CSSF Circular 24/848 on Application of EBA Guidelines on Interest Rate and Credit Spread Risk in Non-Trading Book Activities

Circular CSSF 24/848 Application of the Guidelines of the European Banking Authority on the criteria for the identification, evaluation, management and mitigation of the risks arising from potential changes in interest rates and of the assessment and monitoring of credit spread risk, of institutions’ non￾trading book activities (EBA/GL/2022/14)

CIRCULAR CSSF 24/848 2/3 Circular CSSF 24/848 Application of the Guidelines of the European Banking Authority on the criteria for the identification, evaluation, management and mitigation of the risks arising from potential changes in interest rates and of the assessment and monitoring of credit spread risk, of institutions’ non-trading book activities (EBA/GL/2022/14) To all credit institutions designated as Less Significant Institutions under the Single Supervisory Mechanism and CRR investment firms incorporated under Luxembourg law and to the Luxembourg branches of credit institutions and CRR investment firms having their registered office in a third country Luxembourg, 29 December 2023 Ladies and Gentlemen, The purpose of this circular is to inform you that the CSSF, in its capacity as competent authority, applies the Guidelines of the EBA specifying criteria for the identification, evaluation, management and mitigation of the risks arising from potential changes in interest rates and of the assessment and monitoring of credit spread risk, of institutions’ non-trading book activities (EBA/GL/2022/14) (the “Guidelines”). Consequently, the CSSF has integrated the Guidelines into its administrative practice and regulatory approach with a view to promoting supervisory convergence in this field at the European level. The Guidelines specify the criteria that institutions and competent authorities should apply in view of the sound and prudent management of interest rate risk for non-trading book activities (“IRRBB”) and credit spread risk for non-trading book activities (“CSRBB”) further to Article 53-20 of the Law of 5 April 1993 on the financial sector (“LFS”). The CSSF, in its capacity as competent authority, has notified to the EBA its intention to apply the Guidelines.

1. The Guidelines The Guidelines repeal the Guidelines on the management of interest rate risk arising from non￾trading book activities (EBA/GL/2018/02). Compared to the EBA/GL/2018/02, the Guidelines mainly provide the following changes: • Interest income, interest expenses and market value changes should be considered for the measurement of IRRBB and CSRBB under internal systems to ensure a comprehensive assessment of the impact of all interest-rate and credit-spread-sensitive items; • More prudent behavioural assumptions on non-maturity deposits from non-financial counterparties, and introducing a five-year cap on weighted average repricing maturity for certain retail and wholesale non-maturity deposits; • Minimum criteria that will be assessed by the CSSF to determine whether an institution’s IRRBB internal systems are satisfactory. If internal systems are found to be non-satisfactory, the CSSF

CIRCULAR CSSF 24/848 3/3 may require an institution to use the standardised approach as envisaged in Article 53-20(3) of the LFS. • Further details on the definition of CSRBB, which shall include assets recognised at fair value, but also any other assets, liabilities or off-balance sheet items that can be exposed to CSRBB. The Guidelines also provide further details on the expected assessment and monitoring of CSRBB, adequate and proportionate governance arrangements on CSRBB and processes to identify, manage, monitor and report CSRBB as well as related internal control mechanisms. The reference to EBA/GL/2018/02 in Part III, Chapter 8, sub-chapter 8.1, paragraph 47 of Circular CSSF 12/552 shall now be read as follows: “When implementing Article 53-20 (Interest rate risk arising from non-trading book activities) of the LFS, the institutions shall comply with EBA/GL/2022/14”. This amendment will be reflected in the next update of Circular CSSF 12/552. The Guidelines are attached to this circular and are available on the EBA’s website.1 2. Scope of application This circular shall apply to Less Significant Institutions2 and CRR investment firms incorporated under Luxembourg law and to the Luxembourg branches of credit institutions and CRR investment firms having their registered office in a third country. 3. Date of application This circular shall apply from 31 December 2023. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annex EBA Guidelines issued on the basis of Article 84(6) of Directive 2013/36/EU specifying criteria for the identification, evaluation, management and mitigation of the risks arising from potential changes in interest rates and of the assessment and monitoring of credit spread risk, of institutions’ non￾trading book activities. 1 https://www.eba.europa.eu/regulation-and-policy/supervisory-review-and-evaluation-process-srep-and￾pillar-2/guidelines-irrbb-and-csrbb 2 “Significant supervised entities” as defined in Article 2, point (16) of Regulation (EU) No 468/2014 of the European Central Bank (ECB) of 16 April 2014 (the SSM Framework Regulation) shall refer to the relevant ECB rules.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON￾TRADING BOOK ACTIVITIES EBA/GL/2022/14 20 October 2022 Final report Guidelines issued on the basis of Article 84 (6) of Directive 2013/36/EU specifying criteria for the identification, evaluation, management and mitigation of the risks arising from potential changes in interest rates and of the assessment and monitoring of credit spread risk, of institutions’ non-trading book activities

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 2 Contents

1. Executive Summary 3
2. Background and rationale 5
3. Guidelines 8
4. Compliance and reporting obligations 11
5. Subject matter, scope and definitions 12
6. Implementation 16
7. Guidelines on the management of interest rate risk and on the assessment and monitoring of credit spread risk, arising from non-trading book activities 17 4.1 General provisions 17 4.2 Identification and management of IRRBB 18 4.3 Measurement of IRRBB by an institution’s internal system 33 4.4 Non-satisfactory IRRBB internal systems 42 4.5 Identification and assessment of CSRBB 42 4.6 Monitoring of CSRBB 49 Annex I — IRRBB measurement methods (non-exhaustive list) 51 Annex II – Sophistication matrix for IRRBB measurement 54
8. Accompanying documents 58 5.1 Cost-benefit analysis / impact assessment 58 5.2 Feedback on the public consultation 63

