Central Bank of Brazil Normative Instruction No. 609 of April 11, 2025

NORMATIVE INSTRUCTION BCB NO. 609, OF APRIL 11, 2025

Provides for the information that must be included in the report referred to in Article 123, § 3, item III of Resolution BCB No. 303, of March 16, 2023, makes the preliminary analysis stage optional, and clarifies the evaluation of the application.

The Heads of the Strategic Management and Specialized Supervision Department - Degef, the Department of Supervision of Cooperatives and Non-Bank Institutions - Desuc, and the Banking Supervision Department – Desup, using the authority granted to them by Article 23, item I, letter “a” of the Internal Regulations of the Central Bank of Brazil, published through Resolution BCB No. 340, of September 21, 2023, and in view of the provisions of Resolution BCB No. 303, of March 16, 2023,

D E C I D E:

CHAPTER I
OBJECTIVE

Article 1. This Normative Instruction provides for:

I - the information that must be included in the document “Information on Internal Credit Risk Classification Systems” referred to in Article 123, § 3, item III of Resolution BCB No. 303, of March 16, 2023;

II - the preliminary analysis; and

III - the evaluation of the application.

CHAPTER II
DEFINITIONS

Article 2. For the purposes of this Normative Instruction, the following are considered:

I - application: the act of final submission of the documents necessary for the request for authorization to use internal credit risk classification systems (IRB approaches) listed in Resolution BCB No. 303, of March 16, 2023;

II - application booklet: report prepared based on the document “Information on Internal Credit Risk Classification Systems” referred to in Article 123, §3, item III, of Resolution BCB No. 303, of March 16, 2023;

III - preliminary analysis: a stage optional for institutions applying for the use of IRB approaches, in which the documents listed in the annex of the document “Information on Internal Credit Risk Classification Systems” are submitted and analyzed regarding completeness and compatibility with the request; and

IV - evaluation of the application: the stage in which the final submitted documentation is qualitatively evaluated in detail to support the decision of the Central Bank of Brazil regarding the authorization to use the IRB approaches for calculating the capital requirement.

CHAPTER III
ON THE DOCUMENT “INFORMATION ON INTERNAL CREDIT RISK CLASSIFICATION SYSTEMS”

Article 3. The document “Information on Internal Credit Risk Classification Systems” referred to in Article 123, § 3, item III, of Resolution BCB No. 303, of March 16, 2023, is hereby published in the form of the annex to this Normative Instruction.

CHAPTER IV
PRELIMINARY ANALYSIS

Article 4. The interested institution seeking authorization to use the IRB approaches is granted the option to submit documents for preliminary analysis by the Central Bank of Brazil, prior to the application referred to in Article 123 of Resolution BCB No. 303, of March 16, 2023.

§ 1. The use of the option established in the caput is done through the protocolization of the intention to apply in an official letter signed by the risk management director, CRO, as referred to in Article 44 of CMN Resolution No. 4.557, of February 23, 2017, and Article 52 of BCB Resolution No. 265, of November 25, 2022, indicating the period in which it intends to carry out the application.

§ 2. For the preliminary analysis, the institution must submit to the Central Bank of Brazil the documentation listed in item “IV – ANNEXED DOCUMENTS” of the document “Information on Internal Credit Risk Classification Systems”.

§ 3. The institution may submit other documents to the Central Bank of Brazil that it deems necessary.

Article 5. In the preliminary analysis, the Central Bank of Brazil will evaluate the submitted documentation, considering:

I - the scope of the application for IRB approaches:

a) the categories, subcategories, and portfolios intended;

b) partial use; or

c) the rural credit business unit;

II - the business units involved and their respective exposures;

III - the risk segments (for modeling purposes) and their respective exposures;

IV - the involvement of senior management;

V - the guidelines, policies, and procedures for the institution's risk management;

VI - the processes for granting, classifying, and recovering credit-risk operations, including the development of new products;

VII - the exposures by risk levels in all business areas;

VIII - migration between classification levels in each business unit;

IX - the reports and methodologies for measuring and controlling risk;

X - the documentation of each model used in measuring risk parameters;

XI - the methodology of backtesting tests and corrective actions resulting from these tests;

XII - the comparisons of model results with results from alternative methodologies or external data (benchmarking);

XIII - the methodology and results of stress tests;

XIV - the policies for defining limits and handling extrapolations;

XV - the information technology systems involved in the application;

XVI - operational control routines, including the process of reconciling positions from risk areas with accounting;

XVII - the procedures and performance of model validation, processes, and information technology environment;

XVIII - the handling of relevant changes related to the use of IRB approaches;

XIX - the internal audit procedures and performance in evaluating the validation process, risk management, and compliance with the requirements of Resolution BCB No. 303, of March 16, 2023.

§ 1. The preliminary analysis will result in a preliminary diagnosis of the analyzed items, indicating information, complements, and improvements necessary for the act of application.

§ 2. Additional information and documentation may be requested during the preliminary analysis.

§ 3. Information, complements, and improvements suggested in the preliminary analysis will be re-evaluated in the application booklet submitted by the institution at the time of application.

§ 4. In the preliminary analysis, the performance of the independent validation and internal audit areas will also be evaluated, contrasting the statements of these areas with the corrective actions adopted and planned.

CHAPTER V
EVALUATION OF THE APPLICATION

Article 6. The result of the preliminary analysis will be used for prioritization and selection as provided in Article 124, sole paragraph, of Resolution BCB No. 303, of March 16, 2023.

