Amendment of Circular CSSF 07/301 on ICAAP and ILAAP and Circular CSSF 11/506 on Stress Testing

Circular CSSF
20/753
AMENDMENT OF CIRCULAR
CSSF 07/301, AS AMENDED BY
CIRCULARS CSSF 08/338,
CSSF 09/403, CSSF 11/506
AND CSSF 13/568 ON THE
IMPLEMENTATION OF THE
INTERNAL CAPITAL AND
LIQUIDITY ADEQUACY
ASSESSMENT PROCESS (ICAAP
AND ILAAP) AND OF CIRCULAR
CSSF 11/506 ON PRINCIPLES
OF A SOUND STRESS TESTING
PROGRAMME

CIRCULAR CSSF 20/753
2/21
Circular CSSF 20/753
Re: Amendment of Circular CSSF 07/301, as amended by Circulars CSSF 08/338, CSSF 09/403, CSSF 11/506 and CSSF 13/568 on the implementation of the Internal Capital and Liquidity Adequacy Assessment Process (ICAAP and ILAAP) and of circular CSSF 11/506 on principles of a sound stress testing programme Ladies and Gentlemen, The purpose of this circular is to amend Circular CSSF 07/301, as amended, as well as circular CSSF 11/506 in order to provide CRR institutions, as defined in Article 1(1) of CSSF Regulation N° 15-02 and hereafter referred to as “institutions”1, updated supervisory expectations on the regulatory requirements applicable to the ICAAP/ILAAP and to stress testing programmes pursuant to the guidelines EBA/GL/2018/042 of the European Banking Authority (EBA). In line with CSSF Regulation N° 15-02 and the principle of proportionality, the amended Circulars CSSF 07/301 and CSSF 11/506 shall no longer be applicable to non CRR investment firms. As regards circular CSSF 07/301, it can be observed that today the general principles of ICAAP and ILAAP are broadly understood. Therefore the circular has been considerably shortened and is now focusing on key implementing provisions that institutions shall meet in order to comply with articles 18 and 19 of CSSF Regulation N° 15-02. These provisions complement the general (risk) governance principles of Circular CSSF 12/552 that apply to ICAAP and ILAAP in particular. In the amended text, the wording has been aligned with current terminology (e.g. “management body” or “risk appetite”). Also, the reporting requirements have been clarified in line with the EBA Guidelines on ICAAP and ILAAP information collected for SREP purposes of 3 November 2016 (EBA/GL/2016/10)3. The amendments of circular CSSF 11/506 are meant to provide further guidance on the principle of proportionality (point 6) and on operational arrangements relating in particular to the coverage of longer term risks (e.g. climate-related risks; points 24 and 25) and data infrastructure (point 30). 1 "Significant supervised entities" as defined in Article 2, point 16 of Regulation (EU) N° 468/2014 of the European Central Bank (ECB) of 16 April 2014 (SSM Framework Regulation) shall refer to the relevant ECB rules (if any). 2 The guidelines are available on the EBA website https://www.eba.europa.eu 3 The guidelines are available on the EBA website https://www.eba.europa.eu Luxembourg, 23 October 2020 To all credit institutions and investment firms

CIRCULAR CSSF 20/753
3/21
In order to allow for a straightforward review of the changes made, the amendments made to Circular CSSF 11/506 are presented in tracked changes in
Annex 1. A dedicated version in tracked changes of Circular CSSF 07/301 is not
provided due to the substantial shortening and redesign of the circular. The amended text, without tracked changes, appears in Annex 2. This circular – and hence the amended versions of circulars CSSF 07/301 and CSSF 11/506 - apply from 31 October 2020. CSSF expects these changes to be reflected within the institutions’ governance and operating frameworks from 31 December 2020. Yours faithfully, Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General
Annex

CIRCULAR CSSF 20/753
4/21
Ladies and Gentlemen,
In accordance with requirements specified in Directive 2013/36/EU4, as transposed by Article 6 of CSSF Regulation N° 15-02 (“RCSSF 15-02”), CRR institutions (as defined in Article 1(1) of RCSSF 15-02 and hereafter referred to as “institutions”) shall have in place effective processes to identify, manage, monitor and report the risks they are or might be exposed to. The purpose of this circular is to further specify the implementation of these articlesthis article in the field of stress testing which represents an essentiala key practice for sound risk management. This implementation is set out in and capital and liquidity planning. The requirements hereunder are aligned with the guidelines issued in this respect by the European Banking Authority (EBA).5 “Guidelines on institutions’ stress testing” of 19 July 2018 (EBA/GL/2018/04)6.
Chapter I. Introduction

