CEBS Guidelines for Joint Risk Assessment (GL 39)

CEBS 2010 293 Final
22 December 2010
GUIDELINES FOR THE JOINT ASSESSMENT OF THE ELEMENTS COVERED BY THE SUPERVISORY REVIEW AND EVALUATION PROCESS (SREP) AND THE JOINT DECISION REGARDING THE CAPITAL ADEQUACY OF CROSS￾BORDER GROUPS (GL39)
Table of contents
Chapter 1: Introduction and executive summary ........................................... 3
1.1 Introductory statements .................................................................... 3
1.2 Executive summary .......................................................................... 7
Chapter 2: The joint assessment of risk factors and risk management and control
factors in the college of supervisors ............................................................. 9
2.1 The coordination and translation of risk assessments through common
templates and scoring scales ................................................................... 9
2.2. Methodology for structuring the dialogue between college members and
reaching a joint assessment of risk factors and risk management and control
factors................................................................................................ 13
2.3. Reaching a joint assessment of the risk factors and risk management and
control factors of the group and its entities .............................................. 19
Chapter 3: Joint assessment of the ICAAP processes and methodologies for
cross-border groups at the consolidated, sub-consolidated and/or solo levels .. 21
3.1 Coordination and translation of assessments of the ICAAP processes
through common templates and scoring tables......................................... 21
3.2. Methodology to structure the dialogue between college members and
reach a joint assessment of the ICAAP process......................................... 23
3.2.1 ICAAP scope............................................................................ 23
3.2.2 ICAAP methodologies................................................................ 23
3.2.3 ICAAP governance and internal control........................................ 25
3.3 Reaching a joint assessment of the group and its entities’ ICAAP ........... 25
Chapter 4: The joint assessment of compliance with the various minimum
requirements set out in the CRD ............................................................... 27
4.1 Coordination and translation of individual assessments through a common
template............................................................................................. 27
4.2 Methodology to structure the dialogue between college members and reach
a joint assessment of compliance with the various minimum requirements set
out in the CRD..................................................................................... 27
4.3 Reaching a joint assessment of compliance with the various minimum
requirements set out in the CRD ............................................................ 29
Chapter 5: Determination of the adequate levels of own funds at the group and
entities levels ......................................................................................... 31
5.1 Translation of the assessment of capital adequacy of individual entities .. 32
5.2 Methodology to structure the dialogue between college members in order
to reach a joint decision on risk-based capital adequacy ............................ 36

5.2.1 Reconciliation between the ICAAP outcomes and the supervisory
assessments........................................................................... 36
5.2.2. Treatment of diversification effects and allocation of capital across the
group .................................................................................... 37
5.2.3 Determination of capital adequacy with a forward looking perspective
and under stressed conditions ................................................... 38
5.2.4. Internal capital estimates and regulatory capital requirements ...... 39
5.3. Reaching a joint decision on risk-based capital adequacy..................... 40

Chapter 1: Introduction and executive summary
1.1 Introductory statements

1. The revised Capital Requirements Directive (CRD, Article 129(3))1
   , approved by the European Parliament on 6 May 2009 (2009/111/EC), whose provisions will be applicable from 31 December 2010, requires that the consolidating supervisor and supervisors of subsidiaries involved in the supervision of an EEA cross-border banking group do everything within their power to reach a joint decision on the application of the Pillar 2 provisions related to the Internal Capital Adequacy Assessment Process (ICAAP) and to the Supervisory Review and Evaluation Process (SREP). The joint decision should cover the determination of the adequacy of the consolidated level of own funds held by the group with respect to its financial situation and risk profile, as well as the required level of own funds, above the regulatory minimum, applied to each entity within the group.
2. The consolidating supervisor and supervisors of subsidiaries (hereafter
   called host supervisors) shall carry out this task within the colleges of supervisors established in accordance with the CRD provisions and operating under the framework provided by CEBS’s Guidelines for the operational functioning of colleges (GL 34)2 .
3. In order to facilitate the joint decision process and to avoid inconsistencies
   in the approaches followed by the various colleges, the CRD also requires that CEBS elaborates guidelines for the convergence of supervisory practices with regard to the joint decision process. These Guidelines elaborate on the requirements of Article 129(3)3 and provide concrete guidance on how to cooperate on the risk assessment process and how to apply the CRD provisions regarding ICAAP (Article 123), SREP (Article 124) and the prudential measures subject to the joint decision process (Article 136(2)).
4. Accordingly, these guidelines, which should be read in conjunction with
   CEBS’s GL 34 and, in particular, with Chapter 54 thereof, set out a common process for the joint assessment and decision process, with the aim of:

Capital Requirements Directive (CRD) is a technical expression which comprises Directive 2006/48/EC and Directive 2006/49/EC. Please note that in general references to “Directive 2006/48/EC” and “Directive 2006/49/EC” or “CRD” refer to the versions of the Directives as amended in May 2009. The amending Directive can be found under:
http://www.europarl.europa.eu/sides/getDoc.do?type=TA&reference=P6-TA-2009- 0367&language=EN&ring=A6-2009-0139 CEBS’s Guidelines for the Operational Functioning of Colleges, GL 34 (15 June 2010) http://www.c-ebs.org/documents/Publications/Standards--- Guidelines/2010/Colleges/CollegeGuidelines.aspx 3 Recital 8 of the CRD states that article 129(3) of the CRD ”should not change the allocation of responsibilities between competent supervisory authorities on a consolidated, sub-consolidated and individual basis” 4 Those Guidelines focus on the procedural part of the joint assessment and decision, elaborating on the definition of the different participants in the process, and the degree of involvement expected from them according to their supervisory responsibilities, as well

a. providing the consolidating and host supervisors with guidance in order to coordinate the results of the SREP of the entities under their supervision (performed at the individual, sub-consolidated or consolidated level according to the legal allocation of supervisory responsibilities), facilitate discussion within the colleges, enhance mutual understanding and encourage reliance on each others’ assessments; b. addressing misalignments caused by the fact that the supervision of prudential requirements is carried out on a legal entity basis whereas the institutions are often managed through other functional structures, (e.g. where key functions are centralised and host supervisors have limited access to such centralised functions);
c. facilitating the joint decision process and helping achieve consistency on
the adequate levels of own funds, above the minimum regulatory level, throughout cross-border groups; d. easing the implementation of other prudential measures, pursuant to
Article 136(1) of the CRD, that may be coordinated by the college
members on a voluntary basis; and e. enhancing convergence of practices across colleges (horizontal convergence) in the field of joint assessments and joint decisions on risk￾based capital adequacy.
5. This document takes as its starting point that the members of a college has
each carried out a supervisory review and evaluation process at the individual, sub-consolidated or consolidated level according to the legal allocation of supervisory responsibilities, using their national methodologies and Risk Assessment Systems (RAS), where applicable.
6. According to Article 129(3), only the consolidating supervisor and EEA
supervisors of subsidiaries are required to try to reach a joint decision on the risk capital adequacy of the group and its entities. However, the consolidating supervisor may consider involving non-EEA supervisory authorities in the joint assessment part of the process. Supervisors of EEA branches, in particular where these are significant, although not having supervisory responsibilities for capital adequacy, may be invited to participate in the joint assessment.
7. Depending on the business models and the risk profiles of the institutions,
the consolidating supervisor may also invite non-banking supervisors to participate in the joint assessment process.
8. Where appropriate, a reduced number of supervisors (i.e. the “core
college”) can undertake an in-depth discussion leading to a proposed joint assessment and decision, which should be then presented to and accepted by all EEA supervisors of the subsidiaries.

as relevance/significance considerations, the frequency of the joint decision and the outcome of the process, among others.

9. In order for the process to function smoothly, supervisors should
   understand the main differences in regulatory and supervisory approaches, including key specificities of RAS, in each jurisdiction.
10. In accordance with what is stated in the CEBS’s Guidelines on the
    Application of the Supervisory Review Process under Pillar 2 (GL 03)5 , the SREP should encompass the following elements:
    a. identification, review and evaluation of all material risk and control factors; b. assessment, review and evaluation of the ICAAP; and
    c. assessment, review and evaluation of compliance with the various
    minimum requirements of the CRD.
11. The results of the SREP assessments performed by each member of the
    college are reported to the consolidating supervisor using a common format to facilitate their comparison and integration. These results are then integrated by the consolidating supervisor into a preliminary consolidated report, taking into account the relevance of the subsidiaries to the group and the significance of the entities in their local markets. This integration relies to a large extent on the expert judgement of the consolidating supervisor. The report is then presented to the college and should serve as the basis for meaningful discussion and exchange of views among college members, which should in turn result in a joint understanding of the different elements of the SREP and in a joint decision on their risk-based capital adequacy. Where appropriate, the joint decision should contain any requirement(s) to hold own funds above the minimum regulatory level at the group, sub-consolidated and/or individual entity level.
12. The extent of the assessments reported by the host supervisors can be
    adapted to reflect the degree of relevance of the subsidiary to the group or the significance of the entity in the local market. The mapping of the group and its entities as described in GL 34, making explicit their relevance and significance, and shared among college members, could be used for this purpose.
13. For the sake of consistency, efforts should be made to work with data and
    information based on the same reference date, which should be as recent as possible.
14. In the spirit of ICAAP-SREP dialogue discussed in the GL 03, the process of
    the joint assessment should involve a close interaction with the banking group in question6 . In the context of the joint assessment and decision one can identify the following stages, where such interaction could take place:

• submission of ICAAP reports, if and when requested, by all the entities
  of the group subject to the ICAAP reporting requirements;

See http://www.c-ebs.org/getdoc/00ec6db3-bb41-467c-acb9-8e271f617675/GL03.aspx 6 Details on the communication of the college members with the group, in particular with respect to the Joint Assessment and Decision are spelled out in GL 34.

