Circular CSSF 21/773 on the Management of Climate-related and Environmental Risks

CSSF CIRCULAR 21/773 1/9 Circular CSSF 21/773 On the Management of Climate-related and Environmental Risks

CSSF CIRCULAR 21/773 2/9 Circular CSSF 21/773 On the Management of Climate-related and Environmental Risks

1. Introduction
2. Climate-related and environmental risks may translate into physical and transition risks that could materially impair the financial situation and the operational capacity of a credit institution.
3. The purpose of this circular on the management of climate-related and environmental risks (hereafter the “Circular”) is to raise credit institutions’ awareness on the need to consider and assess climate-related and environmental risks and to increase awareness of members of the management body and institutions’ staff about these risks.
4. It describes how the CSSF expects credit institutions to consider and integrate into their operations climate-related and environmental risks, as drivers of existing categories of risks. These expectations are most relevant when credit institutions formulate and implement their business strategy, governance and risk management frameworks. They are part of the wider regulatory developments regarding sustainability considerations. The expectations in this Circular are consistent with the ECB’s “Guide on climate-related and environmental risks” dated November 2020 and the “Guide for Supervisors: integrating climate-related and environmental risks into prudential supervision” published in May 2020 by the Network of Central Banks and Supervisors for Greening the Financial System (NGFS).
5. Article 5 of the Law of 5 April 1993 on the Financial Sector provides that credit institutions shall have robust governance arrangements, including effective processes to identify, manage, monitor and report the risks to which they are or might be exposed to. Credit institutions shall consider the extent to which their current management practices for climate-related and environmental risks are safe and prudent, taking into account the guidance set out in the Circular.
6. The CSSF will continue to develop its supervisory approach to climate-related and environmental risks over time, taking into account regulatory developments at an international level as well as evolving practices in the industry and in the supervisory community. Luxembourg 21 June, 2021 To all credit institutions designated as Less Significant Institutions under the Single Supervisory Mechanism and to all branches of non-EU credit institutions

CSSF CIRCULAR 21/773 3/9 2. Scope of application 6. The Circular applies to all credit institutions designated as Less Significant Institutions under the Single Supervisory Mechanism1 and to all branches of non-EU credit institutions (hereafter “Institutions”). 7. While the CSSF recognises the challenges that smaller Institutions may face in assessing the impacts of climate-related and environmental risks, it should be stressed that the size of an Institution does not directly determine or correlate to the material nature of the risks that it faces. Institutions shall duly consider the expectations in the Circular in a proportionate manner, taking into account the materiality of their exposure to risks arising from climate change and other environmental factors. 3. Definitions 8. Climate change and environmental degradation are sources of structural change that affect economic activity and, in turn, the financial system. Climate-related and environmental risks are commonly understood to comprise two main risk drivers2: 9. Physical risk refers to the financial impact of a changing climate, including more frequent extreme weather events and gradual changes in climate, as well as of environmental degradation, such as air, water and land pollution, water stress, biodiversity loss and deforestation. Physical risk is categorised as “acute” when it arises from extreme events, such as droughts, floods and storms, or “chronic” when it arises from progressive shifts, such as increasing temperatures, sea-level rises, water stress, biodiversity loss and resource scarcity. It may directly result in, for example, damage to property or reduced productivity, or indirectly lead to subsequent events, such as the disruption of supply chains. 10. Transition risk refers to an Institution’s financial loss that may result, directly or indirectly, from the process of adjustment towards a lower-carbon and more environmentally sustainable economy. It could be triggered, for example, by a relatively abrupt adoption of stricter climate and environmental policies, technological progress or changes in market sentiment and preferences. 1 “Significant supervised entities” as defined in Article 2, point 16 of Regulation (EU) No 468/2014 of the European Central Bank (ECB) of 16 April 2014 (SSM Framework Regulation) shall refer to the relevant ECB rules. 2 The definitions of physical and transition risks are framed exclusively in terms of financial impact that Institutions may face. The financial impact is assessed as the most relevant for Luxembourg Institutions. Institutions that in addition face operational impacts shall duly take these into account.

