FMA Minimum Standards on the Internal Capital Adequacy Assessment Process (ICAAP)

FMA MINIMUM STANDARDS ON THE INTERNAL CAPITAL ADEQUACY ACCESSMENT PROCESS (ICAAP) FMA ICAAP MINIMUM STANDARDS Document No.: 02 / 2024 Publication date: 04.12.2024

FMA ICAAP Minimum Standards Version: 04.12.2024 2 / 16 CONTENTS Contents.................................................................................................................................................. 2 1 Introduction .................................................................................................................................... 3 1.1 Subject matter ........................................................................................................................... 3 1.2 Legal basis and applicable frameworks.................................................................................... 4 1.2.1 BWG.................................................................................................................................. 4 1.2.2 EBA Guidelines................................................................................................................. 5 1.2.3 ECB ICAAP Guide.............................................................................................................. 5 1.3 Addressees and scope of application ....................................................................................... 5 2 Principles......................................................................................................................................... 7 2.1 Principle 1 - the management body is responsible for solid governance of the ICAAP .......... 7 2.2 Principle 2 – The ICAAP is an integral part of the overall management framework ............... 8 2.3 Principle 3 – The ICAAP contributes fundamentally to the Institution’s continuity by ensuring its adequate capitalisation from different perspectives........................................... 9 2.3.1 Objective of the ICAAP and perspectives........................................................................ 9 2.3.2 Normative perspective.................................................................................................... 9 2.3.3 Economic Perspective................................................................................................... 12 2.4 Principle 4 – All material risks are identified and taken into account in the ICAAP .............. 12 2.5 Principle 5 – Internal capital is of high quality and clearly defined....................................... 13 2.6 Principle 6 – ICAAP risk quantification methodologies are adequate, consistent and independently validated ......................................................................................................... 14 2.7 Principle 7 – Regular stress testing is aimed at ensuring capital adequacy in adverse circumstances.......................................................................................................................... 15 3 List of Abbreviations ..................................................................................................................... 16

FMA ICAAP Minimum Standards Version: 04.12.2024 3 / 16 1 INTRODUCTION 1.1 SUBJECT MATTER

1. The ECB Guide to the internal capital adequacy assessment process (ICAAP), hereafter referred to as the “ECB ICAAP Guide”, entered into force on 01.01.2019. The ECB ICAAP Guide’s addressees are the significant institutions as defined in Article 6 (4) of Regulation (EU) No 1024/2013 (the SSM Regulation (SSM-R)) that are directly supervised by the ECB. Considering the convergence of supervisory standards in the SSM, the FMA was expected to draw up analogous requirements for less significant institutions (LSI)1 within the scope of indirect supervision by the ECB. Therefore, from the FMA’s perspective there was initially a temporary option for the continued used of the Going Concern and Gone Concern perspectives in implementing the ICAAP, while the further development of the internal capital assessment in line with ECB’s new concept was also possible in terms of methodological freedom, and its content welcomed.
2. The ECB has not extended the ECB ICAAP Guide’s scope of application to also cover LSIs. Taking into account regulatory developments as well as for the purpose of achieving a constant application, the FMA considers the further development of the ICAAP as also being necessary for the institutions that it supervises.
3. These Minimum Standards are to be read as supplementing the ECB ICAAP Guide, and they further specify the proportional application of the principles defined in the ECB ICAAP Guide for the institutions that are supervised by the FMA.
4. It is the institutions’ duty to apply a solid, effective and comprehensive ICAAP for ensuring an adequate capital base, in accordance with the nature, scope and complexity of the banking transactions that it conducts.
5. In this regard, the ECB ICAAP Guide introduces two different but complementary perspectives in the form of the normative and economic perspectives.2 Against such a further methodological development, the application of the normative and economic perspectives for guaranteeing a solid, effective and comprehensive ICAAP is also expected from the institutions that are addressed by these minimum standards.
6. The application of the economic and normative perspectives in the ICAAP of the institutions addressed by these minimum standards is considered appropriate for the following reasons: ▪ Implementation of the normative perspective increases the significance of capital planning as well as a future-oriented perspective, and thereby leads to a stronger intertwining with the management of the bank. 1 LSIs mean those CRR credit institutions (c.f. Article 4 (1) (1) of Regulation (EU) No 575/2013 that are not classified as significant credit institutions as defined in Article 6 (4) SSM-R. 2 Cf. ECB ICAAP Guide, para. 3.