• dialogue between individual entities and the respective supervisors,
  which may be needed in the course of preparing the supervisory assessment;
• through the coordinated dialogue, led by the consolidating supervisor,
  between the college members and group functions, which may be needed in order to assess the centralised functions of the group rendering services to individual entities (e.g. risk management function, risk measurement, economic capital modelling, capital planning, governance issues and stress testing);
• communication of the results of the joint assessment and decision in
  the terms described in Chapter 5 of GL 34; and
• dialogue between the group, its entities, and relevant supervisors to
  discuss the results of the assessment, which may be done at the consolidated level and, where appropriate, also at the sub-consolidated or individual levels.

15. Figure 1 below provides an overview of the joint assessment and joint
    decision process.
    Figure 1. Overview of the process for the joint assessment and decision
    on risk-based capital adequacy

Authority A

Authority B

Authority C

Authority D …
Consolidating supervisor

Authority A
Authority B
Authority C
Authority D
…..
Consolidating supervisor

College discussion

• facilitated by the use of convergence tools - in order to reach a joint
  understanding of the SREP of the group and its entities as a basis for the joint decision.

National SREP results (i.e. assessment of risk and control factors, assessment of ICAAP and assessment of compliance with minimum standards set in the CRD) based on national approaches and methodologies with reference to CEBS existing guidance (GL03) Consolidating supervisor to produce the risk assessment report of the group taking into account the input provided by host supervisors. Individual templates to be annexed to the report. Discussion led by the consolidating supervisor, focused on the SREP of the group, of the signif icant or relevant entities, on the significant risks born at the group and solo level, as well as on risk management issues in a cross-border context Joint decision to be reached within 4 months* after the distribution by the consolidated supervisor of the risk assessment report of the group.

• 6 months until 31
  December 2012

Translation
Common templates and common scoring tables to summarise individual entities’ SRP results:

• Common templates and
  common scale to summarise individual assessments of risk and control factors
• Common templates and
  common scale to summarise individual assessments of ICAAP
• Common templates and
  common scale to summarise individual assessments of compliance with minimum standards set in the CRD Outcome of the process - Joint assessment of elements covered by the SREP - Joint decision on the risk -based capital adequacy - If appropriate, joint decision on the application of Article 136(2)
• Where agreed on a
  voluntary basis, decision on the application of other prudential measures under Article 136(1)
• Communication of the
  fully reasoned joint decision

16. The cooperation and coordination tools for the joint assessment and decision
    provided by these guidelines include:
    a. tables and scoring scales for summarising the results of the assessment by each competent authority of the risk factors and risk management and control factors; b. tables and scoring scales for summarising the assessment of the ICAAP framework and processes by each competent authority;
    c. tables for summarising the assessment by each of the competent
    authorities of the compliance of the supervised entities with various minimum requirements of the CRD; and d. a methodology for facilitating the college discussion leading to the shared assessment and joint decision on risk-based capital adequacy.
    1.2 Executive summary
17. Chapter 2 provides possible templates and guidance for translating the
    results of assessments of risk and control factors performed in accordance with national practices into a common format for the purposes of reporting the results of those assessments and easing their integration into the risk assessment report on the group to be produced by the consolidating supervisor. The guidance contained in Chapter 2 also aims to facilitate the discussion leading to the joint assessment of the risk factors and risk management and control factors of the group and its entities.
18. Chapter 3 provides guidance on how to translate the results of ICAAP
    framework assessments into a common format for the purposes of reporting these results and easing their integration into the report to be produced by the consolidating supervisor. The chapter also gives guidance on how college members should reach a joint assessment of the quality and robustness of the ICAAP framework, methodologies and related governance structure of the cross-border group and its entities.
19. Chapter 4 addresses aspects of the coordination of supervisory
    assessments of compliance with the various minimum requirements of the CRD, such as the evaluation of the methods and models used in advanced approaches under Pillar 1, and an evaluation of disclosures under Pillar 3. A common template is proposed for reporting the results of the assessment of compliance with the CRD requirements within the college.
20. Chapter 5 provides insights into the reconciliation of the institution’s own
    assessment of capital needs related to its risk profile and the evaluation and expectations of the members of the college of supervisors based on the joint assessment of the three elements covered by the SREP (i.e. risk factors and controls, ICAAP framework and compliance with the CRD) for the group and its entities. The Chapter also focuses on some of the main topics to be discussed in the college in the process of reaching a joint decision on an adequate level of capital at the group, sub-consolidated and individual

levels. These topics are: (i) stress tests and their effects on the level of capital; (ii) the allocation of group diversification effects and transferability of capital between the different entities in the cross-border group; as well as (iii) the types of capital that can be accepted to cover additional capital requirements. A summary table which can be used to present the overall outcome of the joint assessment and decision is also provided.

Chapter 2: The joint assessment of risk factors and risk
management and control factors in the college of supervisors
2.1 The coordination and translation of risk assessments through
common templates and scoring scales
Guideline 1. The consolidating and the host supervisors should present the results of their assessment of risk factors and risk management and control factors at the individual, sub-consolidated or consolidated level, as appropriate, through a common template and scoring scale, accompanied by explanations for the scores assigned. 21.College members should agree on a common format for reporting their assessments of the exposure to material risks and the quality of risk controls and the control environment, as well as the adequacy of corporate and internal governance. 22.Table 1 provides an example of a common template for presenting a summary of the assessments done by each authority. In order to allow for a better understanding of the risk profile of the respective entities, supervisors should supplement the summaries of the assessments provided in the table below with a narrative information, which can be supported by quantitative information if deemed appropriate. The narrative information should highlight the key strengths and weaknesses as well as explain the main drivers behind the assessments, expanding on the materiality of each risk, the effectiveness of the risk mitigation and control techniques and the degree of remaining residual risk. Where necessary, supervisors would be also expected to explain the key changes in the risk profile compared to previous assessments. 23.Depending on the specificities of an entity, exposure to risks or deficiencies in controls identified by supervisors, the template should be supplemented by more detailed information and deliberation.
Table 1: Common template for translating the assessment of the risk
profile (risk factors and risk management and control factors)

1. Overall assessment of the risk profile and key weaknesses Overall score
   (to be synthesized from elements 2, 3 and 4):
   Overall assessment of the risk profile of an entity/sub-group/group and analysis of the main strengths and key weaknesses. Overview of the major changes in the risk profile of the group compared to the previous assessment and drivers for changes in the overall assessment (narrative information followed by main conclusions)
2. Financial position Score:
   Assessment of profitability and financial development for a given time horizon (narrative information followed by main conclusions and deficiencies identified).
3. Business and risk strategy, risk tolerance/appetite, corporate and
   internal governance Score:
   Assessment of the business strategy and risk strategy of an entity/group (narrative information following by main conclusions and deficiencies identified). Assessment of the

adequacy (including implementation) of the corporate governance and internal governance frameworks (narrative information followed by main conclusions and deficiencies identified). Points to be addressed:

• risk strategy, business strategy and model;
• roles, responsibilities and organisation of the management body(ies);
• roles, responsibilities, organisation and performance of the internal control framework
  (risk control function, compliance function, internal audit function).

4. Assessment of individual risks factors
   Risk factors
   Score for risk factor assessment, where applicable Score for risk management and control assessment, where applicable Combined score7 (assessment of risk and control factors), where applicable Explanation (including identification of key strengths and weaknesses) Credit risk Risks related to risk transfer through securitisation activities8

Market risk
Operational risk
Liquidity risk
Concentration risk (both intra- and inter-risk)9

Interest rate risk from non-trading activities

The combined score is the score which reflects the assessment of both risk and control factors. Depending on the methodology and specification of individual RAS systems, supervisors may provide scores for the assessment of risk factors and the assessments of risk management and control factors or only the combined score which takes into account both, or all three, if applicable. If taken into account in the assessment of other risk areas this section could be left blank, but with an explanation of how this risk factor is taken into account under another (underlying) risk factor. Following CEBS’s Guidelines on the management of concentration risk under the supervisory review process (GL 31), intra-risk concentrations may be embedded in the risk management and assessment of the underlying risk factors (e.g. credit risk concentration captured in credit risk). If this is the case for an entity, how intra-risk concentrations are taken into account should be clearly explained, and this section could then be left blank. Inter-risk concentration needs to be assessed in any event.

