Governance
Risks And Growth
In a volatile local and global financial landscape, Bank of Ceylon demonstrated its steadfast commitment towards maintaining stability and resilience. As the nation's premier financial institution, we remain deeply committed to maintaining a robust risk management framework that safeguards financial stability while enabling inclusive and sustainable growth. By balancing risk prudence with opportunity, we not only mitigate uncertainties but also contribute to the nation's long-term development.
RISK MANAGEMENT SUCCESS STORY
To be a complement in achieving the Bank's vision through proactive management of risks.
Facilitating sustainable growth of the Bank ensuring comprehensive management of risks in line with regulatory requirements and industry best practices, in a dynamic work environment encouraging teamwork and professional growth.
STRATEGIC RISK MANAGEMENT FOR SUSTAINABLE VALUE
BOC operated in a complex and evolving business environment, balancing opportunities and risks within its Integrated Risk Management Framework. As the economy began recovering, business confidence improved. In this context, BOC remained committed to its vision, mission, and corporate values while fulfilling its critical role as a Domestic Systemically Important Bank, supporting financial stability and economic resilience. Adapting to heightened regulatory measures introduced by the Central Bank of Sri Lanka, we closely monitored emerging macroeconomic trends, strategically allocating capital to sustainable, risk-adjusted growth to create and protect stakeholder value. We are geared to chart our course by channeling our strategies, embracing innovation, rethinking our business models and deepening our understanding of our customers.
NAVIGATING THE RISK LANDSCAPE
Navigating a dynamic risk landscape requires dealing effectively with global risks as well as adverse forces arising from operating within a fragile economy that is on its path to revival.
As an industry leader, we strive to be the industry benchmark, with a strong risk-conscious culture, sound governance and a robust risk management framework. Our risk management framework has been effectively stress-tested by the various crises and events of the past few years and has helped make the Bank more resilient. Our risk management, balance sheet management, internal control environment, compliance, governance and risk culture are built around solid fundamentals. Collectively, these factors have helped the Bank withstand unprecedented times in all material respects and remain resilient and profitable.
An increased focus on sustainability has facilitated the Bank to identify, manage and mitigate emerging risks in areas such as diversity, equity, and climate change as a responsible corporate citizen. Strengthening our Environmental, Social and Governance (ESG) framework ensures our commitment to nurturing adding and protecting stakeholder value.
AN INTEGRATED APPROACH TO MANAGING RISKS
At BOC, we adopt a top-down approach to managing risk, with the Board driving risk appetite setting and overall risk strategy.
The Board fulfils its risk management function through the Integrated Risk Management Committee (IRMC). The Independent Integrated Risk Management Division (IIRMD), headed by the Chief Risk Officer (CRO) operates independently.
Additionally, management-level committees strengthen risk management by aligning strategies with organisational goals and improving decision-making in specific business areas. With transparent reporting, they cultivate a risk-aware culture, enhancing operational resilience, crisis preparedness and strategic alignment.
Our comprehensive Enterprise Risk Management Framework is depicted in page 145.
Objectives
- Enhance the Bank's ability to anticipate and mitigate risks effectively while maximising opportunities for growth.
- Establish common policies and standards for the management and control of all risks.
- Provide a common language, system and framework to foster a consistent approach to manage risks.
Changes to the ERM Framework
In September 2024, the Central Bank of Sri Lanka (CBSL) issued the Banking Act Direction No. 05 of 2024 on Corporate Governance for Licensed Banks. The Direction aims strengthen the corporate governance processes and practices towards enhancing the overall stability of the banking sector and the financial system. Corporate Governance processes and practices shall be deemed to be the management framework that facilitates the conduct of the banking business in a responsible and accountable manner to promote the safety and soundness of the individual banks, thereby leading to the stability of the overall banking sector. The Directive enhances the governance requirements for Board subcommittees and introduced a new Board subcommittee - Related Party Transactions Review Committee.
With respect to Integrated Risk Management Committee (IRMC), the Direction specifies the composition of the committee and their professional competency, experience and responsibilities. This includes the establishment of an independent risk management function that is responsible for integrated risk management of the Bank. The Committee is required to oversee the functioning of CRO.
The Direction offers elaborate instructions on the Responsibilities of the Risk Management Function. Accordingly, the CRO must be independent from the other executive functions of the Bank and should not have any management or financial responsibility related to any operational business lines or revenue generating functions.
The provisions of the Direction are effective from 1 January 2025.
Our robust risk management framework comprises a series of well-defined policies for managing diverse risk categories, with risk governance, independent oversight, and regular monitoring by Board level subcommittees.
The IIRMD revisited the Integrated Risk Management Policy in 2024, commensurate with the new Direction.
THE FOUNDATION OF THE RISK MANAGEMENT FRAMEWORK
The framework is supported by and built around the four essential pillars of risk philosophy, risk appetite, risk identification, mitigation and reporting and risk culture. Together, these pillars provide a strong foundation to our risk management process.
Risk Philosophy
- Risk management is the collective responsibility of all employees.
- It is aligned with our strategic objectives
- In decision making, regulatory compliance is non-negotiable.
- Safeguarding the Bank's reputation carries equal weight in providing protection against financial losses.
Risk Appetite
- The risk appetite statement aligns business decisions with approved risk dimensions.
- Board approved policies guide actions throughout the Bank.
- Executive Committees provide specific guidance and instructions.
- The IIRMD vets all new initiatives regarding potential risks.
Risk Identification and Mitigation and Reporting
- IIRMD proactively identifies emerging risks and uncertainties.
- IRMD engages in risk mitigation at strategic, policy, and operational levels, collaborating with business teams to foster risk ownership at the first line of defense.
- Material risks are reported to the Board and the Risk Management Committee via various frameworks.
Risk Culture
- Relates to how people think, behave and take actions around risk and shapes our ability to identify, understand, openly discuss, escalate and act on current, and potential challenges and risks.
- A dynamic risk culture that builds awareness, recognition and understanding of the value of risk identification, measurement, management, monitoring and reporting as part of daily business activities.
RISK GOVERNANCE
BOC employs a dual strategy to instill a strong Risk and Compliance culture throughout the Bank. In terms of governance, the Board of Directors and Senior Management lead the charge.
As the main custodian responsible for risk management, the Board of Directors of BOC determine guidelines for the management and control of the Bank's key risks and for ensuring appropriate risk policies and limits are established for all important risk areas.
