Group’s risk profile

The overall risk of the banking sector entities, taking into account PZU’s shares in both banks, accounts for approximately 33% of the PZU Group’s total risk (Q3 2022), while the largest contribution is in credit risk.

In 2022, moderate increase in risk was recorded in some areas, in particular capital adequacy and regulatory risk, credit risk and interest rate risk. The 2022 interest rate increase reflected negatively on the level of solvency ratios as valuations of debt securities dropped; however, it is yet to translate into material deterioration of credit quality of PZU Group’s bank portfolio. In 2022, there was a moderate increase in credits costs, which stems from a significant rise of the NBP reference rate due to higher inflation and slower economic growth. Furthermore, the KNF (the Polish Financial Supervision Authority) issued its recommendations on higher requirements applied to examine the client’s creditworthiness, consequently limiting sales. Also, banks were burdened with additional regulatory fees (introduction of credit holiday, additional premium for the Borrower Support Fund, premium for the Commercial Bank Protection System) and increased reserves on account of a growing number of lawsuits and settlements pertaining to Swiss franc loans. These factors have a negative impact on financial results of banks, and in the long term may limit the capital base and business development in the future.

According to the European Commission guidance for nonfinancial reporting, transition risks refer to the transition of the economy to a low-carbon and climate-resilient future. Physical risk on the other hand entails financial losses stemming from the physical consequences of climate change and encompasses acute (e.g. storms, fires) and long-term risk (rising sea level).

The management process for managing various risk categories comprises requirements of sustainable development, and the same applies at the level of each PZU Group subsidiary, in compliance with prevailing provisions of law and individually defined PZU Group internal policies, including the ESG Strategy which constitutes an integral part of the PZU Group Strategy.

Risk identification commences with a proposal to develop an insurance product and continues until the expiry of the related liabilities. The identification of actuarial risk is performed, among others, as follows:

The assessment of actuarial risk consists in the identification of the degree of the risk or a group of risks that may lead to a loss, and in an analysis of risk elements in order to make an underwriting decision.

The monitoring and control of actuarial risk includes a risk level analysis by means of a set of reports on selected ratios.

Reporting aims to ensure effective communication regarding actuarial risk and supports management of actuarial risk at various decision-making levels – from an employee to the supervisory board. The frequency of each report and the scope of information provided therein are tailored to the needs at each decision-making level.

Moreover, mitigation of the actuarial risk inherent in current operations is supported by:

• defining the scopes of liability in the general / specific terms and conditions of insurance or other model agreements;
• co-insurance and reinsurance;
• application of an adequate tariff policy;
• application of the appropriate methodology for calculating technical provisions;
• application of an appropriate procedure to assess underwriting risk;
• application of a correct claims or benefits handling procedure;
• sales decisions and plans;
• prevention.

The risk management process for the credit spread and concentration risk has a different set of traits from the process of managing the other sub-categories of market risk and has been described in a subsequent section (credit risk and concentration risk) along with the process for managing counterparty insolvency risk.

The market risk in the PZU Group originates from three major sources:

• operations associated with asset and liability matching (ALM portfolio);
• operations associated with active allocation, i.e. designating the optimum medium-term asset structure (AA portfolios);
• banking operations – in conjunction with them the PZU Group has a material exposure to interest rate risk.

Market risk identification consists in the identification of actual and potential sources of this type of risk. For assets, the identification of risk begins with the decision to commence transactions in a given type of financial instrument. Units that make a decision to start entering into such transactions draw up a description of the instrument containing, in particular, a description of the risk factors. They convey this description to the unit responsible for risk that identifies and assesses market risk on that basis.

The identification of market risk associated with insurance liabilities commences with the process of developing an insurance product. It involves identification of the relationship between the cash flows generated by that product and the relevant market risk factors. The identified market risks are subject to assessment using the criterion of materiality, specifying whether the materialization of risk entail a loss capable of affecting the financial condition.

Market risk is measured using the following risk measures:

• VaR, or value at risk, a measure quantifying the potential economic loss that will not be exceeded within a period of one year under normal conditions, with a probability of 99.5%;
• standard formula;
• exposure and sensitivity measures;
• accumulated monthly loss.

Monitoring and control of market risk involves an analysis of the level of risk and of the utilization of the designated limits.