CSSF CIRCULAR 21/773 4/9 11. Climate-related and environmental risks are drivers of existing risks, in particular credit risk, operational risk, market risk and liquidity risk. Climate￾related and environmental risk factors also impact reputational risk. 4. Identification of risk exposure 12. The CSSF expects Institutions to regularly assess the materiality and relevance of climate-related and environmental risks for the Institution in the short, medium and long term, covering more than five years. The assessment of materiality is an institution-specific assessment, taking into account the specificities of the business model, the operating environment and the risk profile. 13. Institutions shall identify their exposure to climate-related and environmental risks drivers, considering risk concentration by sector, geographies, products and services, as relevant, and using a forward-looking perspective taking into account their business model. 5. Business strategy and risk appetite 14. The business strategy is an Institution’s principal tool for positioning itself within its business environment in order to generate acceptable and sustainable returns in line with its risk appetite. When determining their business strategy, Institutions are expected to integrate climate-related and environmental risks that materially impact their business environment in the short, medium or long term. When implementing their strategy, Institutions should factor such risks also into their internal communication. 15. Institutions shall include as part of their risk appetite framework, climate￾related and environmental risk indicators and limits for the risks that they are willing to bear. 16. Institutions are encouraged to monitor the fulfilment of their strategy, by setting key performance indicators (KPIs) and key risk indicators (KRIs), that are cascaded down to individual business lines and portfolios, where relevant. Such indicators should be approved by the management body and linked to the risk appetite. 17. Given the limitations of actual data and quantitative methodologies, Institutions may resort to qualitative measures to monitor strategic objectives. Institutions are expected to progressively develop and keep up-to-date sound and robust monitoring tools tailored to their specific risk appetite/profile.

CSSF CIRCULAR 21/773 5/9 6. Risk management framework 18. When climate-related and environmental risks are assessed as material, they shall be fully integrated into the risk management framework of an Institution. 19. Institutions are expected to incorporate climate-related and environmental risks as drivers of existing risk categories into their risk management framework, with a view to managing and monitoring these over a sufficiently long-term horizon, and to review their management and monitoring arrangements on a regular basis. 20. Institutions are expected to identify and quantify these risks within their overall process of ensuring capital and liquidity adequacy. The risk identification shall be documented in writing by the Institutions. A high-level summary of this risk identification shall be provided in the ICAAP and ILAAP reports issued each year. 21. Institutions are expected to understand the ways in which material climate￾related and environmental risks affect the different regulatory risk categories, including credit, operational, market and liquidity risks. The table below provides an example of how physical and transition factors may lead to increased risks. Risks affected Physical Transition Climate-related Environmental Climate-related Environmental • Extreme weather events • Chronic weather patterns • Water stress • Resource scarcity • Biodiversity loss • Pollution • Other • Policy and regulation • Technology • Market sentiment • Policy and regulation • Technology • Market sentiment Credit The probabilities of default (PD) and loss given default (LGD) of exposures within sectors or geographies vulnerable to physical risk may be impacted, for example, through lower collateral valuations in real estate portfolios as a result of increased flood risk. Energy efficiency standards may trigger substantial adaptation costs and lower corporate profitability, which may lead to a higher PD as well as lower collateral values. Market Severe physical events may lead to shifts in market expectations and could result in sudden repricing, higher volatility and losses in asset values on some markets. Transition risk drivers may generate an abrupt repricing of securities and derivatives, for example for products associated with industries affected by asset stranding. Operational The bank’s operations may be disrupted due to physical damage to its property, branches and data centres as a result of extreme weather events. Changing consumer sentiment regarding climate issues can lead to reputation and liability risks for the bank as a result of scandals caused by the financing of environmentally controversial activities.