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 3

1. Executive Summary Article 84(6) of the Directive 2013/36/EU1 (Capital Requirements Directive – CRD) mandates the EBA to issue Guidelines to specify the criteria for the evaluation by an institution's internal system of the interest rate risk of an institution’s non-trading book activities (IRRBB) as well as the criteria for the identification, management and mitigation by institutions of the IRRBB either if it implements internal systems, the standardised approach or the simplified standardised approach. The EBA published in July 2018 Guidelines “on the management of interest rate risk arising from non-trading book activities” (“the 2018 Guidelines”) that apply from June 2019 with dedicated provisions on these aspects. The current Guidelines replace the 2018 EBA Guidelines as some of its parts will be covered by dedicated RTS and the amended mandate includes new aspects as explained below. These new Guidelines maintain continuity with the previous Guidelines as far as possible, while updating some elements. The Guidelines are broadly consistent with the Basel standards with some further elaborated sections following the CRD mandate, particularly on CSRBB assessment and monitoring and non￾satisfactory IRRBB internal systems. The EBA is mandated to specify in these Guidelines additional criteria for the assessment and monitoring by institutions of their credit spread risk arising from their non-trading book activities (CSRBB). The Guidelines provide a definition and the scope of application of CSRBB. They contain dedicated sections for CSRBB with specific provisions on the identification, assessment and monitoring of CSRBB. Finally, the mandate requests the inclusion of criteria for determining whether the internal systems implemented by institutions for the purpose of evaluating IRRBB are not satisfactory, in which case a competent authority may require an institution to use the standardised methodology. After some general provisions, the Guidelines contain separate specific chapters for IRRBB and for CSRBB. Next steps The guidelines will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report whether they comply with the guidelines will be two months after the publication of the translations. Upon publication of these Guidelines, the 2018 Guidelines are repealed and replaced. Given the importance of this regulatory product at the 1 Directive (EU) 2019/878 of the European Parliament and of the Council of 20 May 2019 amending Directive 2013/36/EU as regards exempted entities, financial holding companies, mixed financial holding companies, remuneration, supervisory measures and powers and capital conservation measures.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 4 time of its publication in the current interest rate risk environment, the EBA will continue its continuous dialogue with stakeholders for a close monitoring of the IRRBB aspects.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 5 2. Background and rationale

