2.1. Principle 1—Capital Adequacy

A Bank must have capital, of adequate amount and appropriate quality, for the nature, scale and complexity of its business and for its risk profile. A Bank must have appropriate risk management strategies that have been approved by the Bank's Governing Body. The Governing Body of the Bank must set its risk appetite to define the level of risk the Bank is willing to assume.

2.2. Principle 2—Credit Risk and Problem Assets

(1) A Bank must have an adequate Credit Risk management policy that takes into account the Bank’s risk tolerance, its risk profile and the market and macroeconomic conditions. This policy must identify, measure, evaluate, monitor, report and control or mitigate Credit Risk in a timely way.

(2) A Bank must have adequate policies for the early identification and management of problem assets, and the maintenance of adequate provisions and reserves.

2.3. Principle 3—Transactions with Related Parties

A Bank must enter into transactions with related parties on an arm’s-length basis to avoid conflicts of interest.

2.4. Principle 4—Concentration Risk

A Bank must have adequate policies to identify, measure, evaluate, manage and control or mitigate concentrations of risk in a timely way.

2.5. Principle 5—Market Risk

A Bank must have an adequate Market Risk management policy that takes into account the firm’s risk tolerance, its risk profile, the market and macroeconomic conditions and the risk of a significant deterioration in market liquidity. This policy must identify, measure, evaluate, manage and control or mitigate Market Risk in a timely way.

2.6. Principle 6—Operational Risk

A Bank must have an adequate operational risk management policy that takes into account the firm’s risk tolerance, its risk profile and market and macroeconomic conditions. This policy must identify, measure, evaluate, manage and control or mitigate operational risk in a timely way.

2.7. Principle 7— Interest Rate Risk in the Banking Book

A Bank must have an adequate management policy for Interest Rate Risk in the Banking Book that takes into account the firm’s risk tolerance, its risk profile and the market and macroeconomic conditions. This policy must identify, measure, evaluate, manage and control or mitigate interest rate risk in the Banking Book in a timely way.

2.8. Principle 8—Liquidity Risk

A Bank must have prudent and appropriate quantitative and qualitative liquidity requirements. A Bank must also have adequate policies to identify, measure, evaluate, manage and control or mitigate Liquidity Risk in a timely way.

2.9. Principle 9—Group Risk

A Bank must effectively manage risks arising from its membership in a group.