The Integrated Risk Management Committee (IRMC) is the main Committee that assists the Board in executing its risk management responsibilities. As per the Terms of Reference (TOR) set out by the Board, the main role of the IRMC is to engage in proactive risk monitoring and reporting to the Board.
The executive level committees involved in risk management to facilitate board level requirements and to ensure alignment to defined policies and procedures, are depicted under the Enterprise Risk Management framework in page 145.
The Bank's dedicated Risk Management Division supports the Board and Board subcommittees in discharge of their duties related to risk management. This division, headed by the Chief Risk Officer (CRO), holds the responsibility of identifying and assessing risks that could impact the achievement of our strategic objectives, including by monitoring early warning signals, forecasting potential for future losses.
Operationally, the Compliance Department together with the Independent Integrated Risk Management Division (IIRMD) spearheads the integration of a dynamic risk management culture.
THE THREE LINES OF DEFENCE
The Bank employs the Three Lines of Defence Model for risk management as follows:
RISK MANAGEMENT PROCESS
With clearly delineated roles and responsibilities, well-defined policies, procedures, and processes; the Bank's ERM framework supports consistent identification and management of risks across business units, functions, and operations.
Stress testing is an important tool for managing risks within the Bank. It involves simulating various adverse scenarios to assess Bank's resilience and identify potential vulnerabilities across key areas such as credit, market, liquidity, and operational risks. The Bank can proactively address weaknesses, strengthen financial position, and ensure the preparedness to withstand unexpected economic challenges or financial shocks.
Additional Stress Tests Conducted During 2024
Impact of Debt Restructuring
In 2024, the Bank conducted comprehensive stress tests to evaluate the potential effects of debt restructuring, with a specific focus on International Sovereign Bonds (ISBs) and Sri Lanka Development Bonds (SLDBs). These tests were designed to simulate a range of restructuring scenarios by adjusting key criteria, such as the haircut level (the percentage reduction in the value of the bonds). This approach allowed Bank to assess the impact on three critical areas:
- Profitability: Analysed different restructuring outcomes to assess the impact on Bank’s earnings, ensuring the ability to maintain financial health under adverse conditions.
- Capital Adequacy: Evaluated the Bank's ability to retain sufficient capital reserves to meet regulatory requirements, even in stressed scenarios.
- Liquidity: Assessed the ability to meet short-term obligations provided that restructuring led to reduced cash flows or heightened liquidity demands.
By varying the haircut levels and other restructuring parameters, these stress tests provided valuable insights into Bank's financial resilience. The results enabled to make informed decisions about capital planning and liquidity management, ensuring the ability to handle the challenges of debt restructuring while maintaining stability.
Government Sector Exposure
Given the Bank's substantial investments and loans tied to the government sector, evaluation carried out to assess potential impact of restructuring of government debt. This analysis helped the Bank to anticipate capital needs and adjust financial plans accordingly to meet the regulatory standards while supporting the nation's restructuring efforts.
Additional Risk Weight on Government Securities
The Bank conducted stress test to evaluate potential implementation of additional risk weight on government securities, in light of its significant
exposure to these assets and the zero-risk weight applied currently.
BOC Maldives Credit Portfolio
The resilience of Male’ branch’s loan portfolio tested assuming a worst-case scenario where total loan portfolio transferred into Stage 3 (non-performing) considering country's economic situation linked to its debt sustainability in order to measure the credit risk and potential impact to Bank's bottom-line.
Liquidity Stress on BOC Maldives
A liquidity stress, assuming a run on Male' branch due to adverse economic conditions carried out to assess the potential liquidity impact to the Bank.
Multiple scenario analysis
The comprehensive scenario stress test conducted with consideration for the potential occurrence of individual scenarios simultaneously.
Going forward:
- Extend stress testing horizon to cover five years, to complement long-term business goals.
- Extend analyses to include tests on potential risks of default based on bank specific and market driven scenarios.
INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS (ICAAP)
Internal capital adequacy assessment ensures the availability of capital to cover all potential risks, hence a comprehensive assessment is crucial to ensure resilience of the Bank against all potential scenarios. During 2024, Bank completed the ICAAP complying with the regulatory requirements. More frequent ICAAP and Recovery Plan (RCP) steering committee meetings were held to assess and evaluate the recapitalisation requirements and to decide action plan in accordance with the concerns raised by the regulator. Quantitative mechanism developed to assess the capital charge for residual risk incorporated into the ICAAP during the year.
The Bank reviewed its ICAAP during the second half of the year, incorporating the revised (estimated) budget to align with the economic conditions prevailed in the country.
Going forward:
- Develop a risk index to assess capital requirement for environmental, social and climate risk considerations and incorporate into ICAAP.
- Under the capital augmentation plan, the issuance of debentures to strengthen the capital base of the Bank is planned.
RECOVERY PLAN (RCP)
Independent Integrated Risk Management Division (IIRMD) regularly monitors the recovery indicators and report any alert levels to the Management in order to take precautionary actions. Where necessary the ICAAP and RCP steering committee is convened to discuss the recovery actions as per the approved recovery plan.
Going forward:
- Review and revisit the Recovery Plan for 2025.
- Improve the process introducing additional recovery indicators to assess the requirement of recovery actions or options.
- Introduce new recovery actions in line with the recovery indicators thus identified.
- Strengthen Bank's Recovery Plan in line with proposed Resolution Plan.
SUBSIDIARY RISK MANAGEMENT
The Bank conducted a comprehensive risk assessment of its group of companies to ensure financial stability, regulatory compliance and operational resilience. The risk management framework is aligned with the Bank's overall risk appetite and strategic objectives, incorporating industry best practices and regulatory requirements.
CREDIT RISK
DEFINITION
Credit risk is defined as the potential financial loss to the Bank arising from a bank borrower or counterparty failing to meet its obligations in accordance with the agreed terms.
COMPONENTS OF CREDIT RISK
Default Risk occurs when a borrower fails to make payments as agreed.
Settlement Risk is a type of counterparty risk that can be associated with default risk in a bank, and occurs specifically during the settlement period of a transaction.
Concentration Risk is having too much exposure to a single borrower, industry, sector, or asset class.