1. Stress tests formtesting forms a set of practices the objective of which is to
   regularly assess howwhether adverse events maywould jeopardise the adequacy between the an institution’s business model, its risk profileappetite and its existing capacity to manage and bear risks and . Its outcome should enable the management body to decide, where appropriate, the whether corrective measures which are required in order to guarantee financial stability and perenniality of an ensure the viability of the institution. The and its resilience in times of stress tests are an essential. Stress testing is a key risk management practice which completes in particularcomplements the ongoing, daily control of the compliance with the internal limits corresponding to the risk profile determined by the institution. 2.1.The strategic dimension inherent in stress testing requires a strong involvement by the authorised management and board of directors which ensure the implementation of a, sound stress testing programme in order 4 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC 5 Please refer to the document "CEBS Guidelines on Stress Testing (GL32)" published on 26 August 2010 by the Committee of European Banking Supervisors (CEBS) which was replaced by EBA on 1 January 2011. This document is available on the website: http://www.eba.europa.eu/Publications/Standards￾Guidelines.aspx. These CEBS/EBA rules are based on the "Principles for sound stress testing practices and supervision" published by the Basel Committee on Banking Supervision in May 2009. 6 Available on the website https://www.eba.europa.eu Luxembourg, 21 October 2020 To all credit institutions and CRR investment firms incorporated under Luxembourg law and to the Luxembourg branches of credit institutions and investment firms having their registered office in a third country
   Annex 1
   Circular CSSF 11/506 as amended by Circular CSSF 20/753 Re: Principles of a sound stress testing programme

CIRCULAR CSSF 20/753
5/21 to secure the financial stability and perenniality of their institution. The purpose of this circular is to define the regulatory requirements which apply to all sound stress testing programmesand prudent management of risk. 3.2.During the implementation of their stress testing programme, the institutionsInstitutions may use calculation inputs and expertise not owned by themthird party (e.g.including intragroup) methodologies andor resources available in this respect at their group level provided that these resources observe the requirements set out in this circular. The performed tests shall have . Stress tests conducted with such support shall be fit for local purpose: their results whichshall fully reflect the financial and operational situation of the institution in Luxembourg institution and shall allow the local operators to have any information and knowledge enabling them to apply the results to the institution in Luxembourg.local management to take well informed risk mitigating measures, as required. The detail of thesesuch stress tests shall be available to the CSSF at its request. 4.3.The stress testing programme includes notably the stress tests carried out pursuant to Pillar 2 and documented, in particular, through the ICAAP report/ILAAP information that the authorised management submits to the management body in its supervisory functionboard of directors and to the CSSF at least once a year. .
Chapter II. Scope
1. All credit institutions and investment firms incorporated under Luxembourg law
and all branches of non-EU credit institutions and investment firms are subject to the provisions of this circular. These entities are referred to as "institutions". 2.4.All institutions7 are required to have in place a sound and proportionate stress testing programme. The requirements of this circular apply to the institutions based on their individual and consolidated legal situation. They aim at all the internal ("Pillar 2") and regulatory (required in the context of the "advanced" methods of "Pillar 1") stress tests, notwithstanding the requirements governing the performance of regulatory stress tests as shown in other circularssituation.
5. The circular applies to all the internal ("Pillar 2") as well as the regulatory
("Pillar 1") stress tests, notwithstanding specific stress testing requirements contained in other regulation.
Chapter III. Principle of proportionality
3.6.The requirements of this circular shall be implemented proportionally to the nature, scale and complexity of the institution’s activities and organisation. 7 « Significant supervised entities » as defined in Article 2, point 16 of Regulation (EU) No 468/2014 of the European Central Bank (ECB) of 16 April 2014 (SSM Framework Regulation) shall refer to the relevant ECB rules (if any).