CSSF CIRCULAR 21/773 6/9 Other risk types (liquidity, business model) Liquidity risk may be affected in the event of clients withdrawing money from their accounts in order to finance damage repairs. Transition risk drivers may affect the viability of some business lines and lead to strategic risk for specific business models if the necessary adaptation or diversification is not implemented. An abrupt repricing of securities may reduce the value of banks’ high-quality liquid assets, thereby affecting liquidity buffers. Source: ECB, Guide on climate-related and environmental risks 22. In their credit risk management, Institutions are expected to consider climate￾related and environmental risks at all stages of the credit-granting process and to monitor the related risks in their portfolios. 23. In their operational risk management, Institutions are expected to consider how climate-related events could have an adverse impact on business continuity and the extent to which the nature of Institutions’ activities could increase reputational and/or liability risks. 24. In their market risk management, Institutions are encouraged to monitor on an ongoing basis the effect of climate-related and environmental factors on their current market risk positions and to evaluate potential investments in respect of these risks. 25. Institutions with material climate-related and environmental risks are expected to assess whether those risks could cause net cash outflows or depletion of liquidity buffers and, if so, incorporate these factors into their liquidity risk management. 26. Institutions with material climate-related and environmental risks are expected to evaluate the appropriateness of their stress testing framework, with a view to incorporating such risks into their baseline and adverse scenarios. Institutions should progressively enhance their stress testing capacities to strengthen their understanding on how adverse events or scenarios driven by physical and transition risks affect their financial and operational position.

CSSF CIRCULAR 21/773 7/9 7. Internal governance 27. The assessment of the negative consequences that climate change might have on an Institution’s strategic positioning and its financial risks shall be critically assessed, and its outcome explicitly endorsed, by the management body. The management body shall ensure that climate change and environmental risks are factored into business strategy, risk appetite and risk management frameworks as described in this Circular. 28. Institutions shall clearly define and assign responsibility for the management of climate-related and environmental risks within the organizational structure in accordance with the three lines of defence model. Roles and responsibilities for all business areas shall be documented and communicated. 29. Business line staff, acting as first line of defence, shall perform its duties in accordance with any climate-related and environmental policy, procedure or limit. More specifically, the first line of defence is expected to identify, assess and monitor any climate-related and environmental risks relevant for the creditworthiness and the scoring/rating of a client or counterparty, as well as to conduct proper due diligence on climate-related and environmental risks that the Institution is or will become exposed to. 30. The risk control function is key in the operational implementation of climate￾related and environmental risk mitigation within the risk management framework as detailed in section 6. The compliance function shall ensure that Institutions take into account the legal and reputational risks and monitor the alignment of the Institutions’ activities with all applicable legal and regulatory requirements on climate and environmental aspects as well as Institutions’ own internal policies. 31. Once the climate-related and environmental risks have been incorporated into Institutions’ governance and organisational arrangements, the internal audit function shall include those features in their audit plans and capture them under the existing processes. 32. The CSSF expects that adequate training on climate-related and environmental risks is given to all relevant staff in order to ensure the necessary skills and avoid knowledge gaps. 33. Institutions shall develop regular and transparent reporting to the management body in order to enable it to exercise effective oversight in line with the overall business strategy and the risk management framework. The management body in its supervisory function is expected to monitor and follow-up on targets and developments in KPIs and KRIs.

CSSF CIRCULAR 21/773 8/9 34. To encourage behaviour consistent with their climate-related and environmental (risk) approach, Institutions that have set climate-related and environmental objectives should consider implementing a variable remuneration component linked to the successful achievement of those objectives. 8. Date of application 35. This Circular is applicable as of its date of publication. CSSF expects Institutions to start reviewing their current business models and operational frameworks by mid-year 2021 with a view to progressively implement operational arrangements that incorporate climate-related and environmental risk factors. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General

CSSF CIRCULAR 21/773 9 / 9 Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1

1 direction@cssf.lu www.cssf.lu