Article 7. The applying institution will be informed about the result of the application through an official letter sent by the Central Bank of Brazil.

§ 1. The result of the authorization request may be:

I - rejection;

II - approval with conditions; or

III - approval.

§ 2. In the case of rejection, the institution may present duly evidenced arguments to contest the result.

§ 3. The conditions referred to in item II of § 1 refer to the handling of findings made during the evaluation of the application or the preliminary analysis, if the institution has used the option provided in Article 4.

§ 4. The findings associated with the conditions referred to in § 3 refer to items that require corrective actions by the institution but that, in the opinion of the Central Bank of Brazil, do not warrant the rejection of the application.

§ 5. In the case of approval with conditions, the official letter referred to in the caput will determine the deadlines for completing the corrective actions.

CHAPTER VI
FINAL PROVISIONS

Article 8. Normative Instruction BCB No. 259, of March 30, 2022, is hereby revoked.

Article 9. This Normative Instruction enters into force on the date of its publication.

ARISTIDES ANDRADE
CAVALCANTE NETO
Head of Degef

ADALBERTO FELINTO DA
CRUZ JUNIOR
Head of Desuc

BELLINE SANTANA
Head of Desup

ANNEX TO NORMATIVE INSTRUCTION BCB NO. 609, OF APRIL 11, 2025

INFORMATION ON INTERNAL CREDIT RISK CLASSIFICATION SYSTEMS

I. INSTRUCTIONS

1 - The following information must compose the “Application Booklet” report (hereinafter “Booklet”) to be provided by financial institutions requesting authorization to use internal credit risk classification systems (IRB approaches) for calculating the monthly amount of the RWACIRB portion of the risk-weighted assets (RWA) total, as provided in CMN Resolution No. 4.958, of October 21, 2021, and BCB Resolution No. 200, of March 11, 2022.

2 - The terms and nomenclatures used refer to those in Resolution BCB No. 303, of March 16, 2023. The institution must clearly and concisely describe the practices and procedures that demonstrate compliance with the minimum requirements provided in said Resolution.

3 - The institution must indicate the scope of application of the IRB approaches (all categories, subcategories, and portfolios; partial use, indicating which categories, subcategories, and portfolios are in the application; or specific rural credit business unit).

4 - If the request involves the simultaneous use of different internal credit risk models, for example, for different business units or for different products, a set of information must be provided for each model.

For each item, sufficient information must be provided for good understanding; simple reference to external documents, annexed or not, is prohibited, except in explicitly requested or absolutely necessary cases.

6 - The report and all requested annexes must be provided preferably electronically via a link for upload to be made available by the Central Bank of Brazil.

Although the request is made by the leader of the prudential conglomerate, this document uses the generic nomenclature of “Supervised Entity” or SE for simplicity reasons.

In this document, the word risk refers to credit risk, which includes counterparty credit risk.

9 - The SE, in agreement with the responsible Supervision Supervisor, may formalize interest in the request by submitting, prior to said report, the documents listed in the “Annexed Documents” list set forth in Section IV and others deemed necessary, for preliminary analysis by the Central Bank of Brazil, as referred to in the NI containing this Annex.

10 - Said report must be accompanied by the other documents mentioned in Article 123 of Resolution BCB No. 303.

11 - The SE may include any additional reports, documents, or explanations it deems pertinent to the understanding of the application request.

Doubts regarding the preparation of the Booklet may be addressed to the responsible Supervision Supervisor for the supervision of the applying SE.

II - IDENTIFICATION OF THE SE

1 - Name of the SE or conglomerate.

2 - Name, phone, and email of the risk management director (CRO), as established in Article 44 of CMN Resolution No. 4.557, of February 23, 2017, or BCB Resolution No. 265, of November 25, 2022.

3 - Name, position, phone, and email of the technical person[1] responsible for the Booklet.

4 - Name, position, phone, and email of the contact person[2] for issues related to the Booklet.

5 - Application base date. It must be a recent base date (maximum of six months prior to the time of application).

III - INFORMATION ON THE APPLICATION

Scope of the application.

1.1 - Scope of the authorization request for use of IRB approaches.

The information in sub-items 1.1.1 to 1.1.3 must include all exposures defined according to Article 4 of Resolution BCB No. 303, of 2023, even if the SE does not consider them relevant or is not including them in the IRB approach at the time of application.

1.1.1 - List of conglomerate companies included in the entire scope of the authorization request for use of IR approaches.

1.1.2 - Categories, sub-categories, and portfolios for which authorization is requested for use of IRB approaches.

List of categories, sub-categories, and portfolios[3] (consolidated in all business units) included in the entire scope of the authorization request for use of IRB approaches, respective Risk Weighting Factors (RWF) provided in BCB Resolution No. 229, of May 12, 2022, value of the respective RWACPAD.

Specify, for each category, subcategory, and portfolios (and respective business units), the value of exposures weighted by the respective RWFs that belong to each company of the prudential conglomerate and to each category (according to Article 7 of Resolution BCB No. 303, of 2023) or subcategory (according to Articles 8 to 10) of exposure.

Indicate the IRB approach in application and the value of RWA from internal models.

The value of RWACIRB must anticipate the floor of 72.5% of RWACPAD established according to Article 34 of Resolution BCB No. 303, of 2023.

The Constituted Provision is the provision referred to in CMN Resolution No. 4.966, of November 25, 2021, or BCB Resolution No. 352, of November 23, 2023.

