Risk management of VP Bank Group

Effective capital, liquidity and risk management is an elementary prerequisite for the success and stability of a bank. VP Bank understands this to mean the systematic process of identifying, evaluating, managing and monitoring relevant risks as well as the steering of capital resources and liquidity necessary to assume risks and to guarantee risk-bearing capacity. The binding framework for action in this context is provided by the regulations defined by the Board of Directors of VP Bank Group, consisting of the Risk Appetite Statement, risk policy and risk strategies.

The Risk Appetite Statement defines the overall risk tolerance along the risk taxonomy, forming the basis for operationalising limits and targets in the risk policy. As an overall framework, the risk policy, together with the risk strategies per risk group (strategic and business risks, financial risks as well as non-financial risks), regulates the specific objectives and principles, organisational structures and processes, methods and tools of risk management.

In Liechtenstein, the regulatory requirements governing risk management are set out primarily in the Banking Act (BankA) and the Banking Ordinance (BankO). In addition, the Capital Requirements Regulation (CRR) together with the Capital Requirements Directive (CRD) apply in Liechtenstein. In Liechtenstein, the CRD was enacted in the BankA and in the BankO. VP Bank was classified as a locally systemically relevant banking institution by the Financial Market Authority Liechtenstein and must hold in aggregate equity amounting to at least 12.5 per cent of its risk-weighted assets. Thanks to its solid equity basis, balance sheet structure and comfortable liquidity position, VP Bank constantly outperformed the minimum regulatory requirements over the course of 2024.

Capital and balance sheet structure management

The minimum capital ratio of VP Bank of 12.5 per cent of risk-weighted assets consists of the regulatory minimum requirement of 8 per cent, a capital conservation buffer of 2.5 per cent and a buffer for other system-relevant banks of 2 per cent. Basel III also provides for an anti-cyclical capital buffer that was set at 0 per cent for 2024 by the Financial Market Authority Liechtenstein.

VP Bank complied with the minimum capital requirements for 2024 at all times. Thanks to an exceedingly robust tier 1 ratio of 25.9 per cent as of the end of 2024, it continues to guarantee sufficient room for manoeuvre. This enables VP Bank to continue to assume risks associated with the conduct of banking operations.

As of the end of 2024, the leverage ratio of VP Bank was 9.9 per cent. VP Bank has published further information as to the leverage ratio in the disclosure report.

As part of the management of equity resources and the balance sheet structure, compliance with regulatory requirements and the coverage of its business needs are monitored on an ongoing basis. Using an internal process to assess the adequacy of capital and liquidity resources (the Internal Capital or Internal Liquidity Adequacy Assessment Process / ICAAP and ILAAP), possible adverse effects on the equity and liquidity position under stress situations are simulated and analysed. With the ICAAP, the Financial Market Authority Liechtenstein imposes specific requirements regarding the internal strategies and procedures for determining, managing and monitoring capital risks, which were again surveyed and assessed by the Financial Market Authority Liechtenstein in 2024 using an ICAAP questionnaire.

Liquidity risk management

In compliance with statutory liquidity requirements and provisions contained in the BankO, CRR and CRD, VP Bank monitors and manages liquidity risks using internal directives and limits regarding interbank business and credit-granting activities. Maintaining liquidity within VP Bank Group has the highest priority at all times. This is assured with large cash and cash-equivalent holdings as well as high-quality liquid assets (HQLA). VP Bank observed the minimum regulatory liquidity requirements at all times during 2024.

In this context, compliance with the liquidity coverage ratio (LCR) of 100 per cent is required by law, which was clearly exceeded with a value of 165 per cent thanks to a comfortable liquidity situation. The net stable funding ratio (NSFR) at 144 per cent as of the end of 2024 significantly exceeded the regulatory requirement of 100 per cent.

With the Internal Liquidity Adequacy Assessment Process (ILAAP), the Financial Market Authority Liechtenstein imposes specific requirements regarding the internal strategies and procedures for determining, managing and monitoring liquidity risks, which were again surveyed and assessed by the Financial Market Authority Liechtenstein in 2024 using an ILAAP questionnaire.

As part of its liquidity management process, VP Bank has drawn up an emergency liquidity plan which ensures that VP Bank possesses adequate liquidity in the event of liquidity crises. Early-warning indicators are regularly reviewed to monitor and identify, on a timely basis, any deterioration in the liquidity situation.

As part of liquidity management, compliance with regulatory requirements and the coverage of business needs is subjected to ongoing monitoring. Using stress tests, possible adverse scenarios are simulated and the impact on liquidity in stress situations is analysed.

Credit risk

The management and monitoring of credit risk plays a central role, particularly due to the importance of client loans (CHF 5.9 billion as of 31 December 2024 or 56 per cent of total assets). In addition to the lending business, credit risks arising from the securities portfolio held for liquidity purposes in the banking book (predominantly high-quality liquid assets) as well as from interbank investments at banks with good credit ratings are also of relevance to VP Bank.

Credit regulations govern credit risk management in the client loan business. In 2024, the volume of client loans increased significantly by CHF 474 million. The growth was mainly due to the mortgage lending business.

At CHF 851 million, the volume of receivables from banks was around CHF 500 million lower than in the previous year. In order to strengthen the interest income, free liquid assets continue to be invested with banks with good credit ratings, predominantly cantonal and regional banks in Switzerland.

The securities portfolio consists mainly of investment-grade securities and had a nominal value of approximately CHF 2.2 billion as of 31 December 2024. Detailed guidelines (including volume and risk limits, duration ranges) for the management of securities have been established in the risk management process.

