The Derivatives Business: Focus on Financial Risk and Control Systems

1. The Derivatives Business:Focus on Financial Risk and Control Systems  MILAN, 30 JUNE 2004

2. Key Facts • COMPANY PROFILE (December 2003) • Conceived in 1998, formally spun off in 2000 • 569 employees, average age 35 • S&P Rating: AA- • Total Assets: EUR 47b • Gross Revenues: EUR 770m • Net income: EUR 340m • Average daily VaR: EUR 4.4m • Cost/Income: 24% • ROE: 61% • Net revenues/employee: EUR 598k • SOME TRADING BOOK STATISTICS • Derivatives portfolio’s outstanding notional > € 1,000b • Outstanding trades > 200,000 • Total risk factors > 40,000 • Total web transactions on capital guaranteed products > 500,000 • Number of daily trade revaluations > 15m

3. Executive Summary • Over 80% of UBM’s gross revenues are generated from Financial Products – sales & trading (FP) • FP includes institutional and corporate derivatives as well as fixed income and equity trading • Over 85% of FP’s gross revenues are generated from derivatives • In total approximately 75% of UBM’s gross revenues are generated from derivatives • The purpose of this presentation is to illustrate the risk management framework behind this activity • Four main risk classes are analysed: • Market risk • Model risk • Counterparty risk • Operational risk

4. Financial Products - sales and trading • From the beginning of operations, market risk management has been a distinctive element in UBM • Derivative products are traded on all asset classes • Ability to address a broad segment of corporate and institutional customers with innovative financial products • Core skills in pricing, hedging and trading • Products are unbundled into elementary risk components by proprietary pricing models and hedged through wholesale markets • Limited back-to-back trading • Industrial approach: large volumes, high throughput, efficient time-to-market • UBM transforms derivatives risks into market, model, counterparty and operational risks

5. The Risk Management Stages DERIVATIVE PRODUCT OPERATIONAL RISK MARKET RISK MODEL RISK COUNTERPARTY RISK CTPY1 CLIENT1 UBM CTPY2 CLIENT2 CTPY3 CLIENTn CTPYm SALES RISK MANAGEMENT TRADING

6. Market Risk: daily Value-at-Risk … Value-at-Risk (VaR) • UBM’s portfolio affected by more than 40,000 risk factors • VaR calculated daily through a proprietary VaR engine via historical simulation • VaR parameters: 99% double-tail confidence level, 1-day holding period, daily update of time series • VaR model has been validated by Italian regulators for capital requirement purposes • UBM daily VaR limit is €7m, against a one-year average of €4.4m (max €6.6m) • Daily back-testing against “clean” P&L series

7. … and daily Stress and Crash Tests • Stress Tests • A total of 8 stress scenarios are evaluated and the worst outcome is selected • Stress test (as of 14 May 2004): €14.8m Crash Tests • A total of 8 crash scenarios are evaluated and the worst outcome is selected • The last scenario is calculated as a combination of the the worst event for each asset class • Credit spread scenarios have been obtain using telecom industry and South America as benchmarks • Crash test (as of 14 may 2004): €13.7m STRESS CRASH

8. 25% 24% 23% 22% 21% 20% 19% 18% 17% 16% 15% 14% 13% 12% 11% 1 10% 3 5 3.0% 3.5% 4.0% 7 4.5% Maturity 4.8% 9 5.0% 5.5% 6.0% 12 7.0% 8.0% Strike 9.0% 10.0% Model Risk • Team of dedicated professionals developing and implementing pricing models for exotic derivatives • Implementation and maintenance of a large, high-throughput risk management system • Over 200 proprietary pricing models deployed • Dedicated Model Testing team based in London • Front-office booking system with over 200,000 trades • Proprietary technology for capital guaranteed products with more than 500,000 web-based transactions executed, with real time tracking and stress tests • Ubiquitous computing: Enterprise-wide Parallel Processing (over 500 CPUs) • Skew/smile proprietary pricing models based on stochastic volatility The structure Some examples Market Surface TCP TCP, FTP

9. Counterparty Risk • Measuring Counterparty Risk • Derivative portfolio size > €1,000b • Market risks are hedged through OTC trades with other market counterparties • Traditionally counterparty risk has been monitored using fixed coefficients • Need to quantify the effective cost of substitution • The cost of substitution is the value of each trade increased by the potential variation that may occur • Estimate the cost of substitution as the marked-to-market valuation plus a simple add-on • Method’s advantages • Quantifies more accurately the effective counterparty risk • Uses standard product control techniques • Can be used with risk mitigation tools such as close-out netting and collateral agreements • When using netting, portfolio diversification is captured • Dynamic methodology in line with market variations • More in line with market practice and central bank models • Can bring in market risk techniques (substitution of the simple add-on with VaR)

10. Counterparty Risk – an example 2,000 1,500 1,000 Exposure (€/m) 500 - -500 13/02/03 20/02/03 27/02/03 06/03/03 13/03/03 20/03/03 27/03/03 03/04/03 10/04/03 17/04/03 24/04/03 01/05/03 08/05/03 15/05/03 22/05/03 29/05/03 05/06/03 12/06/03 Date Counterparty risk : a practical example Monitoring and analysis of historical data • All counterparty information is stored in a database • Marked-to-market valuations are available at individual deal level • Simple add-on is compared with realized 10-day marked-to-market valuation moves • There is evidence that current method overestimates effective exposure • Currently implementing 10-day VaR in place of simple additive add-on • This will factor in portfolio diversification and will bring a uniform methodology to exposure valuation Simple Add-on vs 10-day delta MTM 1,400 1,200 1,000 800 DELTA MTM LIMIT ADD_ON EXPOSURE Value (€/m) MTM 600 COLLATERAL 400 200 - -200 13-Feb-03 06-Mar-03 27-Mar-03 17-Apr-03 09-May-03 30-May-03 Date

11. Operational Risk • Assessing and controlling operational risk • Operational risk is defined as the risk of losses resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk (Basel, September 2001) • Risk control is achieved through process mapping, risk assessment and business process reengineering • The “Operational risk control” project is an on-going activity that advances by gradual improvements • Main steps: • Definition of roles and responsibility • Implementation of techniques of process analysis and representation • Application development to support historical loss data collection • Study of risk assessment methodology to influence business process and control reengineering • Banking activity is so heterogeneous and specialised that only process owners are able to effectively control, process and assess risk • Internal workgroups have been constituted with line managers and Internal Audit • These workgroups have permanent responsibility on process design, operational risk assessment and reengineering solution identification • Processes are targeted and mapped out to workflow charts • Workflow charts illustrate the role of every actor in the process both internal and external, as well as systems contribution • Identification of critical process activities and improvements (e.g. by introducing new control points) • Development of in-house database to support a structured collection of historical data describing operational accidents, related losses and recovery • Implementation of reporting tools both internal and regulatory