1. On 18 July 2018 the EBA issued Guidelines on the management of interest rate risk arising from non-trading book activities. They updated the previous EBA Guidelines from 22 May 2015 and set up the first phase to implement within the EU the Standards on interest rate risk in the banking book published by the Basel Committee on Banking Supervision (BCBS Standards) in April 2016. 2
2. The second phase of the implementation of the Basel Standards within the EU takes place with the revision of Directive 2013/36/EU3 (Capital Requirements Directive – CRD) and Regulation (EU) No 575/2013 (Capital Requirements Regulation - CRR) and the upcoming enactment of a number of technical standards that the EBA is mandated to draft in the revised CRD and CRR.
3. Paragraph 1 of Article 84 of Directive 2013/36/EU establishes that institutions shall use either internal systems, the standardised methodology or the simplified standardised methodology4 to identify, evaluate, manage and mitigate interest rate risk of an institution's non-trading book activities. Paragraph 3 empowers competent authorities to require an institution the use of the standardised methodology to evaluate that risk where its internal systems for the purposes of such evaluation are not satisfactory.
4. In this context, Directive 2013/36/EU sets out a number of mandates to the EBA, namely: (a) Following point (a) of paragraph 6 of Article 84 of Directive 2013/36/EU, these Guidelines will specify the criteria to evaluate interest rate risk of an institution's non-trading book activities when the institutions implement internal systems. 5 In this context Section 4.3 of these Guidelines specify the necessary criteria for the measurement of the risk. (b) For the purposes of paragraph 3 of Article 84 of Directive 2013/36/EU, these Guidelines will specify criteria for the determination of internal systems that are not satisfactory to evaluate interest rate risk of an institution’s non-trading book 2 Available online: http://www.bis.org/bcbs/publ/d368.htm. 3 Directive (EU) 2019/878 of the European Parliament and of the Council of 20 May 2019 amending Directive 2013/36/EU as regards exempted entities, financial holding companies, mixed financial holding companies, remuneration, supervisory measures and powers and capital conservation measures. 4 The simplified standardised methodology is envisaged for small and non-complex institution as defined in point (145) of Article 4(1) of Regulation (EU) No 575/2013. However, following paragraph 4 of Article 84 Directive 2013/36/EU, competent authorities may require them to use the standardised methodology if the simplified standardised methodology is not adequate to capture interest rate risk arising from non-trading book activities. The mandate for these Guidelines does not encompass the assessment of this adequacy. 5 The regulatory technical standards envisaged in paragraph 5 of Article 84 of Directive 2013/36/EU will specify the standardised methodology or the simplified standardised methodology that institutions may apply to evaluate interest rate risk of their non-trading book activities.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 6 activities, as established under point (d) of paragraph 6 of Article 84 of Directive 2013/36/EU. This is developed in Section 4.4 of these Guidelines. (c) As per point (b) of paragraph 6 of Article 84 of Directive 2013/36/EU, these Guidelines will specify the criteria to identify, manage and mitigate interest rate risk of an institution's non-trading book activities if the institutions implement internal systems or use the standardised methodology or the simplified standardised methodology. In this context Sections 4.2 and 4.3 of these Guidelines specify the necessary criteria for this. 5. Paragraph 2 of Article 84 of Directive 2013/36/EU sets out that institutions shall implement systems to assess and monitor the credit spread risk on an institution’s non-trading book activities. 6. Following point (c) of paragraph 6 of Article 84 Directive 2013/36/EU these Guidelines will include criteria to specify how to assess and monitor the credit spread risk on an institution’s non-trading book. In this regard, sections 4.5 and 4.6 of the Guidelines provide a definition of the risk, the identification of the perimeter of exposuresto this risk as well as guiding principles for its assessment and monitoring. 7. In summary, these Guidelines provide the legal framework for institutions’ IRRBB internal systems and for the supervisory outlier tests (SOT) calculations if not specified in the relevant Regulatory Technical Standards on SOT. The Guidelines are also applicable, as regards the identification, management and mitigation of IRRBB, in case the internal systems are replaced by the use of the IRRBB standardised methodology (SA), in which case the relevant Regulatory Technical Standards on SA provide the necessary specifications for IRRBB evaluation aspects as well as for the purposes of SOT calculations if not specified in the relevant Regulatory Technical Standards on SOT. 6 The Guidelines also provide the legal framework for assessing and monitoring CSRBB. Main policy choices 8. The Guidelines are strongly inspired by the 2018 EBA Guidelines on the management of interest rate risk arising from non-trading book activities. As explained in the following paragraphs, these Guidelines generally maintain continuity to the 2018 Guidelines in the identification, management and measurement of IRRBB under internal systems. However, some new elements are introduced like prudent behavioral assumption on non-maturity deposits from non-financial counterparties. The Guidelines also incorporate criteria to identify non-satisfactory IRRBB internal systems and add specific chapters to CSRBB identification, assessment and monitoring. 9. In the context of the measurement of the impact of IRRBB and CSRBB under internal systems, interest income, interest expenses and market value changes should be considered. This 6 Both Regulatory Technical Standards are under public consultation at the moment together with these Guidelines.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 7 ensures a comprehensive assessment of the impact of all interest rate and credit spread sensitive items. 10.Furthermore, in this context, a five years cap on weighted average repricing maturity is introduced now for certain retail and wholesale deposits without a specified maturity. This behavioural assumption targets prudent treatment of these deposits which prove to be a material item in the calculation of the impact of changes of interest rates. 11.In the determination of non-satisfactory IRRBB internal systems implemented by institutions, the Guidelines seek to provide minimum specific criteria to be assessed by the relevant competent authority. This approach targets to ensure that minimum harmonised criteria are used for these purposes while ensuring competent authorities’ ‘may’ power to require the application of the standardised approach as envisaged in paragraph 3 of Article 84 Directive 2013/36/EU remains and any automatism here is avoided. The referred specific criteria mainly build on the compliance with the Guidelines and on a minimum comprehensive management of IRRBB that should be guaranteed. 12.These Guidelines elaborate on the definition of CSRBB following the provisions of the Basel rules text. In the identification of the perimeter of application, the Guidelines include assets recognised at fair value as well as any other assets, liabilities or off-balance sheet items that can be exposed to CSRBB. The Guidelines elaborate on the expected assessment and monitoring of CSRBB in the context of adequate and proportionate governance related aspects, processes to identify, manage, monitor and report and internal control mechanisms as envisaged by paragraphs 1 and 2 of Article 74 of Directive 2013/36/EU. 13.Given the importance of this regulatory product at the time of its publication in the current interest rate risk environment, the EBA will continue its continuous dialogue with stakeholders for a close monitoring of the IRRBB aspects and application of these Guidelines. In this context, particular attention will be paid to the 5-year repricing maturity cap and the repricing approaches used in business lines and products. The EBA will liaise with competent authorities and institutions as far as needed, and with the view to assess any potential unintended or undesirable effect.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 8 3. Guidelines

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 9 EBA/GL/2022/14 20 October 2022 Guidelines issued on the basis of Article 84 (6) of Directive 2013/36/EU specifying criteria for the identification, evaluation, management and mitigation of the risks arising from potential changes in interest rates and of the assessment and monitoring of credit spread risk, of institutions’ non- trading book activities

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 10 Abbreviations ALCO asset and liability management committee ALM asset and liability management BCBS Basel Committee on Banking Supervision BSG Banking Stakeholder Group CET1 Common Equity Tier 1 CSRBB credit spread risk from the banking book (referred to in CRD as credit spread risk arising from non-trading book activities) CRD Capital Requirements Directive (Directive 2013/36/EU) CRR Capital Requirements Regulation (Regulation (EU) No 575/2013) EBA European Banking Authority EaR earnings at risk EV economic value EVaR economic value at risk EVE economic value of equity FVOCI fair value through other comprehensive income ICAAP Internal Capital Adequacy Assessment Process IFRS 9 International Financial Reporting Standard 9 – Financial instruments IMS internal measurement system IR interest rate IRRBB interest rate risk arising from the banking book (referred to in CRD as interest rate risk arising from non-trading book activities) IT information technology LCR Delegated Regulation Commission Delegated Regulation (EU) 2015/61 MIS management information system NII net interest income NMD non-maturity deposit NPE non-performing exposure P&L profit and loss QIS quantitative impact study SREP supervisory review and evaluation process

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 11

1. Compliance and reporting obligations Status of these Guidelines
2. This document contains Guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010. 7 In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the Guidelines.
3. Guidelines set the EBA view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom Guidelines apply should comply by incorporating them into their practices as appropriate (e.g., by amending their legal framework or their supervisory processes), including where Guidelines are directed primarily at institutions. Reporting requirements
4. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify the EBA as to whether they comply or intend to comply with these Guidelines, or otherwise with reasons for non-compliance, by 02.05.2023. In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non￾compliant. Notifications should be sent by submitting the form available on the EBA website with the reference ‘EBA/GL/2022/14’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to EBA.
5. Notifications will be published on the EBA website, in line with Article 16(3). 7 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJ L 331, 15.12.2010, p.12).

