economy of the various countries in which the Bank offers loans. Macro variables are not used to transfer customers between the different stages. In its loss model, the Bank uses three key figures from the OECD for each country: 1) anticipated development in the country's unemployment rate, 2) growth in gross domestic product, and 3) short-term interest rates. The Bank uses three scenarios to assess macro adjustment: positive future outlook, neutral future outlook and negative future outlook. These scenarios are weighted with probability and consequence based on the Bank's assessment of the macroeconomic situation. The Bank's macro adjustment is subject to uncertainty because it is forward-looking.
The Bank's lending is categorized as loans to customer. Primarily as a result of the granular and diversified structure of the loan portfolio, the capital requirement associated with the loan portfolio is considered to be covered by the capital requirement in Pillar 1. The characteristics, including whether the capital requirement is covered by Pillar 1, in this risk assessment and reporting are assessed on an ongoing basis. Information on loans to and receivables from customers and the distribution of risk classification, age distribution, impairments and a reconciliation of impairments from the opening balance to the closing balance (figures in MNOK) is presented in the Appendix.
All loan customers amongst loans to and receivables from customers are classified under different risk classes. The risk classes range from A to D for all products.Risk class A comprises loan customers with the lowest historical probability of default, while risk class D has the highest probability of default. Established loans are defined as loans that are at least six months old, while new loans are defined as loans that are less than six months old. The "time horizon" column in the table below shows the time horizons for which expected losses are calculated for the loans in the various risk classifications. The "PD range" column in the table below shows the probability of default in the time horizon for the risk classification concerned.
- Credit risk on loans and deposits with credit institutions and bond investments
The Bank's liquidity shall be placed as deposits with other banks (nostro accounts or term deposits), in interest-bearing securities or in funds for interest-bearing securities. The Bank's placements shall have a high level of liquidity or should be able to be deposited as security for loans from the Central bank of Norway and shall have low credit risk. The Banks placements in bond funds in 2024 have a Morningstar rating of low interest sensitivity and high credit quality. Other investments are in government bonds and AAA rated OMFs.
-
Definition of credit risk
-
COUNTERPARTY RISK
The Bank do not use derivative contracts to hedge risk; thus counterparty risk is non applicable.
-
MARKET RISK
-
Definition of market risk
Morrow Bank defines market risk as the risk of a loss on a financial instrument as a result of changes in market variables and/or market conditions within a specified time frame. Market risk arises as a result of the Bank holding open positions in various financial instruments. It can be subdivided into the following main groups:
Interest rate risk is the risk of loss as a result of changes in the interest rate markets
Currency risk is the risk of loss as a result of changes in foreign exchange rates
Credit spread risk is the risk of loss as a result of changes in credit spreads
-
Risk strategy and risk tolerance
The financial policy adopted by the Board covers guidelines concerning market risk (including interest rate and currency risk), risk limits, monitoring and reporting in the area. The guidelines are reviewed by the Board at least annually. The Board receives regular reports on developments in the Bank's market risk exposure.
The Bank's objective is to have low market risk.
-
Interest rate risk
The Bank has limited interest rate risk. Both lending and deposits have floating interest rates. The liquidity portfolio is managed by arrangements with low interest rate risk. In total the asset and liability side are well balanced at interest rate level and time buckets.
-
Currency risk
The Bank has loans in the Sweden and Finland respectively, nominated in the currencies SEK and EUR. Currency risk is managed by taking deposits in the respective currencies. The remaining / open exposure is currency hedged in the Bank's multicurrency facility and within the limits stated in the Finance Policy to the Norwegian krone. The limit for total currency exposure is set to maximum of 2% of own funds, with a maximum limit of EUR 4 million and SEK 40 million has also been set for each currency.
The currency limits are well within the threshold values specified in the Capital Requirements Regulations (Circular 12/2016 Appendix 3) hence capital is not held for currency risk.
-
Credit spread risk
Credit spread risk is the risk of loss of value on the Bank's liquidity portfolio due to increased credit premiums (higher yield requirements). The risk has been evaluated in accordance with the methodology in circular 12/2016 based on data as of 31 December 2024.
The Bank had placed NOK 2.6 billion of its liquidity portfolio in bonds and securities as of 31 December 2024.