Market risk

Market risk is made up of interest rate, credit-spread, currency and equity price risks to which VP Bank Group is exposed. Given the importance of the interest bearing business, management and monitoring of market risk on the balance sheet takes on particular importance. After interest rate hikes in all three major currencies (CHF, EUR and USD) in 2023, interest rates fell in 2024, with longer-term expectations fluctuating greatly over the course of the year. The inversion of the yield curves, where long-term interest rates are lower than short-term interest rates, has significantly reduced in 2024.

Operational risk

VP Bank defines operational risk as potential losses or loss of profit that may occur as a consequence of the inappropriateness or failure of internal processes, individuals or systems or as a result of external events. Possible risk scenarios are identified, described and assessed using top-down and bottom-up risk assessments. The identified risks are limited or mitigated by controls as specified in the risk appetite. The controls are an integral part of the business processes and are documented in the internal control system. Controls are periodically assessed for adequacy and effectiveness. The current non-financial risk situation is reported to the Executive Board and the Board of Directors on a quarterly basis.

The geopolitical situation had a major impact on the assessment of the risks arising from sanctions and embargoes. As a result, processes for the early identification and prevention of potential compliance breaches were further strengthened and relevant business policy decisions were implemented. At the same time, the level of regulation in the financial sector continued to increase.

In 2024, VP Bank took comprehensive measures to comply with the requirements of the EU Regulation “Digital Operational Resilience Act” (DORA). This entered into force on 17 January 2025 with the aim of strengthening the digital resilience of financial service providers and ensuring the stability of the financial system. It sets new standards for protecting critical IT systems and tackling cyber attacks in the financial sector.

VP Bank has taken measures to further improve its IT risk management, IT processes, cyber resilience and monitoring of external service providers.

In doing so, VP Bank is underscoring its efforts to ensure the long-term protection of its clients and their assets, the security of its services and the stability of its business processes.

Further risks

In addition to the aforementioned risks, risk management of VP Bank Group covers strategic and business risks, compliance risk and reputational risk. These risks are systematically analysed and continuously evaluated based on the business model and the range of services offered by VP Bank.

The topic of sustainability is becoming increasingly important in risk management with the implementation of the Corporate Sustainability Reporting Directive (CSRD). Detailed reporting based on the double materiality analysis can be found in the sustainability declaration.

ESG stands for environmental, social and governance. ESG risks can occur along VP Bank’s entire value chain and result primarily from the bank’s commitment to its clients and counterparties as well as from invested assets and the lending business. ESG risks are understood to mean risk drivers and can materialise in both financial and non-financial risks. They could potentially have a negative impact on the bank’s earnings situation and financial stability. VP Bank focuses on ESG risks that were identified as material as part of the double materiality analysis.

Risk management at VP Bank Group is predicated on the following principles:

Harmonisation of risk-bearing capacity and risk tolerance

The concept of risk-bearing capacity is intended to enable a bank to continue its business operations or to fully meet the claims of depositors and creditors despite losses from risks that become effective. Risk tolerance indicates the potential loss which the bank is prepared to bear without jeopardising the bank’s ability to continue as a going concern. As a strategic success factor, risk-bearing capacity is to be maintained and enhanced at all times by employing a suitable process to ensure an appropriate capital and liquidity base.

Clearly defined powers of authority and responsibilities

Risk tolerance is operationalised using a comprehensive limit system and implemented effectively with a clear definition of the duties, powers of authority and responsibilities of all bodies, organisational units and committees involved in the risk and capital management process.

Conscientious handling of risks

Strategic and operational decisions are taken based on risk-return calculations and, in this way, aligned with the interests of the stakeholders.

Subject to compliance with statutory and regulatory requirements as well as corporate policy and ethical principles, VP Bank consciously assumes risks provided that the extent of these are known, the system requirements for recording them are in place and the bank will be adequately compensated for them. Transactions with an imbalanced risk-return ratio are avoided, as are major risks and extreme risk concentrations, which could endanger the risk-bearing capacity and therefore also the future existence of the Group.

Segregation of functions

Units that report to the Chief Risk Officer (CRO) and that are independent of the bodies that actively manage the risks are responsible for monitoring and reporting risks to Group Executive Management (GEM) and the Board of Directors.

Transparency

Comprehensive, objective, timely and transparent disclosure of risks to Group Executive Management (GEM) and the Board of Directors forms the basis for risk monitoring.

Risk taxonomy

The prerequisite for risk management and the management of equity resources of VP Bank is the identification of all significant risks and their aggregation to an overall bank risk exposure.

Significant risks are identified based on the business model and related offerings of financial products and services of VP Bank.

The following chart provides an overview of the risks to which VP Bank is exposed in the context of its business activities. These are allocated to the risk groups of strategic and business risks, financial risks, non-financial risks (operational risks, compliance risks and information security risks) and reputational risks.

Strategic and business risks encompass the risk of a potential decline in profitability as a result of an inadequate corporate orientation in relation to the market environment (political, economic, social, technological, ecological, legal) and can arise from unsuitable strategic positioning or the absence of effective countermeasures in case of changes. This includes the risk that the attractiveness of location-related factors recedes or the significance and/or weighting of individual business areas undergo change by virtue of external framework conditions. It also includes the risk that the launch of new products, the distribution of existing products, market access or the conduct of business will be rendered difficult or impossible by regulations or will entail disproportionately high costs or be unprofitable. Finally, adverse developments may arise in connection with target markets as a result of political or geopolitical influences.

Financial risks (liquidity risk, market risk, non-traditional asset risk and credit risk) are deliberately entered into in order to generate income or to safeguard business policy interests.

Liquidity risks comprise market liquidity risk and idiosyncratic liquidity risk. In the case of market liquidity risk, the risk lies in the fact that the bank may be unable to procure the required liquidity due to market distortions on the money or capital markets or can do so only on inadequate terms and conditions. For example, the market for securities, which can normally be sold at market value, might not be sufficiently liquid, or the interbank market might not be available, or only to a limited extent, for short-term liquidity procurement. Idiosyncratic liquidity risk, on the other hand, represents the risk that the bank may not be able to procure liquidity for VP Bank-specific reasons or can do so only on inadequate terms and conditions.