Reporting involves communicating to the various decisionmaking levels information concerning the level of market risk and the results of monitoring and controlling it. The frequency of each report and the scope of information provided therein are tailored to the information needs at each decision-making level.

The application of limits is the primary management tool to maintain a risk position within the acceptable level of risk tolerance. The structure of limits for the various categories of market risk and also for the various organizational units is established by appointed committees in such a manner that the limits are consistent with risk tolerance as agreed by the management boards of the subsidiaries. Banking sector entities are in this respect subject to additional requirements in the form of sector regulations. The existing interest rate volatility may impact the level of solvency ratios through decreasing valuations of debt securities in portfolios of the PZU Group entities. An increase in interest rates and turmoil in financial markets brought about by the Russia-Ukraine war resulted in higher use of market risk limits in banks. However, this still remains at a safe level.

Changes in financial markets also pertain to PZU and PZU Życie portfolios. Nonetheless, most portfolios are HTM in accounting terms and therefore these changes do not affect their value and profitability.

Changes in macroeconomic conditions which took place in 2022 affected capital requirements levels. Throughout three quarters of 2022, the value of capital requirements related to market risk of the PZU Group increased by 5%, which was largely due to an increase in interest rate risk. No risk of exceeding the risk appetite was recorded, and solvency ratios in both companies prove their strong capital position.

Considering the market changes, the insurance market is subject to additional stress tests imposed by the regulatory authority.

Risk assessment and measurement involve estimation of the shortage of cash to pay for liabilities. The risk estimate and measurement is carried out from the following perspectives:

To manage the liquidity of the banks in the PZU Group, liquidity ratios are used for different periods ranging from 7 days, to a month, to 12 months and to above 12 months.

Within management of liquidity risk, banks in the PZU Group also analyze the maturity profile over a longer term, depending to a large extent on the adopted assumptions about development of future cash flows connected with items of assets and equity and liabilities.

Monitoring and controlling financial liquidity risk involves analyzing the utilization of the defined limits.

In the first half of 2022, the banking sector, including banks of the PZU Group, faced decreasing liquidity. It mostly resulted from continued increase in profitability of fixed coupon securities leading to decreased value of banks’ portfolios of debt securities which constitute liquidity reserve. Additionally, the decreased liquidity was also caused by the decision of the Monetary Policy Council (MPC) on increasing the reserve requirement since the end of March 2022.

The outbreak of the Russia-Ukraine war first increased cash withdrawals in ATMs and bank branches, thereby it was necessary to introduce daily limits, especially regarding foreign currencies. However, this situation quickly calmed down and stabilized.

In the second half of 2022, PZU Group banks recorded improved liquidity ratios. Increase in liquidity measures largely resulted from higher volume of term deposits while simultaneously decreasing dynamics of loans granted, and improving assessment of derivative and debt instruments.

In the second half f 2022, liquidity ratios of both banks stabilized, and remain at high and safe levels.

The current conditions did not have a material impact on liquidity risk of PZU Group’s insurance business in 2022. This liquidity was maintained at a safe level, and there were no grounds to take extraordinary management actions in terms of liquidity risk. As part of routine management actions regarding liquidity risk, the PZU Group constantly monitored the level of available liquid funds and the current utilization of liquidity limits.

Liquidity risk reporting involves communicating the level of financial liquidity to various decision-making levels. The frequency of each report and the scope of information provided therein are tailored to the information needs at each decision-making level.

Concentration risk is understood as the possibility of incurring loss stemming either from lack of diversification in the asset portfolio or from large exposure to default risk by a single issuer of securities or a group of related issuers.

Credit risk and concentration risk are identified at the stage of making a decision on an investment in a new type of financial instrument or on accepting credit exposure. It involves an analysis of whether the contemplated investment entails credit risk or concentration risk, what its level depends on and what its volatility over time is. Actual and potential sources of credit risk and concentration risk are identified.

Risk assessment consists of estimating the probability of risk materialization and the potential impact exerted by risk materialization on a given entity’s financial standing.

Concentration risk for a single entity is calculated using the standard formula.

A measure of total concentration risk is the sum of concentration risks for all entities treated separately.

In the case of related parties, concentration risk is calculated for all related parties jointly. In the case of banking entities suitable measures are employed in accordance with the regulations applicable to this sector and best market practices. Credit risk is measured using a set of loan portfolio quality metrics.