Other risk factors
(please specify)

Note: For the purposes of these guidelines the list of risk factors in Table 1 is limited to the commonly agreed classification. However other risk factors – or subsets of the above-mentioned risk factors - could be considered by supervisors depending on the specificities and risk profile of the group (e.g. insurance risk, to the extent that it can affect the banking business, but bearing in mind that insurance companies within the group are subject to capital requirements and to supervision by the competent authorities). Other risks, where not included in the other factors, that may be considered are counterparty, compliance, accounting and auditing risks, macroeconomic risk etc). 24.The different elements mentioned in the common template for translating the assessments of risk factors and risk management and control factors (Table

1. are further described in Chapter 2.2.
   25.Under national RAS a variety of methods may be used by the national supervisors to derive scores and/or judgments on the different types of risks. In some cases risk levels and the quality of risk management and control factors may be measured separately; while in other cases the assessment process combines the two aspects. The college members should agree either on using separate scores for risk level and quality of risk management and control that are then aggregated into a combined score (net risk score), or on just using a net score combining the two elements, based on the definitions provided in these guidelines. 26.Given the fact that the national RAS used by individual authorities to prepare the assessments of their respective entities differ in their methodologies and output parameters, the “translation” of outcomes, pending further coordination10 of Pillar 2 processes, is likely to facilitate the joint assessment and decision process. 27.To translate their assessments of the risk levels associated with different risk factors (Elements 1 to 4 of Table 1) college members should use the scoring scale below (see Table 2). 28.Given that the assessment of risks is made at a certain point in time, supervisors should make efforts to include, in the narrative information explaining the scores, their view on the outlook for these risks for the period until the next annual joint assessment and decision.

10 European Banking Authority (EBA) may develop draft technical standards on common risk assessment methodologies in accordance with Article 124 of the CRD.

Table 2. Common scores for the assessment of risk factors11
Score Description
“Low”
Low risk of significant impact on the prudential elements12 of the group or its entities. “Medium-Low” Medium-Low risk of significant impact on the prudential elements of the group or its entities. Nonetheless, a change in the situation could relatively quickly have a significant impact, and thus the risks or weaknesses considered must be monitored. “Medium-High” Medium-High risk of significant impact on the prudential elements of the group or its entities. The entity’s risk control thus requires supervisory attention. “High” High risk of significant impact on the prudential elements of the group or its entities. The entity’s risk control thus requires heightened supervisory attention. 29.To translate their assessments of the effectiveness of risk controls and the risk control environment college members should use the following scale.
Table 3. Common scores for the assessment of risk controls
Scores Description
“Strong control”
A high level of risk management and control. The risk management and control framework is clearly defined and fully compatible with the nature and complexity of the institution's activities13. “Adequate control” An acceptable level of risk management and control. The risk management and control framework is adequately defined and sufficiently compatible with the nature and complexity of the institution's activities. “Inadequate control” The risk management and control needs improvement. The risks are insufficiently mitigated and controlled, leaving too high a residual risk for the institution. The risk management and control framework is poorly defined or insufficiently compatible with the nature and complexity of the institution's activities. “Weak control” The risk management needs drastic and/or immediate improvement. The risks are not or inadequately mitigated and poorly controlled. The risk management and control framework is neither defined nor compatible with the nature and complexity of the institution's

11 In addition to the scores defined in this table, depending on the situation, supervisors may use “not applicable” when the assessment element is not applicable to the functional activity of an entity, or “not assessed” when supervisor has not yet assessed the element for the respective entity. 12 Prudential elements, as referred to in the table above, are understood to be elements such as an institution's current and future solvency and profitability, its reputation on the market, its liquidity and the adequacy of its organisation. 13 CEBS’s High-level principles for risk management contain guidance for assessing the risk management and control framework of an institution. http://www.c￾ebs.org/documents/Publications/Standards---Guidelines/2010/Risk￾management/HighLevelprinciplesonriskmanagement.aspx

activities.
2.2. Methodology for structuring the dialogue between college
members and reaching a joint assessment of risk factors and risk management and control factors Guideline 2. The report containing the risk assessment of the group, prepared by the consolidating supervisor, should serve to structure the discussion leading to a joint assessment of the risk factors and risk management and control factors of the group and its entities within the college, under the lead of the consolidating supervisor. 30.The report containing the risk assessment of the group - produced by the consolidating supervisor after taking due account of the host assessments delivered by college members according to the principle of proportionality - serves as a basis for the dialogue between the college members. The group risk assessment report should also contain in annexes the templates reported to the college by each supervisor. A meaningful discussion should allow college members to get a shared understanding of the risk factors and risk management and control factors of the group and its entities. 31.Organised, moderated and led by the consolidating supervisor, the discussion among college members leading to a joint assessment of the risk factors and risk management and control factors of the group and its entities should be mainly focused on:
a. The assessments of the group, the relevant entities within the group and those entities which are significant in their local markets should be duly reflected in the report. The mapping of the group’s entities, as defined under GL 34, should be used in this regard. b. Material risks for the group and its entities as well as significant changes compared to the previous assessment. Material risks should be understood as risks, borne either at the consolidated or at the entity level, which may significantly impact the financial situation of the group.
c. Material deficiencies in risk management and control and other internal
governance elements (e.g. quality of the management body14, internal audit) as well as significant changes compared to the previous assessment. Material deficiencies in internal governance should be understood as ones, whether occurring at the consolidated or at the

14 The term ‘Management body’ as defined in Article 11 of the CRD should be understood to embrace different structures, such as unitary and dual board structures and not to refer to any particular board structure. The management body represents the top management level of an institution, and senior management (which is not defined in the CRD) should be understood to represent the level of management below the management body (see also CEBS’s Guidelines on the Application of the Supervisory Review Process under Pillar 2 (GL 03).

entity level, which may significantly impact the control environment of the group. d. Intra-group risk relationships, including concentration of risks in particular entities of the group, intra-group contagion channels and intra￾group transactions, which may significantly impact the risk profile of the group or individual entity. This issue might be of particular importance to a group classified as a financial conglomerate and subject to the supplementary requirements of the Financial Conglomerates Directive (2002/87/EC), and in particular its provisions on Risk Concentration in
Article 7 and on Intra-group transactions in Article 8 and also Annex II of
the Financial Conglomerates Directive (2002/87/EC). e. Risk management and internal governance issues of importance in a cross-border context (e.g. the know-your-structure principle). In situations where the risk management systems or functions, or some elements of both are centralised at the group level, the college members should discuss their adequacy for all entities which are covered by these centralised systems or functions. Where risk management systems or functions, or some elements of both, are decentralised, the college members should assess the adequacy of the integration of individual elements into the overall group risk management and control as well as the aggregation of risk management information and processes across the group. In addition, host supervisors should inform the college on how group policies and risk management instruments are implemented in their respective entities and on the efficiency of these policies, procedures and processes in relation to the local market and the specificities of the entities. Guideline 3. To facilitate a meaningful dialogue, suited to the characteristics of the group, the consolidating supervisor should lead and moderate the college discussion. Host supervisors should explain scores given to material risks and significant changes with respect to previous assessments, with more detailed explanation when the entity is relevant for the group or significant in the local market. The consolidating supervisor should focus on explaining how the host supervisors’ inputs have been taken into account in the preliminary assessment of the risks and controls at group level. 32.The explanations should be backed by quantitative and/or qualitative information to support the assessment and scores. In their discussion, and depending on the specific characteristics of the supervised group as well as its particular situation at the moment when the joint assessment is performed, the consolidating and host supervisors should focus only on the aspects of the elements listed below which have turned out to be significant. Element 1: Overall assessment of the risk profile and key weaknesses of an entity as well as significant changes since the previous assessment 33.Through discussion within the college, the college members should get an adequate understanding of the overall risk profile of the group and its entities, the main strengths and key weaknesses driving the overall assessment and significant changes since the previous assessment. This

overall view should be a synthesis derived from the assessment of the financial position, business and risk strategy, risk tolerance/appetite, corporate and internal governance and the different risk factors reviewed. Element 2: Financial position 34.Based on the consolidating and the host supervisors’ views on the financial condition of each significant entity, the college members should develop a shared view of the current financial conditions of the group and its entities and their possible development, specifying the time horizon considered. 35.When discussing the financial position of the group and its entities, college members should focus on the sources, levels, and composition of income generated as well as cost composition. The focus of the assessment should be on whether the institution’s income is sufficient to cover losses stemming from its operations, whether it offers a sustainable level of profitability and how great the level of uncertainty is regarding the main sources of income and main expense items that may influence expected future net profit. 36.The discussion within the college should also cover the asset structure and funding sources of the institution. The shared supervisory assessments should aim to highlight significant expected changes in the institution’s asset structure, funding structure and profitability. Members of the college should discuss the forward planning of business activities to generate revenue, as well as profits and capital resources, taking account of the expected development of costs. Chapter 5 of these guidelines provides more insights into issues related to the joint assessment of the capital position of a group and its entities. Element 3: Business and risk strategy, risk tolerance/appetite, corporate and internal governance15 37.The members of the college should reach a common understanding of the institution’s overall strategy, including the consistency between the business strategy and risk strategy, as well as the overall risk tolerance/appetite of the group and its entities, and how it is reflected in strategies or other targets. Supervisors should assess possible risk elements in the strategy related to growth, new products and new markets. 38.The discussion should also cover the definition of the types and levels of risks that the institution is willing to take. Furthermore the discussion should include the planning of more concrete steps with which strategic aims are to be implemented (e.g. sufficient staffing, technical and organisational resources and finance, and adequate control structures) as well as whether