CIRCULAR CSSF 20/753
6/21
Proportionality applies to all aspects of the stress testing framework, including methodology and design, technical infrastructure, resources and processes. Institutions that are designated as other systemically important institutions pursuant to article 59-3 of the law of 5 April 1993 on the financial sector are expected to benchmark their stress testing framework against the more granular requirements of the EBA/GL/2018/04. 4.7.All institutions shall implement a qualitative stress testing programme which willshall allow them to assess howwhether the business model, risk profileappetite (defined for all the risks inherent to their activities and organisation) and their existing capacity to manage and bear risks (capital, liquidity buffers and tools for risk management and control) representcontinue to form a coherent and robust system when confronted to adverse internal and external developments. 5.8.The quantitative approaches ofused for stress teststesting purposes ideally combine (simple) analyses of sensitivity to individual risks with integrated analyses allowing the assessment of the impact of (complex) macroeconomic scenarios on the institution's financial and operational situation. The institutions shall choose the combination of those quantitative analyses combinationthat best suitable forsuits their needs as regards the sound and prudent management of their business. Having regard to the principle of proportionality, this choice may be limited only to sensitivity analyses only for institutions whose low and non-complex risk profile is fully analysed in terms of sensitivity analysis.
Chapter IV. Internal governance
6.9.The board of directorsmanagement body shall regularly ensure that the institution has a sound stress testing programme the results of which allow itthe management body to knowidentify and understand the (extreme) adverse events for the institution and to assess howwhether these events maycould jeopardise the adequacy between the business model, the risk profileappetite and the existing capacity to manage and bear risks. ItThe management body in its supervisory function appoints the authorised management to implement a stress testing programme fulfilling this objective.
7.10. The authorised management is in charge of the implementation of
a stress testing programme tailored to the institution’s needs and compliant with the requirements set out in this circular. It lays down in writing and formally adopts the annual plan of stress tests which determines the tests to be performed during the year and the, including their main characteristics (scenario, granularity, scope, frequency, calibration). The authorised management informs the board of directorsmanagement body in its supervisory function, on a regular basis and in case of need, of the state of the stress testing programmes and of the results of this programme.
11. The stress testing programme, as implemented by the authorised
management shall:
– have competent and sufficient executing personnel as well as a technically adequate infrastructure; – be subject to written internal procedures which determine the objectives, the processes as well as methods for stress tests,

CIRCULAR CSSF 20/753
7/21 including working hypotheses and the selection of the relevant scenarios/sensitivities. These procedures identify in particular the responsibilities of the main contributors to the stress testing programme and ensure that these responsibilities are clearly allocated, executed and controlled; – allows all the stakeholders within the institution (at the level of business lines or (internal) control functions) and the relevant hierarchical levels to contribute to the effectiveness of the stress testing programme through their expertise and to take responsibilityies in this respect.
8.12. The authorised management critically assesses and approves the
main methodological choices and hypotheses as well as the scenarios of the stress testing programme on a regular basis. This assessment shall allow itthe authorised management to know and understand the scope and the limits inherent to the stress testing programme. It shall cover the application of the principle of proportionality.
9.13. The board of directors and the authorised management body shall
demonstrate appropriate commitment to and knowledge of the stress testing programme and its outcomes. It should regularly analyse the results of the stress testing programme. Iftests, use these results invalidateas input to the adequacy betweenprocess of establishing, challenging and validating the business model, the risk profile and the existing capacity to manage and bear current and future risks, they decide on the corrective measures necessary in terms of business model, incurred risks, tools forappetite (including risk management and control or onlimits), the risk policy as well as the policies regarding risks,of internal capital orand liquidity which are required in order to maintain the financial stabilityplanning of the institution and to guarantee its perennialitydecide on corrective measures, if needed.
Chapter V. Characteristics of a sound stress testing programme
10.14. The stress testing programmetests shall observecomply with the
following conceptual requirements, in line with the general principles in
chapter 3 of part II of circular CSSF 12/552:
– exhaustively and adequately cover any material risk factor to which the institution is or might be exposed to and any activitiesmaterial activity carried out by the institution; – allow identifying and analysing all material risk concentrations; – take into account the relations (e.g. correlations) which exist between the different activities and the different risk factors considering the changing nature of these relations particularly in a crisis situation.;

1. When implementing the stress testing programme, the authorised
   management ensures that the programme:
   – has competent and sufficient executing personnelbe performed at least once a year or more frequently if required by proportionality; – be submitted to a regular and independent review aiming to guarantee that the stress testing programme remains effective, sound and robust especially in a changing environment;