Market risk refers to the risk of potential present value losses in the banking and trading book that emerge due to unfavourable changes in market prices (interest rates, foreign exchange rates, share prices, commodities, credit spreads) or other price-influencing parameters such as volatility.

Credit risk includes default/creditworthiness, liquidation, counterparty, country and idiosyncratic risks. Default risk refers to the risk of a financial loss which may occur following the default of a debtor or loan collateral. Liquidation risks include potential losses incurred by the bank not due to the debtors themselves, but due to a lack of opportunities to liquidate collateral. Counterparty risk refers to the risk of financial loss resulting from the default of a counterparty in a derivative transaction or from non-performance by a counterparty (settlement risk). Country risk is a result of uncertain political, economic or social conditions as well as payment transaction restrictions in the risk domicile (so-called transfer risks). Idiosyncratic risks include potential losses incurred by the bank from a lack of diversification in the loan portfolio (concentrations in debtors and/or collateral).

Non-traditional asset risks result from alternative investments that cannot be allocated to traditional asset classes, such as equities, bonds or money market products, and are subject to other risk drivers. This category includes, for example, investments in private debt, private equity, real estate (securitised), infrastructure projects and other investment opportunities outside the traditional investment spectrum.

Operational risk is the risk of incurring losses or loss of profit arising from the inappropriateness or failure of internal procedures, individuals or systems, or as a result of external events. These are to be avoided by appropriate controls and measures before they materialise or, if that is not possible, be reduced to a level set by the bank. Operational risk can also arise in all organisational units of the bank, whereas financial risk can only arise in risk-taking units.

Compliance risk is understood to be breaches of statutory and regulatory provisions that can cause significant damage to VP Bank’s reputation or result in sanctions, fines or even in the bank’s licence being withdrawn. The compliance risk of VP Bank consists in particular in the possibility that VP Bank does not or does not sufficiently recognise financial crime risks of its clients and counterparties – such as money laundering, financing of terrorism, violations of sanctions and embargoes, fraud and corruption activities – and has not established appropriate surveillance and monitoring processes for identification, management and limitation of cross-border compliance risks as well as tax and investment compliance risks.

Information security risk (including cyber risk) refers to the circumstances in which inappropriate infrastructure design or infrastructure failure results in losses, or to the risk, in an information technology context, of sophisticated and targeted attacks that are difficult to detect and defend against. From the perspective of data security, there is a risk for VP Bank that failure to adhere to national and international data protection requirements will result in financial and reputational losses, as well as having legal consequences.

ESG and climate-related financial risks represent the risk of adverse economic impacts on VP Bank that may arise from environmental, social or governance factors. Climate-related financial risk is a sub-set of environmental risk and arises due to the effects of climate change and the measures taken to decarbonise the economy.

Reputational risk describes the risk that the confidence of employees, clients, shareholders, regulatory authorities or the public is weakened and the public image and/or reputation of the bank is impaired as a result of other types of risk or through various events. It can exhibit itself in the bank suffering monetary losses, a decline in earnings or, in the worst-case scenario, liquidity shortages.

Duties, powers and responsibilities

The chart (→ above graphic) shows the key duties, powers and responsibilities of the bodies, organisational units and committees involved in the risk management process. The roles and structures of risk steering and risk monitoring are separated, which avoids conflicts of interest between the risk-taking and monitoring units. Management, monitoring and verification of risks takes place over three lines of defence:

1. First line of defence: risk steering
2. Second line of defence: risk monitoring
3. Third line of defence: internal audit

The Board of Directors bears overall responsibility for capital, liquidity and risk management within the Group. Its remit is to establish and maintain an appropriate structure of business processes and organisation as well as an internal control system (ICS) for an effective and efficient management of capital, liquidity and risk, thereby ensuring the risk-bearing capacity of the bank on a sustainable basis. The Board of Directors defines and approves the risk tolerance, the risk policy and the risk strategies. It monitors their implementation, sets the risk tolerance at Group level and establishes the target values and limits for the management of equity resources, liquidity and risk. In assuming these tasks, the Board of Directors is assisted by the Risk Committee.

In addition, the Board of Directors receives reports from the internal auditors and the external auditors on all exceptional and material incidents, including significant losses or serious disciplinary errors. In assuming this task, the Board of Directors is supported by the Audit Committee.

Group Internal Audit is responsible for the internal audit function within VP Bank Group. Organisationally, it forms an autonomous organisational unit which is independent of operations and is responsible for the periodic audit of structures and processes of relevance in connection with the risk policy as well as compliance with applicable requirements.

Group Executive Management (GEM) is responsible for the implementation of and compliance with the risk policy approved by the Board of Directors. One of its central tasks is to ensure the functional capability of the risk management process and the internal control system (ICS). Furthermore, it is responsible for the composition and assignment of duties, responsibilities and competencies of the Asset & Liability Committee, the allocation of objectives and limits set by the Board of Directors to the individual subsidiary companies as well as the group-wide management of strategy, business, financial, compliance, operational and reputational risk.

In its function as the Group Risk Committee (GRC), Group Executive Management assumes responsibility for implementing the risk strategy within the limits and targets defined by the Board of Directors and Group Executive Management as well as dealing with overarching issues.

The Asset Liability Committee (ALCO) is responsible for risk- and return-oriented balance sheet management as well as for the management of financial risks in compliance with the relevant statutory and regulatory provisions. It assesses the Group’s situation with respect to financial risks and initiates remedial steering measures whenever necessary.

The Group Operational Risk Committee (ORC) manages all operational risks and information security risks (including cyber risks). The ORC is responsible for the identification, assessment, management, monitoring and reporting of operational risks and information security risks (including cyber risks) of VP Bank Group.