15 This section should be read in conjunction with CEBS’s High-level principles for risk management, (16 February 2010), http://www.c￾ebs.org/documents/Publications/Standards---Guidelines/2010/Risk￾management/HighLevelprinciplesonriskmanagement.aspx, CEBS’s Guidelines on Remuneration Practices and Policies (GL 42) (10 December 2010), http://www.c￾ebs.org/cebs/media/Publications/Standards%20and%20Guidelines/2010/Remuneration/ Guidelines.pdf and CEBS’s Draft Guidebook on Internal Governance (CP 44) (13 October 2010), http://www.c-ebs.org/documents/Publications/Consultation￾papers/2010/CP44/CP44.aspx

the institution’s business and risk strategy is accompanied by adequate capital plans, risk policies and limit structures as well as an adequate risk management and control structure. 39.While understanding that it is the institution’s responsibility to choose and implement a particular business model, college members should also assess the organisational structure (both legal and functional), governance and risk management procedures with regard to the business model and operations of the group throughout the markets and geographies it operates in and discuss whether the risk control frameworks and internal control procedures are appropriate for the chosen business model and organisational structure. 40.Based on the individual assessments provided by the respective supervisors, the college members should discuss the consistency of business models and strategies throughout the group and whether significant changes in local strategies are duly reflected at the group level and vice versa. Special attention should be paid to recent material changes in key business lines, areas of activities and range of products (e.g. in cases of merger or acquisition) to assess the long term sustainability of the business model in all material markets in which the group operates. 41.Based on the assessments provided by the consolidating and host supervisors, the college members should get a common understanding of the adequacy of risk management and internal control systems, considering whether these systems provide for consistent aggregation of the information across the group, in particular when there is no clear alignment between the legal and operational/business structures of the group. In their assessments, college members should not only discuss the appropriateness of the internal control framework and suitability of the risk strategy for the business strategy and model, but also its implementation across the various levels of the organisation and the division of tasks and responsibilities between group and entity level functions16. 42.The discussion should also consider remuneration policies and practices, including the decision-making process involved (e.g. remuneration committees) in the group and its entities and the institution’s compliance with specific regulations17.

16 With regard to internal controls, the college members should discuss possible inefficiencies and weaknesses identified in their assessments, based on the elements of internal governance stipulated in GL 03 and CEBS’s Consultation Paper on the Guidebook on Internal Governance (CP 44) (13 October 2010): http://www.c￾ebs.org/cebs/media/Publications/Consultation%20Papers/2010/CP44/CP44.pdf. 17 For further details see EU Commission recommendations on remuneration policies in the financial services sector (30 April 2009) http://ec.europa.eu/internal_market/company/docs/directors￾remun/financialsector_290409_en.pdf. In addition, CRD III includes specific requirements regarding remuneration policies and practices, which are further elaborated in the CEBS’s Guidelines on Remuneration Practices and Policies (10 December 2010), http://www.c￾ebs.org/cebs/media/Publications/Standards%20and%20Guidelines/2010/Remuneration/ Guidelines.pdf

43.In the assessment of the internal audit function, college members should review how the function performs the tasks assigned by the legislation in relation to the use by the bank of advanced models for Pillar 1 purposes18. Element 4: Assessment of the main risk factors 44.The college members should discuss in the college framework all material risks taken by the group and its entities, evaluating them with reference to the degree of exposure (risk exposure) and the arrangements made for managing and controlling risks (mitigating factors). Although the material risks for each entity may vary according to their features, some of the main risk factors to be discussed in colleges could include19:
a. credit risk, including residual risk associated with the use of recognised credit risk mitigation techniques; b. risks related to risk transfer through securitisation activities;
c. market risk;
d. operational risk; e. liquidity risk; f. concentration risk (intra- and inter-risk concentrations), including compliance with CRD large exposure rules (LER); and g. interest rate risk from non-trading activities20. 45.Supervisors may also discuss their respective assessments of the compliance of the group’s entities under their supervision with the rules on large exposures set out in Articles 106 to 118 of the CRD, and in CEBS’s guidelines and standards issued on that subject21.

18 As some examples, according to point 26 of Part 6 of Annex III of the CRD, an internal audit process should address credit counterparty risk (CCR management system); paragraph 131, Part 5.3 of Annex VII of the CRD requires internal audit or another comparable independent function to review at least annually the credit institution's rating systems and its operations, including the operations of the credit function and the estimation of PDs, LGDs, ELs and conversion factors; and, according to paragraph 56 of
Part 3 of Annex VIII of the CRD internal audit should cover an institution’s system for the
estimation of volatility adjustments; etc.
19 For the purposes of these guidelines the list of risk factors in this summary table is limited to the commonly agreed classification. However other risk factors – or subsets of the above-mentioned risk factors - should be considered by supervisors depending on the specificities and risk profile of the group. 20 See http://www.c-ebs.org/getdoc/e3201f46-1650-4433-997c￾12e4e11369be/guidelines_IRRBB_000.aspx, which elaborate on the requirements of
Article 124(5) with respect to IRRBB.
21 CEBS’s Guidelines on reporting requirements for the revised large exposures regime, (11 December 2009) http://www.c-ebs.org/documents/Publications/Standards--- Guidelines/2009/Large-exposures_all/Guidelines-on-Large-exposures_connected-clients￾an.aspx

46.Particular attention should be paid to situations where exposures are in breach of the LER and to the measures imposed by the relevant supervisors during the time period given to the institutions to comply with the LER, such as where a supervisor requires deduction of such excess exposures from regulatory capital as it affects the assessment of the overall level of capital and risk-based capital adequacy. 47.It should be also noted that depending on the approach and specificities of the national RAS, some risk factors may be assessed as a part of other risk factors. In those cases, the respective row of the template can be left blank provided that the narrative information explains how that factor is taken into account within the assessment of a different risk factor. For example, risks related to risk transfer through securitisation activities could be assessed as a
part of credit risk; in that case there is no need to assess it separately and
the corresponding field could be left blank, subject to the explanation how this risk factor is taken into account under credit risk. 48.Following CEBS’s Guidelines on the management of concentration risk under the supervisory review process (GL 31)22, intra-risk concentrations may be embedded in the assessment of the underlying risk factors (e.g. credit risk concentration captured in credit risk). If this is the case, the approach should be clearly explained. However, inter-risk concentrations need to be assessed individually as stipulated in GL 31. 49.In addition to the assessment of the overall level of liquidity risk and associated control factors – for which college members should select, monitor and share a set of indicators drawn from the CEBS’s Liquidity ID card23 - supervisors should discuss the compliance of the group and its entities with the minimum requirements for liquidity management (see Annex V points 14 to 22 of the CRD and CEBS’s Recommendations for liquidity risk management24).

22 See http://www.c-ebs.org/documents/Publications/Standards--- Guidelines/2010/Concentration-risk-guidelines/Concentration.aspx 23 CEBS Liquidity Identity Card (22 June 2009) http://www.c-ebs.org/getdoc/9d01b79a￾04ea-44e3-85d2-3f8e7a9d4e20/Liquidity-Identity-Card.aspx 24 See Second part of CEBS’s technical advice to the European Commission on liquidity risk management (18 September 2008) http://www.c-ebs.org/getdoc/bcadd664-d06b￾42bb-b6d5-67c8ff48d11d/20081809CEBS_2008_147_(Advice-on-liquidity_2nd-par.aspx , and CEBS’s Guidelines on liquidity buffer and survival period (9 December 2009) http://www.c-ebs.org/documents/Publications/Standards---Guidelines/2009/Liquidity￾Buffers/Guidelines-on-Liquidity-Buffers.aspx

2.3. Reaching a joint assessment of the risk factors and risk
management and control factors of the group and its entities Guideline 4. The dialogue among college members should result in a joint assessment of the risk factors and risk management and control factors of the group and its entities, which highlights the main vulnerabilities in terms of risk exposures and internal controls across the group. 50.The final joint assessment - which may differ from the preliminary assessments as a result of the college dialogue - of the risk factors and risk management and control factors, contained in the final report and serving as a basis for the joint decision should be mainly focused on:
a. the risk assessments of the group and its relevant and significant entities as defined above; b. the significant risks for the group and its entities; and
c. risk management issues in a cross-border context.
51.The joint assessment of risk factors and risk management and control factors may be designed as set out in Table 4 below.
Table 4. Summary table of the joint assessment of risk and control factors
Entity Entity X/ Sub￾group X
(score)
Entity Y/ Sub￾group Y
(score)
Entity Z/ Sub￾group Z
(score)
GROUP TOTAL
(score)
Overall score
Financial position
Business and risk strategy, risk tolerance/appetite, corporate and internal governance

Individual risk factors (using the combined scores) Credit risk Market risk Risks related to risk transfer through securitisation activities

Operational risk
Liquidity risk
Concentration risk

(intra- and inter-risk)
Interest rate risk from non-trading activities

Other risk factors
(please specify)
Major deficiencies and observations
Narrative information
Conclusions and explanations
Narrative information
Rows for risks related to both risk transfer through securitisation activities and concentration risk (intra-risk) may be left blank where assessed under other risk factors.