CIRCULAR CSSF 20/753
8/21
– be documented (as regards policy, procedures, results as well as a technically adequate infrastructure; – is subject to written internal procedures which determine the objectives, the implemented processes as well as methods for stress tests, including working hypotheses and the selection of the relevant scenarios/sensitivities. These procedures identify in particular the responsibilities of the main contributors to the stress testing programmethe ensuing conclusions and ensure that these responsibilities are clearly allocated;actions). – allows all the stakeholders of the institution (business lines, functions of risk management and internal control) and the different hierarchical levels to contribute to the efficiency of the stress testing programme through their expertise and to take responsibilities in this matter; – is sufficiently flexible so as to easily and quickly generate new stress tests when necessary.
2.15. The results of the stress testing programme shall:
– showhighlight the possible inconsistencies between the business model, risk profileappetite and existing capacity to manage and bear current and future risks.; The results of the stress tests are therefore used to validate in particular the business model, the set tolerance to risk and the risk policy as well as the policies of internal capital and liquidity buffers; – correspond to all different "organisational units" so as to allow managers of these units to include them in their daily management. The organisational units are the institution as a whole, including its branches, its subsidiaries, if any, as well as the units corresponding to the perimeter of the main portfolios and business lines.permit the allocation of adequate capital and liquidity through the economic cycle; – be sufficiently granular, so as to allow a breakdown of the overall stress test results to material or relevant entities or business lines in order to permit dedicated risk management and decision taking at the level of these entities or business lines, in line with the organisational setup of the institution. The stress tests covering the institution as a whole may be theobtained through aggregation of the stress tests of the different constituent organisational unitsparts provided that the methods used are consistent and that the simple aggregation is representative of the (linear) aggregate risk profile of the institution as a whole; – give rise to credible corrective measures as well as consideration as regards the practical implementation of these measures in case adverse developments indeed occur. in terms of business model, incurred risks or tools for risk management and control. These measures shall be reflected particularly at the level of the crisis management and recovery processes described in the policies of internalregarding risks, capital andor liquidity buffers.
3. The stress tests shall be performed regularly and at least once a year. Their
frequency shall be adaptedwhich are required in order to maintain the institution's activities and to financial stability of the nature of the incurred risks.

CIRCULAR CSSF 20/753
9/21
4. The institution shall submit its stress testing programme to a regular and
independent internal review aiming to and to guarantee that the stress testing programme remains efficient, sound and robust especially in a changing environment. – The institution shall document its policy, procedures and results regarding the stress tests as well as the ensuing conclusions and actionsits viability.
Chapter VI. Methodologies
16. The use of appropriate methodologies is a key element in order to reach the goal set
in point 1. Generally, any efficienteffective stress testing programme combines sensitivity analyses and scenario analyses with so-called reverse stress tests as defined under Chapter VI.45. The institutions shall identify the best combination of these methods taking into account the application of the principle of proportionality and the objective described in point 1. The scope of stress testing may vary from simple portfolio level sensitivity or individual risk level analyses to comprehensive institution-wide scenario stress testing. Sub-chapter VI.1. Sensitivity analyses
5.17. Sensitivity analyses aim to assess the effect of an adverse development of
one or several risk factors on the institution's situation. They allow the institutions to better understand the impact of an adverse development of their main risk factors.
6.18. Any institution shall carry out sensitivity analyses of all its main risk factors.
The implementation of these analyses requires an exhaustive identification of the main risk factors inherent to the institution's activities and organisation.
19. In sensitivity analyses, the risk factors identified as the main ones shall be subject
to adverse developments characterised by different intensity degrees of severity matching past experiencesstress episodes as well as hypothetical and prospective considerations.adverse developments. Sub-chapter VI.2. Scenario analyses
7.20. Scenario analyses may be compared to multi-factorial sensitivity analyses in
which the selection of risk factors included in the analysis as well as the severity of their adverse development depend on a hypothetical state of the world ("scenario"). The scenarios may be historical (state of the world observed in the past) or hypothetical.
8.21. Having regard to the principle of proportionality, the institutions carry out
scenario analyses. The scenarios shall be representative of the incurred risks (cover all the main risk factors) and of the environment in which the institution, with its activities and organisation, evolves (prospective scenarios which avoid in particular repeating the historical scenarios which ceased to be representative) and shall refer to adverse developments characterised by different degrees of intensityseverity. In addition, the chosen scenarios shallshould take into account systemic interactions (in particular contagion effects and correlated behaviour) and feedback effects.