Downgrade Risk is a component of credit risk of a bank and happens when a borrower's credit rating is lowered, indicating a higher likelihood of default on their part.
Country Risk is the risk associated with a country's ability to meet its foreign currency payment obligations.
MANAGING CREDIT RISK AT BOC
The largest risk exposure for the Bank typically comes from credit risk.
Our objective in managing credit risk is to safeguard the asset quality and, where possible, to reduce exposure to high-risk segments within banks risk appetite parameters.
The Bank managed its credit risk in accordance with its robust Credit Risk Management Framework.
The Bank's exposure to credit risk at the end of 2024 is LKR 2,177 billion, equivalent to 43.7% of the Total Assets of the Bank.
In managing credit risk, we placed emphasis on maintaining asset quality whilst optimising business growth objectives.
OVERSEAS RISK MANAGEMENT
To ensure operational resilience and sustainable growth of its international branches in Maldives, Seychelles and India, the Bank has implemented a robust overseas risk management framework. This framework addresses the complexities of the global and regional economic landscape, including evolving political and financial challenges.
- Overseas Risk and Control Self-Assessment (RCSA): IIRMD has established a standardised RCSA process for all overseas branches.
- Enhanced credit risk management: Credit risk assessment and stress testing methodologies have been strengthened to comprehensively cover international operations.
PRE-CREDIT SANCTIONING
- Structured credit appraisal mechanisms and defined credit criteria
- Multiple levels of approval and independent review by the Chief Risk Officer (CRO)
- Limits for credit risk categories such as default concentration and counterparty
- Retail scorecards and borrower rating models
- Risk based pricing regulatory limits
POST - CREDIT MONITORING
- Ongoing robust credit reviews
- Periodic portfolio evaluation
- Proactive engagement with customers to identify early warning signals of emerging
- Emerging risks and carrying out stress testing and scenario analysis
- Monitoring watch list exposures
- Ensuring the appropriate functioning of the loan review mechanisms by the Credit Quality Assurance Unit
Credit Risk Concentrations
For more effective management of credit risk, BOC monitors credit risk concentration according to
- Industry sector
- Geographic and key divisions
- Product category
- Collateral type
- Credit Ratings of borrowers
- Cross border exposure
CREDIT RISK MANAGEMENT FRAMEWORK
The Bank's comprehensive credit risk management policy including pre-credit sanctioning and post-credit monitoring mechanisms enables the Bank to manage and mitigate credit risk effectively.
LIQUIDITY RISK
DEFINITION
Liquidity risk is the risk of loss resulting from the inability to meet payment obligations in full and on time as they become due. Liquidity risk is inherent to the business of banking and is the result of different maturity profiles between the Bank's assets and liabilities.
As a Domestic Systemically Important Bank, the stability of the Bank has a significant impact on the stability of the country's financial sector. As befits our role, we place great emphasis on managing and mitigating liquidity risk, in line with the CBSL regulatory requirements.
COMPONENTS OF LIQUIDITY RISK
Funding Liquidity Risk occurs when a bank cannot obtain sufficient funds to meet obligations as they fall due. This is typically associated with the primary debt market, and has two components; one associated with future inflows and outflows of money and future prices of obtaining funds from different sources.
Market Liquidity Risk occurs when a bank cannot easily sell its assets at a fair price when needed. As such it is associated with trading liquidity risk. This can happen when the market is illiquid, which may result in a significant price decline when selling assets.
Maturity Mismatch occurs when a bank's assets (such as long-term loans) mature at different times than its liabilities (such as short-term deposits). The Bank may face liquidity issues in case of a sudden demand for funds.
Interest Rate Risk occurs when interest rates change, affecting the value of a bank's assets and liabilities. This may potentially lead to liquidity problems in cases where the bank is unable to quickly adjust its funding sources.
Credit Rating Downgrades usually increase the costs of borrowing and make it more difficult to get funding, potentially increasing liquidity risk.
Adverse Market Reputation, such as negative publicity or a decline in public confidence which may lead to a run on deposits, thus creating a liquidity crisis.
MEASURING LIQUIDITY RISK
Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio (NSFR)
CBSL Banking Act Determination No. 01 of 2024 (13 June 2024) requires all Licensed Banks to maintain LCR and NSFR as the statutory liquidity ratios at all times in accordance with "Basel III: Liquidity Coverage Ratio and Liquidity Risk Monitoring Tools" and Net Stable Funding Ratio".
MINIMUM REQUIREMENTS
Minimum LCR of 100% at all times in respect of
- Rupee Liquidity Minimum Requirement for local currency operations
- All Currency Liquidity Minimum Requirement for the overall operations
Minimum NSFR of 100% at all times.
The Determination discontinued the use of Statutory Liquid Assets Ratio.
Liquidity Monitoring Tools
- Contractual Maturity Mismatch
- Concentration of Funding
- LCR by Significant Foreign Currency
- Available Unencumbered Assets
- Credit - Deposit Ratio
OBJECTIVES
Safeguard against funding constraints that prevent growth and take measures that enable the Bank to meet all liquidity needs, including sudden surges in demand, if any.
MARKET RISK
DEFINITION
Market risk, also called systematic risk, is the possibility of incurring losses due to factors that impact the overall performance of financial markets. Although systematic risk cannot be eliminated through diversification, it can be hedged against.
The Bank manages these exposures carefully by balancing profitability and stability within the risk appetite set by the Board.
MONITORING AND MANAGING MARKET RISK
Market risk can be measured and managed using a combination of quantitative and qualitative methods, including Value at Risk (VaR), PVBP, duration, convexity, stress testing, and scenario analysis, alongside regulatory frameworks.
KEY COMPONENTS OF MARKET RISK
1. INTEREST RATE RISK
Interest Rate Risk for banks can have both positive and negative impacts, depending on the direction and magnitude of interest rate changes and the asset and liability structure of the bank.
2. EQUITY RISK
The risk that stock or stock indices prices or their implied volatility will change.
3. CURRENCY RISK
The risk that foreign exchange rates (e.g., LKR/ USD, LKR/ GBP) or their implied volatility will change.
4. COMMODITY RISK
The risk that commodity prices (such as crude oil, gold etc.) or their implied volatility will change.
OBJECTIVES
Safeguard against adverse movement of market factors through various strategies including diversification, hedging, stress testing, and by establishing robust risk management frameworks.
