1. Overview

Effective capital, liquidity and risk management is an elementary prerequisite for the success and stability of a bank. VP Bank understands this to mean the systematic process of identifying, evaluating, managing and monitoring relevant risks as well as the steering of capital resources and liquidity necessary to assume risks and to guarantee risk-bearing capacity. The binding framework for action in this context is provided by the regulations defined by the Board of Directors of VP Bank Group, consisting of the risk appetite statement, risk policy and risk strategies.

The risk appetite statement defines the overall risk tolerance along the risk taxonomy, forming the basis for operationalising limits and targets in the risk policy. As an overall framework, the risk policy, together with the risk strategies per risk group (strategic and business risks, financial risks as well as non-financial risks), regulates the specific objectives and principles, organisational structures and processes, methods and tools of risk management.

In Liechtenstein, the regulatory requirements governing risk management are set out primarily in the Banking Act (BankA) and the Banking Ordinance (BankO). In addition, the Capital Requirements Regulation (CRR) together with the Capital Requirements Directive (CRD) apply in Liechtenstein. In Liechtenstein, the CRD was enacted in the BankA and in the BankO. VP Bank was classified as a locally systemically relevant banking institution by the Financial Market Authority Liechtenstein and must hold in aggregate capital amounting to at least 12.5 per cent of its risk-weighted assets. Thanks to its solid capital basis, balance sheet structure and comfortable liquidity position, VP Bank constantly outperformed the minimum regulatory requirements over the course of 2024.

Capital and balance sheet structure management

The minimum capital ratio of VP Bank of 12.5 per cent of risk-weighted assets consists of the regulatory minimum requirement of 8 per cent, a capital conservation buffer of 2.5 per cent and a buffer for other system-relevant banks of 2 per cent. Basel IV also provides for an anti-cyclical capital buffer that was set at 0 per cent for 2025 by the Financial Market Authority Liechtenstein.

VP Bank complied with the minimum capital requirements for 2025 at all times. Thanks to an exceedingly robust tier 1 ratio of 26.1 per cent as of the end of 2025, it continues to guarantee sufficient room for manoeuvre. This enables VP Bank to continue to assume risks associated with the conduct of banking operations.

As of the end of 2025, the leverage ratio of VP Bank was 10.4 per cent. VP Bank has published further information as to the leverage ratio in the disclosure report.

Capital and balance sheet structure management involves ongoing monitoring of compliance with regulatory requirements and coverage of business requirements. As part of the internal processes for assessing adequate capital and liquidity (Internal Capital Adequacy Assessment Process (ICAAP) and Internal Liquidity Adequacy Assessment Process (ILAAP)), potential negative effects on the capital and liquidity base in stress situations are simulated and analysed. The Financial Market Authority imposes specific requirements on internal strategies and procedures for determining, managing and monitoring capital risks through the ICAAP, which are collected and assessed annually by the Liechtenstein Financial Market Authority using an ICAAP questionnaire.

Liquidity risk management

Liquidity risks are monitored and managed in accordance with the statutory liquidity standards and regulations of the Banking Ordinance, CRR and CRD, as well as internal guidelines and limits for interbank and credit business. The maintenance of liquidity within the VP Bank Group at all times is a top priority and is ensured by a high level of cash and cash equivalents and highly liquid assets (high quality liquid assets, HQLA). VP Bank complied with the minimum liquidity requirements for 2025 at all times.

In this context, compliance with the liquidity coverage ratio (LCR) of 100 per cent is required by law, which was clearly exceeded with a value of 180 per cent. The requirement for the net stable funding ratio (NSFR) of 100 per cent was also met and significantly exceeded at 154 per cent at the end of 2025.

With the ILAAP, the Financial Market Authority imposes specific requirements regarding internal strategies and procedures for determining, managing and monitoring liquidity risks, which are collected and assessed annually by the Liechtenstein Financial Market Authority using an ILAAP questionnaire.