CIRCULAR CSSF 20/753
10/21
9.22. The translation of the scenarios into risk parameters being a difficult
task, the institution ensuresshall ensure that the ensuing risk parameters are consistent and that the model risk is limited via critical expert judgement and through an adequate degree of conservatism. Sub-chapter VI.3. Time horizon and severity of the stress tests
23. TheInstitutions should ensure that stress testing programme shall beis
based on severe adverse developments ("exceptional but likely events"). It shall correspond at leastplausible scenarios and the degree of severity should reflect the purpose of the stress test. To that end, stress tests should be:
– meaningful in terms of addressing relevant risks to adverse developments of risk factors duringthe institution with a view to promoting the stability of the institution under severely adverse conditions, being mindful of potential systemic implications; and – consistently applied across the institution, recognizing that the impact of identical scenarios is not necessarily severe economic recessionfor all business lines.
10.24. The institution chooses the time horizon of the stress tests
(assumed duration of the effects of adverse developments for the institution) according to the characteristics of its activities and risks (liquidity and maturity of the exposures), the underlying hypotheses of the stress tests and, where applicable, the dynamics of the chosen scenario. The time horizon takes into account the execution deadlines necessary in order to implement, where applicable, the required corrective measures. Institutions shall also have a clear understanding how successive stress tests link up to provide time consistent management of risks and capital/liquidity over the long run. This is particularly relevant for longer term risks, where the materialization of risks spans longer time horizons. Sub-chapter VI.4. Individual risk areas
25. Individual risk areas may require special attention and all material risks
should be covered in proportionate to the nature, scale, size and complexity of the institution’s activities and risks. Institutions should incorporate into their stress testing relevant longer term risks such as climate-related risks. Sub-chapter VI.5. Reverse stress testing
11.26. Reverse stress testing starts from the assumption of a severely
impaired situation (e.g. a situation in which capital and/or liquidity buffers arebecome insufficient or the institution's business model is called into questionfails) and aims to build adverse events or combinations of adverse eventsscenarios which may trigger such situation. This approach, the purpose of which is to identify the developments with a strong negative impact for the institution, is particularly suitable for the assessment of choices and hypotheses regarding the business model, the risk profileappetite and the institution's capacity to manage and bear risks.
12.27. The institutions shall implement qualitative reverse stress tests
which allow them to identify the nature and characteristics of adverse

CIRCULAR CSSF 20/753
11/21 eventsscenarios which may jeopardise the adequacy between their business model, their risk profileappetite and their existing capacity to manage and bear their current and future risks. Having regard to the principle of proportionality, the institutions completeshould complement this qualitative approach with quantitative reverse stress tests.
Chapter VII. Entry into force and amending provisions
13. This circular comes into force with immediate effect.
14. Circular CSSF 07/301 is amended as follows:
 Points 33, 34 and 37 are repealed;
 The second paragraph of Part IV of the Annexe shall be amended as follows:

• In the second sentence "internal capital adequacy" is replaced by
  "the existing capacity to manage and bear risks (capital, liquidity buffers and tools for risk management and control)";
• In the fourth sentence, "and internal capital" as well as footnote 10
  shall be deleted.

28. As part of their business planning and risk management, institutions should
    use reverse stress testing to understand the viability and sustainability of their business model and organisational setup.
29. Reverse stress testing should be used as an input to inform and test the
    efficiency and effectiveness of recovery actions and recovery planning.
    Chapter VII. Data infrastructure
30. Institutions shall ensure that the stress testing programme is supported by
    a data (management) infrastructure that permits the timely production of all required data points and their processing (including aggregation) so as to ensure the integrity, comprehensiveness and accuracy of the stress test results8. Yours faithfully, 8 Data and data aggregation requirements should be in line with the “Principles for effective risk data aggregation and risk reporting” published by the Basel Committee of Banking Supervision (BCBS 239)

CIRCULAR CSSF 20/753
12/21
Claude SIMON Andrée BILLON Simone
DELCOURT
Jean GUILL
Claude WAMPACH
Director
Marco ZWICK
Director
Jean-Pierre FABER
Director
Françoise KAUTHEN
Director
Claude MARX
Director General