FMA ICAAP Minimum Standards Version: 04.12.2024 4 / 16 ▪ The normative perspective permits an estimation of regulatory and supervisory capital requirements in both the base and adverse scenarios based on a multi-year view. ▪ Institution-specific specificities are displayed better by scenario-based approaches and synergies exist with the scenario-based institution-wide stress test to be conducted. ▪ Its application leads to a harmonisation of prudential requirements for Austrian institutions, especially if an institution changes from SI to LSI status and vice versa. 7. The minimum standards’ structure is based on the ECB ICAAP Guide’s structure, with Chapter 2 containing remarks about the principles subsequently numbered 1 to 7. The stated examples have been highlighted in a box and are of an illustrative nature, but are not intended to restrict the institution-specific and proportional design of the ICAAP. 8. These Minimum Standards do not constitute a Regulation. They serve as guidance and reflect the FMA's legal interpretation and the FMA's practical recommendations for conduct. No rights and obligations extending over and above the provisions of the law can be derived from Minimum Standards.3 The FMA reviews on a case-by-case basis whether failure to observe recommendations issued in Minimum Standards has also led to legal provisions also being breached, especially Article 39a Austrian Banking Act (hereinafter: “BWG”). 9. Institutions are expected to fully consider these minimum standards at the earliest possible opportunity, but at latest by 31.12.2026. 1.2 LEGAL BASIS AND APPLICABLE FRAMEWORKS 1.2.1 BWG 10. Under Article 39a para. 1 BWG, credit institutions must have in place effective plans and procedures in order to determine on a regular basis the amount, the composition and the distribution of capital available for the quantitative and qualitative coverage of all material risks from banking transactions and banking operations and to hold capital in the amount necessary. Credit institutions must review the suitability and enforcement of such strategies and procedures under Article 39a para. 2 BWG at regular intervals, in any case on an annual basis, and to adapt them as necessary. Article 39a BWG transposes Art. 73 of Directive 2013/36/EU (CRD) regarding the ICAAP into national law. 3 Pursuant to Article 69 para. 5 BWG, the FMA is required in performing its duties, to apply the Guidelines, Recommendations, Standards, and other measures adopted by the European Banking Authority (EBA). The BWG is therefore interpreted by the FMA in line with EBA publications. Where such publications are substantively amended or supplemented in the future, then the FMA’s interpretation of the BWG might also change.

FMA ICAAP Minimum Standards Version: 04.12.2024 5 / 16 11. Administrative, accounting and control procedures shall as far as possible also capture risks that may potentially arise from banking transactions and banking operations pursuant to Article 39 para. 2 BWG.4 12. Under Article 69 para. 2 BWG, the reviewing of the adequacy of the ICAAP is an element of the Supervisory Review and Evaluation Process (SREP) and is to be conducted by the FMA on a regular basis taking into consideration the nature, scope and complexity of the banking transactions that are conducted. 1.2.2 EBA GUIDELINES 13. EBA’s “Guidelines for common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing" (EBA/GL/2022/03), "Guidelines on internal governance" (EBA/GL/2021/05) and “Guidelines on institutions’ stress testing” (EBA/GL/2018/04), in addition to the relevant legal regulations at EU and national level, the ECB ICAAP Guide as well as these Minimum Standards, provide a basis about how a robust, effective and comprehensive ICAAP may be designed on an institution-specific basis. 14. Pursuant to Article 16 (3) of the EBA Regulation, competent authorities and financial institutions shall make every effort to comply with the Guidelines issued by EBA. 1.2.3 ECB ICAAP GUIDE 15. The ECB ICAAP Guide defines principles for the ICAAP that have been developed jointly with the national competent authorities, and is relevant for all significant credit institutions pursuant to Article 6 (4) SSM-R.5 16. The ECB ICAAP Guide follows a principles-based approach with a focus on selected key aspects from a supervisory perspective. The Guide should not be understood as providing complete guidance on all aspects relevant for a sound ICAAP.6 1.3 ADDRESSEES AND SCOPE OF APPLICATION 17. These Minimum Standards are addressed to less significant credit institutions. Regarding credit institutions7 that are not CRR credit institutions, these Minimum Standards are applicable to the extent that such institutions are subject to Article 39a BWG.8 They also apply to Austrian credit institutions active in other Member States (Article 2 no. 5 BWG) under the freedom to provide services or the freedom of establishment (Article 10 BWG). They apply to credit institutions as well as (CRR) financial institutions from other Member States if they 4 These procedures are particularly required under Article 39 para. 2b BWG to take the risks into account that are listed therein. See also: Regulation of the Financial Market Authority (FMA) on the proper capture, management, monitoring and limitation of the types of risk specified in Article 39 para. 2b BWG (Regulation on Credit Institution Risk Management – KI-RMV; Kreditinstitute￾Risikomanagementverordnung). 5 Cf. ECB ICAAP Guide, paras. 11-12. 6 Cf. ECB ICAAP Guide, para. 9. 7 Cf. Article 1 para. 1 BWG 8 Cf. Article 3 para. 1 BWG