The Group Credit Committee (GCC) is responsible for the management of credit risks. This includes in particular the handling of credit applications within the scope of delegated competences.

The Group Business Risk Committee (BRMC) proactively manages compliance risks, identifies primary risks, and ensures that risk-mitigating controls are implemented and adhered to.

The Group Reputational Risk Committee (GRRC) decides on client relationships which could represent a material reputational risk for VP Bank Group.

Group Treasury & Execution (GTR) bears the responsibility for the steering and management of financial risks within the objectives and limits laid down by the Board of Directors and Group Executive Management. This is done while also taking into account the Group’s risk-bearing capacity, as well as its compliance with statutory and regulatory provisions.

Group Credit Consulting (CRQ), as the first line of defence, is responsible for credit risk structuring and assessment of all credit applications at group level, as well as for the monitoring process of credit exposure on the individual loan level with regard to cover and limits. CRQ is represented by units in all Group locations. For non-standard credit applications, Group Credit Risk (CCC) carries out a review of the risk analysis, which was prepared by CRQ in the first instance. In addition, CRQ approves loans on its own authority or submits them to the corresponding competence centres for assessment.

The Chief Risk Officer (CRO) heads the risk management function. Within Group Executive Management, the CRO is responsible for independent risk monitoring of VP Bank Group and the individual subsidiary companies. The CRO assures compliance with the existing statutory, legal supervisory and internal bank provisions regarding risk management as well as the implementation of new risk management provisions.

Group Credit Risk (CCC) is the second line of defence, which is responsible for credit risk assessment of the largest individual credit risks of the Group. This concerns all credit exposures that go beyond CRQ’s own area of authority and trigger an additional credit assessment by the second line of defence on the basis of defined risk criteria. In addition, CCC is responsible for all material credit risk standards of VP Bank Group as well as their IT implementation. These include all guidelines, risk concepts, the lending methodology and the underlying lending parameters. Furthermore, CCC regularly prepares portfolio credit risk reports in close cooperation with Group Financial Risk (GFR) for the attention of Group Executive Management and of the Board of Directors. CRQ and CCC also initiate and support all development projects related to the credit business of VP Bank Group, including regulatory projects.

Group Financial Risk (GFR) is responsible for the independent monitoring of financial risks (market risks, non-traditional asset risks, liquidity risks and credit risks from a portfolio perspective) as the second line of defence. It is responsible for defining and assessing the risk methods and models for financial risks as well as reporting on such risks and monitoring the economic risk-bearing capacity.

Group Compliance & Operational Risk is responsible for the independent monitoring of operational and compliance risks as the second line of defence. In addition, it is responsible for the risk inventory and the related risk reporting.

Group Information Security (ISE) is responsible for the independent monitoring of cyber and information security risks as the second line of defence. Its responsibilities include establishing security guidelines, carrying out IT risk analyses, monitoring IT and cyber security incidents and risk reporting within its area of responsibility.

The responsible bodies are regularly informed by the CRO division about the risk situation, developments and compliance with limits through risk reporting.

Process monitoring / Group Internal Audit

Process to ensure risk-bearing capacity

The primary objective of the ICAAP and ILAAP is to comply with the regulatory requirements in order to assure continuation of the bank as a going concern. The risks of banking operations are to be borne by the available risk coverage potential. The components of the risk management process established at VP Bank for all material risks are explained below:

• Determination of the risk strategies: The risk strategies for each risk group (strategic and business risks, financial risk, operational and compliance risks) are derived from the business strategy of VP Bank and provide the framework conditions for risk management of the respective types of risk. The risk policy represents the basic framework for the individual risk strategies.
• Determining the risk coverage potential and setting the risk tolerance: In the risk-bearing capacity calculation, a distinction must be made between a regulatory and a value-oriented perspective. The findings from each of the two perspectives are used in turn to validate and supplement one another. With both perspectives, the identification of the risk-bearing capacity is based on consideration of appropriate risk buffers. On the basis of the risk-bearing capacity calculation, the Board of Directors determines the limits and objectives for a rolling risk horizon of one year. All significant risks and the available risk coverage potential are compared with each other (risk-bearing capacity).
• Risk identification (risk inventory): With the annual risk inventory to be undertaken as part of the review of the framework and risk strategies, it is ensured that all significant risks of the Group (quantifiable, not quantifiable or difficult to quantify) are identified. The analysis is carried out on a top-down and/or bottom-up basis using both quantitative and qualitative criteria. Significant risks are integrated fully into the risk management process and backed by risk capital. Insignificant risks are reviewed and monitored at least annually within the scope of the risk inventory. As part of the risk inventory, potential risk concentrations in all significant risk types are evaluated.
• Risk measurement: Eligible equity as well as the regulatory level of committed capital are relevant for the assessment of risk-bearing capacity from a regulatory viewpoint. From a value-oriented point of view, the risk-bearing capacity results from the net present value of equity after deducting operating costs, a buffer for other risks and the economic capital requirement. For the purpose of determining the economic capital requirement, all risk types of VP Bank which are classified as material as part of the annual risk inventory are taken into account and possible unexpected losses are considered. The economic risk assessment also includes risk types which are not covered by the regulatory capital-adequacy requirements for the bank. To determine the economically required capital, all significant risks are aggregated to form an overall assessment.
• Assessment of risk-bearing capacity: Risk-bearing capacity exists when the available risk coverage potential is greater than the risks taken at any time. In this process, early-warning stages permit a timely change of direction in order not to endanger the continuation of the bank as a going concern.
• Risk steering encompasses all measures on all organisational levels to actively influence the bank’s risks identified as being significant. In this respect, the objective is the optimisation of the risk return ratio within the limits and objectives set by the Board of Directors and Group Executive Management to ensure the risk-bearing capacity of the Group while also complying with statutory and legal supervisory provisions. Risk management is performed at strategic as well as operating levels. Based upon the juxtaposition of risks and limits on the one hand, as well as of regulatory and economically required capital and risk coverage potential on the other, countermeasures are taken in case of a negative variance.
• Independent risk monitoring (control and reporting to GEM and the Board of Directors): Risk steering is accompanied by comprehensive risk monitoring, which is functionally and organisationally independent of risk steering. Risk monitoring covers control and reporting. As part of the monitoring of financial risks, steering impulses can be derived from a routine target-to-actual comparison. The target is derived from the limits and objectives set, as well as from legal and supervisory-law provisions. For review of the extent to which limits are used (actual), early-warning stages are also deployed in order to take timely steering measures for any risks before they materialise.