The structure of credit risk limits and concentration risk limits for various issuers is established by appointed committees in such a manner that the limits are consistent with the adopted risk tolerance determined by the management boards of the respective subsidiaries and in such a manner that they make it possible to minimize the risk of ‘infection’ between concentrated exposures.

In banking activity the provision of credit products is accomplished in accordance with loan granting methodologies appropriate for a given client segment and type of product. The assessment of a client’s creditworthiness preceding a credit decision is performed using tools devised to support the credit process, including a scoring or rating system, external information and the internal databases of a given PZU Group bank. Credit products are granted in accordance with the binding operational procedures stating the relevant actions performed in the lending process, the units responsible for that and the tools used.

To minimize credit risk, adequate collateral is established in line with the credit risk incurred. The establishment of a security interest does not waive the requirement to examine the client’s creditworthiness.

Nonetheless, a moderate increase in credit risk costs was observed, caused by economic downturn.

A significant increase in inflation and interest rates of 2022 translated into a material increase in credit instalments for variable interest rate credits. Thus far, this has not materially deteriorated quality of credit portfolios of PZU Group banks. The problems that a borrower may have faced in 2022 were effectively mitigated by implementing measures of public aid in terms of changes in the Borrower Support Fund and payment moratoria – the so-called credit holiday.

The outbreak of the Russian–Ukrainian war did not directly cause the worsening value of credit portfolios. Banks identified exposures to clients at high risk that are either direct (stemming from operations conducted in Ukraine, Russia or Belarus, holding assets there and business ties in terms of deliveries or sales) or indirect (i.e. high share of imports or exports, high number of Ukrainian employees). The exposures were covered by closed monitoring, however, the risk has not yet materialized to a significant degree. Banks introduced special guidelines to limit financing for entities exposed to the risk of armed conflict by, among others, disallowing stronger involvement, necessity to replenish the loan collateral to 100% of the debt collection value, deciding not to process applications in line with simplified terms excluding risk.

However, as the economic situation continues to worsen in 2023 and it is possible that the conflict in Ukraine may escalate further, it is expected that the credit portfolio will deteriorate.

Monitoring and control of operational risk is supported mainly by an established system of operational risk indicators and limits enabling assessment of changes in the level of operational risk over time and assessment of factors that affect the level of this risk in the business.

Reporting involves communicating to the various decisionmaking levels information concerning the level of operational risk and the results of monitoring and controlling it. The frequency of each report and the scope of information provided therein are tailored to the information needs at each decision-making level.

Management actions involving reactions to any identified and assessed operational risks involve primarily:

• taking actions aimed at minimizing risks, for instance by strengthening the internal control system;
• risk transfer – in particular, by entering into insurance agreements;
• risk avoidance by refraining from undertaking or withdrawing from a particular type of business in cases where too high a level of operational risk is ascertained and where the costs involved in risk mitigation are unreasonable;
• risk acceptance – approval of consequences of a possible realization of operational risk unless they threaten to exceed the operational risk tolerance level.

On 28 January 2022, PZU and PZU Życie established the Crisis Management Team in the light of the attack by the armed forces of the Russian Federation on Ukraine. The announced Crisis Situation means that there is ongoing monitoring of the current political and market situation, and adequate measures are introduced to ensure, in particular:

• safety of employees;
• business continuity of the companies and security of financial assets of the PZU Group;
• additional safety measures in terms of cybersecurity and physical safety

PZU introduced a comprehensive care program addressed to employees of PZU Ukraine and their families evacuated to Poland. It provides, among others, accommodation, food, financial support, medical and legal aid, and professional activation plans.

The task unit of the Crisis Management Team continuously monitors the situation of Ukrainian companies, also in terms of reaching the assumptions of the “Crisis Situation Management Plan”, as prepared by Ukrainian companies.

Many charity initiatives addressed to Ukraine and its nationals are underway, taken individually or in cooperation with state administrative bodies and PZU Group entities, in particular with PZU Zdrowie and the PZU Foundation.

Additional cybersafety measures were introduced to mitigate risk with increasing probability of materialization. Anomalies in terms of cyber threats, extending to subsidiaries, are under continuous 24/7 monitoring. Due to the nationwide implementation of CRP Alert Level 3 (CHARLIE-CRP) and Alert Level 2 (BRAVO), a heightened state of readiness of the physical and cyber security areas has been maintained continuously since February 2022.