As part of its liquidity management, VP Bank has a liquidity contingency plan in place to ensure that it has sufficient liquidity even in the event of a liquidity crisis. Regular monitoring of early warning indicators allows any deterioration in the liquidity situation to be identified at an early stage.

As part of liquidity management, compliance with regulatory requirements and the coverage of business needs are monitored on an ongoing basis. Stress tests are used to simulate possible negative scenarios and analyse the impact on liquidity in stress situations.

Credit risk

The management and monitoring of credit risk plays a key role, particularly given the importance of client lending (CHF 5.9 billion as at 31 December 2025, or 55 per cent of total assets). In addition to lending, VP Bank is also exposed to credit risks arising from securities held for liquidity purposes in the banking book (predominantly high-quality liquid assets) and from interbank investments with banks with good credit ratings.

Credit risk management in the client lending business is governed by the credit regulations. The volume of client loans decreased by approximately CHF 15 million in 2025.

At CHF 747 million, the volume of claims against banks is approximately CHF 104 million lower than in the previous year. To strengthen interest income, free liquid funds continue to be invested with banks with good credit ratings, predominantly Swiss cantonal and regional banks.

The securities portfolio consists mainly of investment-grade securities and had a nominal value of approximately CHF 2.0 billion as of 31 December 2025. Detailed guidelines (including volume and risk limits, duration ranges) for the management of securities have been established in the risk management process.

Market risk

Market risk comprises interest rate, credit spread, currency and share price risks. Due to the significance of the interest-bearing business, the management and monitoring of market risk across the entire balance sheet is of particular importance. In 2025, the trend of falling key interest rates continued, albeit not to the same extent as in the previous year. As a result, market interest rates at the short end fell. In the CHF and EUR currencies, the initially inverted yield curves, where long-term interest rates are below short-term interest rates, normalised. The interest rate level in CHF reached zero. Exchange rates fluctuated significantly over the course of the year, with a downward trend against the CHF; the USD in particular lost over 12 per cent.

Operational risk

VP Bank defines operational risk as potential losses or loss of profit that may occur as a consequence of the inappropriateness or failure of internal processes, individuals or systems or as a result of external events. Possible risk scenarios are identified, described and assessed using top-down and bottom-up risk assessments. The identified risks are limited or mitigated by controls as specified in the risk appetite. The controls are an integral part of the business processes and are documented in the internal control system. Controls are periodically assessed for adequacy and effectiveness. The current non-financial risk situation is reported to the Executive Board and the Board of Directors on a quarterly basis.

The geopolitical situation continues to have a major impact on the assessment of risks arising from sanctions and embargoes. Accordingly, processes for the early detection and prevention of potential compliance violations have been further improved. At the same time, it is assumed that regulatory density in the financial sector will continue to increase.

On 17 January 2025, the requirements of Regulation (EU) 2022/2554 on digital operational resilience in the financial sector (DORA) came into force with the aim of strengthening the digital resilience of financial service providers and ensuring the stability of the financial system. It thus sets new standards for the protection of critical IT systems and the management of cyber attacks in the financial sector. On this basis, tests to review digital operational resilience were carried out for the first time in 2025 as an extension of the existing business continuity tests.

VP Bank has taken measures to further improve IT risk management, IT processes, cyber resilience and the monitoring of external service providers.

Increasing dependence on external service providers and the growing complexity of supply chains are increasing operational risk. By optimising our third-party management, we have strengthened our resilience to default risks, cyber threats and compliance violations.

In this way, VP Bank protects its clients and their assets, the security of its services and the stability of its business processes in the long term.

Further risks

In addition to the risks mentioned above, VP Bank Group's risk management also covers strategy and business risks, compliance risks, ESG risks and climate-related financial risks, as well as reputational risk. Based on VP Bank's business model and range of services, these risks are systematically analysed and continuously assessed.