As operational risks may arise as a result of internal control failures during current business activities, audits for key controls in relation to material risks are undertaken by the respective executive management in all organisational units of VP Bank.

From a risk-monitoring perspective, risk-based checks for compliance and operational risks are carried out on an ongoing basis by Group Compliance & Operational Risk, while the respective business units are responsible for management of compliance and operational risks.

Reputational risks can result from financial, operational, compliance, information security (including cyber) and ESG risks as well as from strategic and business risks. The strategic and business risks as well as any reputational risks are handled by Group Executive Management.

As part of reporting, results of monitoring are set forth in a regular, understandable and transparent manner. Reporting is made ex ante as an input for decisions and ex post for control purposes – in particular to analyse any deviation from budgeted values – as well as ad hoc in case of suddenly and unexpectedly materializing risks.

The process of ensuring the risk-bearing capacity of VP Bank Group is presented in the figure on the previous page.

The required qualitative and quantitative information on capital adequacy requirements, on the strategies and procedures for risk management and on the risk situation of VP Bank are set forth in the risk report and the commentary on the consolidated financial statements. Over and above this, VP Bank Group has drawn up a disclosure report for the 2024 financial year. On this basis, the bank fulfils the regulatory requirements of the Banking Ordinance (BankO) and the Banking Act (BankA) as well as the Capital Requirements Regulation (CRR) and the Capital Requirements Directive (CRD), which represent the implementation of the Basel III Accord currently in force in the European Union.

VP Bank computes its required equity in accordance with the provisions of the CRR. In this connection, the following approaches are applied:

• Standardised approach for credit risk under Part 3, Title II, Chapter 2 of the CRR
• Basic-indicator approach for operational risk under Part 3, Title III, Chapter 2 of the CRR
• Standardised procedure for market risk under Part 3, Title IV, Chapters 2 to 4 of the CRR
• Standard method for credit valuation adjustment (CVA) risks in accordance with Art. 384 CRR
• Comprehensive method for CRR risks to take account of financial collateral in accordance with Art. 223 CRR

In regard to strategy, business and reputational risk, no explicit regulatory capital adequacy requirements are stipulated in the CRR.

The following table shows the capital adequacy situation of the Group as of 31 December 2024.

Capital adequacy computation (Basel III)

While engaged in complying with the relevant statutory and regulatory provisions, the monitoring and management of financial risks is based on internal bank objectives and limits relating to volumes, sensitivities and risk metrics. Scenario analyses and stress tests also demonstrate the effect of events which can not or not sufficiently be taken into consideration within the scope of ordinary risk evaluation. In this respect, the Board of Directors sets strategic guard rails within which risk management is undertaken.

Group Executive Management is responsible for the implementation and observance of the risk strategy for financial risks as approved by the Board of Directors. At operational level, the identification, assessment and monitoring of all relevant risks is carried out by the CRO functions, which are independent of the risk management units. The risk management units are responsible for risk management and first-instance compliance with the targets and limits relevant to them.

Market risks

Market risks arise from taking positions in financial assets (debt instruments, equities and other securities), foreign currencies, precious metals and corresponding derivatives, as well as from client business, interbank business and from consolidated subsidiary companies whose functional currency is a foreign currency.

Interest rate risk is a significant component of market risk. It arises mainly due to divergent maturities between positions on the asset and liability sides of the balance sheet. The table on the maturity structure shows the assets and liabilities of VP Bank broken down into positions at sight, callable positions and positions with specific maturities (→ cf. note 35).

Asset and liability positions of VP Bank denominated in foreign currencies are of importance to determine the currency risk. An overview, analysed by currency, is to be found in note 34 (→ cf. balance sheet by currencies).

The bank employs a comprehensive set of methods and key figures for the monitoring and management of market risks. In this respect, the value-at-risk (VaR) approach has established itself as the standard method to measure market risk. The VaR for market risks quantifies the potential loss in market value of all market risk positions on the evaluation date, expressed in CHF. The value-at-risk is computed on a Group-wide basis with the aid of historic simulation. In this process, the historical movements in market data over a period of at least five years are used in order to evaluate all positions subject to market risk.

The projected loss refers to an investment horizon of 250 trading days and will not be exceeded with a probability of 99 per cent. The calculation of interest rate risk generally takes into account the contractual fixing period of interest-bearing positions. For non-maturing positions, an internal replication model is applied.

The market VaR (99 per cent / 250 days) of VP Bank Group as of 31 December 2024 amounted to CHF 118 million (previous year: CHF 135 million). In addition to interest rate, currency and equity risks, credit-spread risks of the bond portfolio are also recognised in market risk. During 2024, the market VaR fluctuated between CHF 105 million and CHF 126 million, which was mainly due to fluctuations in interest rate positioning. The observable contraction in the market VaR over 2024 was essentially determined by the interest rate risk, while other risk factors had no significant impact. There were no material changes in the credit-spread and equity risk factors.

The following table shows the VaR analysed by types of risk and the total market VaR.