The IRB PE (Expected Loss) must be calculated from the risk parameters of the portfolio object of the application and serves for the calculation of the prudential adjustment referred to in Article 5, item IX of CMN Resolution No. 4.955, of October 21, 2021, and Article 5, item IX of BCB Resolution No. 199 of March 11, 2022.

The information must be sent by filling out tables in the format presented below. The SE may fill out as many tables as necessary to send the information.

The filling out of the tables must be accompanied by a detailed explanatory text detailing the content presented.

Category	Sub-category or portfolio	Exposure Value	RWF[4]	Value of RWACPAD	IRB Approach Indicator (basic or advanced)	RWAinternal models[5]	RWACIRB	Constituted Provision	IRB PE (R$)
Financial Institutions
Retail	Residential
Retail	Qualified Retail Revolving Credit
Retail	Other Retail Exposures
Retail	Receivables
Wholesale	“exposures to non-retail natural persons and small and medium-sized enterprises (SME)”, comprising exposures to non-financial private legal entities referred to in Article 36 of BCB Resolution No. 229, of 2022, and exposures to natural persons not included in Article 8 of BCB Resolution No. 303, of 2023.
Wholesale	“revenue-generating real estate project”, including its special subcategory “high volatility commercial real estate financing (HVCRE)”;
Wholesale	wholesale exposures not classified in the other subcategories described
Wholesale	Receivables

1.1.3 - Exclusions from the scope of the authorization request for use of IRB approaches[6].

List of exposure groups defined in BCB Resolution No. 229, of 2022, excluded from the scope of IRB approaches, in accordance with Article 4, § 1 of BCB Resolution No. 303, of 2023. For each excluded exposure group, inform the value of the exposure weighted by the respective RWF of BCB Resolution No. 229 and the reason for exclusion (items of § 1 of said Article of said regulation).

1.2 - Use of IRB approach at the time of application.

1.2.1 - Categories, subcategories, and portfolios (and respective business units) candidates for use of IRB approach.

List of categories, subcategories, and portfolios (and respective business units) candidates for use of IRB approaches that already use IRB approaches at the time of application, indicating those that already make up the minimum limit of 60% referred to in Article 120 of BCB Resolution No. 303, of 2023.

1.2.2 - Segmentation, in each category, subcategory, and portfolio, of the business units that contain them.

1.2.3 - Inform the implementation date of IRB approaches for each business unit (within each category, subcategory, and portfolio).

The information must be sent in the form of the table below, accompanied by text detailing the content presented:

Category	Subcategory or portfolio	Business Unit	Exposure	RWF[7]	RWACPAD	RWAinternal models	RWACIRB	Constituted Provision	IRB PE (R$)	Implementation Date[8]
Category ‘a’	Subcategory or portfolio 1	Business Unit 1
Business Unit 2
...
Business Unit n
Category ‘a’	Subcategory or portfolio 2	Business Unit 1
...
Business Unit m
Category ‘b’
Category ‘c’
...

1.2.4 - Risk segmentation[9].

Lists of risk segments (for modeling purposes) and their respective exposures included in the entire scope of IRB approaches, on the application base date.

For each segment/model: inform category and subcategory, the value of total exposures and RWACPAD weighted by respective RWFs.

Present the lists in the format of the table in item 1.1.2[10], accompanied by text detailing the content presented.

Fill out a table for each segment/model.

The segmentation for modeling purposes must be done for models of:

a) Counterparty or operation classification;

b) PD measurement;

c) LGD measurement;

d) EAD (FCC) measurement.

In filling out the tables, consider the information of the consolidated average RWF.

Present the detailed information, including descriptive diagrams, starting from the counterparty or operation classification models to the association of these counterparties or operations with their respective PD, LGD, and EAD models involved in the calculation of IRB PE.

1.2.5 - For exposures classified in the “Wholesale” and “Financial Institutions” categories, qualitatively describe the risk bands in use in management and the typical profile of borrowers classified there.

1.2.6 - For exposures classified in the “Retail” category or in the exceptional cases provided for in Article 40 of BCB Resolution No. 303, of 2023, explain the criteria used to construct homogeneous risk groups.

1.2.7 - For the “Wholesale” category, specify the criteria used to classify exposures into the types “revenue-generating real estate project” and “HVCRE”.

1.3 - Progressive implementation plan.

1.3.1 - List of exposures that will be included in IRB approaches in the five years following the approval of the application, in accordance with Article 120, §2 of BCB Resolution No. 303, of 2023, and exposures that, eventually, will not be included in IRB approaches[11]. For each business unit, inform the value of exposures and respective RWFs that belong to each category or subcategory of exposure, as well as the intended date of inclusion in IRB approaches.

1.3.2 - List of exposures from subsidiaries located in foreign jurisdictions and respective implementation plans, according to Article 120, §2 of BCB Resolution No. 303, of 2023.

Present the lists referred to in items 1.3.1 and 1.3.2 in the format of the table in item 1.1.2, considering the first five columns mandatory, and the others optional (if they exist).

1.3.3 - Present the temporal planning of the evolution of the percentage covered by IRB approaches over the 5-year period.

Item 1.3 does not apply to the specific authorization request for a rural credit business unit, as provided in Article 122, § 2 of BCB Resolution No. 303, of 2023.

Administrative structure, policies, and strategies.

2.1 - Senior Management.

2.1.1 - Main committees involved in risk management, indicating composition, meeting frequency, and responsibilities.

2.1.2 - Inventory of main reports or presentations used to communicate to senior management matters related to risk management, indicating purpose, brief description of content, person responsible for preparation, recipients, and frequency.

2.1.3 - Description of senior management's participation in defining the information that composes said reports and presentations.