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 12 2. Subject matter, scope and definitions Subject matter and scope of application 5. These Guidelines specify, in accordance with paragraph 6 of Article 84 of Directive 2013/36/EU: (a) The criteria for the identification, management and mitigation by institutions of IRRBB either if they implement internal systems or use the standardised methodology or the simplified standardised methodology for the evaluation of IRRBB. (b) The criteria for the evaluation – measurement of IRRBB if an institution implements internal systems for it. (c) The criteria for the assessment and monitoring by institutions’ internal systems of CSRBB. (d) The criteria for determining which of the IRRBB internal systems implemented by institutions are not satisfactory for the purposes of paragraph 3 of Article 84 of Directive 2013/36/EU. Addressees 6. These Guidelines are addressed to competent authorities referred to in point (i) of Article 4(2) of Regulation (EU) No 1093/2010, and to financial institutions referred to in Article 4(1) of that regulation which are also institutions in accordance with point 3 of Article 4(1) of Regulation (EU) No 575/2013. Definitions 7. Unless otherwise specified, terms used and defined in Directive 2013/36/EU 8 and in Regulation (EU) No 575/20139 have the same meaning in the Guidelines. In addition, for the purposes of these Guidelines, the following definitions apply: Interest rate risk arising from non-trading book activities The current and prospective risk of a negative impact to the institution’s economic value of equity, or to the institution’s net interest income, taking market value changes into account as appropriate, which arise from 8 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (1) - OJ L 176, 27.6.2013. 9 Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 – OJ L 176, 27.6.2013.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 13 adverse movements in interest rates affecting interest rate sensitive instruments, including gap risk, basis risk and option risk. Interest rate sensitive instruments Assets, liabilities and off-balance-sheet itemsin the non-trading book, which are sensitive to interest rate changes (excluding assets deducted from CET1 capital – e.g., real estate or intangible assets or equity exposures in the non-trading book). Credit spread sensitive instruments Assets, liabilities and off-balance-sheet items in the non-trading book, which are sensitive to credit spread changes (excluding assets deducted from CET1 capital – e.g., real estate or intangible assets or equity exposures in the non-trading book). Gap risk Risk resulting from the term structure of interest rate sensitive instruments that arises from differences in the timing of their rate changes, covering changes to the term structure of interest rates occurring consistently across the yield curve (parallel risk) or differentially by period (non-parallel risk). Basis risk Risk arising from the impact of relative changes in interest rates on interest rate sensitive instruments that have similar tenors but are priced using different interest rate indices. Basis risk arises from the imperfect correlation in the adjustment of the rates earned and paid on different interest rate sensitive instruments with otherwise similar rate change characteristics. Option risk Risk arising from options (embedded and explicit), where the institution or its customer can alter the level and timing of their cash flows, namely the risk arising from interest rate sensitive instruments where the holder will almost certainly exercise the option if it is in their financial interest to do so (embedded or explicit automatic options) and the risk arising from flexibility embedded implicitly or within the terms of interest rate sensitive instruments, such that changes in interest rates may affect a change in the behaviour of the client (embedded behavioural option risk). Credit spread risk from non-trading book activities (CSRBB) Risk driven by changes of the market price for credit risk, for liquidity and for potentially other characteristics of credit-risky instruments, which is not captured by another existing