CIRCULAR CSSF 20/753
13/21
Ladies and Gentlemen,
In accordance with articles 73 and 86 of Directive 2013/36/EU as transposed by articles 18 and 19 of CSSF Regulation N° 15-02 (“RCSSF 15-02”), CRR institutions (as defined in Article 1(1) of RCSSF 15-02 and hereafter referred to as “institutions”) shall have in place an internal capital and liquidity adequacy assessment process (ICAAP/ILAAP). The ICAAP [ILAAP] is a set of sound, effective and comprehensive strategies and processes to assess and maintain on an ongoing basis the amount, types and distribution of internal capital [the level, composition and quality of liquidity buffers] that an institution considers adequate to cover the nature and level of the risks to which it is or might be exposed. ICAAP and ILAAP are part of the wider internal risk management and mitigation processes. They build on the results of the internal processes for identifying, measuring, managing and reporting the risks. ICAAP and ILAAP results feed into the internal process for capital and liquidity planning and management. This circular contains the implementing provisions, including documentation and reporting requirements that institutions shall meet in order to comply with articles 18 and 19 of RCSSF 15-02. They complement the general (risk) governance principles of CSSF Circular 12/552, that apply to ICAAP and ILAAP in particular. The CSSF assesses institutions’ ICAAP and ILAAP as part of the supervisory review and examination process (SREP) according to the EBA Revised Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) and stress testing, amending EBA GL/2014/13 (EBA/GL/2018/03). The documentation requirements are based on the EBA Guidelines on ICAAP and ILAAP information collected for SREP purposes of 3 November 2016 (EBA/GL/2016/10)9.
Chapter I. Scope of application

1. This circular applies to all institutions10 that are required to have in place an
   ICAAP and ILAAP pursuant to article 3 of RCSSF 15-02.
   9 Both GL are available on the EBA website https://www.eba.europa.eu/ 10 "Significant supervised entities" as defined in Article 2, point 16 of Regulation (EU) N° 4687/2014 of the European Central Bank (ECB) of 16 April 2014 (SSM Framework Regulation) shall refer to the relevant ECB rules (if any).
   Annex 2
   Circular CSSF 07/301 as amended by Circulars CSSF 08/338, CSSF 09/403, CSSF 11/506, CSSF 13/568 and CSSF 20/753 Re: Implementation of the Internal Capital and Liquidity Adequacy Assessment Process (ICAAP/ILAAP)

Luxembourg, 21 October 2020
To all credit institutions and
CRR investment firms incorporated under
Luxembourg law and to the
Luxembourg branches of credit institutions and investment firms having their registered office in a third country

CIRCULAR CSSF 20/753
14/21
Chapter II. Requirements applicable to ICAAP and ILAAP
Sub-chapter II.1. General requirements as regards process
2. The ICAAP and ILAAP are internal processes of the institutions, adapted to their
organisation and to their specific operational needs so as to ensure the adequacy of capital and liquidity as a risk mitigation in normal (through the cycle) and stressed times. The scope and capacity of the ICAAP and ILAAP increase with the nature, scale and complexity of the institution’s activities (including their inherent risks) and organisation. The quantitative and qualitative aspects of the ICAAP and ILAAP have to be consistent with the institution’s business model, risk appetite, decision-making as well as risk management, including monitoring.
3. Despite the internal nature of the ICAAP and ILAAP, the informational needs or
technical infrastructures necessary for the operation of the ICAAP and ILAAP may be subject to outsourcing, provided that the outsourcing arrangements are sound, robust and tailored such as to guarantee the continuity and effectiveness of ICAAP and ILAAP. Management decisions, risk and internal capital/liquidity management and monitoring may not be outsourced.
4. The ICAAP and ILAAP must be comprehensively documented, including their
relation to the business model as well as to the strategy and policy (with respect to risk, capital and liquidity) and covering methodology, description of internal organisation and process (work procedures) as well as the results and decisions as regards internal capital and liquidity. The documentation also covers the data infrastructure and IT frameworks underlying ICAAP and ILAAP.
5. The ICAAP and ILAAP are subject to a periodic review by the management body
in order to ensure that:
– the coverage of risks remains comprehensive and adapted to the nature, scale and complexity of the institution’s activities and that the amount, the types and the distribution of internal capital [the level, composition and quality of liquidity buffers] remain appropriate to effectively mitigate risk in normal and stressed times; – the ICAAP and ILAAP remain fully operating and effective on an ongoing basis; – the outcomes of the capital/liquidity adequacy assessments are reflected in the institution’s risk, capital and liquidity management and decision making. This review shall take place at least once a year. It shall be carried out with the necessary objectivity and with the involvement of the risk control function. Internal audit shall also regularly audit the ICAAP and ILAAP according to its risk-based audit plan. Sub-chapter II.2. Specific responsibilities of the management body
6. The management body shall demonstrate appropriate commitment to and
knowledge of the ICAAP and ILAAP. It shall ensure that, as a result of ICAAP and ILAAP, the institution holds internal capital and liquidity that effectively protect the institution against the materialisation of risk.
7. The authorised management is responsible for the development,
implementation and maintenance of an ICAAP and ILAAP in accordance with the risk and the internal capital and liquidity strategy (principles and