2.2 - Units involved in risk management.

Regarding units involved in risk management, such as risk control, portfolio monitoring, and others, in addition to validation and audit units, inform:

2.2.1 - Responsibilities of each unit;

2.2.2 - Number of people working in them;

2.2.3 - Main managers, respective positions, phones, and emails for contact;

2.2.4 - Human resources policy for these areas, such as job profiles, retention, training, remuneration, and manager development;

2.2.5 - Remuneration policy for main executives of units involved;

2.2.6 - Turnover indices of the areas;

2.2.7 - Reports from units involved in risk management, except validation and internal audit.

Inventory of main reports used by areas, indicating purpose, brief description of content, person responsible for preparation, recipients, and frequency.

2.3 - Risk management policies and procedures.

2.3.1 - Risk Appetite Statement, as referred to in Article 5 of CMN Resolution No. 4.557, of February 23, 2017, or Article 3 of BCB Resolution, of November 25, 2022.

2.3.2 - Summary description of main documents establishing guidelines, policies, and procedures for risk management.

2.3.3 - Procedures used to ensure the adherence of policies, processes, systems, and models to the risk strategy defined by management and to ensure that policies are effectively observed by operational areas.

2.3.4 - Procedures for approving changes in processes and policies related to risk management and measurement models.

2.4 - Default and Problematic Asset.

2.4.1 - Definition of the observation unit for marking default within each category, subcategory, or portfolio.

2.4.2 - Criteria (quantitative and qualitative) for marking default, including contagion.

2.4.3 - Differences between the default marking criterion[12] and the problematic asset criterion[13], if such differences exist.

In the case of such differences, describe in detail the cases in which this occurs, including a list of examples.

2.4.4 - Criteria (quantitative and qualitative) for unmarking (curing) default.

2.4.5 - Differences, if any, between the criteria for unmarking default[14] and the decharacterization of problematic assets[15].

2.5 - Credit granting, collection, and renegotiation processes.

2.5.1 - Corporate and business unit-specific credit and collection policies, with indication of main instruments for their implementation and monitoring.

2.5.2 - Commercial area strategies, such as portfolio expansion or reduction.

2.5.3 - Portfolio segmentation within each business unit, from a commercial perspective.

2.5.4 - New products:

a) Process for the development and approval of new products;

b) Post-approval monitoring procedures, including actions resulting from monitoring.

2.6 - Exposure limits.

2.6.1 - Structure and decision-making thresholds:

a) Procedures for establishing and reviewing operational limits and for defining decision-making thresholds;

b) Decision-making threshold structure and current limits at each threshold.

2.6.2 - Control of limits and procedures in case of exceedance:

a) Procedures adopted for customer identification;

b) Types of limits in use at the institution, including the Customer Exposure Limit (LEC), as provided for in CMN Resolution No. 4,677 of July 31, 2018, or BCB Resolution No. 319 of May 18, 2023;

c) Methods for controlling limits[16];

d) Procedures adopted in case of limit exceedance, including the handling of exceptional cases;

e) Examples of recent exceedances and measures adopted.

2.7 - Process for approving operations subject to counterparty credit risk.

2.7.1 - Commercial areas:

a) Credit policies linked to commercial areas in each business unit where there are operations subject to counterparty credit risk, indicating the main instruments for their implementation and monitoring;

b) Portfolio segmentation within each business unit, from a commercial perspective.

2.7.2 - Collateral and clearing and settlement agreements:

a) Policies for the use of collateral and clearing and settlement agreements for risk mitigation;

b) Procedures, controls, and reports used to ensure adherence to these policies.

2.7.3 - Linking exposures to customer credit limits:

a) Policies applied for including exposures subject to counterparty credit risk in the calculation and control of exposure and risk limits per customer;

b) Procedures, controls, and reports used to ensure adherence to these policies.

2.8 - Process for acquiring credit portfolios.

2.8.1 - Policies regarding the risk assessment process.

2.8.2 - Main instruments used for implementing, monitoring, and controlling policies.

2.9 - Description of the criteria for characterizing relevant changes, as provided for in Article 117 of BCB Resolution No. 303, in the systems, models, institution's risk profile, or in the monthly amount of the RWACIRB portion of the institution.

Credit risk classification systems subject to the candidature.

For each business unit for which authorization to use the IRB approach is requested:

3.1 - Describe the modeling scope, both for risk classification systems and for parameter measurement models, justifying the adopted segmentations (granularity).

3.2 - Counterparty and/or operation classification policy (scoring) and procedures adopted to verify compliance with this policy.

3.2.1 - Describe how risk classification reflects not only the 1-year horizon but also the possibility of deterioration in credit quality over horizons longer than 1 year.

3.3 - Listing of counterparty and operation classification models (scoring) for managerial classification and risk ordering purposes, presenting:

a) perspective considered (counterparty or operation);

b) criteria and sampling period;

c) definition of default[17];

d) other relevant aspects.

3.4 - Governance of adjustments (overrides) in risk classification.

3.5 - Description of the relationship between these classification models (scoring) and PD models.

3.6 - For the PD parameter of each model, describe:

a) Data used in modeling (type, information source, and period)[18];

b) Explain the philosophy of the risk classification system (point-in-time or through-the-cycle);

c) Methodologies employed[19] in each model. Include the criteria for selecting data that enters the model;

d) Limitations of the methodology, model assumptions, and available information for modeling and the impact of these limitations on the calculation of risk parameters;

e) Detailing of adjustments made to PDs due to the existence of mitigators (guarantees or credit derivatives). Describe the procedures and controls that ensure the requirements for using the treatments provided for in Article 76 (advanced IRB approach) of BCB Resolution No. 303 of 2023 are met;

f) Evidence of satisfactory performance and model stability;

g) Parameter review process.