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 14 prudential framework such as IRRBB or by expected credit/(jump-to-) default risk. CSRBB captures the risk of an instrument’s changing spread while assuming the same level of creditworthiness, i.e. how the credit spread is moving within a certain rating/PD range. Net interest income measures Measures of changes in expected future profitability within a given time horizon resulting from interest rate movements, in case of IRRBB; or from credit spread changes, in case of CSRBB. It encompasses interest income and interest expenses. Net interest income measures plus market value changes Net interest income measures after the market value changes of instruments have been accounted for/taken into account depending on accounting treatment either through fair value measures or nGAAP. Economic value (EV) measures Measures of changes in the net present value of interest rate sensitive instruments over their remaining life resulting from interest rate movements, in case of IRRBB; or of changes in the net present value of instruments sensitive to credit spread changes over their remaining life resulting from credit spread movement, in case of CSRBB. EV measures reflect changes in value over the remaining life of the interest rate sensitive instruments, in case of IRRBB, or of the credit spread risk sensitive instruments, in case of CSRBB – i.e., until all positions have run off. Economic value of equity (EVE) measures A specific form of EV measure where equity is excluded from the cash flows. Conditional cash flow modelling Cash flow modelling under the assumption that the timing or amount of cash flows is dependent on the specific interest rate scenario. Unconditional cash flow modelling Cash flow modelling under the assumption that the timing and amount of cash flows is independent of the specific interest rate scenario. Run-off balance sheet A balance sheet including on- and off-balance￾sheet items where existing non-trading book positions amortise and are not replaced by any new business. Dynamic balance sheet A balance sheet including on- and off-balance￾sheet items incorporating future business expectations, adjusted for the relevant scenario in a consistent manner.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 15 Constant balance sheet A balance sheet including on- and off-balance￾sheet items in which the total size and composition are maintained by replacing maturing or repricing cash flows with new cash flows that have comparable features with regard to the amount, repricing period and spread components. Retail A natural person or a SME, where the SME would qualify for the retail exposure class under the Standardised or IRB approaches for credit risk, or a company which is eligible for the treatment set out in Article 153(4) of Regulation (EU) No 575/2013 and where the aggregate deposits by that SME or company on a group basis do not exceed EUR 1 million. Transactional deposit and accounts Transactional deposits and transactional accounts are those retail non-maturity deposits where regular transactions are carried out (e.g., where salaries are regularly credited) or those retail non-maturity deposits which are non-interest bearing even in a high interest rate environment. Other retail deposits shall be considered as held in a non-transactional account. IRRBB measures Economic Value (EV) measures and Net interest income measures plus market value changes, applied in the context of the sensitivity to changes in the interest rates. CSRBB measures Economic Value (EV) measures and Net interest income measures plus market value changes, applied in the context of the sensitivity to changes in market credit/liquidity spreads.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 16 3. Implementation Date of application 8. These Guidelines apply at 30 June 2023 with the exception of sections 4.5 and 4.6 that apply at 31 December 2023. Repeal 9. The Guidelines on the management of interest rate risk arising from non-trading book activities (EBA/GL/2018/02)10 are repealed with effect from the date of application of these guidelines. 10 See here.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 17 4. Guidelines on the management of interest rate risk and on the assessment and monitoring of credit spread risk, arising from non-trading book activities 4.1 General provisions 4.1.1 IRRBB and CSRBB (i) IRRBB 10.Institutions should treat IRRBB as an important risk and always assess it solely, explicitly, and comprehensively in their risk management processes and internal capital assessment processes. 11.Institutions should identify their IRRBB exposures and ensure that they are adequately measured, monitored and controlled. Institutions should manage risks arising from their IRRBB exposures and, if necessary, mitigate risks that affect both their economic value and net interest income measures plus market value changes. (ii) CSRBB 12.Institutions should assess and monitor CSRBB explicitly and comprehensively in their risk management processes and internal capital assessment processes. 13.Institutions should identify their CSRBB exposures and ensure that they are adequately assessed, monitored, and controlled both under economic value and net interest income measures plus market value changes. (iii) Net interest income measure plus market value changes 14.For the purposes of these Guidelines, the net interest income upon which to calculate the impact of interest rate or credit spread movements should be determined by the interest income and expenses. For these purposes institutions should also consider market value changes of instruments — depending on accounting treatment (fair value/nGAAP) — either shown in the profit and loss account or directly in equity (e.g., via other comprehensive income). Institutions should take into account the increase or reduction in the amount of profit and losses and capital over short- and medium-term horizons resulting from interest rate or credit spread movements.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 18 15.The change in the net interest income should be the difference between the expected net interest income under a shock or stress scenario from a going-concern perspective and the expected net interest income under a base scenario. 11 The change in the market value of instruments (fair value/nGAAP) should be the difference between the expected market value under a shock or stress scenario from a going-concern perspective and the expected market value under a base scenario at the end of the assessed horizon. 4.1.2 Other aspects, proportionality 16.When implementing the Guidelines, institutions should identify their existing and prospective exposures to IRRBB and CSRBB in a proportionate manner, depending on the level, complexity and riskiness of their non-trading book positions, taking into account their business model, their strategies and the business environment they operate in or intend to operate in. 17.Based upon the assessment of their existing and prospective exposure to IRRBB and CSRBB, institutions should consider elements and expectations stipulated in this section 4.1 of the Guidelines and in the sections on capital identification, calculation and allocation for the purposes of IRRBB (section 4.2.2), IRRBB and CSRBB governance strategy (sections 4.2.3 and 4.5.2), measurement of IRRBB by an IMS (section 4.3.) and monitoring of CSRBB (section 4.6) and implement them in a way that is commensurate with existing and prospective exposures to IRRBB and CSRBB. 18.In addition to the existing and prospective exposure to IRRBB and CSRBB, when implementing the Guidelines, institutions should also consider their general level of sophistication and internal approaches to risk management to make sure that their approaches, processes and systems for the management of IRRBB and CSRBB are coherent with their general approach to risk management and their specific approaches, processes and systems implemented for the purpose of the management of other risks. 4.2 Identification and management of IRRBB 4.2.1 Perimeter of IRRBB 19.Institutions should consider all interest rate sensitive instruments in the banking book in the context of the assessment and management of exposures to IRRBB, including assets, liabilities, interest rate derivatives, non-interest rate derivatives referencing an interest rate and other off-balance sheet items (such as loan commitments). 20.Institutions should consider non-performing exposures12 (net of provisions) as interest rate sensitive instruments reflecting expected cash flows and their timing. 11 From an EVE viewpoint, the change in the economic value of equity should be the difference between the expected economic value of equity under a shock or stress scenario and the expected economic value of equity under a base scenario. 12 Non-performing exposures as defined in Annex V of Regulation (EU) 680/2014.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 19 21.Without prejudice to paragraph 10, small trading book business, as defined by paragraph 1 of Article 94 of Regulation (EU) No 575/2013, shall be included unless its interest rate risk is captured in another risk measure. 4.2.2 Capital identification, calculation and allocation for the purpose of IRRBB 22.When evaluating the amounts, types and distributions of internal capital pursuant to Article 73 of Directive 2013/36/EU, institutions should base the contribution of IRRBB to the overall internal capital assessment on the institution’s internal measurement systems outputs, taking account of key assumptions and risk limits. The overall level of capital should be commensurate with both the institution’s actual measured level of risk (including for IRRBB) and its risk appetite, and be duly documented in its report on the Internal Capital Adequacy Assessment Process (ICAAP report). 23.Institutions should demonstrate that their internal capital is commensurate with the level of IRRBB, taking into account the impact on internal capital of potential changes in the institution’s economic value and future net interest income measures plus market value changes resulting from changes in interest rates. Institutions should evaluate IRRBB risk measures in their internal capital determination particularly noting that the IRRBB measures capture the risk in a complementary manner (e.g., considering IRRBB from a different time horizon). Institutions are not expected to double-count their internal capital for EV and net interest income measures plus market value changes, nonetheless the internal capital allocation methodology should consider both IRRBB risk measures and explicitly assess their potential impact on internal capital. 24.In their ICAAP analysis of the amount of internal capital required for IRRBB, institutions should consider: (a) internal capital held for risks to economic value that could arise from adverse movements in interest rates; and (b) internal capital needs arising from the impact of rate changes on future net interest income plus market value changes capacity, and the resultant implications for internal capital buffer levels. 25.Institutions should not only rely on the supervisory assessments of capital adequacy for IRRBB or on the outcome of the supervisory outlier test, but should develop and use their own methodologies for capital allocation, based on their risk appetite, level of risk and risk management policies. In determining the appropriate level of capital, institutions should consider both the amount and the quality of capital needed. 26.Capital adequacy assessments for IRRBB should take into account the following: (a) the size and tenor of internal limits on IRRBB exposures, and whether or not these limits are reached at the point of capital calculation;