Chapter 3: Joint assessment of the ICAAP processes and
methodologies for cross-border groups at the consolidated, sub-consolidated and/or solo levels
3.1 Coordination and translation of assessments of the ICAAP
processes through common templates and scoring tables Guideline 5. A common template and scoring scale should be used by the consolidating and host supervisors to share the results of their assessments of consolidated, sub-consolidated and/or individual entities’ ICAAP processes. 52.Table 5 provides an example of a template summarising the supervisors’ assessments. Supervisors should supplement it with narrative information, accompanied with quantitative information where appropriate.
Table 5. Common template for translating the ICAAP process
assessments
Entity
Score Explanation
Overall ICAAP score
Where applicable:
ICAAP scope, including:
entities covered
(organisational scope) risks covered
ICAAP methodologies
Diversification assumptions25
Stress testing framework
ICAAP governance and internal control
Major deficiencies and observations
Narrative information
Conclusions and explanations Narrative information 53.The common scoring scale to be used in the assessments of the accuracy and robustness of the ICAAP methodologies and processes is defined in Table 6.

25 The assessment of diversification assumptions used in the economic capital model for ICAAP purposes is seen as a part of the assessment of the ICAAP framework and processes and should not pre-empt the discussion regarding the recognition of diversification benefits in the final capital estimates by supervisors (SREP capital).

Under this scale, the lower the rating the more adequate the supervisors deem the methodologies and processes developed by the institution for its ICAAP framework, i.e. the more accurate the internal methodology for deriving internal capital estimates is considered to be for the assessment of capital adequacy from a supervisory point of view. When reporting to the consolidating supervisor and discussing in the college the results of their ICAAP reviews, supervisors should justify the scores assigned.
Table 6. Common scores for assessment of the accuracy and robustness
of the ICAAP methodologies and processes
Scores Description
(“Good”)
Methodologies and processes are of good quality. They make it possible to determine a precise and accurate estimate of internal capital needs both overall and per risk factor, where applicable. (“Satisfactory”) Methodologies and processes are of satisfactory quality. They make it possible to determine an estimate of internal capital both overall and per risk factor, where applicable, which - if not precise - is conservative and prudent. (“Unsatisfactory”) Methodologies and processes are of unsatisfactory quality. They potentially underestimate the internal capital needs both overall and per risk factor, where applicable. (“Largely insufficient”) Methodologies and processes are largely insufficient. They significantly underestimate the internal capital needs both overall and per risk factor, where applicable. 54.This template can be expanded to cover individual risk factors assessed by the institution’s ICAAP so the scores may be assigned by risk factors captured under the ICAAP to reflect whether the methodologies and processes provide adequate estimates of the internal capital requirements. When the scores are assigned by risk factor, rows may be left blank for risks that are not covered with internal capital to the extent that this approach has been deemed justifiable under the supervisory assessment, i.e. when this exclusion is fully reasoned and documented. 55.However, a single score may be assigned reflecting the overall review of the ICAAP framework when it suits better the methodologies followed by the respective supervisors for the assessment of the ICAAP (the current format of
Table 5).

3.2. Methodology to structure the dialogue between college
members and reach a joint assessment of the ICAAP process
3.2.1 ICAAP scope
Guideline 6. Through dialogue structured by the consolidating supervisor the college members should reach a joint view on whether the ICAAP framework, at the group and entity levels, adequately captures all relevant entities and business lines, as well as current and expected material risks. 56.In accordance with CEBS’s GL 03, the ICAAP should be comprehensive both in terms of risks captured and in terms of business lines and entities. In other words, the supervisors should reach a joint understanding of how the group and its entities meet the criteria set out in principles ICAAP 1, ICAAP 6 and ICAAP 7 of CEBS’s GL03.
3.2.2 ICAAP methodologies
Guideline 7. The college members should, subject to the principle of proportionality and under the coordination of the consolidating supervisor, discuss the extent to which processes and methodologies used by the institutions generate reasonable, comprehensive, risk￾based, robust and sufficiently precise ICAAP outcomes, both overall and per risk factor. 57.The college members should assess whether the methodologies used for risk measurement under the ICAAP are consistent across the group, allow for the construction of a consolidated view and take due account of the nature, size and complexity of the different activities performed throughout the group, including any non-regulated activities. 58.The consolidating and host supervisors should discuss the quality, methodologies and processes used for internal capital purposes per risk-type taking due account of proportionality concerns. They should determine whether their outcome provides an adequate estimate of the internal capital requirements and is sufficiently forward looking. 59.The discussion should be based on supervisory understanding of how the group and its entities meet the criteria set out in principles ICAAP 9, ICAAP 8 and ICAAP 10 of CEBS’s GL03. Guideline 8. When an economic capital model is used for ICAAP purposes, the college members, under the coordination of the consolidating supervisor, should assess its relevance, from both group and single-entity perspectives, including diversification assumptions and the allocation of capital to business lines and entities.

60.Commonly (large) cross-border groups use internal (economic capital) models26 as a key building block of their ICAAP. When this is the case, college members should pay particular attention to the quality and suitability of the methodology related to the different entities of the group, its level of conservatism, the treatment of correlations and diversification effects and the methodology for capital allocation to business lines or entities. In addition, supervisors should look into the ICAAP control environment to ensure the appropriateness of the quantification and avoid over reliance on risk models. 61.Institutions may assume diversification effects within their economic capital models. These can be regarded from different viewpoints, e.g. diversification within risk factors (intra-risk diversification), between risk factors or risk drivers (inter-risk diversification) and between group entities (cross-border diversification). The latter dimension is of particular interest within the context of the joint decision on capital adequacy and is further explored in
Chapter 5.2.2.
62.Another important element concerns the mechanism (criteria and techniques) for allocating the consolidated internal capital numbers to subsidiaries with regard to their respective risk profile. The college members, while acknowledging that economic capital can be allocated along business lines, should consider the existence of a risk sensitive allocation of internal capital at the level they are responsible for. Guideline 9. The college members, under the coordination of the consolidating supervisor, should discuss the reliability of the institution’s capital planning based on stress test results. Particular attention should be paid to the scope of the stress testing programme, the shock transmission mechanisms and the consideration of stress testing within the risk management systems at the consolidated and relevant entities levels. 63.Pursuant to the CEBS’s revised Guidelines on stress testing (GL 32),27 stress test results should be used to assess the viability of the capital plan in adverse circumstances. To this end, the consolidating and host supervisors should determine whether stress tests carried out by the institution are consistent with these Guidelines and, in particular whether a range of scenarios, including a severe economic downturn and/or a system-wide shock on liquidity are considered. 64.For the assessment of the stress testing programme under ICAAP, supervisors should refer to GL 32. In the context of the joint decision process, they should pay particular attention to the scope of the stress-testing framework, which should be group-wide and also be performed for all entities for which ICAAPs are required.