Market value-at-risk (end-of-month values)

As the maximum losses arising from extreme market situations cannot be determined with the VaR approach, the market risk analysis is supplemented by stress tests that allow an assessment of the effects of extreme market fluctuations on the present value of equity and on net interest income. In this manner, the fluctuations in net present value of all balance sheet items and derivatives in the area of market risks are computed with the aid of sensitivity indicators based on simulated market movements (parallel shift, rotation or inclination of interest rate curves, exchange rate fluctuations by a multiple of their implicit volatility, slump in equity share prices). In addition, the development of interest income is simulated for selected market scenarios (rising interest rates, falling interest rates, falling exchange rates).

The following table exemplifies the results of the key rate duration. For this, first of all, the present values of all asset and liability items as well as derivative financial instruments are calculated. Then, the interest rates of the relevant interest rate curves are increased by 1 basis point and the resulting change of present value is scaled to 1 per cent (100 basis points) in each maturity band and per currency. The respective movements represent the gain or loss of the net present value resulting from the shift in the interest rate curve. Negative values point to an excess of assets, while positive values indicate an excess of liabilities over the relevant term.

Key rate duration profile per 100 basis points increase

The following table sets out the effects of a negative movement in the principal foreign currencies on group net income and shareholders’ equity. The implicit volatility as of 31 December 2024 and 31 December 2023 is responsible for the underlying fluctuation of the CHF against the EUR and the USD , respectively.

Movement in significant foreign currencies

The following table illustrates the impact of a possible downturn in equity markets of 10, 20 and 30 per cent, respectively, on group net income and equity capital.

Movement in relevant equity share markets

For risk management purposes, derivative financial instruments are entered into exclusively in the banking book and serve to hedge equity price, interest rate and currency risks as well as to manage the banking book. The risk policy defines the derivatives approved for this purpose.

VP Bank refinances its medium- and long-term client loans and its nostro positions in interest-bearing debt securities primarily with short-term client deposits and is therefore subject to an interest rate risk. Rising interest rates have an adverse impact on the net present value of fixed income business activities, and they also increase refinancing costs. As part of VP Bank’s asset and liability management, interest rate swaps measured at fair value are deployed to hedge this risk. VP Bank applies fair-value hedge accounting under IFRS in order to record the offsetting effect of changes in the value of the hedged item on the balance sheet. For this purpose, a portion of the underlying transactions (fixed interest loans) are linked to the hedging transactions (payer swaps) through hedging relationships. In the event of fair-value changes caused by interest rate changes, the carrying values of the underlying transactions concerned are adjusted and the gains/losses taken to income.

Fixed rate positions are transformed into variable interest rate positions through the conclusion of payer swaps, thus establishing a close economic relationship between the hedge item (loan) and the hedge instrument (swap). Therefore, the hedge ratio between the designated amount of the hedge item and the designated amount of the hedge instruments is one. A hedge relationship is efficient and/or effective whenever the movements in the value of the hedge item and the hedging transactions induced by interest rate changes offset each other. Ineffectiveness mainly results from variations in duration, such as those which arise from different maturities of transactions, interest payment dates or different interest rates.

The initial efficiency of a hedge relationship is proven by a prospective effectiveness test. For this purpose, future changes in the fair value of the hedge item and hedge instrument are simulated on the basis of scenarios and are subjected to a regression analysis. Effectiveness is assessed on the basis of the results of the analysis. Repeated reviews take place during the duration of the hedge relationship.

By entering into foreign exchange transactions, VP Bank has hedged its own financial investments against exchange rate fluctuations in the principal currencies. Currency risks from the client business generally may not arise, and currency positions that remain open are closed via the foreign exchange market. Group Treasury & Execution is responsible for the management of foreign currency risks from the client business.

Liquidity risks

Liquidity risks may arise through contractual mismatches between the inflows and outflows of liquidity in the individual maturity bands. Any differences arising demonstrate how much liquidity the bank must eventually procure in each maturity band in the event of an outflow of all volumes at the earliest possible time. Furthermore, there may be refinancing concentrations that are so significant that a withdrawal of the corresponding funds may cause liquidity problems.

Liquidity risks are monitored and managed using internal targets and limits for the interbank and lending business and other balance-sheet-related key figures – while also complying with statutory liquidity norms and provisions.

In view of the increasing number of securities investments by clients and the ongoing adjustment of the client portfolio (strategic withdrawal from the business with Russian clients and revision of client documents), the deposits side of the balance sheet declined in 2024. On the assets side, this resulted in a decline in liquid assets and securities holdings, and thus the liquidity figures. VP Bank retains a comfortable liquidity situation, with a liquidity coverage ratio (LCR) of 165 per cent and a net stable funding ratio (NSFR) of 144 per cent at the end of 2024.

The maturity structure of assets and liabilities is set out in note 35 . In the short-term band range, the bank refinances itself primarily through client deposits at sight as well as call and time deposits.

VP Bank can rapidly procure liquidity on a secured basis in case of need through its access to the Eurex repo market. The risk of an extraordinary, nevertheless plausible event with low probability can be measured using stress tests. In this manner, VP Bank can take all applicable remedial action on a timely basis and set limits where necessary.

Credit risks

Credit risks arise from all transactions for which payment obligations of third parties in favour of VP Bank exist or can arise. Credit risks accrue to VP Bank from client lending activities, the money market business including bank guarantees, correspondent and metals accounts, the reverse repo business, the bank’s own portfolio of securities, securities lending and borrowing, collateral management and OTC derivative trades.

Risk concentrations can arise through large exposures (cluster risks) or inadequate diversification of the loan or collateral portfolio. Such concentrations can constitute exposures from borrowers which are domiciled in the same countries or regions, are active in the same industry segment or possess the same collateral. Concentrations can lead to the creditworthiness of borrowers or the recoverability of collateral being impacted by the same economic, political or other factors. Risk concentrations are closely monitored by VP Bank as well as being controlled with corresponding limits and operational checks.

