CSSF Circular 18/693: Adoption of EBA Guidelines on Connected Clients

Circular CSSF 18/693 Page 1/4 Luxembourg, 5 July 2018 To all credit institutions and CRR investment firms incorporated under Luxembourg law and to Luxembourg branches of credit institutions and CRR investment firms having their registered office in a third country CSSF CIRCULAR 18/693 Re : Adoption of the Guidelines of the European Banking Authority on connected clients under Article 4(1)(39) of Regulation (EU) No 575/2013 (EBA/GL/2017/15) Ladies and Gentlemen, The purpose of this circular is to draw your attention to the Guidelines of the European Banking Authority (EBA) on connected clients under Article 4(1)(39) of Regulation (EU) No 575/20131 (EBA/GL/2017/15 – the “Guidelines”) that enter into force on 1st January 20192 and with which the CSSF intends to comply in its capacity as competent authority.3

1 Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (the “CRR”). 2 As of 1st January 2019, the Guidelines will repeal the “Guidelines on the implementation of the revised large exposures regime” issued by the Committee of European Banking Supervisors (CEBS) on 11 December 2009 (the “CEBS Guidelines”). 3 “Significant supervised entities” as defined in Article 2, point 16 of Regulation (EU) No 468/2014 of the European Central Bank (ECB) of 16 April 2014 (SSM Framework Regulation) shall refer to the relevant ECB rules (if any): See https://www.bankingsupervision.europa.eu/legalframework/regulatory/compliance/html/index.en.html

Circular CSSF 18/693 Page 2/4 Article 4(1)(39) CRR defines “group of connected clients” as: “(a) two or more natural or legal persons who, unless it is shown otherwise, constitute a single risk because one of them, directly or indirectly, has control over the other or others; (b) two or more natural or legal persons between whom there is no relationship of control as described in point (a) but who are to be regarded as constituting a single risk because they are so interconnected that, if one of them were to experience financial problems, in particular funding or repayment difficulties, the other or all of the others would also be likely to encounter funding or repayment difficulties. Notwithstanding points (a) and (b), where a central government has direct control over or is directly interconnected with more than one natural or legal person, the set consisting of the central government and all of the natural or legal persons directly or indirectly controlled by it in accordance with point (a), or interconnected with it in accordance with point (b), may be considered as not constituting a group of connected clients. Instead the existence of a group of connected clients formed by the central government and other natural or legal persons may be assessed separately for each of the persons directly controlled by it in accordance with point (a), or directly interconnected with it in accordance with point (b), and all of the natural and legal persons which are controlled by that person according to point (a) or interconnected with that person in accordance with point (b), including the central government. The same applies in cases of regional governments or local authorities to which Article 115(2) applies.” The concept of ‘group of connected clients’ is particularly relevant for the large exposures regime as it constitutes a backstop designed to limit the impact of the failure of a client or a group of connected clients on an institution. The concept is also relevant to the following areas of the CRR where the concept of “group of connected clients” is also used:

• the categorisation of clients in the retail exposure class for the purposes of credit risk in the standardised approach (art. 123(c) CRR) and in the IRB approach (art. 147(5)(a)(ii) CRR);
• the assignment within a rating system (IRB approach) of exposures to corporates, institutions, central governments and central banks, as well as certain equity exposures (art. 172(1)(d) CRR);