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 20 (b) the expected cost of hedging open positions that are intended to take advantage of internal expectations of the future level of interest rates; (c) the sensitivity of the internal measures of IRRBB to key or imperfect modelling assumptions; (d) the impact of shock and stress scenarios on positions priced with different interest rate indices (basis risk); (e) the impact on economic value and net interest income plus market value changes of mismatched positions in different currencies; (f) the impact of embedded losses and embedded gains; (g) the distribution of capital relative to risks across legal entities included in the group’s prudential perimeter of consolidation, in addition to the adequacy of overall capital on a consolidated basis; (h) the drivers of the underlying risk; and (i) the circumstances under which the risk may materialise. 27.The outcomes of the capital adequacy for IRRBB should be considered in an institution’s ICAAP and flow through to the assessments of capital associated with business lines. 28.To calibrate the amount of internal capital to be held for IRRBB, institutions should use measurement systems and a range of interest rate shock and stress scenarios, which are adapted to the risk profile of the institution in order to quantify the potential scale of any IRRBB effects under adverse conditions. 29.Institutions that operate internal capital models should ensure that the internal capital allocation for IRRBB is properly factored into the overall internal capital allocation and that any assumptions on diversification are documented and their reliability as well as stability is verified using historical data appropriate for the individual institution and the markets in which it operates. Internal capital costs may be allocated back to the business units and products to ensure that the full costs of the underlying business units or products are properly understood by those responsible for managing them. 30.In considering whether or not an allocation of internal capital should be made in respect of IRRBB to net interest income measures plus market value changes, institutions should take into account the following: (a) The relative importance of net interest income to total net income, and therefore the impact of significant variations in net interest income from year to year;

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 21 (b) The actual levels of net interest income achievable under different scenarios (i.e., the extent to which margins are wide enough to absorb volatility arising from interest rate positions and changes in the cost of liabilities); (c) The potential for actual losses to be incurred under stressed conditions, or as a result of secular changes in the market environment – e.g., where it might become necessary to liquidate positions that are intended as a long-term investment to stabilise net interest income measures plus market value changes; (d) The relative importance of interest rate sensitive instruments (including interest rate derivatives) in the non-trading book, with potential effects shown either in the profit and loss account or directly in equity (e.g., via other comprehensive income); and (e) The fluctuation of net interest income measures plus market value changes, the strength and stability of the net interest income measures plus market value changes streams and the level of income needed to generate and maintain normal business operations. Institutions with a high level of IRRBB that could, under a plausible range of market scenarios, result in losses, in curtailing normal dividend distribution, or in a decrease in business operations should ensure that they have sufficient capital to withstand the adverse impact of these scenarios. 31.Institutions should consider internal capital buffer adjustments where the results of their stress testing highlight the potential for reduced net interest income measures plus market value changes (and therefore reduced capital generation capacity) under stress scenarios. 4.2.3 IRRBB Governance strategy 32.The IRRBB strategy of the institution, including the risk appetite for IRRBB and IRRBB mitigation, should be part of the overall strategy, in particular the strategic objectives and risk objectives, which the management body must approve as laid down in subparagraph (2), letter (a) of Article 88(1) of Directive 2013/36/EU. 33.The institution’s risk appetite for IRRBB should be expressed in terms of the acceptable impact of fluctuating interest rates on both IRRBB measures should be reflected in limits. Institutions with significant exposures to gap risk, basis risk or option risk should determine their risk appetite in relation to each of these material sub-types of IRRBB. 34.The overall IRRBB strategy should also include the decision about the extent to which the business model relies on generating net interest income by ‘riding the yield curve’ – i.e., funding assets with a comparatively long repricing period with liabilities with a comparatively short repricing period. Where the business model relies heavily on this source of net interest income, the management body should explain its IRRBB strategy and how it plans to survive periods of flat or inverse yield curves. 35.Institutions should duly assess proposals to use new products, or engage in new activities, risk￾taking or hedging strategies, prior to acquisition or implementation to ensure that the