- Targeted visits were conducted to high-risk branches, facilitating collaborative development of corrective action plans with the branch operations department, identified using a matrix analysis tool developed by the IIRMD based on audit, compliance, and risk data.
- In order to facilitate effective information exchange and to promote a unified risk management approach, enhanced coordination and communication between the risk management function, business and operational units, and internal audit is utilized.
- Continuous oversight and follow-up provided through Operational Risk Management Executive Committee (ORMEC).
MEASURING & MANAGING OPERATIONAL RISK
BOC ensures that all operational risks fall well below the risk appetite threshold.
OPERATIONAL RISK
DEFINITION
Operational risk encompasses the probability of financial loss due to inadequate or failed internal processes, people, systems, or external events.
It includes legal risk. It specifically excludes strategic and reputational risk.
Risk and Control Self-Assessment (RCSA)
IIRMD introduced an improved mechanism for Risk & Control Self-Assessment (RCSA) of branch network and completed RCSAs for 50 branches, RCSAs for Critical Business Units and Risk assessment of overseas branches carried out during the year.
COMPONENTS OF OPERATIONAL RISK
Sub-components of operational risk include:
- Internal Fraud
- External Fraud
- Employment Practices and Workplace Safety
- Clients, Products and Business Practices
- Damage to Physical Assets
- Business Disruption and System Failures
- Execution, Delivery and Process Management
OBJECTIVES
The primary objective of Operational Risk Management is to minimise losses and disruptions arising from processes, people and systems, in essence operation risk management aims to create more stable and resilient working environment.
STRATEGIC RISK
This involves the potential losses arising from the possible flaws in the Bank's future business plans and the possibilities of strategies being inadequate. Formulating proper response plans to refine the Bank's strategy to suit the changes in the business environment is essential for management of strategic risk.
The strategic direction of the Bank provided by its overarching vision and mission, articulated in BOC's corporate plan with specific measurable time bound targets. The Bank's strategic plan is developed under the guidance of the Board of Directors and involvement of the Corporate Management and Executive Management team taking into consideration the changes in the operating context and stakeholder needs. Continued monitoring of performance is carried out against defined targets and comprehensive scorecards are used to measure strategic risk exposures.
The Bank successfully achieved its strategic targets and maintained its leading position in year 2024, despite facing numerous challenges due to the prevailing economic conditions.
FUTURE FOCUS
The gradual economic recovery, coupled with the regime change and the monetary policy stance, complemented by the five-year strategic plan may enable the Bank to achieve its strategic targets while contributing to the country's development.
REGULATORY AND COMPLIANCE RISK
Regulatory and compliance risk arises from the failure to comply with laws, regulations, and industry standards governing banking activities. In 2023, the Bank continued to navigate a complex regulatory environment, including prudential regulations, Anti-Money Laundering (AML) requirements, consumer protection laws, and international standards through close and proactive engagement with regulators. A dedicated Compliance Unit monitors all compliance with guidelines and regulations. A comprehensive compliance policy governs the compliance risk management. Continuous island-wide training and awareness programmes and onsite compliance assessments including overseas branches ensure effective management of regulatory and compliance risk.
LEGAL AND REPUTATIONAL RISK
Legal and reputational risk entails potential losses to earnings and reputational damage arising from noncompliance with regulatory/ statutory provisions, uncertainty due to legal actions, or uncertainty in the applicability for interpretation of relevant laws or regulation applicable to the Bank and negative perception of the stakeholders on Bank's financial and operation position.
FRAUD RISK
Bank utilises a comprehensive process to minimise the potential for financial and reputational losses stemming from fraudulent activities which involves pinpointing potential vulnerabilities that could be exploited for fraudulent purposes.
By strengthening following fraud risk management practices, Bank aims to significantly reduce its exposure to financial losses and reputational damage.
- Fraud detection technologies.
- Employee training on fraud awareness.
- Developing and implementing policies and procedures.
THIRD-PARTY RISK
Third-party risk refers to the potential for negative impacts stemming from relationships with external entities such as vendors, contractors or partners. These impacts can manifest into operational, compliance, financial or reputational risks.
Mitigation Actions
The Bank has implemented risk management clauses in contracts to clarify expectation, responsibilities and remedies for non-compliance. A continuous monitoring process is also in place to track third-party performance.
FUTURE FOCUS
Develop a vendor assessment Index/ risk scoring model to quantify the risk levels associated with each third party, based on listed set of criteria.
CONDUCT RISK
Conduct risk pertains to the potential for losses resulting from unethical or inappropriate behavior by an organisation or its employees, particularly in relation to compliance, customer treatment and market integrity. This may lead to legal penalties, reputation damages or financial losses due to misconduct in operational processes.
Prevailing economic conditions and the post-pandemic environment have resulted in operational control deficiencies and increased staff interdictions.
Mitigation Actions
The Bank has issued operational guidelines through Office Instructions Circulars and deployed Internal Control Officers (ICOs) to enhance control efficiency. In addition, employee code of conduct has been revised during the year.
FUTURE FOCUS
Implementation of a comprehensive Conduct Risk management policy.
RISK LANDSCAPE ELEMENT
GLOBAL ECONOMY
Created implications for:
Credit Risk, Market Risk, Liquidity Risk, Strategic Risk and Operational Risk
Impact of global economic conditions and external factors
- During 2024, the global economy had an overall positive impact on Sri Lankan banks by aiding in the restoration of macroeconomic stability and by allowing them to reduce uncertainties associated with foreign currency debt restructuring. This improved financial system stability and a more resilient banking sector, particularly with the support of the IMF program.
- Sri Lanka's net foreign inflows grew in 2024, with increased levels of foreign investments, workers' remittances, and tourism earnings compared to 2023.
- Geopolitical uncertainties have become a major factor influencing the global economy. These uncertanities stem from conflicts trade tensions, political instability and shifts in international alliances.
Impact on Sri Lankan Banks
- Completion of the foreign currency debt restructuring process significantly reduced risks for Sri Lankan banks and enhanced financial stability.
- Improved market sentiment led to increased investor confidence and a stable rupee.
- A recovering global economy contributed to an increase of foreign exchange inflows together with rebounding tourism and worker remittances.
Lower Interest Rates
- In 2024, global interest rates trended towards a gradual decline as most central banks opted for cautious rate cuts throughout the year. This was primarily due to easing inflationary pressures across key economies.