3.7 - For the LGD parameter of each model, describe:

a) Data used in modeling (type, information source, and period);

b) Methodologies employed in each model. Include the criteria for selecting data that enters the model;

c) Treatment for estimating the LGD parameter value relative to an exposure in default;

d) Limitations of the methodology, model assumptions, and available information for modeling and the impact of these limitations on the calculation of risk parameters;

e) For the Basic IRB approach, in the case of using an LGD of 45% for operations not covered by collateral, describe how the proof of higher prioritization degree than unsecured credit is provided, in accordance with current legislation, as per Article 68, sole paragraph, of BCB Resolution No. 303;

f) In the case of candidature for the Advanced IRB approach, for exposures not covered by collateral classified in the "Wholesale" category that represent a claim against a private legal entity with gross annual revenue exceeding BRL 3,000,000,000 (three billion reais) in the most recent fiscal year, describe the criteria for considering exposures as explicitly or economically subordinated to another class of exposures of the same counterparty. Present data segmenting the LGD calculation for this case and for others, as per Article 74, § 2º, items I and II, of BCB Resolution No. 303;

g) Conservative treatment for potential dependencies between the counterparty's credit risk and the guarantor's risk or the guarantee itself, regardless of its nature, as well as mismatches in tenors and currencies;

h) Discount rates used in the LGD calculation and the justification provided for in Article 69, § 7º of BCB Resolution No. 303, if necessary;

i) Criteria used for defining the economic cycle and the period used for LGD measurement;

j) Detailing of the treatment given to mitigators, collateral, bilateral agreements, surety guarantees, and credit derivatives in the basic and advanced approaches. Describe the procedures and controls that ensure the requirements for using the treatments provided for in Articles 74 and 76 (advanced IRB approach), or Article 82 (basic IRB approach) of BCB Resolution No. 303 of 2023 are met;

k) Evidence of satisfactory performance and model stability;

l) Parameter review process.

3.8 - For the EAD parameter (treatment of unused credit limits and provided guarantees), describe:

a) Data used in modeling (type, information source, and period);

b) Methodologies employed in each CCF (Credit Conversion Factor) model. Include the criteria for selecting data that enters the model;

c) Limitations of the methodology, model assumptions, and available information for modeling and the impact of these limitations on the calculation of risk parameters;

d) Parameter review process.

3.9 - Treatment of Acquired Financial Receivables (wholesale and retail).

a) Data used in modeling (type, information source, and period);

b) Methodologies employed. Include the criteria for selecting data that enters the models;

c) Limitations of the methodologies, model assumptions, and available information for modeling and the impact of these limitations on the calculation of risk parameters;

d) Regarding the reduction risk associated with financial receivables (Articles 55 and 56 of BCB Resolution No. 303), if the institution opts to use an effective term equal to one year (Article 55, §6º of BCB Resolution No. 303), describe the monitoring and control system for reduction risk;

e) Proof of the irrelevance of reduction risk in the case of a request for exemption from calculating this risk (Article 55, § 7º of BCB Resolution No. 303), if applicable.

3.10 - IRB Expected Loss.

3.10.1 - Table containing for each PD and LGD combination, the category, subcategory, exposure, rating (scoring), PD, LGD, EAD, and Expected Loss.

3.10.2 - Detail the method for calculating IRB Expected Loss.

3.10.3 - Detail the method for estimating IRB Expected Loss for exposures in default subject to the IRB approach.

3.10.4 - Detail the process for comparing the provision constituted and IRB Expected Loss.

Monitoring and Evaluation of models subject to the candidature.

4.1 - Monitoring of portfolios subject to the candidature.

4.1.1 - Describe the process for monitoring portfolio risk (Article 33, items I and VII of BCB Resolution No. 303).

4.1.2 - Describe the model performance control systems (Articles 14 (item III), 20, 31, and 33 (items II to VI) of BCB Resolution No. 303).

4.2 - Backtesting[20].

Describe the criteria adopted in the backtesting tests and present backtesting data based on the comparison of predicted and observed percentages for each parameter, regardless of other metrics the FI uses and presents.

4.2.1 - Process description:

a) Frequency of execution;

b) Observation periods;

c) Definition of criteria and metrics used;

d) Level of granularity/disaggregation (business units, portfolios, risk factors, products, and/or others);

e) Units responsible for execution.

4.2.2 - Examples, if any, of situations where backtesting tests were used to improve risk classification systems and models in the last 24 months.

4.3 - Comparison of model results with results from alternative methodologies and external data sources (benchmarking)[21].

4.3.1 - Description and results of alternative quantitative methodologies and comparisons with external data sources.

Stress Testing[22].

5.1 - Process description:

a) Methodology applied to stress tests;

b) Definition and approval of stress scenarios (including responsible parties and review deadlines);

c) Assumptions of current scenarios;

d) Frequency of execution.

5.2 - Demonstration of the sufficiency and compatibility of the Reference Equity (PR) with the results of stress tests.

Technological environment and data base of portfolios subject to the candidature.

6.1 - Description of the technological environment and data base inherent to risk modeling.

6.1.1 - Explanatory diagram and brief description[23] of:

a) Information sources involved in building the data bases used in risk modeling;

b) Information systems used in risk modeling processes;

c) Controls existing in information systems such as: access, audit trail, data quality, backup, etc.