FMA ICAAP Minimum Standards Version: 04.12.2024 6 / 16 perform activities in Austria through a branch (Article 9 para. 7 BWG; Article 11 para. 5 no. 1 BWG) or under the freedom to provide services (Article 9 para. 8 BWG; Article 11 para. 6 no. 1 BWG). They also apply to the responsible undertakings pursuant to Article 30 para. 6 BWG (Article 39a para. 3 BWG) and affiliations of credit institutions pursuant to Article 30a BWG (Article 30a para. 7 BWG). 18. For the purposes of consistent terminology, the term “institution” will be used hereafter to the scope of addressees defined in para. 17. In the event of any deviations, separate references will be made. 19. Under Article 77d BWG, the FMA shall only be competent for enforcing Article 39a where enforcement has not been conferred upon the ECB under the SSM-R. Article 4 (1) (f) SSM-R in particular defines carrying out supervisory reviews, stress tests and their possible publication for determining whether the arrangements, strategies, processes and mechanisms put in place by credit institutions and their capitalisation ensure a sound management and coverage of risk, as being a duty of the ECB. In conjunction with Article 6 (4) SSM-R direct ECB competence therefore arises regarding the enforcement of Article 39a BWG for “significant institutions” as defined in Article 6 (4) SSM-R. Pursuant to Article 4 (3) SSM-R, the ECB is required to apply relevant Union law. Where this exists in the form of Directives transposed into national law, it shall apply the latter.9 This means that the ECB directly applies the rules set out in the BWG regarding the ICAAP for significant institutions. From Article 4 in conjunction with Article 6 para. 4 SSM-R, FMA in addition remains directly competent for the enforcement of Article 39a BWG towards less significant credits institutions, but in this competence is subject to ECB oversight (indirect ECB competence). With this in mind, it must be ensured that FMA and ECB’s interpretation of Article 39a BWG is as harmonised as possible. 9 The ECB is however not bound to the administrative practices of national authorities and therefore is also not bound to these Minimum Standards. Reference is made to the ECB ICAAP Guide regarding ECB’s administrative practices.