- Along with global impacts, the easing of monetary policy by the Central Bank of Sri Lanka led to a decline in market interest rates. This facilitated increased lending to the private sector and boosted economic activity.
- Continued support from the International Monetary Fund (IMF) further strengthened the Sri Lankan economy, providing a stable backdrop for banking operations.
However, potential challenges remain:
- Although the global economy showed signs of recovery, potential future economic shocks could still impact Sri Lankan banks.
- A continued focus on structural reforms within Sri Lanka is crucial to maintain long-term economic stability and support the banking sector.
Impact on BOC and Future Focus
Impact on the Bank together with measures bearing a future focus are discussed in the next section under Macro-financial conditions.
MACRO-FINANCIAL CONDITIONS
Created implications for:
Credit Risk, Market Risk, Operational Risk, Liquidity Risk and Strategic Risk
RISK LANDSCAPE ELEMENT
Improvements of macro-financial Conditions,
- In the first half of 2024, domestic macro financial conditions improved along with economic recovery and price stability.
- GDP growth picked up from the negative levels that prevailed throughout most of 2023.
- Inflation remained contained within a stable corridor.
- Credit growth also picked up significantly with Production Managers Indices for both manufacturing and services indicating improving levels of activity. Beginning with the first half of the year, credit to the private sector improved.
- Interest rates including yields on government securities and lending and deposit rates decreased significantly from the highs that prevailed throughout 2023 and stabilised by the end of the year.
- Gross external reserves continued its positive upward trend throughout as the national economy recovered momentum.
Yet Risks Remain,
- The deterioration in real income and elevated price levels remain a challenge.
- Banking sector exposure to real estate remains elevated due to urbanisation.
- Loans and advances picked up momentum with the credit cycle going into an expansionary phase. This inevitably led to higher credit risk exposure.
- Foreign inflows were constrained and promoting inflows through Financial System was challenging.
IMPACT ON BOC
Impact on Net Interest Income
- Relaxation of monetary policy stance of the Central Bank resulted in a 12% YoY Interest Income decline in 2024, primarily due diminished yields on loans and government securities.
- The significant reduction in interest expenses (32%) which outpaced the drop in income, dampened the negative impact on net interest income.
Impact on Loans Growth
- The impact on BOC's loan book was minimal (1% YoY drop).
- The Bank pursued growth with a cautiously optimistic stance, recognizing the need for a prudent, risk-based approach to credit growth.
Adapting to changes in policy and interest rates
- The Bank adapted quickly to changes in policy and interest rates which had a direct impact on savings, borrowing and lending behaviours of consumers, businesses, and the Bank.
Balancing credit risk vs. market opportunities
- Balancing credit risk vs market opportunities was necessary for pursuing growth prospects amidst subdued economic conditions
Heightened credit risks in specific industries
- During the period Sri Lankan banking sector experienced elevated levels of credit risk, particularly within the construction, tourism and apparel sectors, coupled with high interest rates and import restrictions caused to exert pressure on asset quality of the Bank. Prudent provisioning, business revival and rehabilitation and strategic debt restructuring aided Bank to weather the unfavorable economic conditions.
Operational strategies to support economic recovery.
- Supporting Sri Lanka's fragile economic recovery called for adapting a variety of operational strategies. These included new loan schemes targeting Micro, Small and Medium Enterprises (MSMEs) and women entrepreneurs.
- An enhanced focus on supporting customers in financial distress.
- Amidst difficult conditions and financial stress on borrowers, BOC managed to improve default levels significantly with timely and effective post-disbursement follow up actions that offered optimum solutions to our customers.
RISK LANDSCAPE ELEMENT
IMPACT ON BOC
Needed to adapt, innovate and collaborate for positive growth.
- BOC strengthened the balance sheet by expanding the product portfolio launching new products with competitive interest rates during 2024.
- Complications on managing lending and investment portfolios.
- Achieving Sustainable level of capital.
- Strategic Risk – Constraints on achieving budgeted targets.
- Increased operational risk with anticipated growth in business and post pandemic and economic downturn.
BOC RESPONSE AND FUTURE FOCUS
- Strengthening the Bank's resilience to adverse macro-financial developments.
- Strengthening systems with a higher focus and resources for managing non-performing credit facilities.
-
The Bank launched the following new products to cater to growing consumer needs, to widen product portfolio and
strengthen the balance sheet.
- BOC Youth Loan scheme
- BOC Ranliya Loan scheme targeting women entrepreneurs
- A number of loan schemes targeting MSMEs and rural development, covering lifeline industries
- Bank focussed on managing its Net Interest Margins by repricing the loans and advances accordingly to manage a low-interest rate scenario.
- Innovative deposit products such as 100-day investments etc. introduced by the Bank helped bolster the liquidity position during a phase of low interest rates.
- Given increased remittances the Bank enhanced its partnerships with Banks overseas especially in countries where Sri Lankan migrant community is concentrated. The number of trained business promotion officers was increased to enhance service levels.
-
Bank undertook the following actions to promote foreign remittances.
- Expanded the service to new destinations
- Conducted special promotional campaigns
- Introduced 'Smart envoy' app to enable business promotion officers to reach customer information online real time
- Introduced new pre-departure loan products for new visa categories
BOC RESPONSE AND FUTURE FOCUS
- New Fixed Deposit Scheme, 'Prosperity deposit' scheme was introduced enabling customers to invest their funds at an attractive rate of interest. 'BOC Smart Freelancers' - A unique savings scheme designed for Freelancers and online entrepreneurs who earn through reputed digital platforms was introduced.
- Proactively addressed heightened credit risks in specific industries by implementing targeted management overlays, reflecting a cautious approach to credit risk management. This strategy enabled close monitoring, timely mitigation, and the allocation of sufficient provisions for potential credit losses.
- The scope of the NPA Review Committee was enhanced. A staff reward scheme was introduced to encourage staff to perform at their best in recovery.
- Concessionary reschedulement plans and compromised exit plan were introduced to Stage 3 loan holders which led to reversal of loans.
- The successful issuance of LKR 15 billion debentures supported meeting capital requirements by achieving a 16% capital adequacy ratio at the year end.
- The capital augmentation plan was reviewed well in advance to ensure compliance with new requirements which may arise due to restructuring of international sovereign bonds and exposure to government.