- Market risk monitoring
Market risk is regularly monitored and the Bank's investments made in such a way that market risk is kept within the risk tolerance. The Bank's investments primarily consist of deposits in other well-established financial institutions or interest-bearing securities with short-term fixed interest rates and good liquidity. The Board has established limits for maximum interest rate and loss potential on the Bank's investments. These are measured and followed up on a monthly basis. Risk is calculated using sensitivities for the relevant balance sheet items which are affected. The type of engagement, maturity and annual coupon rate are relevant factors used in the calculation.
-
Definition of market risk
-
LIQUIDITY RISK
-
Definition of liquidity risk
Liquidity risk is the risk that the Bank may be unable to meet short term financial obligations. This usually occurs due to the inability to convert a security or asset to liquidity without a loss of capital and/or income in the process. In the context of funding, liquidity risk refers to the Banks ability to fund liabilities (i.e. deposits) as they fall due without incurring losses by being forced to sell less-liquid assets. Under the Basel III rules, banks must hold enough highly liquid assets to cover liability requirements through periods of stress.
-
Liquidity risk policy and strategy
The Board has adopted a financial policy which includes guidelines for liquidity management, risk limits, monitoring and reporting for liquidity risk. The guidelines are discussed by the Board at least annually. The Board receives regular reports on exposure and developments in the Bank's liquidity risk. The Bank's objective is to have a low liquidity risk.
-
Liquidity risk monitoring
Liquidity risk is regularly monitored, and the Bank's investments are made in such a manner that the liquidity risk is kept at a low level. The Bank monitors the liquidity situation on a daily basis. The Bank's investments primarily consist of deposits in other financial institutions or interest-bearing securities with short-term fixed interest rates and good liquidity.
-
Liquidity forecasts
The Bank has updated forecasts for the liquidity situation at all times, both intraday, day-to-day and intervals up to one year.
-
Composition of funding sources and liquidity portfolio
The bank is primarily financed through customer deposits in 3 markets, Norway (NOK), Germany (EUR) and Sweden (SEK). The interest terms in these markets are primarily based on floating interest rates. The Bank has launched a fixed-rate deposits product with up to a 2-year fixed term. These measures will reduce the cost of capital and make the Bank less vulnerable to changes in the various deposit markets, hence strengthen the Bank's capacity to obtain financing.
Deposits from customers have been stable and predictable. Over time, the Bank wants to balance deposits and loans in the same currency.
Details of the composition of liquidity and funding sources are given in the Appendix.
-
Maturity profile financing
The Bank does not currently have any outstanding market financing other than subordinated loans (Tier 1 and Tier 2 capital). The Bank refinanced Tier 2 capital 23.02.2021 at the same terms as previously. Subordinated loans are due in 2026. The remaining balance sheet items have either not defined maturity or are deposits on demand. The maturity profile of the Bank's financing is considered to be low risk.
-
Contingency plans
The Bank has contingency plans to handle a liquidity crisis. The plan describes 5 different contingency levels, roles and responsibilities, lists of potential measures to be implemented and a communication plan.
- Conclusion
In the Bank's opinion, the Bank's liquidity risk is sound and in line with the Board's expressed risk tolerance set to "low" liquidity risk.
-
Definition of liquidity risk
-
OPERATIONAL RISK
Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk but excludes strategic and reputational risk. The Bank uses the standardized method for calculating capital requirements for operational risk.
-
Risk strategy and risk tolerance
The Bank's policy for operational risk provides an overall framework and principles for risk management and control regarding operational risk, related to the Bank's overall operations. The policy shall ensure that the Bank has a satisfactory risk profile. Besides policy for operational risk, reference is made in particular to Policy for risk management and internal control and to the Norwegian Financial Supervisory Authority's module for assessment of operational risk. The board's appetite for operational risk is low.
The Bank's management system has the following documents/ procedures in place for operational risk:
Operational risk management guidelines
Outsourcing guidelines
Event management guidelines
New Product Approval Process
The Bank finalized its first operational risk project in the third quarter 2021. The purpose of the project was to map the Bank's central processes, assess operational risk in the individual processes and lay the basis for further management and control of operational risk. In 2024, the Bank started a project to review and update the central processes and consequently to update the assessment of operational risks in them. The project will be completed during the year but is not expected to reveal an increase in overall operational risk levels.
The Bank has established a method based on calculating unexpected losses according to an internal risk taxonomy. Expected loss is covered on an ongoing basis. The sum of unexpected loss at 99,5 pct confidence is set equal to the total capital requirement for operational risk. The total capital requirement for operational risk is further split into pillar 1 and 2 capital requirements.