Circular CSSF 18/693 Page 3/4

• the specification of items requiring stable funding for reporting purposes (art. 428(1)(g)(ii) CRR); and
• the SME supporting factor (art. 501(2)(c) CRR). The Guidelines further clarify a number of aspects that institutions should consider when determining whether a group of connected clients exists. In particular they clarify that:
• the existence of a control relationship leads to a “single risk”, except in exceptional cases only;
• institutions should make use of their clients’ consolidated financial statements to identify connections based on control;
• exposures to shadow banking entities are also concerned by the Guidelines. As such, the Guidelines make a cross reference to the EBA Guidelines of 14 December 2015 relating to the limits on exposures to shadow banking entities (which have been transposed by CSSF circular 16/647); 4
• institutions should strengthen their investigations, by extensive research of any type of ‘soft information’ as well as information that goes beyond the institutions’ clients, in all cases where the sum of all exposures to one individual client exceeds 5% of Tier 1 capital. Institutions are invited to make the necessary arrangements to ensure their compliance with the Guidelines as at 1st January 2019. In particular, institutions shall take into consideration the Guidelines when assessing whether a group of clients forms a “group of connected clients” for the purposes of, among others, Sub-Chapter 1.2 and Chapters 2, 3 and 6 of Part III of CSSF circular 12/552, 5 their internal capital adequacy assessment process (ICAAP) as defined in CSSF circular 07/3016 and their management of concentration risk (CSSF regulation N° 15-02)7 . As of 1st January 2019, CSSF circular 12/552 will be amended to include in its Part III a wording which could read as follows:

4 Circular CSSF 16/647: Update of Circular CSSF 12/552 on the central administration, internal governance and risk management following the adoption of the European Banking Authority (EBA) guidelines relating to the limits on exposures to shadow banking entities which carry out banking activities outside a regulated framework under Article 395(2) of Regulation (EU) No 575/2013 (EBA/GL/2015/20) 5 Circular CSSF 12/552 on central administration, internal governance and risk management 6 Circular CSSF 07/301 on the implementation of the Internal Capital Adequacy Assessment Process (ICAAP) 7 CSSF Regulation N° 15-02 relating to the supervisory review and evaluation process that applies to CRR institutions

Circular CSSF 18/693 Page 4/4 “When assessing whether a group of clients forms a “group of connected clients” (as such term is used in Regulation (EU) No 575/2013), institutions shall take into consideration the EBA Guidelines on connected clients (EBA/GL/2017/15). The concept applies in particular in the context of article 11 (Concentration risk) of CSSF Regulation N° 15-02 relating to the supervisory review and evaluation process and Chapters 2, 3 and 6 of Part III of this circular.” The present circular shall apply with immediate effect. The Guidelines are appended and available on the EBA website under: https://www.eba.europa.eu/regulation-and-policy/large-exposures/guidelines-on￾connected-clients Yours faithfully, COMMISSION de SURVEILLANCE du SECTEUR FINANCIER Jean-Pierre FABER Françoise KAUTHEN Claude SIMON Director Simone DELCOURT Claude MARX Director Director general

Appendice: EBA Guidelines on connected clients under Article 4(1)(39) of Regulation (EU) No 575/2013

GUIDELINES ON CONNECTED CLIENTS EBA/GL/2017/15 23/02/2018 Guidelines on connected clients under Article 4(1)(39) of Regulation (EU) No 575/2013

GUIDELINES ON CONNECTED CLIENTS 2

1. Compliance and reporting obligations Status of these guidelines
2. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010. 1 In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the guidelines.
3. Guidelines set out the EBA’s view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements
4. In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify the EBA as to whether they comply or intend to comply with these guidelines, or otherwise give reasons for non-compliance, by 23/04/2017.
5. In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website to compliance@eba.europa.eu with the reference ‘EBA/GL/2017/15’.
6. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to the EBA. Notifications will be published on the EBA website, in line with Article 16(3).

1 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12. 2010, p. 12).

GUIDELINES ON CONNECTED CLIENTS 3 2. Subject matter, scope and definitions Subject matter and scope of application 6. These guidelines specify the approach institutions, as defined under point (3) of Article 4(1) of Regulation (EU) No 575/2013, should take when applying the requirement to group two or more clients into a ‘group of connected clients’ because they constitute a single risk in accordance with Article 4(1)(39) of that Regulation. Addressees 7. These guidelines are addressed to competent authorities as defined in point (i) of Article 4(2) of Regulation (EU) No 1093/2010 and to financial institutions as defined in Article 4(1) of Regulation No 1093/2010. Definitions 8. Unless otherwise specified, terms used and defined in Regulation (EU) No 575/2013 and Directive 2013/36/EU have the same meaning in these guidelines.