6.1.2 - Information flow between the information systems referred to in the previous item, specifying integration methods. For manual integrations or processing not performed by the IT (Information Technology) area, describe the existing compensating controls and the plan for automation under the management of the IT area.

6.2 - Description of the technological environment used in the calculation of risk parameters, RWACPAD portions, as per BCB Resolution No. 229, and RWACIRB, and in the risk management process.

6.2.1 - Explanatory diagram and brief description[24] of:

a) Information sources used in the risk management process and in information systems that process the calculation of risk parameters and RWACPAD portions, as per BCB Resolution No. 229, and RWACIRB;

b) Information systems involved in the risk management process and in the calculation of risk parameters and RWACPAD and RWACIRB portions;

c) Controls existing in systems such as: access, audit trail, data quality, backups, etc.

6.2.2 - Information flow between the systems referred to in the previous item, specifying integration methods. For manual integrations or processing not performed by the IT area, describe the existing compensating controls and the plan for automation under the management of the IT area.

6.2.3 - Business continuity strategy established to ensure the execution of business processes in case of significant unavailability of information systems and other technological resources necessary for the calculation of risk parameters and RWACPAD portions, as well as for the proper functioning of the credit risk management process.

6.3 - Classification history.

6.3.1 - Complete history of risk classification of operations, counterparties, and guarantors, covering initial risk classification, classification date, methodology, main data used, and the person responsible for classification.

6.3.2 - Complete history of PD parameter estimates and observed default frequency for each risk level (in each model), as well as the complete history of exposure migration between risk levels.

6.3.3 - Complete history of LGD and EAD parameter estimates for the "wholesale" and "financial institutions" categories subject to the candidature.

6.3.4 - Complete history of LGD and EAD parameter estimates for other exposures subject to the candidature, if any.

6.4. Controls.

6.4.1 - Routine procedures, both automatic and manual, aimed at identifying errors in the data used in the risk classification system, indicating those responsible for executing the control.

6.4.2 - Process for reconciling operation positions, the accounting system, and the input data of the risk management system, indicating those responsible for executing the control. List the application systems used and existing controls, including access controls.

Implementation of the calculation of RWACPAD and RWACIRB portions in information technology systems.

7.1 - Categorization[25].

7.1.1 - Describe the categorization process.

7.1.2 - Describe the adopted categorization criteria, including the treatment of special cases[26].

7.2 - Describe the method for calculating the M parameter in each case[27].

7.3 - Describe the method for calculating the K factor in each case.

7.4 - Describe the method for calculating the correlation factor R in each case.

Validation relative to the candidature.

8.1 - Description of the validation process stages.

Describe and attach the validation opinion of the models and processes of the candidature, including reports on risk parameters.

Describe and attach the validation opinion for information technology systems, including those acquired from third parties, as per Article 112 of BCB Resolution No. 303.

8.2 - Policy defining the frequency and circumstances in which validations must be performed.

Describe the frequency of the validation process and the criterion for defining relevant changes that make a new validation process necessary, as per Article 109 of BCB Resolution No. 303 of 2023.

8.3 - Description of changes that do not warrant the performance of a validation process.

Describe the criteria for waiving the validation process and the critical evaluation process adopted in these cases, as per Article 118 of BCB Resolution No. 303 of 2023.

8.4 - Validation opinion.

Without prejudice to the validation opinion provided for in Article 108 of BCB Resolution No. 303 of 2023, the validation must manifest in detail on:

8.4.1 - Scope of the candidature and progressive implementation plan;

8.4.2 - Definition and consistency[28] of the observation unit for the purpose of the candidature and any managerial definitions that diverge from those in use at the FI;

8.4.3 - Consistent use of the observation unit for risk classification, PD, LGD, and EAD (CCF) measurement;

8.4.4 - Consistency of the sampling of default observations for PD, LGD, and EAD (CCF) measurement;

8.4.5 - Default marking, including: compliance with regulatory requirements;

8.4.6 - Processes to guarantee the integrity and uniqueness of information that feeds the various information systems and modeling pipelines, including in the existence of a manual processing stage for default marking in modeling;

8.4.7 - Default marking criterion for products with revolving characteristics;

8.4.8 - Risk classification models, including:

a) model segmentation;

b) criterion for identifying operations and counterparties used in modeling;

c) model performance;

d) formation of homogeneous risk groups;

e) assessment of concentration of operations or counterparties at certain risk levels;

8.4.9 - PD measurement models, including:

a) model segmentation;

b) data sufficiency;

c) sample adequacy;

d) model performance;

e) process for monitoring renegotiated operations and the relationship with the original operation;

8.4.10 - LGD measurement models, including:

a) model segmentation;

b) choice of workout period and relationship between parameter lag and greater data capture;

c) sample adequacy;

d) model performance;

e) process for individualized capture of direct recovery costs;

f) process for calculating indirect recovery costs;

g) process for monitoring restructured operations and relationship with the original operation;

h) information on collateral executions when applicable;

i) treatment of LGD for the cases;

j) in the case of candidature for the Advanced IRB approach, the treatment given to exposures not covered by collateral classified in the "Wholesale" category that represent a claim against a private legal entity with gross annual revenue exceeding BRL 3,000,000,000 (three billion reais) in the most recent fiscal year, describe the criteria for considering exposures as explicitly or economically subordinated to another class of exposures of the same counterparty;

k) treatment given to surety guarantees and risk mitigators in the calculation of parameters;

8.4.11 - EAD (CCF) measurement models;

8.4.12 - Precision and adequacy of estimated (or minimum) values for risk parameters, Expected Loss, RWACPAD, and RWACIRB;

8.4.13 - Process for implementing the calculation of RWACPAD and RWACIRB portions in information technology systems;

8.4.14 - Proof (test) of use as referred to in Articles 106 and 107 of BCB Resolution No. 303 of 2023, exhaustively listing the models and respective uses by category and subcategory;

8.4.15 - Scope of exposures considered in each category and subcategory, including any operation similar to credit (TVMs and leasing, among others);

8.4.16 - Adequacy of technological infrastructure, information systems, and data bases for:

a) risk modeling;

b) the risk management process; and

c) the calculation of risk parameters and RWACPAD and RWACIRB portions.