Created implications for:
Credit Risk, Market Risk, Operational Risk, Liquidity Risk and Strategic Risk
RISK LANDSCAPE ELEMENT
Sri Lanka's Credit Rating
- In April 2022 the Sri Lankan government announced that it was defaulting on sovereign debt leading to an IMF bailout and debt restructuring negotiations.
- Fitch Ratings downgraded Sri Lanka's Long-Term Foreign-Currency Issuer Default Rating (IDR) at 'RD' (Restricted Default) in May 2022 and the government is not currently servicing its foreign-currency debt.
- On 20 December 2024, Fitch Ratings upgraded Sri Lanka's Long-Term Foreign-Currency Issuer Default Rating (IDR) to 'CCC+' from 'RD' (Restricted Default) which considered the improvement in the country's credit rating at end of the year, following a period of significant downgrades due to economic difficulties.
- The upgrade was accompanied by a similar upgrade to the Long-Term Local-Currency IDR to 'CCC+' from 'CCC-'.
IMPACT ON BOC
- The Restricted Default (RD) sovereign country rating had a negative impact on borrowing levels across the financial sector, immediately impacting credit ratings of individual financial institutions.
Impact of debt restructuring
- Restructuring of International Sovereign Bonds (ISBs) created a positive net impact on the profit for the year.
- A "Day 1 loss" on the income statement arises during debt restructuring when the immediate accounting loss suffered as a result of terms of a debt are modified. It reflects the difference between the carrying value of the original debt and the present value of the restructured debt on Day 1 of the restructuring agreement.
- A further haircut loss arose from the de-recognition of financial assets. A haircut refers to the reduction of outstanding interest payments or a portion of a bond payable that will not be repaid during a debt restructuring process.
RISK LANDSCAPE ELEMENT
Bank's Credit Rating
- Fitch Ratings upgraded the Bank of Ceylon's (BOC) credit ratings multiple times in 2024 and 2025.
- 6 June 2024: Fitch affirmed BOC's Long-Term Foreign-Currency Issuer Default Rating (IDR) at 'CC'.
- Long-Term Local-Currency IDR of 'CCC-' with a Stable Outlook, and the Short-Term IDR at 'C'.
- 5 December 2024: Fitch upgraded BOC's Long-Term Foreign Currency IDR to 'CCC-' from 'CC'.
- 9 January 2025: Fitch upgraded BOC's Long-Term Foreign- and Local-Currency IDRs to 'CCC+' from 'CCC-'.
- 23 January 2025: Fitch upgraded BOC's National Long-Term Rating to 'AA-(lka)' from 'A(lka)'.
IMPACT ON BOC
Sovereign exposure risk
- Bank's substantial investment and loans tied to government sector, to be a key driver in the Bank's risk profile. This may affect the Bank's liquidity position because of constraints on the government's repayment capacity.
- The Bank as a strategy put in concerted efforts to increase lending to the private sector, which has moderated the impact of sovereign exposure.
BOC RESPONSE AND FUTURE FOCUS
- Despite setbacks, BOC's strong financial performance across key metrices in the face of challenging economic conditions helped the Bank retain its credit rating during 2024, with an upgrade in December 2024. It was notable that the Bank's credit ratings were upgraded even prior to the Sri Lanka credit ratings were upgraded.
- To strengthen the capital base, BOC raised LKR 15.0 billion in Basel III compliant Tier II capital via a debenture issue during 2024.
- The anticipated strengthening of recovery measures and economic prospects transforming into improved asset quality, the Bank expects a net positive impact on capital adequacy ratio by way of improved capital base and reduction in risk weighted assets.
CHANGES IN THE REGULATORY ENVIRONMENT
Created implications for:
Credit Risk, Market Risk, Operational Risk, Liquidity Risk and Strategic Risk
RISK LANDSCAPE ELEMENT
Continuing austerity measures and regulatory reforms
- Continuing austerity measures and regulatory reforms resulted in monetary policy and fiscal measures.
- The Bank needed to maintain the required capital levels and liquidity ratios despite pressures on both.
- Potential loss of business opportunities was anticipated from exercising a more cautious approach to lending.
- Deterioration in asset quality required impairment provisions with impact on shareholder returns affecting profitability.
Liquidity Management
- With the Banking Act Determination No. 01 of 2024 (13 June 2024), CBSL discontinued the Statutory Liquid Asset Ratio (SLAR) as a liquidity indicator, instead placing greater emphasis on the Liquidity Coverage Ratio (LCR) and the Net Stable Funding Ratio (NSFR) as defined under Basel III liquidity standards.
- With this change, the CBSL aims to enhance the resilience of the banking sector to shocks and reduce the risk of financial instability.
Additional regulatory requirement on the Bank
-
Additional regulatory requirements imposed by the CBSL considering the;
- Restructuring of ISBs and SLDBs
- Restructuring of SOEs
- In the context of Sri Lanka's financial sector, the CBSL allows licensed banks to draw down the Capital Conservation Buffer (CCB) up to 2.5% under specific conditions stipulated in Basel III directions, impacting the Capital Adequacy Ratio (CAR).
IMPACT ON BOC
- BOC had to adapt to new legislation and regulations on banking operations to ensure compliance.
- Deterioration in asset quality during 2023 required significant impairment charges. However, gradually improving economic conditions throughout 2024 reduced the impact.
- An impairment charge of LKR 12.4 billion was recognised for loans and advances, which reflects the challenges faced by sectors that are yet to recover from economic downturns and global disruptions.
- The impaired loans (Stage 3) ratio increased to 7.2% from 5.1% in 2023.
- The impairment coverage ratio (Stage 3 impairment provision to Stage 3 loans) remained strong at 53.6%, a reflection of prudent risk management measures.
- The Statutory Liquid Asset Ratio (SLAR) as a liquidity indicator monitored by the CBSL was discontinued with more focus on the Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio (NSFR).
-
The Bank maintained a robust capital adequacy, with
- Common Equity Tier 1 ratio of 12.0% and
- Total Capital Ratio of 16.6%.
- Both were above the Basel III requirements and underscores the Bank's strong capital position and the ability to absorb potential risks.
- BOC's liquidity coverage ratios for both Rupee and all currencies remained well above regulatory requirements in 2024 and indicates the Bank's ability to meet financial obligations.