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 22 resources required to establish sound and effective IRRBB management of the product or activity have been identified, that the proposed activities are in line with the institution’s overall risk appetite, and that procedures to identify, measure, monitor and control the risks of the proposed product or activity have been established. It should be ensured that the IRRBB characteristics of these new products and activities are well understood. 36.Institutions using derivative instruments to mitigate IRRBB exposures should possess the necessary knowledge and expertise. Each institution should demonstrate that it understands the consequences of hedging with interest rate derivatives. 37.Institutions using models of customer behaviour as input for the measurement of their IRRBB should possess the necessary knowledge and expertise. Each institution should be able to demonstrate that it understands the consequences of modelling the behaviour of its customer base. 38.When making decisions on hedging activities, institutions should be aware of the effects of accounting policies, but the accounting treatment should not drive their risk management approach. 39.Consolidating institutions should ensure that internal governance arrangements and processes for the management of IRRBB are consistent and well integrated on a consolidated and a sub￾consolidated basis. 4.2.4 IRRBB risk management framework and responsibilities 40.In view of having internal governance arrangements pursuant to Article 74 and 88 of Directive 2013/36/EU, institutions should, in relation to IRRBB, ensure the following: (a) That their management body bears the ultimate responsibility for the oversight of the IRRBB management framework, the institution’s risk appetite framework and the amounts, types and distribution of internal capital to adequately cover the risks. The management body should determine the institution’s overall IRRBB strategy and approve the corresponding policies and processes. The management body may, however, delegate the monitoring and management of IRRBB to senior management, expert individuals or an asset and liability management committee under the conditions further specified in paragraph 42. (b) That they have in place an IRRBB management framework that establishes clear lines of responsibilities and that consists of a limit system, policies, processes and internal controls including regular independent reviews and evaluations of the effectiveness of the framework. (c) That the arrangements, processes and mechanisms referred for the assessment of IRRBB are comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and the institution's activities.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 23 41.The management body should, in particular, be responsible for the following: (a) Understanding the nature and the level of the IRRBB exposure. The management body should ensure that there is clear guidance regarding the risk appetite for IRRBB in respect of the institution’s business strategies. (b) Establishing that the appropriate actions are taken to identify, measure, monitor and control IRRBB, consistent with the approved strategies and policies. In this regard, the management body or its delegates are responsible for setting: i. appropriate limits on IRRBB, including the definition of specific procedures and approvals necessary for exceptions, and ensuring compliance with those limits; ii. systems and standards for measuring IRRBB, valuing positions and assessing performance, including procedures for updating interest rate shocks, parameters and stress scenarios and key underlying assumptions driving the institution’s IRRBB analysis; iii. a comprehensive IRRBB reporting and review process; and iv. effective internal controls and management information systems (MISs). (c) Approving major hedging or risk-taking initiatives in advance of implementation. Positions related to internal risk transfers between the non-trading book and the trading book should be properly documented. (d) Carrying out the oversight of the approval, implementation and review of IRRBB management policies, procedures and limits. The level of and changes in the institution’s IRRBB exposure should be provided regularly to the management body (at least quarterly). (e) Ensuring that the validation of IRRBB measurement methods and assessment of corresponding model risk are included in a formal policy process that should be reviewed and approved by the management body or its delegates. (f) Understanding and assessing the functioning of its delegates in monitoring and controlling IRRBB, consistent with policies approved by the management body, on the basis of regular reviews of timely and sufficiently detailed information. (g) Understanding the implications of the institution’s IRRBB strategies and their potential linkages with market, liquidity, credit and operational risk but without requiring all the management body members to be experts in the area. Some of the members should have sufficient technical knowledge to question and challenge the reports made to the management body. The institution should establish that management body members are responsible for ensuring that senior management has the competence to understand IRRBB and that IRRBB management is provided with adequate resources.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 24 42.Institutions should have delegation arrangements and procedures in place for any delegation by the management body of the monitoring or management of IRRBB, including, but not limited to, the following: (a) Persons or committees to which tasks of the management body are delegated for developing IRRBB policies and practices, such as senior management, expert individuals or an ALCO, should be identified and have objectives clearly set out by the management body. (b) The management body should ensure that there is an adequate separation of responsibilities in the risk management process for IRRBB. The IRRBB identification, measurement, monitoring and control functions should have clearly defined responsibilities, should be independent from risk-taking functions on IRRBB and should report IRRBB exposures directly to the management body or its delegates. (c) The institution should ensure that the management body’s delegates have clear lines of authority over the units responsible for risk taking on IRRBB. The communication channel to convey the delegates’ directives to these line units should be clear. (d) The management body should establish that the institution’s structure enables its delegates to carry out their responsibilities, and facilitates effective decision-making and governance. In this regard an ALCO, or its equivalent, should meet regularly and its composition should reflect each major department linked to IRRBB. The management body should foster discussion regarding the IRRBB management process, both between its members and its delegates and between its delegates and others in the institution. The management body should also ensure that regular communication between the risk management and strategic planning areas facilitate the monitoring of the risk arising from future business. 4.2.5 IRRBB risk appetite and policy limits 43.Institutions should articulate their risk appetite for IRRBB in terms of the risk to IRRBB measures in particular: (a) Institutions should have clearly defined risk appetite statements that are approved by their management body and implemented through comprehensive risk appetite frameworks – i.e., policies and procedures for limiting and controlling IRRBB. (b) Their risk appetite frameworks should: a. delineate delegated powers, lines of responsibility and accountability over IRRBB management decisions; and b. list the instruments, hedging strategies and risk-taking opportunities authorised for IRRBB.