26 For an overview of issues surrounding economic capital modelling, please refer to:
BCBS, March 2009, “Range of practices and issues in economic capital frameworks”, www.bis.org. 27 See: http://www.c-ebs.org/documents/Publications/Standards--- Guidelines/2010/Stress-testing-guidelines/ST_Guidelines.aspx

3.2.3 ICAAP governance and internal control28
Guideline 10. The college members, under the coordination of the consolidating supervisor, should discuss the appropriateness of the governance aspects related to a cross-border banking group’s ICAAP. 65.CEBS’s GL03 contains principles setting out what supervisors expect from institutions regarding the governance aspects of their ICAAP (ICAAP 2, 3, 4, 5 of GL 03). The following elements are of particular importance:
a. The level of involvement of the management body29 of each entity of the group. The management body should set effective strategies and policies to maintain, on an on-going basis, amounts, types and distribution of both internal capital and own funds adequate to cover the risks of the entity being considered. Such policies would typically involve the frequency of revision of the ICAAP outcome by the management bodies of the group and the respective entities (including independent reviews), the capital planning and capital targets of the institution (at group and entity level), take into account internal as well as external factors (e.g. market expectations and rating agencies), and cover the (target) distribution of capital over the group’s entities and the composition of its capital. b. The extent to which the ICAAP forms an integral part of the management process and decision-making culture of each entity.
c. The development and maintenance of strong internal control systems by
the management body of each entity, including the quality of audit methods and processes regarding the ICAAP.
3.3 Reaching a joint assessment of the group and its entities’
ICAAP
Guideline 11. The dialogue among college members should result in a joint assessment of the ICAAP of the group and its entities 66.The final joint assessment of the ICAAP of the group and its entities, which may differ from the preliminary assessments as a result of the college dialogue produced within the college should be mainly focused on:
a. major deviations between the ICAAP outcomes and supervisory assessments regarding capital at the aggregate and/or entity levels; b. identified deficiencies in the control environment;
c. the validity of diversification assumptions; and
d. identified deficiencies in the modelling approaches that are used by an institution.

28 This section should be read in conjunction with CEBS’s GL 03. 29 As defined in Article 11 CRD.

67.A common summary table to report the outcome of the joint ICAAP assessment reached through the process described in this Chapter may be designed along the following lines. Table 7 below is built on the aggregation of the preliminary supervisory assessments of the ICAAP, updated where needed as a result of the college discussion, using the scoring discussed in
Chapter 3.1, where applicable.
Table 7. Summary table of the joint ICAAP process assessment
Entity Entity X/ Sub￾group X
Entity Y/ Sub￾group Y
Entity Z/ Sub￾group Z
GROUP TOTAL
Overall ICAAP score
Detailed score (where applicable):
ICAAP scope, including:

entities covered
(organisational scope)

risks covered
ICAAP methodologies

Diversification assumptions
Stress testing framework
ICAAP governance and internal control
Major deficiencies and observations
Narrative information
Conclusions and explanations
Narrative information

Chapter 4: The joint assessment of compliance with the
various minimum requirements set out in the CRD
4.1 Coordination and translation of individual assessments
through a common template
Guideline 12. Consolidating and host supervisors should present the results of their assessments of compliance with the CRD requirements by the entities under their supervision using a common template. 68.Table 8 provides an example of such a common template building on the elements discussed in Chapter 4.2, to be used to present a summary of the assessments done by each authority.
Table 8. Common template to report assessments of compliance with the CRD
requirements
Entity:
Topic Material deficiencies identified Measures taken or considered Advanced approaches under Pillar 130 Narrative information Narrative information Disclosure requirements31 Narrative information Narrative information Conclusions and explanations, if deemed necessary Narrative information
4.2 Methodology to structure the dialogue between college
members and reach a joint assessment of compliance with the various minimum requirements set out in the CRD Guideline 13. To facilitate a meaningful dialogue in the college, suited to the characteristics of the group, the college members, under the lead of the consolidating supervisor, should agree on the main elements to be covered in the college discussion on compliance with the various minimum requirements of the CRD for the group and its entities.

30 For the purpose of these Guidelines the template brings together the compliance criteria for advanced models for credit, operational and market risks. In the application of the Guidelines, college members may agree on a more detailed breakdown of the compliance criteria differentiating between credit, market and operational risk models and also introduce other more detailed elements to the template, where needed. 31 College members may agree on using a detailed breakdown of disclosure requirements as stipulated in Annex XI of the CRD and CEBS’s standards and guidelines on the subject (see Element 2 of Guideline 13).

69.Article 124(1) of the CRD requires the consolidating and host supervisors to review the arrangements, strategies, processes and mechanisms implemented by the institution to comply with the requirements of the CRD.
Annex XI of the CRD provides a list of elements, which need to be considered
in the course of the SREP, including results of stress tests for credit risk (IRB institutions) and market risk (internal models institutions), concentrated exposures and concentration risk management, residual risk stemming from the use of credit risk mitigation techniques, risk transfer through securitisation, liquidity risk management, and the impact of diversification. 70.In addition, GL 03 suggests that as a part of the evaluation of compliance with CRD minimum requirements, supervisors should look at the methods used in the advanced approaches under Pillar 1, as well as at large exposures, and should evaluate the quality of disclosures under Pillar 332. 71.The discussion in the college should focus, where relevant, on compliance with all of the above-mentioned elements, which are covered in detail by various CEBS’s standards and guidelines, to the extent they were not previously discussed when assessing risks and control factors (see Chapter 2) and the ICAAP process (see Chapter 3). The following elements should be discussed in particular. Element 1: Compliance with the minimum requirement for advanced approaches under Pillar 133 72.In addition to the issues related to the model validation and approval process, which may influence the outcome of the assessment of the risk-based capital adequacy, the consolidating and host supervisors could exchange information on issues like the constant use of the regulatory approved models in internal risk management (on-going review of the use test), model modifications, changes to and updates of data series, and more formal issues like the roll￾out of advanced models across the group, and the fulfilment of conditions, if any, set in the decision (permission) on model use. 73.When discussing this issue, college members could pay particular attention to changes in the conditions of the application of the advance models since their approval by supervisors, such as changes in methodologies, data quality, scope, quantitative and qualitative procedures (e.g. components of the models and their control environment), and technological environment. 74.Particular attention should also be paid to the fulfilment of specific terms and conditions attached to the permissions to use advanced measurement approaches when initially approved under Article 129(2) of the CRD, especially when such terms and conditions are related to implicit or explicit capital add-ons (e.g. to mitigate insufficient length and population of data series supervisors may have agreed to impose a floor above the regulatory

32 See Guideline 6 of the CEBS’s GL 03. 33 This section should be read in conjunction with the CEBS’s Guidelines on the implementation, validation and assessment of Advanced Measurement (AMA) and Internal Ratings Based (IRB) Approaches, GL 10 (4 April 2006) http://www.c￾ebs.org/getdoc/5b3ff026-4232-4644-b593-d652fa6ed1ec/GL10.aspx

transitional floor or requested the institution to hold a higher level of own funds). 75.When assessing compliance with the minimum requirements of the CRD related to post-model validation work and the roll-out of advanced models across the group, consolidating and host supervisors should follow the procedures agreed for the model validation, including division of tasks and responsibilities. CEBS has addressed these matters in its Guidelines on the implementation, validation and assessment of Advanced Measurement (AMA) and Internal Ratings Based (IRB) Approaches34 and the Guidelines for operational functioning of colleges35. Element 2: Compliance with disclosure requirements under Pillar 3 76.Pillar 3 requirements as set out in Articles 145-149 of the CRD are (in accordance with Article 72(1)) applicable at the level of the EU parent credit institution / financial holding company, although significant subsidiaries must disclose the information (on capital and minimum requirements) set out in
Annex XII, Part 1 point 5 of the CRD. CEBS has issued disclosure guidelines in
response to the lessons learnt from the financial crisis (GL 30)36. This work – even when not specifically aimed at Pillar 3 – provides a useful point of reference for the discussion within a college.
4.3 Reaching a joint assessment of compliance with the various
minimum requirements set out in the CRD
Guideline 14. The dialogue among college members should result in a joint assessment, highlighting the main vulnerabilities and deficiencies, of the group and its entities’ compliance with the various minimum requirements of the CRD as discussed in Chapter 4.2. 77.Reflecting the discussions held within the college, the joint assessment – which could differ from the initial assessments as a result of the college dialogue - contained in the final report and serving as a basis for the joint decision should be mainly focused on:
a. the assessments of the compliance of the group and its entities with the minimum requirements of the CRD and corresponding CEBS’s standards and guidelines, clarifying specific CRD requirements; b. material deficiencies in compliances; and

34 CEBS’s Guidelines on the implementation, validation and assessment of Advanced Measurement (AMA) and Internal Ratings Based (IRB) Approaches, GL 10 (4 April 2006) http://www.c-ebs.org/getdoc/5b3ff026-4232-4644-b593-d652fa6ed1ec/GL10.aspx 35 CEBS’s Guidelines for the Operational Functioning of Colleges (15 June 2010) http://www.c-ebs.org/documents/Publications/Standards--- Guidelines/2010/Colleges/CollegeGuidelines.aspx 36 CEBS’s Disclosure Guidelines: Lessons learnt form the financial crisis, GL 30 (26 April
2010) http://www.c-ebs.org/documents/Publications/Standards---
Guidelines/2010/Disclosure-guidelines/Disclosure-principles.aspx

c. risk management and control issues related to compliance with the CRD
requirements in a cross-border context (e.g. centralised modelling or internal model validation function, group-wide data pooling and use of data from other markets/geographies etc). 78.The joint assessment contained in the final report should make a clear distinction between compliance with the direct requirements of the CRD (elaborated in CEBS’s standards and guidelines) and requirements stemming from the application of national discretions and additional to the CRD requirements implemented in national legislation. 79.The joint assessment of compliance with the CRD requirements throughout the group may be presented as in Table 9 below.
Table 9. Summary table assessment of compliance with the CRD requirements
Entity X/ Sub-group X Entity Y/ Sub-group Y Group total Topic Material deficiencies identified Measures taken or considered Material deficiencies identified Measures taken or considered Material deficiencies identified Measures taken or considered Advanced approaches under Pillar 137

Disclosure requirements38

Conclusions and explanations
Narrative information

37 For the purpose of these Guidelines the template does not distinguish between advanced models for credit, operational and market risks, and the compliance criteria are amalgamated. In the application of the Guidelines, college members may agree on a more detailed breakdown of compliance criteria differentiating between credit, market and operational risk models. 38 College members may agree to use a detailed breakdown of the disclosure requirement as stipulated in Annex XI of the CRD and CEBS’s standards and guidelines on the subject (see Element 2 of Guideline 13).