CIRCULAR CSSF 20/753
15/21 objectives) established by the management body in its supervisory function and the applicable regulatory requirements. This responsibility covers the ICAAP’s and ILAAP’s sound and effective operation and adequacy. It applies to the entire ICAAP and ILAAP, whether or not some aspects have been outsourced.
8. The authorised management informs the management body in its supervisory
function on the institution’s situation of risks and its internal, current and planned capital and liquidity, in the form that best suits the institution’s needs. The frequency of the reporting should be adapted to a.o. risk and business developments, excess capital and liquidity buffers and the internal decision making process. This information contains the capital adequacy statement (“CAS”) and liquidity adequacy statement (“LAS”) that the management body in its supervisory function is required to endorse. Sub-chapter II.3. Capital and liquidity adequacy
9. ICAAP and ILAAP shall be comprehensive, scoping in all material risks,
wherever they are located within business lines or (legal) entities. In this context, “material risk” refers to a contingency that may cause material economic losses or outflows that would deplete the institution’s internal capital or liquidity.
10. ICAAP and ILAAP shall be effective, resulting in all material risks being
supported by adequate capital and liquidity where “adequate” refers to both quantity and quality of capital/liquidity including their immediate operational availability to mitigate risk. To ensure effectiveness, and in line with the economic definition of risk as provided here above, the perspective taken on ICAAP/ILAAP shall be the economic one, focussing on substance rather than form. For instance, the institution shall duly reflect in its internal capital and liquidity needs the risks and losses it could face in relation to related entities outside the regulatory perimeter of consolidation.
11. The justifications for not holding internal capital or liquidity shall be duly
documented.
12. ICAAP and ILAAP shall not only take into account the current situation of the
institution but shall be forward-looking in order to ensure that internal capital and liquidity remain adequate on an ongoing basis, including in times of stress, and considering the economic and regulatory environment in which the institution operates or could come to operate, for instance as a result of internal business decisions or factors external to the institution.
13. The internal capital and liquidity adequacy assessment shall be determined
with reference to a credible baseline scenario (“normal times”) and a severe, institution-specific, adverse scenario (“stressed times”).
14. The institutions shall ensure that their capital and liquidity remains adequate
over the long term. The shorter-term perspective of (usually) one year has to be complemented by a longer-term (at least 3 years horizon) forward-looking perspective in line with the horizon of the institution’s multi-year capital and liquidity planning. Furthermore, institutions shall have a clear understanding how successive (e.g. 3 years) longer-term planning horizons link up in order to ensure the time-consistent management of internal capital and liquidity over the long run and to avoid potential cliff effects.
15. Besides the internal capital and liquidity adequacy (“economic perspective”),
institutions are also bound by regulatory capital and liquidity requirements

CIRCULAR CSSF 20/753
16/21
(“normative perspective”) and possibly other external (financial) constraints and considerations on capital and liquidity (e.g. related to their external rating). Institutions shall establish an internal multi-year assessment process regarding their ability to fulfil all of their capital and liquidity-related demands on an ongoing basis. This process should ensure the consistency of those demands and their full integration into all material management processes and decisions. Sub-chapter II.4. Reporting requirements
16. For the purpose of point 8 of this circular, the ICAAP and ILAAP information
should cover at least the following:
– Where relevant for ICAAP and ILAAP, general summary context information on:
i. Business model (strategy);
ii. Risk governance and management framework;
iii. Risk appetite framework (statement);
iv. Stress testing framework and programme;
v. Risk data, aggregation and IT systems.
– ICAAP and ILAAP specific information as set out in points 17 and 18 of this circular; – Summary of the main conclusions of the ICAAP and ILAAP including the CAS and LAS as set out in point 19 of this circular.
17. The ICAAP information should provide a broad overview over the methodology
and the ICAAP implementation in terms of policies and operations, covering in particular the following aspects:
a. Risk measurement, assessment and aggregation b. Internal capital and capital allocation
c. Capital planning
Institutions may gather all the ICAAP and ILAAP information either in one comprehensive report (for capital and liquidity taken together) or as two separate reports. They may also choose to have the ICAAP and ILAAP information split across different internal documents and use cross-referencing. In that case, a reader’s manual needs to be prepared as an overarching document facilitating the assessment. According to the circular CSSF 19/731, the ICAAP and ILAAP information should be submitted to the CSSF. Institutions should be prepared to provide CSSF with additional supporting information upon request (e.g. minutes of relevant committees and meetings of the management body evidencing the sound set-up and implementation of the ICAAP and the ILAAP).