Internal audit relative to the candidature.

Procedures adopted by internal audit for the evaluation of the validation process, risk management, and compliance with the requirements of BCB Resolution No. 303 of 2023.

9.1 - Attach Audit Reports on compliance with BCB Resolution No. 303 of 2023, including opinion on the items listed in Article 119 of Resolution No. 303 of 2023, and on:

a) Risk management and independent validation structure free of adverse incentives, without variable remuneration related to results, including analysis of variable remuneration contracts and description of evaluation criteria used;

b) Opinion on the use of the Comprehensive Approach, in the use of financial collateral, as per Article 8 of BCB Circular No. 3,809 of August 25, 2016;

c) Opinion on the use of the SA-CCR Approach, in the calculation of counterparty credit risk arising from operations with financial derivative instruments, as per Annex I of BCB Resolution No. 229;

d) In the case of divergence between independent validation and internal audit opinions, listing of divergences duly justified.

9.2 - Audit Standard and Planning for compliance with Article 119 of BCB Resolution No. 303 of 2023.

9.3 - Report on compliance with the Validation process as referred to in Articles 108 to 117 of BCB Resolution No. 303 of 2023.

IV - ATTACHED DOCUMENTS

---

Item	Description of Documents	Reference Topic
1	Lists of categories, subcategories, and portfolios (consolidated across all business units) and their respective exposures, in editable spreadsheet format	1.1.2
2	Lists of categories, subcategories, and portfolios (by business unit) and their respective exposures, in editable spreadsheet format	1.2.1; 1.2.2; and 1.2.3
3	Lists of risk segments (for modeling purposes) and their respective exposures	1.2.4
4	Lists detailing the phased implementation plan both in the local jurisdiction and in foreign jurisdictions, where applicable	1.3.1 and 1.3.2
5	Organizational chart of the conglomerate or institution, indicating director positions and names of officeholders.	2.1
6	Last three minutes of each meeting of the committees cited.	2.1.1
7	Reports or presentations used for communication to senior management on matters related to risk management (last copy of each type).	2.1.2
8	Last three minutes of senior management decisions resulting from the information comprising the reports and presentations.	2.1.3
9	Organizational charts of all units involved in risk management.	2.2
10	Resume of the main managers involved with credit risk classification systems.	2.2.3
11	Documents establishing guidelines, policies, and procedures for risk management.	2.3.2
12	For the Wholesale and Financial Institutions categories, a list of observations marked as non-compliance within the bases used for modeling.	2.4
13	Manuals related to the processes of granting, classifying, and recovering credit-risk operations, including the development of new products subject to credit risk.	2.5
14	Documentation regarding the development and approval of the last three products subject to credit risk.	2.5.4
15	Map of exposures by risk level (in each category, subcategory, or portfolio) in all business units.	3
16	For the Wholesale and Financial Institutions categories, a list of overrides that occurred in the 24 months prior to the application base date.	3.4
17	Migration matrix between classification levels for a one-year period in each business unit.	6.3
18	Main reports used by units involved in risk management for risk control and monitoring of results, new operations, and exposures (last copy of each type).	4.1
19	Manuals related to the methodologies used for risk measurement and control (including their theoretical foundation) and to procedures complementary to the IRB approaches.	3.6; 3.7; and 3.8
20	Documentation of each model used for the calculation of risk parameters, including details on the definition of risk levels.	3.6; 3.7; and 3.8
21	Manual for backtesting tests.	4.2
22	Last set of backtesting reports, with indication and explanatory analysis of exceptions that occurred at the available levels of disaggregation. Examples: (a) realized default rates with values predicted by the model for each risk level; (b) values of LGD and EAD parameters observed with their estimates for each risk level, in the event of using the advanced IRB approach; and (c) risk parameters disclosed by the Central Bank of Brazil with their respective realized values for exposures, in the event of using the basic IRB approach.	4.2
23	Action plans for correcting deviations observed in the last set of backtesting reports.	4.2
24	Comparisons of model results with results from alternative methodologies and external data sources (benchmarking).	4.3
25	Manual for stress tests.	5
26	Report of the most recent stress tests (scenarios used and impact on risk factors and capital).	5
27	Manual or policy for defining and reviewing limits.	2.6
28	Manual addressing the treatment given to limit extrapolations.	2.6.2
29	Documentation of the procedures for constructing the database used in the risk modeling environment.	6.1
30	Documentation of the information technology systems involved in the risk classification system (including operational manuals).	6
31	Inventory of the technological infrastructure used in the risk classification approach (hardware, database, operating system, and tools), including those not under IT governance.	6.1 and 6.2
32	End-to-end mapping of the information flow in the systems used, from the capture of information used in models to the systems that generate the information used in monitoring and production of reports associated with credit risk.	6
33	Documentation, only within the scope of the IRB approaches, of business continuity plans and reports with the results of tests of these plans.	6.2
34	Manuals of procedures and operational control routines, including the process of reconciliation of positions of the risk areas with accounting.	6.4
35	Manuals for validation of models, processes, and the information technology environment.	8
36	Reports of the validation process.	8
37	History of relevant changes in systems, models, or the institution's risk profile, occurring in the last 12 months.	2.9
38	Internal audit manuals regarding the evaluation of the validation process, risk management, and compliance with the requirements of Resolution BCB No. 303.	9
39	Most recent internal audit reports regarding the evaluation of the validation process, risk management, and compliance with the requirements of Resolution BCB No. 303.	9
40	Other internal audit reports, prepared in the last 12 months, regarding credit and risk areas, if any.	9
41	Most recent reports of the technological environment for risk management produced by internal audit.	9