GUIDELINES ON CONNECTED CLIENTS 4 3. Implementation Date of application 9. These guidelines apply from 1 January 2019. Repeal 10.The CEBS ‘Guidelines on the implementation of the revised large exposures regime’, of 11 December 2009, are repealed with effect from 1 January 2019.

GUIDELINES ON CONNECTED CLIENTS 5 4. Groups of connected clients based on control 11.When applying Article 4(1)(39)(a) of Regulation (EU) No 575/2013, institutions are required to assume that two or more clients constitute a single risk when there is a control relationship between them. 12.In exceptional cases, where institutions are able to demonstrate that no single risk exists despite the existence of a control relationship among clients, institutions should document the relevant circumstances that justify this case in a detailed and comprehensible manner. For example, in specific cases where a special purpose entity that is controlled by another client (e.g. an originator) is fully ring-fenced and bankruptcy remote – so that there is no possible channel of contagion, and hence no single risk, between the special purpose entity and the controlling entity – it may be possible to demonstrate that no single risk exists (see scenario C 1 in the annex). 13.Institutions should apply the concept of control as defined in Article 4(1)(37) of Regulation (EU) No 575/2013 as follows: a) In relation to clients that prepare their consolidated financial statements in conformity with the national rules transposing Directive 2013/34/EU, 2 institutions should rely on the control relationship between a parent undertaking and its subsidiaries within the meaning of Article 22(1) and (2) of Directive 2013/34/EU. For this purpose, institutions should group clients accordingly on the basis of their clients’ consolidated financial statements. To this end, references to Directive 2013/34/EU should be understood as references to the national rules that transposed Directive 2013/34/EU in the Member State where the institutions’ clients are required to prepare their consolidated financial statements. b) In relation to clients that prepare their consolidated financial statements in conformity with the international accounting standards adopted by the Commission in accordance with Regulation (EC) No 1606/2002, institutions should rely on the control relationship between a parent undertaking and its subsidiaries within the meaning of those accounting standards. For this purpose, institutions should group clients accordingly on the basis of their clients’ consolidated financial statements. c) In relation to clients to which point (a) or point (b) of this paragraph do not apply (e.g. natural persons, central governments, and clients that prepare consolidated financial statements in accordance with the accounting rules of a third country), institutions should deem to be control relationships those between any natural or legal person and an undertaking that are similar to the parent undertaking/subsidiary relationships mentioned in points (a) and (b) of this paragraph.

2 Article 22(1) and (2) of Directive 2013/34/EU has replaced the content of Article 1 of Directive 83/349/EEC, referred to in Article 4(1)(37) of Regulation (EU) No 575/2013. In accordance with Article 52 of Directive 2013/34/EU, references to the repealed directive must be construed as references to Directive 2013/34/EU and must be read in accordance with the correlation table in its Annex VII.

GUIDELINES ON CONNECTED CLIENTS 6 When conducting this assessment, institutions should deem any of the following criteria to constitute a control relationship: i. holding the majority of the shareholders’ or members’ voting rights in another entity; ii. right or ability to appoint or remove a majority of the members of the administrative, management or supervisory body of another entity; iii. right or ability to exercise a dominant influence over another entity pursuant to a contract, or provisions in memoranda or articles of association. Other possible indicators of control that institutions should consider in their assessment include the following: iv. power to decide on the strategy or direct the activities of an entity; v. power to decide on crucial transactions, such as the transfer of profit or loss; vi. right or ability to coordinate the management of an entity with that of other entities in pursuit of a common objective (e.g. where the same natural persons are involved in the management or board of two or more entities); vii. holding more than 50% of the shares of capital of another entity. 14.Given that the decisive factor for the assessment of the existence of a control relationship is the accounting criteria or indicators of control set out in paragraph 13(a), (b) and (c), institutions should group two or more clients on account of a relationship of control, as described in this section, even where these clients are not included in the same consolidated financial statements because exemptions apply to them under the relevant accounting rules, for example under Article 23 of Directive 2013/34/EU. 15.Institutions should group two or more clients into a group of connected clients on account of a relationship of control among these clients regardless of whether or not the exposures to these clients are exempted from the application of the large exposures limit under Article 400(1) and (2) of Regulation (EU) No 575/2013 or in accordance with exemptions under national rules implementing Article 493(3) of that Regulation.