- Heightened levels of regulation necessitated additional provision and capital requirement for the Bank.
RISK LANDSCAPE ELEMENT
Sri Lankan debt recovery laws changed during the year.
- An amendment to the Debt Recovery (Special Provisions) Act No. 4 of 1990 was made with the Recovery of Loans by Banks (Special Provisions) (Amendment) Act, No. 26 of 2024. The amendments suspended the sale of mortgaged property by public auction with an initial suspension effective until 15 December 2024.
- Only debt recovery action approved by courts could continue.
Overnight Policy Rate (OPR)
- The Overnight Policy Rate or OPR became the Central Bank of Sri Lanka's single monetary policy rate with effect from 27 November 2024. OPR replaces the previous framework which relied on the dual rates of the Standing Deposit Facility Rate (SDFR) and the Standing Lending Facility Rate (SLFR).
Large exposure of Licensed Banks
This measure would enhance the resilience of the Banking sector by reducing the systemic risk that could arise due to the economic dependence between borrowers. LBs with higher large exposures above the cap of 25% of tier 1 capital are required to bring down the respective exposures below the cap by end 2028 on a staggered basis. Similarly, banks are required to comply with the cap on large exposures to public corporations by end 2030. Further, the aggregate limit on large exposures is required at 55% of the total exposures of the Bank.
Financial Consumer Protection Act
- The Financial Consumer Protection Regulations (FCP Regulations) of Sri Lanka, No. 01 of 2023, protect consumers from financial service providers (FSPs). The regulations were issued by the Central Bank of Sri Lanka on August 9, 2023.
IMPACT ON BOC
- The Bank carried out risk analysis to assess any additional capital requirements and took proactive measures to seek alternative capital sources. As a result the 2024 ended with a healthy capital position.
- Suspension of parate executions made it more difficult to recover debts while also increasing the risk premium for all borrowers, putting customer deposits at risk.
- OPR facilitates interest rate stability by reducing volatility in interbank lending rates and providing greater confidence to borrowers. A well anchored OPR makes borrowing costs predictable, thus contributing to economic growth.
- The new regulations promote fair competition and equitable practices in the financial services sector; establishes a grievance redressing mechanism for consumers, creates a regulatory and supervisory framework for FSPs and ensures that consumers are treated fairly and transparently.
- FCP Regulations apply to all FSPs regulated by the CBSL and are formulated in line with international standards. They supplement existing consumer protection laws in Sri Lanka.
- Credit concentration risks of Licensed Banks have been managed through large exposure caps been placed to enhance resilience of the Banking sector.
- The guideline on large exposure would help the Bank to further diversify its portfolio through strengthening the balance sheet which also helps to reduce the spill over impact to related industries.
BOC RESPONSE AND FUTURE FOCUS
- Enhanced overall risk management practices with changes in the governance structures.
- In particular, measures for evaluating new loans and advances were strengthened in order to manage the risk associated with issuing new credit.
- As a fully state-owned government Bank, the Bank relies mainly on retained earnings as the primary source of capital to maintain the additional buffers so that it can meet regulatory requirements and meet potential future capital stress periods and events.
- To further strengthen its capital position the Bank has planned to issue debentures in 2025.
- The Bank assigned a dedicated Financial Consumer Protection Officer of an executive grade to ensure full compliance.
- The Bank revisited all of the Bank's documents such as agreements to incorporate the contents specified in the regulations to ensure customers are protected accordingly and provided with an improved level of service.
- Established Board approved financial consumer protection policy.
- With respect large exposures, the Bank has established the internal tolerance limits and system developments (on reporting and monitoring) and operational guidelines are underway.
TECHNOLOGY RELATED RISKS AND THE EVOLVING CYBERSECURITY THREAT LANDSCAPE
Created implications for:
Operational Risk, Liquidity Risk and Strategic Risk
RISK LANDSCAPE ELEMENT
Cybersecurity and Information Technology Risks
- Information security risk is a key risk for banks as they maintain personal and financial data of customers.
- Banks must act in accordance with Sri Lanka's Personal Data Protection Act 99 of 2022 (PDPA).
- Rising cyber threats pose serious concerns for financial institutions, creating a substantial risk to financial stability.
- The risk of a cyberattack with systemic consequences has risen due to greater digitalization and heightened geopolitical tensions worldwide. Risk of extreme losses from cyber incidents is on the rise.
- Firms in the financial sector are uniquely exposed to cyber risk given the large amounts of sensitive data and transactions they handle. Criminals target these firms seeking to steal money or disrupt economic activity. Attacks on financial firms account for nearly one-fifth of the total attacks, of which banks are the most vulnerable and exposed.
Digital Transformation and Cybersecurity
- Leveraging technology in delivering financial services has become a highly competitive frontier.
IMPACT ON BOC
- The Bank had to place great emphasis on data privacy to ensure compliance with applicable regulations and to safeguard customer information.
- Information and Cybersecurity threat landscape is constantly evolving and requires constant vigilance and updated policies and a dynamic stance towards information security.
- In order to stay competitive a rapid digitalisation drive to enhance operational efficiency, customer experience and competitive advantage is demanded. Accordingly, digital transformation and Information Technology (IT) risks are increasing which necessitates an enhancement of the Bank's IT Risk Management Framework.
BOC RESPONSE AND FUTURE FOCUS
BOC's response and future focus
- Changed the reporting line of the Chief Information Security Officer (CISO) to General Manager, to provide the CISO with the necessary authority to enable speedy decision making and be more independent to ensure information security is prioritized across the entire Bank.
- Employees covering all layers of the organisation structure and Outsourced Service Providers were required to complete mandatory information security awareness courses. In addition, awareness on Information security hygiene was enhanced through e-flyers, videos, physical and virtual presentations etc. Further, we telecasted educational videos on tvBOC, published content in the website to improve customer awareness on information security.
- Pre and Post Cybersecurity assessments were conducted for IT projects to identify potential threats to the Bank and implement necessary IT controls. Bank wide information security risk assessments were conducted for technology infrastructure, business applications, processes. Further, regular due diligence exercises were conducted for suppliers to identify potential cyber risk exposures and impact on the Bank.
- Strengthen information security activities by aligning policies, risk management and control mechanisms with the COBIT 2019 framework to ensure governance, compliance and continuous improvement in cybersecurity.