FMA ICAAP Minimum Standards Version: 04.12.2024 7 / 16 2 PRINCIPLES 2.1 PRINCIPLE 1 - THE MANAGEMENT BODY10 IS RESPONSIBLE FOR SOLID GOVERNANCE OF THE ICAAP 20. Overall responsibility for the implementation of the ICAAP lies with the management body of the institution due to its central role for risk management, hence why it is responsible both for the approval of the core elements of the ICAAP and for the clear allocation of responsibilities under the principle of the separation of functions. All institutions individually decide on the nature, scope and complexity of a governance framework, depending on their size and organisation and as applicable their inclusion in sectoral procedures. 21. Where central rules in relation to institution-wide risk management are presented in a single document, as is typical for many institutions, then this is in line with the Austrian supervisor’s expectation, even if such a document is far less extensive than such frameworks for SIs. Under such an approach, this central document contains all information regarding the institution’s institution-wide risk management, and the information required for ensuring that the obligations of the supervisory board are duly met (including the interpretation of the results of the bank-wide risk management). The central document may refer to additional rules regarding the appropriate performance of the institution-wide risk management (e.g. details about conducting the quantifying of risk for a specific risk or the stress test). 22. The FMA does not necessarily expect a separately drawn up CAS for the ICAAP, in the case that the adequacy of the capital is addressed to the FMA/OeNB within the central ICAAP document (e.g. the ICAAP handbook) or within the SREP questionnaire. 23. In practice, sector-wide or cross-institution solutions for reviewing the institution-wide risk management procedures of Austrian institutions have proven to be useful. Nevertheless, institutions shall also ensure a clear approach for reviewing the procedure as well as for reporting the findings of the review to the management body. The assessment about whether ICAAP procedures are suitable for the respective institution in hand, therefore also lie in the responsibility of the respective management body also in the case of sectoral or cross￾institution solutions. 10To ensure a consistent terminology, the terms “executive director” and “non-executive director” shall be used to apply to all members of the management body in its respective management or supervisory function respectively, with the term “supervisory board” being used for the competent supervisory body under law or under the entity’s articles of association.

FMA ICAAP Minimum Standards Version: 04.12.2024 8 / 16 Example of Proportionality: scope and frequency of the internal review of the ICAAP procedures The scope of the internal review and the validation of procedures shall be designed in the case of institutions in accordance with the nature, scope, complexity and risk profile of the activities performed. In such cases a lower scope of the review may be particularly adequate, where adequately risk-sensitive and methodologically recognised measuring procedures are deployed. If, for example, the formulae stated in the CRR for the IRB Approach is used for quantifying credit risk, then a plausibility check, and, where applicable, an update of the parameters shall suffice in the regular review. As a rule, institutions shall undertake a review of the procedures on an annual basis. The FMA does not expect SNCIs with a simple business model and risk measurement methodology to adjust the procedures and methodologies on an annual basis where a documented and plausible review shows that there have been no material changes in the institution’s business environment, risk profile and risk parameters or that such changes are not expected. 2.2 PRINCIPLE 2 – THE ICAAP IS AN INTEGRAL PART OF THE OVERALL MANAGEMENT FRAMEWORK 24. The ICAAP ensures the adequate coverage of risk by means of capital, and actively controls it, so that preventive measures can be initiated in a timely manner. To guarantee this, the consistent integration of the ICAAP into an institution’s business processes, decision-making processes and risk management processes is of material importance. Normative and economic perspectives ensure that business and risk strategy, capital plans, risk identification processes, risk appetite and limits, stress test results and risk-adjusted performance indicators as well as the remuneration framework are finely tuned with one another. 25. Where the market environment and the institution’s risk situation are stable, then as a rule reporting to the management body11 may be conducted on a quarterly basis. The reporting to the supervisory board may take on an abbreviated and succinct form, while however addressing all material risks. It is not necessary to have a separate document about the risk appetite framework, usually risk appetite and the corresponding steering mechanisms are set out in the central ICAAP document or in the risk strategy. 11 Or a committee in which the management body as a whole is represented.