GUIDELINES ON CONNECTED CLIENTS 7 5. Alternative approach for exposures to central governments 16.In line with the definition of ‘group of connected clients’ under the last subparagraph of Article 4(1)(39) of Regulation (EU) No 575/2013, institutions may assess the existence of a group of connected clients separately for each of the persons directly controlled by or directly interconnected with the central government (‘alternative approach’).3 17.The same provision allows for a partial application of the alternative approach, assessing separately the natural or legal persons directly controlled by or directly interconnected with the central government (see scenario CG 1 in the annex). 18.The provision also makes clear that: a) The central government is included in each of the groups of connected clients identified separately for the natural or legal persons directly controlled by or directly interconnected with the central government (see scenario CG 2 in the annex). b) Each group of connected clients under point (a) includes also persons controlled by or interconnected with the person who is directly controlled by or directly interconnected with the central government (see scenario CG 3 in the annex). 19.Where the entities directly controlled by or directly interconnected with the central government are economically dependent on each other, they should form separate groups of connected clients (excluding the central government), in addition to the groups of connected clients formed in accordance with the alternative approach (see scenario CG 4 in the annex). 20. In line with the last sentence of the last subparagraph of Article 4(1)(39) of Regulation (EU) No 575/2013, this section of the guidelines is also applicable to regional governments or local authorities to which Article 115(2) of that Regulation applies, and natural or legal persons directly controlled by or interconnected with these regional governments or local authorities.

3 In accordance with Article 400(1)(a) of Regulation (EU) No 575/2013, asset items constituting claims on central governments, which unsecured would be assigned a 0% risk weight under the standardised approach, are exempted from the application of Article 395(1) (limits to large exposures) of the same regulation.

GUIDELINES ON CONNECTED CLIENTS 8 6. Establishing interconnectedness based on economic dependency 21.When assessing interconnectedness among their clients based on economic dependency, in accordance with Article 4(1)(39)(b) of Regulation (EU) No 575/2013, institutions should take into account the specific circumstances of each case, in particular whether the financial difficulties or the failure of a client would lead to funding or repayment difficulties for another client (see scenarios E 1, E 2, E 3 and E 4 in the annex). 22.Where an institution is able to demonstrate that the financial difficulties or the failure of a client would not lead to funding or repayment difficulties for another client, these clients do not need to be considered a single risk. In addition, two clients do not need to be considered a single risk if a client is economically dependent on another client in a limited way, meaning that the client can easily find a replacement for the other client. 23.Institutions should consider, in particular, the following situations when assessing economic dependency: a) Where a client has fully or partly guaranteed the exposure of another client and the exposure is so significant for the guarantor that the guarantor is likely to experience financial problems if a claim occurs. 4 b) Where a client is liable in accordance with his or her legal status as a member in an entity, for example a general partner in a limited partnership, and the exposure is so significant for the client that the client is likely to experience financial problems if a claim against the entity occurs. c) Where a significant part of a client’s gross receipts or gross expenditures (on an annual basis) is derived from transactions with another client (e.g. the owner of a residential/commercial property the tenant of which pays a significant part of the rent) that cannot be easily replaced. d) Where a significant part of a client’s production/output is sold to another client of the institution, and the production/output cannot be easily sold to other customers. e) Where the expected source of funds to repay the loans of two or more clients is the same and none of the clients has another independent source of income from which the loan may be serviced and fully repaid. f) Other situations where clients are legally or contractually jointly liable for obligations to the institution (e.g. a debtor and his or her co-borrower, or a debtor and his or her spouse/partner).

4 This situation refers to guarantees that do not comply with the eligibility requirements provided for in Part Three, Title II, Chapter IV (Credit Risk Mitigation) of Regulation (EU) No 575/2013 and, consequently, in relation to which the substitution approach (referred to in Article 403 of that Regulation) cannot be used for prudential purposes.

