Management of default risks in consumer lending

Memorandum 1 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public Regulations and Guidelines 1/2025 [Management of default risks in consumer lending] Summary and feedback on comments Reference Comments with justifications (and possible formulation proposals) Finanssivalvonta's response

General comments The Bank of Finland considers the general starting points and objectives of the regulations on the management of default risks to be supportable and important, as the regulations promote credit grantors' management of credit risks, assessment of borrowers' creditworthiness, prevention of excessive consumer lending and household over-indebtedness, and thus the stability of the entire financial system. The Bank of Finland considers it important that credit institutions and other credit grantors and intermediaries granting consumer loans have risk classification systems at their disposal, through which they can reliably monitor and assess default risks and avoid granting loans to consumers whose default risk is unreasonably high. The Bank of Finland considers it good that credit grantors use uniform methods in assessing credit risks and credit risk models, and that credit grantors report credit risks and the functionality of risk models to Finanssivalvonta in accordance with the regulations. No proposal for amendment No proposal for amendment No proposal for amendment

Memorandum 2 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public The Ministry of Finance considers the draft regulations and guidelines to be appropriate in its starting points and justifications, and generally carefully prepared. The Ministry of Finance considers that the proposed approach corresponds to the powers to issue more detailed regulations on risk classification systems required from credit institutions and consumer credit grantors, as stipulated in Section 11b(4) of Chapter 15 of the Act on Credit Institutions (610/2014) and Section 13(4) of the Act on the Registration of Certain Credit Grantors and Credit Intermediaries (186/2023). In the Ministry of Finance's view, the further preparation should clarify to what extent the new regulations in question would add to the obligations of credit institutions falling within the scope of the Credit Institutions Directive (2013/36/EU) and the EU Capital Requirements Regulation (No 575/2013), in addition to the obligations stipulated in those acts and the implementing national legislation. At a general level, the Ministry of Finance considers that risk classification systems are regulated quite comprehensively in the aforementioned acts. Although the aforementioned regulations concern the risk management of credit institutions, and the draft regulations and guidelines in question deal with the minimum requirements of risk classification systems from a consumer protection perspective, the setting of additional requirements in the new regulations and guidelines should be carefully justified for credit institutions. The preparatory works of the Act state that the fulfillment of the risk management obligations of a credit institution is in principle sufficient also for the obligations stipulated in Section 11b of Chapter 15 of the Act on Credit Institutions (HE 101/2022 vp, p. 58). No proposal for amendment Finanssivalvonta notes that with the new regulation in question, a new obligation for credit institutions would be the MK reporting defined in the guidelines and regulations, through which Finanssivalvonta monitors the management of default risks in consumer lending by supervised entities. This reporting is justified because it is not possible to issue more detailed regulations on the thresholds and distributions necessary for assessing default risks, as well as on the data and operational models used in risk classification systems, based on current reporting.

Memorandum 3 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public The Competition and Consumer Authority (KKV) considers that for the sake of clarity, the regulations and guidelines on the management of default risks in consumer lending should mention the obligation to assess the consumer's creditworthiness stipulated in Section 14 of Chapter 7 of the Consumer Protection Act. Furthermore, the KKV wishes to remind consumer loan grantors that although they have a risk classification system to monitor and assess default risks, the credit grantors must always assess the individual creditworthiness of the loan applicant for each loan contract. Finnish Financial Industry Association (FA) summary: Credit institutions should be exempted from the new unnecessary reporting obligation

• The Finnish Financial Industry Association (FA) considers the draft MOK (Regulations and Guidelines) to be unsuitable for credit institutions and considers that credit institutions should be excluded from its scope. Finanssivalvonta notes that credit grantors are obliged to comply with the obligations concerning the assessment of creditworthiness, which the proposed new MOK does not cover. Finanssivalvonta notes that the new regulation on the management of default risks in consumer lending also applies to credit institutions.