NOTE

Supervision Matters – Provides for the information that must be included in the report referred to in Resolution BCB No. 303 of March 16, 2023.

The regulation of this subject deals with the possibility of financial institutions requesting the use of internal credit risk models (IRB approaches) for the calculation of the value relating to the RWACIRB portion, as dealt with in CMN Resolution No. 4.958 of October 21, 2021, and BCB Resolution No. 200 of March 11, 2022.

2. In Instruction Normative BCB No. 259 of March 30, 2022, information that must be included in the report provided for in Circular No. 3.648 of March 4, 2013, is set forth. However, the revocation of this Circular by Resolution BCB No. 303 of 2023 makes it necessary to update the Instruction Normative.

3. Given that the terms of this Instruction Normative are considered low impact, serving only as a means to clarify the procedure for executing the option contained in CMN Resolution No. 4.958 of 2021, BCB Resolution No. 200 of 2002, and BCB Resolution No. 303 of 2023, without causing, therefore, an increase in costs for economic agents, users, budgetary or financial expenses, nor impacting the public policy executed, in accordance with items III and IV of Article 4 of Decree No. 10.411 of June 30, 2020, there is no need to prepare a regulatory impact analysis as provided for in Article 5 of Law No. 13.874 of September 20, 2019.

ARISTIDES ANDRADE CAVALCANTE NETO
Head of the Department of Strategic Management and Specialized Supervision

ADALBERTO FELINTO DA CRUZ JUNIOR
Head of the Department of Supervision of Cooperatives and Non-Bank Institutions

BELLINE SANTANA
Head of the Banking Supervision Department

---

[1] Person responsible for consolidating the Notebook, verifying the content sent, and for consistency among the various sources of information and areas involved in the preparation of the material.

[2] Contact point for issues related to the request, which may eventually be the technical responsible for the Notebook or a person involved in routine relationships with the Central Bank of Brazil.

[3] On the application base date.

[4] Risk Weighting Factor as provided for in BCB Resolution No. 229 of 2022. In the case of a category, subcategory, or portfolios that comprise exposures with different RWFs, present the information in a specific line for each RWF. Present in a table in the same format, separately, the consolidated information with the average RWF by category, subcategory, or portfolio.

[5] In accordance with Article 34, item I of BCB Resolution No. 303 of 2023. This is the value obtained by internal models before comparison with 72.5% of RWACPAD.

[6] Link the exposure groups of this report to the DLO accounts.

[7] In this table, present the average RWF.

[8] Implementation date of the IRB approaches for the business unit. Clarify whether it will be implemented at the initial moment or the expected date within the phased implementation plan.

[9] This is the method of classification of exposures used in modeling. For example, Wholesale divides wholesale exposures into three segments and uses a specific model to classify clients in each of the three.

[10] For filling out the spreadsheets associated with PD, LGD, and EAD segmentation (FCC), disregard the columns related to the provision constituted and IRB PE.

[11] This refers to exposures not covered by the 95% coverage of exposures (weighted by their respective RWFs) as provided for in Article 120, § 2.

[12] In accordance with Article 15 of BCB Resolution No. 303 of 2023.

[13] In accordance with Article 3 of CMN Resolution No. 4.966 or BCB Resolution No. 352 of 2023.

[14] As provided for in Article 15, §5 of BCB Resolution No. 303 of 2023.

[15] As provided for in Article 3, §4 of CMN Resolution No. 4.966 or BCB Resolution No. 352 of 2023.

[16] For example, through locks in computerized systems or monitoring done by an independent area.

[17] Definition used for managerial purposes for classification and ordering of risk of operations or counterparties.

[18] Example for a data group: list of registration information, obtained directly from the internal database.

[19] Examples: external mapping, decision tree, internal estimation, linear regression.

[20] This refers to the goodness-of-fit tests mentioned in Article 60, §1 of BCB Resolution No. 303.

[21] Normative reference: Article 114 of BCB Resolution No. 303.

[22] Normative reference: Article 26 of BCB Resolution No. 303.

[23] The detailed description must be sent as an attachment, as listed in Section IV.

[24] The detailed description must be sent as an attachment, as listed in Section IV.

[25] Process of identifying exposures subject to capital allocation in the RWACPAD and RWACIRB portions and the treatment to be given to each of them (BCB Resolution No. 229, and BCB Resolution No. 303).

[26] Example: treatment of acquired receivables, in the case of impossibility of associating each exposure to its subcategory.

[27] Specifically, clarify the cases in which M is less than 1.

[28] Consistency of the observation unit over time, in marking default and assigning parameters. The evaluation of consistency must also consider the existence of divergent observation units for similar cases.