GUIDELINES ON CONNECTED CLIENTS 9 g) Where a significant part of the receivables or liabilities of a client is to another client. h) Where clients have common owners, shareholders or managers. For example, horizontal groups where an undertaking is related to one or more other undertakings because they all have the same shareholder structure without a single controlling shareholder or because they are managed on a unified basis. This management may be pursuant to a contract concluded between the undertakings, or to provisions in the memoranda or articles of association of those undertakings, or if the administrative management or supervisory bodies of the undertaking and of one or more other undertakings consist for the major part of the same persons. 24.Institutions should also consider the non-exhaustive list of situations in paragraph 23 when assessing connections among shadow banking entities.5 Institutions should give due consideration to the fact that relationships between entities falling under the definition of shadow banking entities will most likely consist not of equity ties but rather of a different type of relationship, i.e. situations of de facto control or relationships characterised by contractual obligations, implicit support or potential reputational risk (e.g. sponsorship or even branding). 25.Where an institution’s client is economically dependent on more than one client, which are not dependent on each other, the institution should include the latter clients in separate groups of connected clients (together with the dependent client). 26.Institutions should form a group of connected clients where two or more of their clients are economically dependent on an entity, even if this entity is not a client of the institution. 27.Institutions should group two or more clients into a group of connected clients on account of economic dependency among these clients regardless of whether or not the exposures to these clients are exempted from the application of the large exposures limit under Article 400(1) and (2) of Regulation (EU) No 575/2013 or in accordance with exemptions under national rules implementing Article 493(3) of that Regulation. Economic dependency through a main source of funding 28.Institutions should consider situations where the funding problems of one client are likely to spread to another on account of a one-way or two-way dependency on the same funding source. This does not include cases where clients get funding from the same market (e.g. the market for commercial paper) or where clients’ dependency on their existing source of funding is caused by the clients’ deteriorating creditworthiness, such that they cannot easily replace that source of funding. 29.Institutions should consider cases where the common source of funding depended on is provided by the institution itself, its financial group or its connected parties (see scenarios E 5 and E 6 in the

5 As defined in the EBA guidelines on limits on exposures to shadow banking entities that carry out banking activities outside a regulated framework under Article 395(2) of Regulation (EU) No 575/2013: https://www.eba.europa.eu/regulation-and-policy/large-exposures/guidelines-on-limits-on-exposures-to-shadow-banking

GUIDELINES ON CONNECTED CLIENTS 10 annex)6 . Being clients of the same institution does not in itself create a requirement to group the clients if the institution providing funding can be easily replaced. 30.Institutions should also assess any contagion or idiosyncratic risk that could emerge from the following situations: a) use of one funding entity (e.g. the same bank or conduit that cannot be easily replaced); b) use of similar structures; c) reliance on commitments from one source (e.g. guarantees, credit support in structured transactions or non-committed liquidity facilities), taking into account its solvency, especially where there are maturity mismatches between the maturity of underlying assets and the frequency of the refinancing needs.

6 Recital 54 to Regulation (EU) No 575/2013 sets out that ‘In determining the existence of a group of connected clients and thus exposures constituting a single risk, it is also important to take into account risks arising from a common source of significant funding provided by the institution itself, its financial group or its connected parties.’

GUIDELINES ON CONNECTED CLIENTS 11 7. Relation between interconnectedness through control and interconnectedness through economic dependency 31.Institutions should first identify which clients are connected via control in accordance with Article 4(1)(39)(a) of Regulation (EU) No 575/2013 (‘control group’) and which clients are connected via economic dependency in accordance with Article 4(1)(39)(b) of the same Regulation. Subsequently, institutions should assess whether the identified groups of connected clients need to be (partially) connected themselves (e.g. whether groups of clients connected on account of economic dependency need to be grouped together with a control group). 32.In their assessment, institutions should consider each case separately, i.e. identify the possible chain of contagion (‘domino effect’) based on the individual circumstances (see scenarios C/E 1 and C/E 2 in the annex). 33.Where clients that are part of different control groups are interconnected via economic dependency, all entities for which a chain of contagion exists need to be grouped into one group of connected clients. Downstream contagion should always be assumed when a client is economically dependent and is itself the head of a control group (see scenario C/E 3 in the annex). Upstream contagion of clients that control an economically dependent entity should be assumed only when this controlling client is also economically dependent on the entity that constitutes the economic link between the two controlling groups (see scenario C/E 4 in the annex).