CIRCULAR CSSF 20/753
17/21
18. The ILAAP information should provide a broad overview over the methodology
and the ILAAP implementation in terms of policies and operations, covering in particular the following aspects:
a. Liquidity and funding risk management framework b. Funding strategy
c. Strategy regarding liquidity buffers and collateral management
d. Cost-benefit allocation mechanism e. Intraday liquidity risk management f. Liquidity contingency plan
19. The main conclusions of the internal capital and liquidity adequacy
assessments shall be set out in a clear and concise statement on the current and future capital adequacy (CAS) and liquidity adequacy (LAS). The conclusion shall also spell out the implications of these assessments for the management and the organisation of the institutions’ activities and the management of risks. Yours faithfully, Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General
Annex: Further guidance on specific aspects of ICAAP and ILAAP.

CIRCULAR CSSF 20/753
18/21
ANNEX: Further guidance on specific aspects of
ICAAP and ILAAP
This annex includes some additional guidance to institutions for the practical implementation of their ICAAP and ILAAP.
I. Business model, strategy and risk appetite
The institution is expected to clearly express how the implementation and monitoring of its business strategy and risk appetite are supported by its ICAAP and ILAAP, and how this effectively allows it to comply with the agreed risk boundaries set out in the risk appetite statement. In order to facilitate sound and effective risk management, the institution is expected to use the ICAAP and ILAAP outcomes when setting up an effective risk monitoring and reporting system and an adequately granular limit system (including effective escalation procedures) that allocates specific limits to, for example, individual risks, sub￾risks, entities and business areas.
II. Risk identification
The institution is responsible for defining its own internal risk taxonomy. It is expected not to simply adhere to a regulatory risk taxonomy, unless it can demonstrate that such taxonomy is fit for purpose. Institutions should take into account all the underlying risks, where material, stemming from their financial and non-financial participations, subsidiaries and other connected entities (for example, step-in and group risks, reputational and operational risks, risks stemming from letters of comfort, etc.). Each institution is expected to decide internally whether and how it combines risk categories and risk sub-categories. It remains the institution’s responsibility to determine all of its material risks, all risk concentrations at the relevant granularity as well as co-movements between and within the risk (sub-) categories.

CIRCULAR CSSF 20/753
19/21
Institutions shall at least assess:

• Credit risk (including counterparty credit risk, country risk)
• Market risk (including structural foreign exchange (FX) risk)
• Liquidity risk
• Interest rate risk (differentiating EVE and NII scenarios)
• Operational risk (including business disruption and systems failure, IT
  risk, legal and compliance risk and model risk)
• Risks related to money laundering and terror financing (ML/TF)
• Concentration risks
  Institutions providing services in the field of private banking or wealth management, UCI administration or depository banking shall factor related reputational risk, operational risk as well as ML/TF risks in their ICAAP and ILAAP, where relevant. The data quality framework is expected to ensure reliable risk information that supports sound decision-making, and it is expected to cover all relevant risk data11 and data quality dimensions.
  III. Risk and internal capital measurement
  Institutions should recognise that, owing to different valuation methodologies and assumptions for assets, liabilities and transactions, the available internal capital under the economic perspective may differ significantly from the own funds under the normative perspective. Consequently, institutions should take a prudent approach when defining their required internal capital. This prudence applies to all underlying assumptions and methodologies used for the quantification of the available and required internal capital. 11 This particularly applies for operational risk for which the loss database should be considered in the ICAAP.

CIRCULAR CSSF 20/753
20/21
Institutions should adopt prudent and robust risk measurement approaches. They should ensure that their choices regarding the holding period and the aggregation guarantee the objective of permanent internal capital adequacy. For this purpose, they shall act with prudence and good judgement, in particular concerning the hypothesis made on aggregation. The assumptions concerning the way in which the various risks interact together (“co-movements” between risks) shall in particular take into account the variability of these co-movements over time, notably in stress situations.
IV. Consistency between ICAAP/ILAAP and recovery plans
The institution is expected to ensure consistency and coherence between its ICAAP and ILAAP and its own or relevant group recovery planning in terms of early warning signals, indicators, escalation procedures following breaches of these thresholds and potential management actions.

CIRCULAR CSSF 20/753
21
/21
Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1 - 1 direction@cssf.lu www.cssf.lu