As of 31 December 2024, the total credit exposure excluding collateral amounted to CHF 9.3 billion (as of 31 December 2023: CHF 9.4 billion). The following table shows the composition of the balance-sheet and off-balance-sheet items.

Credit exposures

The increase in client loans of approximately CHF 474 million was mainly attributable to the mortgage business, although the lombard loan business also grew.  While the volume of unsecured loans was deliberately kept low, the volume of mortgage loans increased by around CHF 438 million. The volume of receivables from banks decreased compared to the previous year and amounted to CHF 851 billion at the end of 2024. Free liquid assets continue to be invested with banks with good credit ratings, predominantly cantonal and regional banks in Switzerland.

Receivables from clients are granted by default on a secured basis. This area primarily includes the mortgage business in Switzerland and Liechtenstein, the lombard loan business as well as a small number of special loans.

In the mortgage business, cover is primarily provided by residential, mixed or commercial properties in Switzerland and Liechtenstein. In Liechtenstein, the provisions of the Capital Requirements Regulation apply regarding guidelines and procedures for the valuation and management of mortgage collateral. Lombard loans are granted in exchange for the pledging of primarily liquid and diversified securities portfolios. In addition, life insurance policies can be used as collateral. Predefined minimum requirements apply to the issuers of the corresponding policies. Each issuer must be pre-approved.

The qualitative requirements for eligible collateral and permissible loan-to-value ratios are defined internally. In 2024, further methodological improvements for the quantitative derivation of loan-to-value ratios in margin lending transactions were developed and successfully introduced. Risk concentrations within the collateral are to be avoided through a prudent credit policy.

Within the scope of the client loan business, loans are granted on a regional and international basis to private and commercial clients. The focus remains on the private client business with a volume of CHF 3.7 billion of mortgage credits (31 December 2023: CHF 3.3 billion). From a regional perspective, VP Bank conducts the lion’s share of this business in the Principality of Liechtenstein and in the eastern part of Switzerland.

The ten largest single exposures encompass 12.5 per cent of total credit exposures (31 December 2023: 7.8 per cent).

The credit regulations, the framework directive and the Group Standard Credit form the binding framework for credit risk management of client loans. In addition to the general guidelines and framework conditions for the lending business, these also set out the decision-making powers and related ranges for the approval of loans (rules on powers of authority).

In principle, exposures in the private client loans business and in the commercial loans business must be covered by the loan-to-value of the collateral (collateral after haircut). Counterparty risks in the loan business are governed by limits which restrict the level of exposure depending on the creditworthiness, industry segment, collateral and risk domicile of the client. VP Bank uses an internal method for risk classification to assess creditworthiness. Deviations from credit-granting principles (exceptions to policy) are dealt with as part of the credit risk management process based on their individual risk assessment.

VP Bank enters into both secured and unsecured positions in the interbank business. Unsecured positions result from money market activities (including bank guarantees, correspondent and metals accounts), secured positions arising from reverse repo transactions, securities lending and borrowing, collateral management and OTC derivative transactions. Repo deposits are fully secured, and the collateral received serves as a reliable source of liquidity in a crisis situation. Hence, counterparty risk and liquidity risk are reduced with reverse repo transactions.

Counterparty risks in the interbank business may only be entered into in approved countries and with approved counterparties. Exposures to banks relate to institutions with a good credit rating (investment grade rating) and registered office in an OECD country. A comprehensive system of limits contains the level of exposure depending on the term, rating, risk domicile and collateral of the counterparty. In this regard, VP Bank relies on the rating of banks by the two rating agencies Standard & Poor’s and Moody’s. OTC derivative transactions may be concluded exclusively with counterparties with whom a netting agreement has been signed.

Credit risks are managed and monitored not only on an individual transaction level but also on a portfolio level. On the portfolio level, VP Bank uses expected and unexpected credit loss estimates to monitor and measure credit risk. The expected credit loss represents the average loss that can be expected within one year. Unexpected credit loss represents a scenario-based unexpected loss from a stressed loss framework that is the difference between the potential loss in a stressed scenario (stressed loss) and the loss to be expected in a normal market environment (expected loss) over one year. In particular, the stressed loss framework takes account of idiosyncratic credit risks. The unexpected loss is limited and monitored by a corresponding credit risk limit, both overall and per loan portfolio.

Credit derivatives (contract volume)

No proprietary trading transactions in credit derivatives were carried out in the past financial year.

Country risk

Country risks arise whenever political or economic conditions specific to a country impinge on the value of an exposure abroad. The monitoring and management of country risk is undertaken using volume limits which restrict the respective aggregate exposures per country rating (Standard & Poor’s and Moody’s). All receivables on the balance sheet are considered in this process; positions in the Principality of Liechtenstein and Switzerland do not fall under this country limit rule.

The risk domicile of an exposure is the basis for recognising country risk. With secured exposures, consideration is usually given to the country in which the collateral is located.

The following table shows the distribution of credit exposures by country rating. Non-rated country exposures are mostly exposures from local business activities (receivables secured by mortgage) of VP Bank (BVI) Ltd.

Country exposure by rating

IFRS 9 Impairment

The additional tables to be disclosed from IFRS 9 Impairment can be seen below.

Credit exposures by rating classes

Expected credit losses according to IFRS 9 Impairment

The following table shows the biggest changes in valuation adjustments by stage.

The following table provides disclosures on assets which were modified and at the same time have a stage 2 and 3 valuation adjustment.

While financial risks are deliberately assumed in order to earn income, operational risks should be avoided by suitable controls and measures or, if this is impossible, should be reduced to a level set by the bank.