GUIDELINES ON CONNECTED CLIENTS 12 8. Control and management procedures for identifying connected clients 34.Institutions should have a thorough knowledge of their clients and their clients’ relationships. Institutions should also ensure that their staff understand and apply these guidelines. 35.Identification of possible connections among clients should be an integral part of an institution’s credit granting and surveillance process. The management body and senior management should ensure that adequate processes for the identification of connections among clients are documented and implemented. 36.Institutions should identify all control relationships among their clients and document as appropriate. Institutions should also investigate, and document as appropriate, any potential economic dependencies among their clients. Institutions should take reasonable steps and use readily available information to identify these connections. If, for example, an institution becomes aware that clients have been considered interconnected by another institution (e.g. because of the existence of a public register), it should take into account that information. 37.The efforts that institutions put into the investigation of economic dependencies among their clients should be proportionate to the size of the exposures. Therefore, institutions should strengthen their investigations, by extensive research of any type of ‘soft information’ as well as information that goes beyond the institutions’ clients, in all cases where the sum of all exposures to one individual client exceeds 5% of Tier 1 capital. 7 38.To assess grouping requirements based on a combination of control and economic dependency relationships, institutions should collect information on all entities forming a chain of contagion. Institutions might not be able to identify all clients that constitute a single risk if there are interconnections that stem from entities that are not in a business relationship with the institution and are therefore unknown to the institution (see scenario Mm 1 in the annex). However, if an institution becomes aware of interconnections via entities outside its clientele, it should use this information when assessing connections. 39.Control and management procedures for identifying connected clients should be subject to periodic review to ensure their appropriateness. Institutions should also monitor changes to interconnections, at least in the context of their periodic loan reviews and when a substantial increase to a loan is planned.

7 The threshold refers to the institution’s Tier 1 capital for the purposes of applying these guidelines on an individual basis. The threshold refers to the Tier 1 capital of the group of the institution for the purposes of applying these guidelines on a subconsolidated or consolidated basis.

GUIDELINES ON CONNECTED CLIENTS 13 Annex: Illustrations The scenarios included in this annex illustrate the application of the guidelines to groups of connected clients falling under the definition in Article 4(1)(39) of Regulation (EU) No 575/2013, from the perspective of the reporting institution. Groups of connected clients based on control Scenario C 1: Exceptional case (no single risk exists despite the existence of control) The reporting institution has exposures to all entities shown below (A, B, C and D). Entity A has control over entities B, C and D. The subsidiaries B, C and D are special purpose entities/ special purpose vehicles (SPEs/SPVs). To assess if there is no single risk, despite the existence of a control relationship, the reporting institution should assess at least all of the following elements in relation to each of the SPEs/SPVs (entities B, C and D in this scenario): i) The absence of economic interdependence or any other factors that could be indicative of a material positive correlation between the credit quality of the parent undertaking A and the credit quality of the SPE/SPV (B, C or D). Among other factors, potential reliance on parent undertaking A for funding sources and some of the criteria preventing the deconsolidation of the SPE/SPV or the derecognition of securitised assets under the applicable accounting rules have to be assessed as potential signs of material positive correlation. ii) The specific nature of the SPE/SPV, especially its bankruptcy remoteness (based on Article 300(1) of Regulation (EU) No 575/2013) – in the sense that effective arrangements exist that ensure that the assets of the SPE/SPV will not be available to the creditors of parent undertaking A in the event of its insolvency – and if the debt securities issued by the SPE/SPV normally reference assets that are third parties’ liabilities. B C D A