Memorandum 4 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public

• The definition of default risk used in the draft differs from the definition of default in the EBA guidelines, which are used in the development of credit institutions' credit risk models. Also, some other definitions used in the draft MOK are non-standard and deviate from the terminology of the Act on Credit Institutions and EU regulation.
• The proposed reporting does not correspond to the actual content of credit risk assessment in credit institutions.
• The reporting format is manual and administratively very burdensome. The benefit obtained in supervision is not proportional to the costs incurred by the supervised entities. FA individual paragraphs: Finanssivalvonta notes that institutions report past due amounts similarly to how they report past due amounts on the FINREP 18.00 form. This is clarified as a new item (35) in the draft MOK as follows: Supervised entities within the scope of Finanssivalvonta's Regulations and Guidelines 20/2013 (supervised entities as referred to in the Act on Finanssivalvonta (878/2008) and foreign branches) shall report information on non-performing and past due receivables applying the guidance provided in Commission Implementing Regulation (EU) No 451/2021 for FINREP form F 18.00 concerning the significance thresholds of receivables and the level of classification (by transaction, by debtor). Finanssivalvonta comments on this point below. Finanssivalvonta notes that this reporting is justified because it is not possible to issue more detailed regulations on the thresholds and distributions necessary for assessing default risks, as well as on the data and operational models used in risk classification systems, based on current reporting. Furthermore, in the thematic review on the management of default risks (Supervised Entity Information 21.3.2024 – 15/2024), data was collected from supervised entities largely in accordance with the MK report format, and credit institutions were generally able to provide the requested information on schedule.

Memorandum 5 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public

1. General remarks on the draft MOK FA stated in its statement on the Government's bill for legislation limiting household indebtedness (HE 101/2022 vp) that the proposal contained in the bill regarding the management of default risks related to consumer loans is problematic. The reporting obligations proposed for credit institutions and the rule-making power proposed for Finanssivalvonta were in conflict or overlapping with other regulation. In practice, FA considered the proposals to be part of prudential supervision, which is fully harmonized in the EU for credit institutions. FA also considered that the proposals could not be included in the chapter on conduct of business in the Act on Credit Institutions. The Finanssivalvonta draft MOK currently under consultation shows that FA's concern raised to the Economic Committee was justified. The new obligations for credit institutions contained in the draft in its proposed form are significantly in conflict with the requirements of prudential calculation and the definition of default. According to Section 11b of Chapter 15 of the Act on Credit Institutions, a credit institution must have a risk classification system through which it can reliably monitor and assess default risks in its consumer lending. The Act on Finanssivalvonta grants the authority to provide more detailed guidance on this system. FA wishes to emphasize that the existence of the risk classification system, the assumptions and data it contains, and its use in credit decisions are a central part of the model supervision of institutions using internal models. Finanssivalvonta notes that the draft MOK does not relate to prudential supervision but to conduct of business supervision, and is therefore not in conflict or overlapping with other regulation (see below for details). Finanssivalvonta notes that the MOK draft in question does not relate to the prudential calculation and supervision referred to in the statement, but to conduct of business supervision, and is therefore not in conflict or overlapping with other regulation. The purpose of the reporting is to obtain information on the reliability of the assessment of default risks at the time of loan granting.

Memorandum 6 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public These classification systems are based on EU regulation and, for large institutions, also on EU supervision, whose starting points differ significantly from those presented in the draft. Although the calculation and reporting according to the draft would be possible for credit institutions, FA does not see it adding information to credit decisions and the variables used therein. Instead, FA considers it an obvious risk that the supervisor would draw conclusions from the reporting that are not justified and do not reflect the actual conduct of credit institutions in lending. 2) The reporting burden on credit institutions should not be increased The Economic Committee stated in its report (TaVM 36/2022 vp) that the Government's bill contained rather heavy reporting obligations for credit grantors, and emphasized the importance of sufficient and continuous dialogue between authorities and the industry, and considered it important not to increase the regulatory burden of the financial market sector and the costs caused by it excessively. In FA's opinion, reporting obligations can be considered excessive if the information contained therein is already submitted to authorities for the fulfillment of other legislative obligations, or if such reporting does not practically correspond to the legislator's aim to assess whether credit institutions grant loans to insolvent customers. Finanssivalvonta notes that in the thematic review on the management of default risks (Supervised Entity Information 21.3.2024 – 15/2024), data was collected from supervised entities largely in accordance with the MK report format. The results and conclusions of the thematic review showed that with this reporting, Finanssivalvonta is able to effectively and, above all, comparably assess the management of default risks in consumer lending by all credit grantors, regardless of whether the entities are credit institutions or other credit grantors not subject to EU prudential regulation. Finanssivalvonta notes that the MK reporting obligation coming to credit institutions with the MOK draft in question is not considered to excessively increase the reporting burden on credit institutions. Finanssivalvonta does not receive MK report data from any other current reporting. Current reporting does not include reporting on new loans, on the basis of which it would be possible to assess default risks in the manner intended by the MOK draft. Furthermore, Finanssivalvonta notes that in the thematic review on the management of default risks (Supervised Entity Information 21.3.2024 – 15/2024), data was collected from supervised entities largely in accordance with the MK report format. The results and conclusions of the thematic review showed that with this reporting, Finanssivalvonta is able to effectively assess and, above all, comparably assess the management of default risks in consumer lending by all credit grantors, regardless of whether the entities are credit institutions or other credit grantors not subject to EU prudential regulation.