There is a wide variety of causes for operational risks. People make mistakes, third parties fail to provide the agreed service, external risks affect the bank or business processes do not work. It is therefore necessary to determine the factors which trigger important risk events and their impact in order to avoid or at least contain them with suitable preventive measures.

The management of operational risks is understood at VP Bank to be an integral cross-divisional function which is to be implemented across all business units and processes on a uniform group-wide basis. The following methods are used:

• The internal control system of VP Bank encompasses all process-integrated and process-independent measures, functions and controls which assure the orderly conduct of business operations.
• Early-warning indicators are used to recognise potential losses in a timely manner and to ensure that enough time still remains for the planning and realisation of countermeasures.
• Significant loss occurrences are recorded systematically and are then evaluated centrally. The findings from the collection of loss data are integrated directly into the risk management process.
• Operational risks are assessed on a top-down and bottom-up basis within the framework of annual group-wide non-financial risk assessments. Based on these assessments, Group Executive Management decides how to deal with the identified risks and, if necessary, determines proactive risk-reducing measures.

The Group Operational Risk & Methodology unit, which is part of Group Compliance & Operational Risk, is responsible for the group-wide implementation, monitoring and further development of the methods and tools used to manage operational risks.

Each person in a management position is responsible for identification and evaluation of operational risks as well as for definition and performance of key controls and measures to contain risks.

Controls are periodically assessed for adequacy and effectiveness. The current operational risk situation is reported to the Executive Board and the Board of Directors on a quarterly basis.

Operational resilience and business continuity management (BCM) are a further important sub-area of operational risk management. Operational resilience refers to the ability of the institution to hedge its critical functions against potential attacks, failures and impairments and to be able to restore them in the event of interruptions. BCM essentially denotes a management method that ensures continuity of business activity under crisis conditions, or at any rate unforeseeable difficult conditions, with the help of a life cycle model. The objective of BCM is to systematically prepare for and test the management of extraordinary loss events, so that even in critical situations and emergencies, important processes are not interrupted or only temporarily interrupted and the economic existence of the business remains secure in spite of a loss event. For this purpose, the Board of Directors of VP Bank has clearly defined the duties, powers and responsibilities in connection with operational resilience and BCM.  The group-wide crisis organisation is an integral part of VP Bank and becomes operative as soon as a business-critical loss event occurs or a corresponding situation is threatened. The members of the crisis organisation are regularly trained.

Protection against cyber attacks remains a top priority for VP Bank. This protection is ensured by the bank’s use of modern IT systems and by employees who have been familiarised with the issue and trained accordingly. Information security requirements are set out in the bank’s corporate guidelines and are implemented by means of technical and organisational measures. VP Bank uses robust processes and sophisticated systems to protect data. Cyber threats are subject to continuous analysis, with appropriate defence measures taken depending on the risk involved. VP Bank ensures a high level of security by means of targeted vulnerability management and regular penetration tests.

Business risk on the one hand results from unexpected changes in market and underlying conditions with an adverse effect on profitability or equity. On the other hand, it indicates the danger of unexpected losses that may result from management decisions regarding the business policy orientation of the Group (strategic risk). Group Executive Management is responsible for managing business risk. Taking into account the banking environment and the internal corporate situation, this risk is analysed by Group Executive Management, top-risk scenarios are derived and appropriate measures are worked out, the implementation of which is entrusted to the responsible body or organisational unit (top-down process).

Compliance risk is understood to be breaches of statutory and regulatory provisions that can cause significant damage to VP Bank’s reputation or result in sanctions, fines or even in the bank’s licence being withdrawn. The compliance risk of VP Bank consists in particular in the possibility that VP Bank does not or does not sufficiently recognise financial crime compliance risks of its clients and counterparties – such as money laundering, financing of terrorism, violations of sanctions and embargoes, and fraud and corruption activities – and has not established appropriate surveillance and monitoring processes/measures for identification, management and limitation of cross-border compliance risks as well as tax and investment compliance risks.

All relevant compliance risks which are of significance for the business and service activities of VP Bank Group are recorded and assessed within the scope of a group-wide, annual non-financial risk assessment. In this regard, all relevant, risk-based compliance controls as well as processes and systems within the overall organisation of VP Bank Group are assessed in order to determine whether they are up to date, appropriate and effective. In this context, the risk-based compliance controls must be proportionate to the respective risk, the management effort and the intended control objectives. VP Bank Group also ensures through regular compliance training that all employees of VP Bank Group are familiar with and adhere to the relevant compliance regulations.

ESG risks and climate-related financial risks (hereinafter “ESG risks”) represent the risk of adverse economic impacts on VP Bank that may arise from environmental, social and governance factors. VP Bank does not view ESG risks as an independent risk category but rather as a risk driver that can manifest itself in other risk groups or risk categories. The inclusion of ESG risks in the risk taxonomy and in the risk management process reflects the increasing importance of sustainability in the financial sector. VP Bank records, evaluates and takes into account ESG risks in its business activities as well as in the assessment of its counterparties and client relationships.

VP Bank has set itself the goal of aligning its material loan portfolios and investment portfolios on the balance sheet with net-zero emissions by 2050. In addition, VP Bank expects business partners to comply with at least three internationally recognised standards, namely the “UN Global Compact”, the “United Nations Guiding Principles for Business and Human Rights” and the “International Labour Organisation (ILO) Standards”.

Reputational risk represents the risk of negative economic effects that could arise as a result of damage to the public image or reputation of VP Bank. Strategic and business risks, operational and compliance risks, financial risks as well as ESG risks can lead to reputational risks and weaken the confidence of employees, clients, shareholders, regulators or the public in general in the bank.

This may result in asset losses or a decline in earnings, for instance due to deteriorating or terminated client relationships, rating downgrades, higher refinancing costs or more difficult access to the interbank market.

Reputational risks are monitored by Group Executive Management.