-
Infrastructure and outsourcing
Management and control of system development/change follows defined processes and management structures with respect to third parties. All central infrastructure and system operation/monitoring are outsourced to established suppliers, which are required to deliver according to defined procedural descriptions and SLA requirements. The Bank has a well-developed framework for risk assessment of the tasks that are outsourced and for assessing the suppliers to which the tasks are outsourced. As a result of the agreements that the Bank has with key external suppliers, the Bank has secured access to resources and expertise that would otherwise be difficult for a small enterprise to justify financially.
In 2024, extensive use was made of services from external service providers in the Bank's operations. These are monitored in line with established guidelines for outsourcing. The Bank strives for a high degree of automated, efficient and scalable processes that meet the needs of customers and the Bank in a satisfactory and reliable manner.
The Bank's board of directors has focused heavily on the AML area over the past years and sees that it is necessary to maintain a strong focus in the future as well to ensure continuous improvement and maintain a continuous compliance culture.
The Bank uses combinations of standard systems and proprietary systems as central parts of the infrastructure for the operation. System development / change follows defined processes, and structures have been implemented for management and control of development / change in systems operated / delivered by third parties. All central infrastructure and system operation
/ monitoring are outsourced to well-established operational suppliers who must deliver in accordance with defined routine descriptions and SLA requirements.
The Bank has a well-developed framework for risk assessment of the tasks that are outsourced and for assessing the suppliers the tasks are outsourced to. As a result of the agreements the Bank has with key external suppliers, the Bank is ensured access to resources and expertise that would otherwise be difficult to defend financially for a business of the Bank's size.
The Bank has followed a growth strategy, and the Bank has defined a moderate level of risk tolerance. In connection with the launch of new products or existing products in new countries, the Bank has assumed that the projects will be transferred to a stable operational phase with normal operational risk before product resources are released for work on new projects. A key part of the work to reduce operational risk from project to operational phase is the training of personnel to ensure daily operations, as well as documentation and quality assurance of routines and processes. Furthermore, the Bank always carries out a limited pilot followed by a so-called soft launch to minimize operational risk at start-up and ensure control at all stages before increasing volumes.
-
Risk strategy regarding mortgage brokers (agents)
The Bank has agreements with loan intermediaries (agents), which disseminate private individuals' applications for consumer loans to the Banks they cooperate with. Agreements have been made with loan intermediaries in all countries The Bank is represented. The Bank is aware of the responsibility that rests with the Banks that enter into such agreements, and that the Banks must ensure that intermediaries have agreements with comply with current regulations.
- AML procedures
Exposure to money-laundering and terrorist financing is considered a material risk for Morrow Bank. The Bank has systems in place to identify and report potential money laundering and terrorist financing activity and provides frequent training of employees to prevent the Bank's products and services being used for money laundering or terrorist financing.
Morrow Bank has established a comprehensive framework for preventing money laundering and terrorist financing. This includes initial due diligence and risk assessments of new customers as part of the onboarding process, review of high-risk customers and accounts, ongoing customer- and transaction monitoring and reporting and follow-up processes. The AML Risk Assessment and Policy are subject to revisions by the Board of Directors when needed, minimum annually.
Over the past year, the Bank has made further improvements in its efforts to uncover anti-money laundering and terrorist financing. The main focus areas have been:
Strengthen internal control and control functions
Strengthen the Bank's resources in anti-money laundering and terrorist financing
Review, update, development and implementation of policies and procedures
Development of implemented (automated) processes
Work and procedures related to anti-money laundering and terrorist financing have the highest priority in the Bank. The Chief Compliance Officer is the Bank's AML Officer ("Hvitvaskingsansvarlig"). The Credit, Customer Service and FCP (Financial Crime Prevention) departments are responsible for customer onboarding and KYC-processes (Know Your Customer). the ongoing due diligence and continuous monitoring and follow-up on suspicious customer behavior is monitored by the FCP department.
-
Risk strategy and risk tolerance
-
COMPLIANCE RISK
-
Definition of compliance risk
Compliance risk is defined as the risk of loss caused by non-compliance with laws and regulations.
-
Risk strategy and risk tolerance
Compliance risk is managed as a sub-category of operational risk, with the same structure for identifying and managing risk, and the same risk appetite (low).