The Crisis Management Team also remains on standby to address the epidemic emergency.

Model risk, classified by the PZU Group as significant, is defined as the risk of incurring financial losses, incorrectly estimating data reported to the regulatory authority, taking incorrect decision or losing reputation as a result of errors in the development, implementation or application of models.

The model risk management process involves:

• risk identification, which takes place through regular identification of the models used in the areas covered by the process; identified models are assessed for materiality;
• risk measurement, which is based on the results of independent model validations and monitoring;
• risk monitoring, which involves ongoing analysis of deviations from the adopted points of reference regarding the model risk (e.g. verification of the recommendation execution method and comparison of the risk level to the adopted tolerance level);
• risk reporting, which involves communicating the process results on the appropriate management level, in particular results of risk monitoring, validation and measurement;
• management actions, which aim to mitigate the model risk level; they can be active (e.g. recommendations resulting from completed validations) and passive (developing model and model risk management standards).

The compliance risk understood as the risk that the PZU Group may infringe on the law, internal regulations and adopted standards of conduct, including ethical standards, which results or may result in:

• being subject to legal sanctions;
• incurring financial loss;
• or loss of reputation or credibility

PZU makes efforts aimed at ensuring adequate and uniform standards of compliance solutions in all subsidiaries and monitors compliance risk throughout the entire Group.

In 2022 the compliance systems of PZU Group entities were aligned with the standards set by PZU. The provision of full information on compliance risk in Group companies is the responsibility of their compliance units. They are required to assess and measure compliance risk, undertake and implement appropriate remedial actions, which reduce the likelihood of realization of this risk.

PZU Group entities are obligated to provide ongoing information on compliance risk to the PZU Compliance Department. The Compliance Department analyses and processes information received from PZU Group entities, in particular to:

• assess compliance risk at the level of the PZU Group and execute the compliance function in the PZU Group;
• prepare reports and management information regarding the efficiency and adequacy of the compliance function in the PZU Group, and submit them to the Management Board and the Supervisory Board of PZU;
• prepare and develop uniform standards pertaining to the functioning of the effective internal control system in the PZU Group entities;
• prepare, develop and promote common training and information standards.

Compliance risk includes, in particular, the risk that the operations performed by PZU Group entities will be out of line with the changing legal environment. This risk may materialize as a result of delayed implementation or absence of clear and unambiguous laws, or what is known as a legal gap. This may cause irregularities in the PZU Group’s business and, as a result, lead to higher costs (for instance, administrative penalties, other financial penalties) and a heightened level of loss of reputation risk.

Due to the broad spectrum of the PZU Group’s business, reputation risk is also affected by the risk of litigation is predominantly inherent in the Group’s insurance companies and banks.

The identification and assessment of compliance risk for each internal process in PZU Group entities is the responsibility of the heads of organizational units, in accordance with the allocation of responsibility for reporting. Moreover, compliance units in PZU Group entities identify compliance risk on the basis of notifications to the register of conflicts of interest, gifts and irregularities, and from inquiries sent to them.

Compliance risk is assessed and measured by calculating the effects of risk materialization of the following types:

• financial risks, resulting among others from the possibility of imposing administrative penalties, court judgments, decisions issued by UOKiK, contractual penalties and damages,
• intangible risks pertaining to a loss of reputation, including damage to the PZU Group’s image and brand.

As part of efforts aimed at reducing compliance risk in the PZU Group at system level and day-to-day level, the following risk mitigation actions are undertaken:

Moreover, in 2021, PZU Życie implemented the necessary measures that ensured adaptation to the product intervention (KNF’s decision of 15 July 2021 prohibiting the marketing, distribution and sale of investment products – life insurance agreements if they feature unit-linked funds). The offer, modified in January 2022, included solely and exclusively products that met all the criteria set forth in the decision issued by the regulatory authority.

Supplementary supervision protects the financial stability of lending institutions, insurance undertakings, reinsurance undertakings and investment firms being members of financial conglomerates. The supervision is exercised, among others, through measuring the risk concentration level in the financial conglomerate as a whole, also from the perspective of regulated entities being its members.

Risk concentration is measured and monitored, in particular, in the following dimensions:

• concentration per counterparty or group of counterparties;
• concentration per currency;
• concentration per sector of economy;
• concentration per country;
• concentration per asset type.