GUIDELINES ON CONNECTED CLIENTS 14 iii) The structural enhancement in a securitisation, and the delinkage of the obligations of the SPE/SPV from those of parent undertaking A, such as the existence of provisions, in the transactions documentation, ensuring servicing and operational continuity. iv) The compliance with the provisions under Article 248 of Regulation (EU) No 575/2013 regarding arm’s length conditions. Having assessed all of these elements, the reporting institution could conclude that, for example, subsidiaries B and C do not constitute a single risk with parent undertaking A. As a result, the reporting institution needs to consider a group of connected clients composed only of clients A and D. The institution should document these assessments and their findings in a comprehensive way. D A

GUIDELINES ON CONNECTED CLIENTS 15 Alternative approach for exposures to central governments To illustrate the possible scenarios, the following general scenario is used: the central government directly controls four legal persons (A, B, C and D). Entities A and B themselves have direct control over two subsidiaries each (A1/A2, B1/B2). The reporting institution has exposures to the central government and all of the entities shown. Scenario CG 1: Alternative approach – partial use The reporting institution could carve out only one group (‘central government/A/all controlled or dependent entities of A’) and keep the general treatment for the rest (‘central government/B, C and D/all controlled or dependent entities of B’):

GUIDELINES ON CONNECTED CLIENTS 16 Scenario CG 2: Alternative approach – used for all directly dependent entities Scenario CG 3: Alternative approach – applicable on ‘first/second level’, not below In the scenarios CG1 and CG2, entities A, B, C and D constitute the ‘second level’, i.e. the level directly below the central government (‘first level’). Here, a carve-out from the overall group of connected clients is possible. However, entities A1, A2, B1 and B2 are only indirectly connected to the central government. A carve-out on their level is not possible (e.g. both A1 and A2 need to be included in the group ‘central government/A’):

GUIDELINES ON CONNECTED CLIENTS 17 Scenario CG 4: ‘Horizontal connections’ on the ‘second level’ In a variation on the general scenario above, entities A and B are economically dependent (payment difficulties for B would be contagious to A): Assuming that the reporting institution uses the alternative approach only in part, as described in scenario CG 1 above, the following groups of connected clients need to be considered: Central Government Central Government A A1 A2 B B1 B2 C D A A1 A2 B B1 B2 Economic dependency

GUIDELINES ON CONNECTED CLIENTS 18 Establishing interconnectedness based on economic dependency Scenario E1: Main case The reporting institution has exposures to all entities shown below (A, B, C and D). B, C and D rely economically on A. Hence the underlying risk factor for the institution is in all cases A. The institution has to form one comprehensive group of connected clients, not three individual ones. It is irrelevant that there is no dependency among B, C and D. Scenario E 2: Variation on main case (no direct exposure to source of risk) There is a grouping requirement even if the reporting institution does not have a direct exposure to A but is aware of the economic dependency of each client (B, C and D) on A. If possible payment difficulties for A are contagious to B, C and D, they will all experience payment difficulties if A gets into financial trouble. Therefore, they need to be treated as a single risk. As in scenario E 1, it does not matter that there is no dependency among B, C and D. A causes the grouping requirement, although it is not a client itself and thus is not part of the group of connected clients.

GUIDELINES ON CONNECTED CLIENTS 19 Scenario E 3: Overlapping groups of connected clients If an entity is economically dependent on two (or more) other entities (note that the payment difficulties of one of the other entities (A or B) might be sufficient to result in C being in difficulty), it has to be included in the groups of connected clients of both (all such) entities: The argument that the exposure to C will be double-counted is not valid because the exposure to C is considered a single risk in two separate groups. The large exposure limit applies separately (i.e. the limit applies once to exposures to group A/C and once to exposures to group B/C). As there is no dependency between A and B, no comprehensive group (A + B + C) needs to be formed.

GUIDELINES ON CONNECTED CLIENTS 20 Scenario E 4: Chain of dependency In the case of a ’chain of dependency’, all entities that are economically dependent (even if the dependency is only one way) need to be treated as one single risk. It would not be appropriate to form three individual groups (A + B, B + C, C + D). Scenario E 5: Reporting institution as source of funding (no grouping requirement) In the following scenario, the reporting institution is the sole provider of funds for three customers. It is not an ‘external funding source’ that connects the three clients and it is a funding source that can normally be replaced.