FMA ICAAP Minimum Standards Version: 04.12.2024 9 / 16 2.3 PRINCIPLE 3 – THE ICAAP CONTRIBUTES FUNDAMENTALLY TO THE INSTITUTION’S CONTINUITY BY ENSURING ITS ADEQUATE CAPITALISATION FROM DIFFERENT PERSPECTIVES 2.3.1 OBJECTIVE OF THE ICAAP AND PERSPECTIVES 26. The ICAAP contributes to the institution’s continuity by ensuring an adequate capitalisation and by guaranteeing that risks are managed effectively to place the institution in a position of holding adequate capital to bear its risks, absorb losses and pursue its business model sustainably, even where adverse developments prevail for an extended period of time.12,13 For this purpose, two different but complementary perspectives are introduced in the form of the normative and economic perspectives. Institutions establish both perspectives in their ICAAP as stated in the ECB ICAAP Guide, taking into account the principle of proportionality. 2.3.2 NORMATIVE PERSPECTIVE 27. The application of the normative perspective replaces the previous going concern perspective. It is no longer necessary to also continue the previous going concern perspective. 28. A sound, multi-year business and capital plan is the starting point for the normative perspective. According to the ECB ICAAP Guide, the business and capital plan is expected to comprise baseline and adverse scenarios and to cover a forward-looking horizon of at least three years.14 Regulatory own funds are available to institutions to cover their risks and losses. Example of Proportionality: number of adverse scenarios Depending on the nature, scale, complexity and risk profile of the institution’s activities fewer adverse scenarios may be defined than for SIs. Non-SNCIs are required to prepare at least two adverse scenarios. In the case of SNCIs, one adverse scenario in the form of a stressed business and capital plan may in principle be considered adequate.15 29. Adverse scenarios’ severity is defined in such a way to cover severe economic downturns and systemic shocks to the financial system, and depict the key weaknesses of the institution in line with its risk inventory16 and display material effects on the internal and regulatory capital. The scenarios are deduced from historical and hypothetical events. 12 Cf. ECB ICAAP Guide, paras 5 and para. 39. 13 A clear delineation therefore exists to the recovery plans, which are only activated in the case of a considerable deterioration of the financial situation, with measures being taken from the recovery plan to re-establish the institution’s financial stability. 14 Cf. ECB ICAAP Guide, para. 44. 15 In the following remarks about the normative perspective, for the term “adverse scenarios”, we have refrained from the simultaneous usage of “one adverse scenario” (applicable as a rule for SNCIs) and “several adverse scenarios” (applicable for non-SNCIs). They however equally apply under consideration of the remarks in the example for non-SNCIs and SNCIs. 16 While developing the adverse scenarios, it should be reviewed whether the risks captured in the risk inventory materialise under a stress event.

FMA ICAAP Minimum Standards Version: 04.12.2024 10 / 16 30. As a minimum, capital planning should cover the current year and the two following years for the forward-looking horizon.17 Example of Proportionality: Frequency of review and calculation of the adverse scenarios According to the ECB ICAAP Guide, the assessment of the adverse scenarios is expected to be reviewed on at least a quarterly basis and assessments calculated regularly (e.g. quarterly) of the impacts of the adverse scenarios.18 As a rule, an annual evaluation of the adequacy and the calculation of the adverse scenarios suffices for the institutions covered by the scope of application of the minimum standards. In the case of special events (e.g. a material change in the macroeconomic environment or the composition of the institution’s portfolio) an intra-year assessment may however be necessary. 31. The effects on the own funds situation (change in the total risk exposure and own funds) are calculated both in the baseline scenario as well as in the adverse scenarios. In addition, the effects on risk bearing capacity in the adverse scenarios from a proportionality perspective are also estimated. Example for the procedure in the normative perspective The following example presents the concept of the normative perspective for non-SNCIs in condensed form.19 The business and capital plan in the baseline scenario form the starting point. Planned new business, capital issuances, relevant regulatory amendments etc. are included in the business plan. The baseline scenario is supplemented by adverse scenarios. The stress assumptions are derived from the institution-specific vulnerabilities and cover severe macroeconomic developments, that may arise in a crisis situation. Furthermore, the adverse scenarios assume that the current business strategy will be maintained and the implications of the difficult business environment (e.g. falling levels of concluded business, margins etc.) are taken into account. Stress effects are presented separately to countermeasures20. On this basis, the annual results are deduced for the baseline scenario and the adverse scenarios: 17 The time horizon for capital plan in the ICAAP is therefore extended to at least cover the plan data reporting (Annexes I1a to I3) under the Regulation on Asset, Income and Risk Statements VERA-V. 18 Cf. ECB ICAAP Guide, Principle 7, point (iii). 19 The example shall be applied for SNCIs taking into consideration the potential simplification regarding the number of adverse scenarios (see example of Proportionality regarding the number of adverse scenarios). 20 The countermeasures under the normative perspective are consistent with the adverse scenario and their implementation adequately specifically planned and executable. The countermeasures do not cause any change or threat to the business strategy and do not constitute any kind of recovery measures.