- Advanced threat detection and prevention tools (Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), Security Information and Event Management (SIEM), endpoint detection) were introduced to minimise cyber risk.
- The Bank liaises with external professional bodies to obtain threat intelligence and best practices. (such as CERTs - Computer Emergency Readiness Teams)
- The Bank got an award for most Information Systems Audit and Control Association (ISACA) certified members in Sri Lanka. The Bank has shaped its members to be professionally qualified in the field to ensure better information and cyber security.
- Individual awards (CISO awards) Banks-Local Merit award was awarded to the CISO of BOC in 2024.
- Convenient one-stop payment solution which gives a seamless experience on effortless payments was introduced (Gewamu.lk). even a non-customer can enjoy the convenience of managing all their bills seamlessly at a single website.
- Multi-layer security controls such as firewalls, intrusion detection systems and encryption mechanisms protect sensitive customer data and prevent unauthorised access.
- Regular security assessments including vulnerability scans, are conducted to identify and mitigate potential vulnerabilities.
SKILL RETENTION AND MANPOWER
Created implications for:
Operational Risk and Strategic Risk
RISK LANDSCAPE ELEMENT
- In 2024, Sri Lanka experienced a significant increase in labour migration.
- Labour migration has a direct impact on the staff turnover within the banking sector with many skilled employees leaving for overseas jobs.
- This "brain drain" posed potential challenges for banks to retain qualified staff.
- There was increased incidence of headhunting from competitive banks.
IMPACT ON BOC
- Staff turnover at BOC increased significantly during the year causing loss of experienced personnel with critical and specialised skills.
- Frequent staff turnover disrupts established banking workflows, resulting possible increase in processing errors and delays, impact customer service and operational efficiency, a decline in institutional knowledge, hindering the smooth transition of tasks and responsibilities resulting an elevated training costs and onboarding time for new hires, reducing short term productivity.
- The heightened risk of possible non-adherence to internal controls due to staff turnover could result weakened oversight, increased vulnerability to fraud and security breaches due to a lack of familiarity with established protocols including inconsistent application of risk management practices.
BOC RESPONSE AND FUTURE FOCUS
The Bank has developed following employee retention strategies/ initiatives under the Bank's employee retention policy;
- Reward and Recognition for Employee motivation.
- Redesign and revamping organization structure to attract and engage new generations.
- The Bank's succession plan effectively ensured the responsibility and accountability took place smoothly following staff turnovers.
- Personal counselling program was introduced to increase more focus on employee mental health.
- Employee Branding - Encourage each employee to develop positive attitudes about the Bank and empowering them to be more effective ambassadors.
- The Bank has proactively implemented a comprehensive employee development program aimed at enhancing the skills and competencies of its workforce. Through a series of targeted training initiatives, employees are provided with opportunities to acquire new knowledge, refine their existing skills, and stay abreast of industry best practices.
ENVIRONMENTAL AND SOCIAL RISKS, CLIMATE RISK CONSIDERATION
Created implications for:
Credit Risk, Liquidity Risk, Operational Risk and Strategic Risk
RISK LANDSCAPE ELEMENT
Environmental and Social Risk
- The risk landscape is shifting towards a greater emphasis on sustainability and responsible business practices. Organisations must proactively identify assess, and manage E&S risks to protect their long-term value and contribute to a sustainable future.
- Increased regulatory scrutiny of E&S considerations and compliance.
Climate Change and Environmental Risks
There is an increasing focus on climate-related risks globally, with stakeholders, including consumers, demanding a more proactive stance to climate related risk management. Businesses are taking proactive actions and sustainability and related disclosures are becoming a frontier for competitiveness.
More frequent and severe weather events and longer-term shifts in climate patterns could result in impairment of the Bank's assets, including advances, and those held as collateral.
Adverse weather events can also jeopardise the sustainability and profitability of small, medium and microenterprises, raising credit risk.
The Bank's financial performance and reputation could also be impacted by insufficient climate commitments, insufficient financing of new opportunities in renewable industries, and financing or partnering with organisations that damage the environment or violate human rights.
IMPACT ON BOC
Fostering Financial Inclusion and Sustainable Banking
With BOC Connect, the Bank together with Sri Lanka Post extends access to banking services to the nation's most underserved communities. Rural communities will be able to access everyday banking services including deposits, withdrawals, bill payments, and fund transfers saving time and without incurring significant travel costs. It is also an approach to environmentally sustainable banking and further financial inclusion.
Responsible banking and sustainable development
- Strengthening Due Diligence Processes. We conducted Environmental and Social Due Diligence (ESDD) for high-risk projects, ensuring compliance with national regulations and international best practices.
- Policy and Governance Enhancements. Updated ESMS policies and procedures to align with evolving regulatory requirements and industry standards.
- Capacity Building and Awareness Programmes. Conducted training sessions for credit officers and risk teams to enhance their understanding of E&S risk assessment methodologies.
- Promoting Green and Socially Responsible Financing. Expanded our sustainable finance portfolio, prioritizing renewable energy, energy efficiency, and environmentally friendly businesses.
RISK LANDSCAPE ELEMENT
IMPACT ON BOC
Impact of severe weather events in 2024
- Severe weather conditions that prevailed in May and June, and again in November and December 2024 resulted in significant crop and livestock damages from floods.
- These affected large swathes of farmland with extensive damages to paddy and other crops.
- Just in the second part of the year, over 100,000 farmers reported substantial losses seeking compensation.
Impact on Agriculture Sector and MSME loans and advances
- There is bound to be a significant impact from crop and livestock damages across multiple districts and business disruptions (both SME and other).
BOC RESPONSE AND FUTURE FOCUS
- Developing a comprehensive ESG risk management framework.
- Bank is continually enhancing tools and approaches to manage E&S risk exposures across our lending and supplier processes.
- Under ESMS, the Bank strengthened Due Diligence processes, introduced policy and governance enhancements, conducted capacity building and awareness programmes to promote green and socially responsible financing.
- Established Sustainability subcommittee to strengthen ESG Framework.
Climate Change Preparedness
- Identify and assess Bank exposures for both physical and transition risks.
- Stress testing to assess different climate scenarios to understand their impact on financial stability of the Bank.
- Integrating climate risk management into the Bank's overall governance and risk management framework.
- Engage with customers to manage their own climate-related risks.
- Create new financial products to facilitate climate change adaptation.