Memorandum 7 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public The reporting obligation contained in the MOK draft is, in FA's opinion, of the kind mentioned above and thus in conflict with its position, which the Economic Committee took when handling the legislation on Finanssivalvonta's supervision fees. According to the Committee's report (TaVM 7/2023 vp), the significantly increased regulation of the financial sector has led to considerable regulatory implementation and supervision costs in the industry, and for this reason it is important that regulation is as consistent and unambiguous as possible and forms a clear whole, and that this applies to EU and national legislation as well as to the regulations, guidelines, and recommendations issued by Finanssivalvonta. The new reporting obligation was justified during the legislative preparation, inter alia, by the fact that it serves a different purpose than the reporting in accordance with existing prudential regulation. However, this cannot be considered a sufficient basis for the reporting burden according to the MOK draft. The reporting according to the draft appears particularly burdensome because the required information would have to be given in a different format and organized differently compared to existing reporting. Overall, the reporting format in the MOK draft is manual and administratively very burdensome. Finanssivalvonta notes that this reporting is justified because it is not possible to issue more detailed regulations on the thresholds and distributions necessary for assessing default risks, as well as on the data and operational models used in risk classification systems, based on current reporting. Furthermore, in the thematic review on the management of default risks (Supervised Entity Information 21.3.2024 – 15/2024), data was collected from supervised entities largely in accordance with the MK report format, and credit institutions were generally able to provide the requested information on schedule. Finanssivalvonta notes that this reporting is justified because it is not possible to issue more detailed regulations on the thresholds and distributions necessary for assessing default risks, as well as on the data and operational models used in risk classification systems, based on current reporting. Furthermore, in the thematic review on the management of default risks (Supervised Entity Information 21.3.2024 – 15/2024), data was collected from supervised entities largely in accordance with the MK report format, and credit institutions were generally able to provide the requested information on schedule.

Memorandum 8 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public 3) The MOK draft does not reflect the actual content of credit risk assessment in credit institutions The credit risk analysis of consumer loans and the assessment of creditworthiness of individual customers are based on several different factors, the most important of which are indicators related to the customer's ability to pay and rules related to income and expense estimates. Underlying the activity is the credit institution's determined credit strategy, which contains various risk parameters and decision rules. The results of the risk scoring of credit risk models are used as part of decision-making together with other information. The weight of models is usually smaller than the aforementioned payment capacity indicators. Credit institutions sometimes have several different models in use to support credit decisions. For the reporting presented in the MOK draft to work in practice, FA considers it necessary to use one credit risk model such that it covers all product and other segments and contains risk parameters related to high-level credit decision rules. This is usually not the case. Overall, the reporting presented in the MOK draft does not, in FA's opinion, correspond to the actual content of credit risk assessment in credit institutions. 5 Finally In FA's opinion, the MOK draft does not correspond to the authority granted to Finanssivalvonta by the Act on Credit Institutions to supervise the conduct of credit institutions, and the reporting presented in the MOK draft does not provide such information that would be truly useful for supervising the conduct of credit institutions. FA considers that Finanssivalvonta should either reconsider its approach entirely or exclude credit institutions from the scope of the MOK and apply it only to other entities granting consumer loans. Furthermore, FA draws attention to the fact that the definition of default risk used differs from the definition of default in the EBA guidelines, which are used in the development of banks' credit risk models. Consequently, the results obtained in the reporting cannot be used to assess the functionality of banks' models. The Experts in the Credit Industry Association (Luotas) considers the more detailed and uniform guidance on the management of default risks to be good and necessary. The Regional Administrative Agency of Southern Finland has no statement on the matter. Finanssivalvonta notes that although risk scores may influence credit decisions along with other risk parameters and decision rules, risk scores must nevertheless reliably predict payment behavior. Therefore, with this reporting, Finanssivalvonta is able to effectively and comparably assess the management of default risks in consumer lending by credit grantors. Finanssivalvonta notes that in the thematic review on the management of default risks (Supervised Entity Information 21.3.2024 – 15/2024), data was collected from supervised entities largely in accordance with the MK report format. The results and conclusions of the thematic review showed that with this reporting, Finanssivalvonta is able to effectively assess and, above all, comparably assess the management of default risks in consumer lending by all credit grantors, regardless of whether the entities are credit institutions or other credit grantors.