FMA ICAAP Minimum Standards Version: 04.12.2024 11 / 16 The impacts of the stress assumptions are not restricted to the income statement. They also affectregulatory own funds, the own funds requirement or the total risk exposure and in addition for IFRS institutions through the OCI on capital adequacy. The following table presents examples of the effects of the baseline scenario and the adverse scenarios on the CET1 ratio: In addition to the capital ratios (across all capital qualities), depending on their relevance the institution also reviews other regulatory requirements, e.g. leverage ratio, MREL, large exposures. Shortfalls in buffer and P2G requirements are only permitted in the adverse scenarios. Depending on the nature, scale, complexity and risk profile of the activities of the institution the impact on risk utilisation under the economic perspective are also calculated. This creates an efficient combination of normative and economic perspectives. Example regarding the management buffer Institutions define an appropriate management buffer for the baseline scenario as well as for the adverse scenarios and take this into consideration in the capital planning. The management buffer is measured in such a way, to guarantee the continuity of the institution’s business model over a medium-term horizon in the baseline scenario as well as in longer phases of adverse developments. The management buffers ensure that the OCR and the P2G are continuously complied with under the baseline scenario and that the TSCR is continuously complied with in the adverse scenarios.21 The factors that influence the amount of the management buffer may be the expectations of owners, investors or customers, requirements to distribute a dividend, 21 Cf. ECB ICAAP Guide, paras. 45 et seq. Annual result Year Year + 1 Year +2 Year + 3 Baseline scenario 15 15 16 16 Adverse scenario 1 -3 -1 5 Adverse scenario 2 -12 -8 1 CET1 ratio Year Year + 1 Year +2 Year + 3 Baseline scenario 19.5% 21.2% 22.8% 24.3% Adverse scenario 1 17.3% 15.6% 15.2% Adverse scenario 2 15.2% 12.4% 11.4% Risk utilisation under economic perspective Year Year + 1 Year +2 Year + 3 Baseline scenario 47% 44% 41% 38% Adverse scenario 1 65% 65% 61% Adverse scenario 2 91% 93% 91%

FMA ICAAP Minimum Standards Version: 04.12.2024 12 / 16 payments on Additional Tier 1 instruments or other business model-specific factors. Where the consideration of a management buffer in the normative perspective is foregone without an adequate justification, tight capital planning without reserves may negatively influence the supervisory evaluation of the institution and attractive closer supervisory monitoring. 2.3.3 ECONOMIC PERSPECTIVE 32. The liquidation approach established in Austrian institutions (gone concern perspective) has conceptual similarities with the economic perspective. For example, in the liquidation approach, risks were calculated based on an unexpected loss at a determined level of confidence (e.g. 99.9%) and a defined risk horizon (e.g. one year) at a certain point in time (= reporting date approach). Probability-based measuring of risk and the reporting date approach continue to remain key points of the economic perspective. In this context reporting date-based means that they risks calculated across the time horizon may already been borne as of the reporting date of the calculation. The calculation of the risk bearing capacity analysis therefore occurs without consideration of future management measures and in maintaining the current business strategy. Only risk-covering funds (cf. Principle 5) that are directly suitable for risk bearing purposes and which are available on the respective reporting date may be allocated as such. From the economic perspective, the going concern principle therefore is therefore central. 33. We refer to Principles 5 and 7 regarding the definition of internal capital as well as the requirements for the regular stress tests in the economic perspective. 2.4 PRINCIPLE 4 – ALL MATERIAL RISKS ARE IDENTIFIED AND TAKEN INTO ACCOUNT IN THE ICAAP 34. Institutions implement a clearly structured and documented process that stipulates, both under the economic and the normative perspective following the gross approach, that institution-specific risks are identified on at least an annual basis and subsequently are assessed in terms of their respective materiality for the institution. The regulatory risk taxonomy (e.g. Article 39 para. 2b BWG) may be applied as a starting point for identifying risk. 35. Since significant institutions (SIs) typically have more complex risk profiles than the institutions in the scope of application of these Minimum Standards, it must be assumed that the risk identification process for smaller institutions is less substantial in terms of its scope and complexity. It may also be assumed that the risk inventory’s scope and complexity in the smaller institutions addressed by these Minimum Standards is also less substantial than in the case of SIs. Regarding proportionality, the depth of the analysis of the underlying risks is commensurate to the institution’s business activities or its business model.22 22 Cf. ECB ICAAP Guide, para. 66.