GUIDELINES ON CONNECTED CLIENTS 21 Scenario E 6: Reporting institution as source of funding (grouping requirement) In the following scenario, the reporting institution is the liquidity provider of three SPVs or conduits (similar structures): In such a case, the reporting institution itself can constitute the source of risk (the underlying risk factor) as recognised in recital 54 to Regulation (EU) No 575/2013: 8 In the scenario above, it does not make a difference whether the liquidity lines are directly to the SPV or to underlying assets within the SPV; what matters is the fact that liquidity lines are likely to be drawn on simultaneously. Diversification and quality of the assets are also not considerations in this scenario, nor is the reliance on investors in the same sector (e.g. investors in the ABCP market), as the single risk is created by the use of similar structures and the reliance on commitments from one source (i.e. the reporting institution as the originator and sponsor of the SPVs). Relation between interconnectedness through control and interconnectedness through economic dependency

8 Recital 54 to Regulation (EU) No 575/2013 reads: ‘In determining the existence of a group of connected clients and thus exposures constituting a single risk, it is also important to take into account risks arising from a common source of significant funding provided by the institution itself, its financial group or its connected parties.’

GUIDELINES ON CONNECTED CLIENTS 22 Scenario C/E 1: Combined occurrence of control and economic dependency (one-way dependency) In the following scenario, the reporting institution has exposures to all entities shown in the diagram below. A controls A1 and A2, B controls B1. Furthermore, B1 is economically dependent on A2 (one￾way dependency): Grouping requirement: In this scenario, the reporting institution should come to the conclusion that B1 is in any case to be included in the group of connected clients of A (the group thus consisting of A, A1, A2 and B1) as well as of B (the group thus consisting of B and B1): In case of financial problems for A, A2 and ultimately B1 will also experience financial difficulties on account of their legal (A2) and economic (B1) dependency respectively. The forming of three different groups (A + A1 + A2, A2 + B1, B + B1) would not be sufficient to capture the risk stemming from A, because B1, although dependent on A2 and thus on A itself, would be carved out of the single risk of group A.

GUIDELINES ON CONNECTED CLIENTS 23 Scenario C/E 2: Combined occurrence of control and economic dependency (two-way dependency) In this scenario, the economic dependency of A2 and B1 is not only one way but mutual: Grouping requirement: A2 would need to be included additionally in group B, and B1 would need to be included additionally in group A:

GUIDELINES ON CONNECTED CLIENTS 24 Scenario C/E 3: Downstream contagion In a variation on scenario C/E 1 above, B1 also controls two entities (B2 and B3). In this case, the financial difficulties of A will pass through A2 and B1 down to the two subsidiaries of B1 (‘downstream contagion’). Grouping requirement: A B A1 A2 B1 B2 B3 A A1 A2 B1 B2 B3 B B1 B2 B3

GUIDELINES ON CONNECTED CLIENTS 25 Scenario C/E 4: Upstream contagion The control relationship between B and B1 does not automatically lead to including B in the group of connected clients of A, as financial problems for A are not likely to result in financial difficulties for B. However, the controlling entity B needs to be included in the group of A if B1 forms such an important part of group B that B is economically dependent on B1. In this case, the financial difficulties of A will proceed not only downwards but also upwards to B, causing payment difficulties for B (i.e. all entities now form a single risk). Grouping requirement: B A A1 A2 B1 B2 B3 A A1 A2 B1 B2 B3 B

GUIDELINES ON CONNECTED CLIENTS 26 Control and management procedures for identifying connected clients Scenario Mm 1: Limits to the identification of a chain of contagion Further developing the scenario above (C/E 4), the reporting institution has exposures only to entity A and entity B3. In such a case, it is recognised that it might not be possible for the reporting institution to become aware of the chain of contagion and the group of connected clients might not be correctly formed. A A1 A2 B B1 B2 B3