Chapter 5: Determination of the adequate levels of own
funds at the group and entities levels
80.This Chapter provides an overview of the main topics to be discussed by the consolidating and host supervisors within the college in order to reach an agreement and joint decision on risk-based capital adequacy39 for the group and its entities. The successful outcome of this discussion process is based on the following key principles:
a. Supervisors should first reconcile the outcome of the risk and control assessments (see Chapter 2) with the results of the assessments of the respective entities’ ICAAP and resulting internal capital estimates (see
Chapter 3). This process will determine the extent to which the internal
capital estimates meet the current and forward-looking supervisory views on risks. b. Taking into account the outcome of the ICAAP assessments and internal capital estimates, supervisors should define the extent to which benefits from the diversification effects can be taken into account in the determination of capital adequacy.
c. Looking at the outcomes of the institution’s capital planning stress tests,
supervisors should consider to what extent they are covered by appropriate capital reserves (buffers) at group level and sub￾consolidated/solo levels and whether additional levels of capital should be required to cover the impact of the chosen scenarios. Supervisors should take into consideration the deficiencies identified in the assessment of compliance with the various minimum requirements of the CRD (see
Chapter 4) to the extent that the capital measure might be affected.
81.As a result of this analysis, additional levels of own funds above the regulatory minimum may be deemed necessary. In the light of the overall assessment of capital adequacy, supervisors may also consider that no corrective action is required or that prudential measures other than additional levels of own funds can more effectively address the identified deficiencies. The college members may agree to adopt measures other than additional levels of own funds on a voluntary basis since the provisions of Article 129(3) do not call for a joint decision to be reached on such other actions.

39 The assessment of the capital position of an institution would take into account the institution’s time horizon used for ICAAP purposes or prevailing regulatory requirements for the ICAAP time horizon. As a minimum, the forward-looking assessment should cover one year and be relevant until the next regular joint assessment and decision process.

5.1 Translation of the assessment of capital adequacy of individual
entities
Guideline 15. The consolidating and host supervisors should present the results of their assessments using a common template. 82.College members should agree on a common format to report the outcome of their risk assessments of the components discussed in Chapters 2 to 4, and reconciliation of these assessments with the institution’s internal capital estimates and supervisory views on the appropriate level of capital (capital requirements). The reconciliation of risk and ICAAP assessments made by each supervisor can be carried out, depending on the supervisory approach taken, on a risk-by-risk or on a more holistic basis and should take place in dialogue with the institution. 83.Table 10 provides an example of such a common template, summarising the assessments done by each authority. It does not intend to provide a mechanistic link between the scores given to risk factors, Pillar 1, ICAAP and capital numbers. Adequate capital levels as evaluated by the supervisors should be provided in terms of overall requirements or in terms of additional amounts of capital by risk factors, depending on the approach taken. 84.Table 10 provides a summary of:
a. The results of the assessment of risk and control factors (column 1), using the assessment criterion referred to in Chapter 2, as well as an overall score reflecting the risk profile of the institution. Instead of a single combined score for each risk factor reflecting both the assessment of the risk profile and risk management and control factors, college members may report separate scores for risk level and quality of management and control as discussed in Chapter 2, which would result in modification of the table. b. Pillar 1 regulatory capital requirements broken down by risk factor (column 2) and overall amount of regulatory capital required compared to the amount of available own funds for regulatory purposes, as described in Article 57.
c. The level of internal capital as calculated and allocated within the ICAAP
of an entity (column 3). This should be provided, if possible, per risk factor and category, depending on the approach taken by the institution or required by the supervisor. d. The supervisory view on the levels of capital (column 4) that the respective supervisor would expect the institution to hold taking into account the results of the risk and ICAAP assessments (including under stressed conditions)40 Depending on the approaches adopted by supervisors, these levels can be provided either in terms of overall requirements or in terms of additional amount of capital by risk factors

40 Depending on the approach chosen, college members may agree to modify the table and split both ICAAP and SREP capital estimates differentiating between stressed and unstressed conditions.

(capital add-ons). This column may be amended during the joint decision process to reflect the agreed outcomes. e. The score for the ICAAP process assessment as discussed Chapter 3. f. The additional levels of capital that supervisors may require where there is a breach of the CRD requirements as discussed in Chapter 4 or which have been agreed with the institution to compensate for some deficiencies in the advanced models used for Pillar 1 regulatory capital calculations. g. The reduction in capital that has been recognised where diversification benefits (intra- and/or inter-risk) have been accepted by the respective supervisor. h. The additional levels of capital (capital buffer) estimated by the institution or required by the supervisor to cover the impact of stressed conditions (stress testing buffer), if not directly incorporated into the ICAAP and SREP capital estimates per risk factor.

Table 10. Common template to report the preliminary individual results of the risk-based capital requirements
Entity:
Score
(1)
Pillar 1 regulatory capital requirements
(2)
(amount)
ICAAP capital estimate
(3)
(amount)
SREP capital estimate41
(4)
(amount)
Comments and explanation / TOTALS
(5)
Overall score
Financial position
Risk strategy, risk tolerance/appetite, corporate and internal governance Credit risk Where applicable Where applicable Risks related to risk transfer through securitisation Where applicable Where applicable Market risk Where applicable Where applicable Operational risk Where applicable Where applicable Concentration risk (intra- and inter-risk) Where applicable Where applicable Liquidity risk Where applicable Where applicable Interest rate risk from non-trading activities Where applicable Where applicable Other risk factors (please specify) Where applicable Where applicable ICAAP score Compliance with CRD requirements Where applicable Effect of diversification benefits (intra￾and inter-risk)42 Where applicable Where applicable 41 College members may calculate the SREP capital and, where appropriate, capital add-ons by risk types or through an overall figure.

Stress testing buffer Where applicable Where applicable Total P1 capital requirement /ICAAP capital estimate/SREP estimate Either ratio or amount Total amount of available regulatory own funds Either ratio or amount Other financial resources to cover ICAAP estimates (amount) Either ratio or amount Rows for risks related to both risk transfer through securitisation activities and concentration risk (intra-risk) may be left blank where assessed under other risk factors. 42 If deemed necessary the impact of diversification effects could be further broken down to inter-risk, and intra-risk within credit, market, operational and other risk factors.

85.Both the consolidating and host supervisors should complement the table with written comments drawing the main conclusions from their capital adequacy assessments and the rationale for requiring additional levels of own funds above the regulatory minimum (capital add-ons), where necessary. If the college members agree to include corrective actions other than additional capital requirements under the joint decision process, supervisors should report to the consolidating supervisor and inform other college members of any prudential measures envisaged as well as the rationale for them.
5.2 Methodology to structure the dialogue between college
members in order to reach a joint decision on risk-based capital adequacy
5.2.1 Reconciliation between the ICAAP outcomes and the supervisory
assessments
Guideline 16. The college members, under the coordination of the consolidating supervisor, should reconcile supervisory risk assessments and ICAAP outcomes, taking due account of the levels of own funds that are available to the institution. 86.The evaluation of capital adequacy by the college members should be based on the results of the joint risk assessment and the joint ICAAP assessment as referred to under Chapters 2 and 3; the assessment of compliance with the various minimum requirements of the CRD (Chapter 4) will also need to be taken into account. 87.If other supervisory measures are deemed inadequate, additional levels of own funds beyond the minimum regulatory requirements can be considered as a remedy to address identified deficiencies (taking account of the level of own funds that is available to the institution), such as:
a. significant and persistent deficiencies in the institution’s internal control system, or deficiencies likely to materialise in a restructuring; b. persistent doubts concerning the adequate coverage of risks, particularly in cases of uncontrolled growth or excessive concentrations of exposures to counterparties, business sectors, or geographical areas;
c. significant amounts of losses anticipated, or insufficient profitability,
which could reduce the amount of own funds and consequently the solvency ratio; and d. rapid or significant growth in existing activities, or the starting-up of new activities, without sufficient safeguards, or when the risks associated with the scale of activity at the level of the institution, a market, or the system as a whole are increasing.