FMA ICAAP Minimum Standards Version: 04.12.2024 13 / 16 36. The institution-specific nature of the risk identification process makes it necessary for the respective institution to conduct it taking into consideration the institution’s vulnerabilities, even where procedures of a sector-wide or multi-institutional nature are used. 37. If there have not been any material changes in the institution’s business environment and risk profile since the process was last conducted, and the justification for the classification of the materiality of the risk types from the previous process are still valid, then the management body shall confirm this as being the case. 2.5 PRINCIPLE 5 – INTERNAL CAPITAL IS OF HIGH QUALITY AND CLEARLY DEFINED 38. As stated in the ECB ICAAP Guide, the internal capital defines the risk-covering funds in the economic perspective.23 39. The ICAAP focuses on ensuring the continuing existence or the economic viability of an institution. For this purpose, institutions choose a conservative definition of their internal capital and only apply capital, that are available assuming the continuity of the institution’s operations to cover losses. 40. Regulatory own funds may be chosen as the starting point for defining internal capital in the economic perspective. In this instance, the internal capital largely consists of Common Equity Tier 1 capital.24 According to their terms of issuance, Additional Tier 1 capital and Tier 2 instruments are as a rule designed in such a way that they are not able to absorb losses under the going concern principle. Institutions therefore do not principally allocate Additional Tier 1 instruments pursuant to Article 51 point a CRR and the associated share premium account pursuant to Article 51 point b CRR as well as Tier 2 instruments pursuant to Article 62 point a CRR and the associated share premium account pursuant to Article 62 point b CRR to the internal capital. 25 41. In the case of valuation reserves pursuant to Article 57 para. 1 BWG, these are post-tax undisclosed reserves, that may be dissolved and allocated to Common Equity Tier 1 capital at any time. Their loss absorbing capacity is comparable to that of Common Equity Tier 1 capital and they may be fully considered in the internal capital. 42. Where an institution calculates the credit risk in the ICAAP using a model that is similar to an IRB model (or another credit portfolio model), then as a rule there is an expected excess or shortfall.26 Since only the expected loss is deducted from the capital, then a risk is calculated for parts of the credit portfolio that have already been written down in the event of an 23 Cf. ECB ICAAP Guide, Principle 5, point (i). 24 Cf. ECB ICAAP Guide, para. 70. 25 Cf. ECB ICAAP Guide, Example 5.1 and the FAQs about the EZB, ICAAP and ILAAP Guides, URL: https://www.bankingsupervision.europa.eu/legalframework/publiccons/html/icaap_ilaap_faq.en.html (retrieved: 02.07.2024). 26 An expected excess/shortfall is defined respectively as a surplus/shortfall in the portfolio of value adjustments and loan loss provisions compared to the expected loss.

FMA ICAAP Minimum Standards Version: 04.12.2024 14 / 16 expected excess. The institution may therefore allocate the expected excess to the internal capital. In contrast, expected shortfalls are fully deducted from the internal capital. 43. Hidden reserves that can be realised within a reasonable period of time for the actual absorption of loss may be included in a conservative matter in the internal capital. Hidden losses are included by deducting them from internal capital. In both cases, care is taken to ensure consistency between internal capital and risk quantification. 2.6 PRINCIPLE 6 – ICAAP RISK QUANTIFICATION METHODOLOGIES ARE ADEQUATE, CONSISTENT AND INDEPENDENTLY VALIDATED 44. Institutions implement risk quantification methodologies, as stated in the ECB ICAAP Guide, for both the economic and normative perspectives. 27 Supervisory expectations regarding the quantification methodologies are based on the nature, scale and complexity of the institution’s activities, with procedures showing an appropriate degree of conservativeness. Institutions implement risk quantification methodologies that they fully understand, and which are not used for their own internal risk management and decision-making.28 45. While, for example the quantification of credit risk may occur in the economic perspective by means of probability-based approaches, in contrast, in the normative perspective the effects of the adverse scenarios on the profit-and-loss account, capital requirements for credit risk, and on the capital are quantified. In the economic perspective, the quantification is based on the economic value. In contrast, in the normative perspective accounting methodology among other things are taken into account. 46. Regarding the measurement of risk and the scope of independent validation activities, a distinction is made as to whether methodologically recognised risk measurement methods with comparatively easy-to-derive parameters or complex quantification methods are used, the results of which depend heavily on how the parameters are chosen and derived. In practice, in many institutions, especially those that have a sufficiently large portfolio and sufficient data history, for example, the quantification of credit risk using the formulae under the IRB approach in the CRR and additional quantifying of concentration risks has proven itself to be reliable. Depending on the data that is available for the respective sub-portfolios, for example, the basic or advanced IRB approach may be used. 47. In the case of independent validation, institutions ensure that the development of procedures and their validation are carried out by different people. Based on the principle of proportionality, for correspondingly large or complex institutions, as great a degree of separation of responsibilities as possible is expected, e.g. in separate organisational units. 27 Cf. ECB ICAAP Guide, Principle 6, point (i). 28 Cf. ECB ICAAP Guide, para. 83.