Memorandum 9 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public Finanssivalvonta has the authority under Section 11b of Chapter 15 of the Act on Credit Institutions to supervise the management of default risks in consumer lending. The MOK is issued pursuant to the said section. Finanssivalvonta notes that MK reporting does not assess the prudential models of credit institutions. No proposal for amendment No proposal for amendment Section-specific comments

Memorandum 10 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public Chapter 1.1 FA draws attention to the fact that for the sake of clarity, the draft MOK should mention that loans related to residential property under Chapter 7a of the Consumer Protection Act (KSL) are not within the scope of application. Finanssivalvonta notes that the scope of application of the regulations and guidelines is in paragraph 1.1. Loans related to residential property under Chapter 7a of the Consumer Protection Act (38/1978) are not within the scope of application. Chapter 1.2 The Bank of Finland draws attention to the concepts of consumer loan, secured consumer loan, and unsecured consumer loan. These concepts are not used elsewhere in the regulations nor in the Consumer Protection Act. The Bank of Finland considers that for the sake of clarity, it would be good to use the concept of consumer loan falling within the scope of application of Chapter 7 of the Consumer Protection Act (38/1978). FA draws attention to the fact that the definitions also mention secured consumer loans for some reason, although they are not referred to elsewhere in the text. Furthermore, FA draws attention to the fact that the EBA guidelines allow the treatment of default also at the product or customer level, which differs from the reporting level defined in the MOK draft. Thus, the definition level in the draft may not be in use in all credit institutions, which confuses reporting. FA notes that it is generally important that the definitions used in the draft are consistent with the Act on Credit Institutions and EU regulation. This applies, for example, to the definition of bad and good loans. Due to the deviation of definitions, it is not clear, for example, how the calculation of past due days is performed. Finanssivalvonta notes that the concepts consumer loan, secured consumer loan, and unsecured consumer loan are removed from paragraph 1.2 Definitions. Finanssivalvonta notes that the concepts consumer loan, secured consumer loan, and unsecured consumer loan are removed from paragraph 1.2 Definitions. Finanssivalvonta notes that institutions report past due amounts similarly to how they report past due amounts on the FINREP 18.00 form. This is clarified as a new item (35) in the draft MOK as follows: Supervised entities within the scope of Finanssivalvonta's Regulations and Guidelines 20/2013 (supervised entities as referred to in the Act on Finanssivalvonta (878/2008) and foreign branches) shall report information on non-performing and past due receivables applying the guidance provided in Commission Implementing Regulation (EU) No 451/2021 for FINREP form F 18.00 concerning the significance thresholds of receivables and the level of classification (by transaction, by debtor).

Memorandum 11 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public FA notes that several other matters require clarification, such as how to report a loan terminated before 90 days past due, which has not been written off as a loan loss. The calculation of past due days ends at the time of termination, and according to the MOK draft, such a loan could apparently be reported either in the column corresponding to the past due days of the termination date or in the column corresponding to loans for which loan losses have been written off. FA notes that the MOK draft does not define the reporting schedule. If the draft is put into use also for credit institutions despite the above, FA proposes that the reporting date should be June 30 of the year following the reference date. This would ease the burden caused by reporting on supervised entities. Finanssivalvonta notes that the MOK and the MK reporting template will be supplemented in this respect so that a loan terminated before 90 days past due, which has not been written off as a loan loss, is reported in the columns of actual loan losses. Finanssivalvonta notes that the reporting schedule is mentioned in item (32) of the MOK draft. On the first reporting occasion, the MK form will report all new loans granted during the period 1.1.–31.12.2024 as of 31.12.2025. Finanssivalvonta considers that this schedule does not excessively increase the burden caused by reporting on supervised entities, as the first reporting will take place in the first half of 2026. Chapter 4.1 Luotas raises that data related to consumers' ability to pay is currently available significantly more than before, and to ensure the best possible predictive power in credit risk models, it is recommended to take into account not only the financial company's internal data but also data produced or transmitted by third parties, or at least to utilize this as part of the ability to pay assessment. Such third parties can include, in addition to the aforementioned and the Tax Administration's positive credit information register, for example, collection and credit information companies (e.g., payment behavior data, collection data, generic risk classification models, and PSD2 data). The utilization of this information, which generally requires the consumer's consent, creates a comprehensive overall picture of the consumer's income and expenses, enabling a more individualized assessment of payment capacity. No proposal for amendment

Memorandum 12 (12) Appendix FIVA/2024/2102 SP/FIVA-CONFIDENTIAL Public Chapter 4.4, item (31) The Bank of Finland draws attention to the scope of application of the regulations. The regulations apply to credit grantors who grant consumer loans falling within the scope of application of Chapter 7 of the Consumer Protection Act (38/1978). It is not clear from the regulations why the reporting according to the regulations...