- Management, control and risk monitoring
The Bank's 1. line managers are responsible for regulatory compliance in their own area of responsibility, including ensuring that operations are conducted in accordance with applicable external and internal regulations. Employees with management positions and other key personnel in the Bank have a particular responsibility to promote good and effective regulatory compliance in the day-to-day operations of their respective areas of responsibility. This means responsibility for ensuring that:
The business is conducted in accordance with applicable requirements in external and internal regulations
The employees have good knowledge of the current rules for the area
Identified deficiencies in regulatory compliance are reported to the Compliance function, and that
Necessary measures are identified and implemented when regulatory compliance deficiencies are identified.
The Bank has appointed an independent 2.line Compliance function that shall provide support to the Board, including the Audit and Risk Committee, the general manager and functions responsible for operational activities. The function shall contribute to ensure compliance with regulations subject to the Banks operating license, conduct independent
controls, monitor change in relevant legislations and assist in identifying and assessing compliance risk. Annual plans and action plans are approved by the Board.
-
Definition of compliance risk
-
OTHER RISKS
-
Strategic and business risk
Strategic and business risk is the risk that failed decisions may pose to a company's ability to
achieve the bank's strategic and business goals.
Strategic risk may arise from increased competition which will affect growth and expected returns or from worsened macroeconomic conditions such as interest rate increases affecting the customer's ability to serve their debt and the Bank's financing costs. Furthermore, the Bank has experienced stricter regulatory requirements for the consumer finance industry.
The Board will emphasize the following factors related to the Bank's strategic and business risk:
Reduced growth as a result of strong competition or tight regulatory regulation will result in a smaller loan portfolio and will thus result in a lower capital requirement nominally in both Pillar 1 and Pillar 2.
The Board believes that the Bank's products are geographically well diversified any changes in macroeconomic conditions within a geographical area will not necessarily propagate to other geographical areas in which the Bank operates.
-
Reputation risk
The consumer finance industry in general has been featured negatively in the national media over the years. Negative publicity could lead to a weakened reputation, which may affect existing deposit customers and increase withdrawals and reduce the number of new customers. In the capital market, it may become more difficult to issue debt securities and possibly result in higher risk premiums. The Bank have therefore made significant efforts to close the gaps pointed out by the Norwegian Financial Supervisory Authority.
The Bank is concerned about its brand name and will prevent it from being abused or otherwise inflicted damage as a result of undesirable behavior by loan brokers. The Bank therefore has regular dialogue with its loan intermediaries
-
ESG risk
ESG risks are defined as environmental, social and governance issues that can impact the long-term financial performance and reputation of the company.
To ensure that Morrow Bank prioritizes issues that matter most to its business and its stakeholders, a materiality analysis has been conducted. Based on the results from the
materiality analysis, Morrow Bank has identified the following three topics as focus areas for long-term value creation for all stakeholders:
Responsible lending practices
Combating corruption and money laundering
Data security and customer privacy
Morrow Bank has defined objectives and corresponding key performance indicators (KPIs) for the selected focus areas to contribute to long-term value creation. In 2024, the Bank will conduct a dual materiality analysis in line with the CSRD. This involves reporting on the impact Morrow Bank has on the environment and people around it, as well as how sustainability factors affect the Bank's ability to create long-term value.
The bank has an extensive ESG report that is part of the annual report for 2023.
-
Concentration risk
In the Basel framework concentration risk is describing the level of risk in a bank's portfolio arising from concentration to a single counterparty, sector or country. Capital requirements for concentration risk are not covered Pillar 1 under current regulation. The Bank is assessing concentration risk in the ICAAP process.
Concentration risk in the loan portfolio is a well-known theme in banks' risk assessment. Pillar 1 requirements are based on an expectation that banks normally reduce their total credit risk by spreading loans to a large number of borrowers, sectors or countries.
Morrow Bank operates its credit business in three countries (Norway, Sweden and Finland) and with three products (consumer loans, point-of-sale financing and credit cards). The Bank's business model with geographical and product distribution to retail customers with relatively small ticket size ensure diversifications and low concentration risk.
- Pension risk
The bank has no risk associated with pension obligations towards its employees since all employees have defined contribution pensions.
-
Strategic and business risk
- CONTINGENCY / RECOVERY PLAN (HENNING)
Contingency plan and recovery plans are updated on a yearly basis. The plans define organization, allocation of responsibilities and measures in an emergency or recovery situation. Various risk indicators with trigger level on when the plans are to be implemented are defined. These risk indicators are measured and reported in monthly management reporting. Furthermore, what is considered to be critical features is important to ensure that it works in the recovery situation.
APPENDIXSee the tables in the Pillar 3 Appendix for additional quantitative information.