FMA ICAAP Minimum Standards Version: 04.12.2024 15 / 16 2.7 PRINCIPLE 7 – REGULAR STRESS TESTING IS AIMED AT ENSURING CAPITAL ADEQUACY IN ADVERSE CIRCUMSTANCES 48. Institutions shall establish a stress testing programme taking into consideration the principle of proportionality covering the normative and economic perspective in both cases as well as reverse stress tests in both perspectives. 49. We refer to the remarks contained in Principle 3 regarding the requirements under the adverse scenarios in the normative perspective and the potential proportional application of the ECB ICAAP Guide. 50. Over and above this, institutions shall also develop regular stress tests for the economic perspective. Such stress tests shall analyse potential events that are not (adequately) captured by the probability-based risk measuring procedures. As a general rule, a yearly evaluation of the adequacy of the stress tests for the economic perspective shall be sufficient, unless extenuating events necessitate and intra-year review. 51. Especially in the case of SNCIs, the stress tests in the economic perspective may be implemented in the form of sensitivity analyses that quantify the effects of possible future events on risk amounts and risk-covering funds. Due to its simplified design, as a rule such sensitivity analyses are conducted more frequently (e.g. with the same frequency as the risk bearing capacity calculation under the economic perspective). As a rule, annual calculation suffices for more complicatedly designed scenario analyses. EXAMPLE ABOUT THE STRESS TESTS UNDER THE ECONOMIC PERSPECTIVE Potential stress events in the economic perspective are: ■ Shifts in credit ratings in the loan and bond portfolio ■ Default of a certain number of credit exposures ■ Changes in the yield curve ■ Widening of credit spreads ■ Changes in exchange rates In the interests of a simpler calculation method, institutions may choose to forego a time dimension in calculating the stress test’s results. Stress effects on the utilisation of risk are stated as at the relevant reporting date (as opposed to a multi-year time horizon in the normative perspective). 52. Reverse stress tests for the normative and economic perspectives are conducted on an at least annual basis. Reserve stress testing serves the purpose of identifying the extent of an event or developments leading to a business model no longer being viable, when, for example the TSCR or management buffers being breached.29 29 Cf. ECB ICAAP Guide, para. 97 et seq.

FMA ICAAP Minimum Standards Version: 04.12.2024 16 / 16 3 LIST OF ABBREVIATIONS BWG Austrian Banking Act (Bankwesengesetz) CAS Capital Adequacy Statement CET1 Common Equity Tier 1 CRD Capital Requirements Directive EBA European Banking Authority ECB European Central Bank FMA Austrian Financial Market Authority ICAAP Internal Capital Adequacy Assessment Process IFRS International Financial Reporting Standards IRB Internal Ratings-Based LSI Less Significant Institution MREL Minimum Requirement for Own Funds and Eligible Liabilities OCI Other Comprehensive Income OCR Overall Capital Requirement OeNB Oesterreichische Nationalbank para. paragraph P2G Pillar 2 Capital Guidance P2R Pillar 2 Capital Requirement R Regulation SI Significant Institution SNCI Small non-complex institution pursuant to Article 4 (1) (145) CRR SREP Supervisory Review and Evaluation Process SSM Single Supervisory Mechanism TSCR Total SREP Capital Requirement