5.2.2. Treatment of diversification effects and allocation of capital across
the group43
Guideline 17. The college members, under the coordination of the consolidating supervisor, should discuss diversification effects for capital adequacy purposes and agree on their recognition under Pillar 2. 88.The college members should assess and discuss the extent to which diversification benefits calculated using an economic capital model play a role in the overall internal capital estimates. 89.In any event, the total capital buffer to be assessed in the SREP should adequately cover all risks an institution is exposed to (including Pillar 1 and Pillar 2 risks) and should allow it to withstand severe systemic and idiosyncratic (institution specific) shocks. 90.As the estimation of the effects of diversification benefits is closely embedded into an institution’s economic capital model, the assessment of diversification should be part of the overall assessment of the economic capital model and include44 :
a. the validity and stability of the correlation assumptions, including the existence of large enough historical data sets and of different time horizons by risk factor; b. the reliability and conservatism of estimations and the adequacy of input data and calculation methodology;
c. the degree of robustness of individual calculations, and their stability
over an economic cycle; and d. mechanisms used for allocation of internal capital estimates and diversification benefits to individual entities. 91.Possible weaknesses in the assumptions of changes in correlations at times of crisis, as well as contagion phenomena among risks of different natures need to be taken into account. Guideline 18. The college members, coordinated by the consolidating supervisor, should consider the level of capital for each subsidiary, the scope of their risk management and control structure and material restrictions to capital transferability to determine whether

43 These guidelines are “process-oriented”, merely identifying what elements should be discussed within colleges. They do not propose a common European stance on the recognition of diversification benefits, which is elaborated in the CEBS’s position paper on the recognition of diversification benefits under Pillar 2 (2 September 2010), http://www.c-ebs.org/documents/Publications/Other￾Publications/Others/2010/Diversification.aspx 44 For more details regarding the possible assessment criteria of diversification see CEBS’s position paper on the recognition of diversification benefits under Pillar 2 (2 September 2010): http://www.c-ebs.org/documents/Publications/Other￾Publications/Others/2010/Diversification.aspx

diversification benefits across the group can be recognised when deciding upon capital adequacy. 92.When deciding upon the adequate levels of own funds at the group and solo levels, the college members should consider the appropriateness of the institution’s allocation of capital across the group.
93. While recognising the specificities of an institution’s economic capital models
and acknowledging that internal (economic) capital could be allocated along business lines instead of to legal entities, the college members should discuss the allocation mechanism of the internal capital to the subsidiaries, which are subject to capital requirements and supervision under the CRD. In particular, the college members should determine:
a. to what extent the allocation approach is coherent with the legal and organisational structure of the group; b. how the internal capital is allocated to subsidiaries;
c. how the allocation approach addresses the actual stand-alone risk profile
of an entity which receives allocated capital (see also the discussion on the recognition of diversification benefits in Section 5.5.2); d. how the allocation approach deals with regulatory constraints that may be imposed on the different entities in the group; and e. how the local management ensures the adequacy of the allocated internal capital.
94. The college members should also determine whether the institution is able
to demonstrate that the group’s capital can be made available in a timely manner, especially in stressed conditions, to entities that need it, i.e. they should obtain sufficient evidence that no material obstacles impede the transferability of capital between group entities.
5.2.3 Determination of capital adequacy with a forward looking
perspective and under stressed conditions Guideline 19. Based on the assessment of the institution’s stress tests, the college members, coordinated by the consolidating supervisor, may require institutions to put in place specific capital buffers or targets, taking into account the outcomes of group-wide stress tests and stress-tests for all the entities for which an ICAAP is required.
95. Pursuant to the CEBS’s revised Guidelines on Stress Testing (GL 32),
supervisors should review stress testing outputs in order to assess the resilience of individual institutions to adverse economic conditions and whether they are able to maintain sufficient capital and liquidity. In doing this, supervisors should take into account details of movements in capital and capital needs, and liquidity and liquidity needs, under stressed conditions. To that end, supervisors should assess whether the institution is able to remain

above the minimum required regulatory capital ratios at all times in a severe but plausible stressed event. They may also consider how the quality of capital the institutions holds affects the results of the stress test and should ensure that capital is available to absorb losses and increases in regulatory capital requirements.
96. With a view to assessing the forward-looking perspective of the capital plan,
and taking into account the results of stress tests performed as a part of the ICAAP and the risk mitigation actions taken or planned by the institution, the college members may agree on setting additional institution specific (idiosyncratic) capital buffers and/or liquidity buffers, or target capital/liquidity ratios, where permitted in national legislation. Where necessary, supervisors may also require the institution to maintain appropriate additional institution-specific capital buffers at the current time such that those reserves are available to absorb losses during a severe scenario.
5.2.4. Internal capital estimates and regulatory capital requirements
Guideline 20. College members should understand the drivers behind the differences between the internal capital estimates and regulatory capital requirements. 97.Comparison between internal capital estimates and Pillar 1 minimum capital requirements generally helps with understanding the sources of the differences between ICAAP figures and regulatory figures for risks covered by Pillar 1 and also helps with assessing whether the internal capital needs or targets determined by the institution adequately reflect its risk profile. This comparison is of particular importance when the institution is relying on an economic capital model as a building block for its ICAAP capital estimate. 98.The discussion within the college should cover both the quality of internal capital estimates compared to regulatory capital (numerator) and internal capital requirements compared to Pillar 1 capital requirements (denominator), with a view to reaching a common understanding of the differences and their explanation. 99.Diversification, mentioned earlier, is not the only factor that may lead to differences between ICAAP and Pillar 1 capital figures. Thus, in order to assess the contribution of diversification, supervisors may need to identify other reasons for differences between internal and regulatory capital calculations, for instance:
a. the use of a different confidence level in the ICAAP model (target rating, supervisory confidence intervals, 1 in 10 events, etc.); b. any differences in the scope of the risks considered;
c. the removal of floors (like PD floors) or other regulatory constraints;

d. the impact of different methodologies (VaR vs. Expected Shortfall, full economic capital modelling); and e. any differences in the assumptions used (e.g. granularity of the IRB portfolio). Guideline 21. College members, coordinated by the consolidating supervisor, should agree on a similar approach and common criteria to assess internal capital instruments which are not eligible as regulatory capital.
100. The internal capital used by institutions to cover all material risks (beyond
Pillar 1 minimum risks - credit, market, operational risks) may include other financial resources or contingent capital which are not eligible as regulatory capital as defined by the CRD. Similarly, deductions from internal capital can be different from those applicable for the calculation of regulatory capital (e.g. treatment of equity holdings, goodwill, deferred tax assets etc.). Since ICAAP is an institution-driven process, these Guidelines do not intend to prescribe any definition of internal capital or instruments which can be considered against non Pillar 1 risks. The quality of internal capital and its impact on the determination of capital adequacy at the group and entity levels should, however, be discussed within the college.
5.3. Reaching a joint decision on risk-based capital adequacy
Guideline 22. The discussion among college members - coordinated by the consolidating supervisor - on the topics described in these Guidelines should lead to a joint decision on the adequacy of the own funds held by the group and its entities with respect to their financial situation and risk profile, as well as the required level of own funds, above the regulatory minimum, that may be applied at the individual, sub-consolidated and consolidated levels. Where appropriate, other prudential measures under Article 136(1) can be adopted on a voluntary basis.
101. The joint decision on capital adequacy needs to cover all the levels where
capital requirements are in place (i.e. at the consolidated, sub-consolidated and individual levels). It will take into account the waivers allowed by Article 69 for individual or sub-consolidated parts of the group.
102. The outcome of the joint risk assessment and decision on risk-based capital
adequacy may be summarised as in Table 11. The actual templates used within the colleges should reflect the outcome of the college discussion and contain the summary information derived from risk and ICAAP assessments as reflected in the common scoring scales and tables defined in the previous chapters. Where applicable, it should list SREP capital by the risk types agreed on by the college members.

Table 11. Summary information on risk-based capital-adequacy of Group
XY
Entity X/ Sub￾group X
Entity Y/ Sub￾group Y Group total
Available regulatory own funds (amount or %) Other financial resources to cover ICAAP estimates (amount or %) Pillar 1 regulatory capital requirements (amount or %) ICAAP capital estimates (amount or %) SREP capital requirements (amount or %)

Guideline 23. When, as a result of the joint assessments the college members consider that additional levels of capital above the Pillar 1 requirements should be imposed this will be formulated in terms of regulatory capital.
103. The quality of regulatory capital is an important element of the joint decision
on capital adequacy. Pending further harmonisation in the definition of capital at the EU level, the level of the requirement should preferably be formulated in terms of own funds, as defined in the CRD.
104. In setting the level of additional capital above the regulatory minimum,
supervisors should consider the current and prospective levels of regulatory capital requirements, including any impact of regulatory changes to be introduced within the assessment’s time horizon.