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 25 (c) In defining their risk appetites, institutions should take account of net interest income risks that may arise as a consequence of the accounting treatment of transactions in the non￾trading book. The risk may not be limited to interest income and expenses: the effects of changes in interest rates on the market value of instruments that, depending on accounting treatment, are reflected either through the profit and loss account or directly in equity (via other comprehensive income), should be taken into account separately. Institutions should particularly take into account the impact related to embedded optionalities in fair value instruments under ongoing interest rate shocks and stress scenarios. Institutions should also take into account the potential impact on the P&L accounts of hedging interest rate derivatives if their effectiveness was hampered by interest rate changes. 44.Institutions should implement limits that target maintaining IRRBB exposures consistent with their risk appetite and with their overall approach for measuring IRRBB, in particular the following: (a) Aggregate risk limits that clearly articulate the amount of IRRBB acceptable to the management body should be applied on a consolidated basis and, as appropriate, at the level of individual affiliates. (b) Limits may be associated with specific scenarios of changes in interest rates and term structures, such as their increase or decrease or a change in shape of the yield curve. The interest rate movements used in developing these limits should represent sufficiently adverse shock and stress situations, taking into account historical interest rate volatility and the time required by management to mitigate those risk exposures. (c) Policy limits should be appropriate to the nature, size, complexity and capital adequacy of the institution, as well as its ability to measure and manage its risks. (d) Depending on the nature of an institution's activities and business model, sub-limits may also be identified for individual business units, portfolios, instrument types, specific instruments or material sub-types of IRRBB risk such as gap risk, basis risk and option risk. (e) Systems should be in place to ensure that positions that exceed, or are likely to exceed, limits defined by the management body or its delegates receive prompt management attention and are escalated without delay. There should be a clear policy on who will be informed, how the communication will take place and the actions which will be taken in response. (f) The reporting of risk measures to the management body or its delegates should have at least a quarterly frequency and should compare current exposure with policy limits. 45.A framework should be in place to monitor the evolution of hedging strategies that rely on instruments such as derivatives, and to control mark-to-market risks in instruments that are accounted for at fair-value.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 26 4.2.6 IRRBB risk policies, processes and controls Risk policies and processes 46.The management body should, based on its overall IRRBB strategy, adopt robust risk policies, processes and systems which should ensure that: (a) procedures for updating scenarios for the measurement and assessment of IRRBB are set up; (b) the measurement approach and the corresponding assumptions for measuring and assessing IRRBB, including the allocation of internal capital to IRRBB risks, are appropriate and proportional; (c) the assumptions of the models used are regularly reviewed and, if necessary, amended; (d) standards for the evaluation of positions and the measuring of performance are defined; (e) appropriate documentation and control over permissible hedging strategies and hedging instruments exist; and (f) the lines of authority and responsibility for managing IRRBB exposures are defined. 47.The policies should be well reasoned, robust and documented and should address all IRRBB components that are important to the institution’s individual circumstances. Without prejudice to the proportionality principle, the IRRBB policies should include the following: (a) The application of the boundary between ‘non-trading book’ and ‘trading book’. Internal risk transfers between the banking book and the trading book should be properly documented and monitored within the broader monitoring of the IRRBB originated by interest rate derivatives instruments. (b) The more detailed definition of economic value and its consistency with the method used to value assets and liabilities (e.g., based on the discounted value of future cash flows, and on the discounted value of future net interest income) adopted for internal use. (c) The more detailed definition of net interest income measures plus market value changes and its consistency with the institution’s approach to developing financial plans and financial forecasts adopted for internal use. (d) The size and the form of the different interest rate shocks to be used for internal IRRBB calculations. (e) The use of conditional or unconditional cash flow modelling approaches.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 27 (f) The treatment of ‘pipeline transactions’13 (including any related hedging). (g) The aggregation of multicurrency interest rate exposures. (h) The measurement and management of basis risk resulting from different interest rate indexes. (i) Whether or not non-interest-bearing assets and liabilities of the non-trading book (including capital and reserves) are included in calculations measuring IRRBB for the ICAAP. (j) The behavioural treatment of current and savings accounts (i.e., the maturity assumed for liabilities with short contractual maturity but long behavioural maturity). (k) The measurement of IRRBB arising from behavioural and automatic options in assets or liabilities, including convexity effects and non-linear payoff profiles. (l) The degree of granularity employed in measurement calculations (e.g., use of time buckets). (m) The internal definition of commercial margins and adequate methodology for internal treatment of commercial margins. 48.All IRRBB policies should be reviewed regularly, at least annually, and revised as needed. 49.To ensure that the institution’s IRRBB management policies and procedures remain appropriate and sound, the management body or its delegates should review the IRRBB management policies and procedures in the light of the outcomes of regular reports. 50.The management body or its delegates should ensure that analysis and risk management activities related to IRRBB are conducted by sufficient and competent staff with technical knowledge and experience, consistent with the nature and scope of the institution’s activities. Internal controls 51.With regard to IRRBB control policies and procedures, institutions should have appropriate approval processes, exposure limits, reviews and other mechanisms designed to provide a reasonable assurance that risk management objectives are being achieved. 52.Institutions should undertake regular reviews and evaluations of their internal control systems and risk management processes, seeking assurance that personnel comply with established policies and procedures. Such reviews should also address any significant changes that may affect the effectiveness of controls, including changes in market conditions, personnel, technology and structures of compliance with exposure limits, and ensure that there are 13 Pipeline exposures (e.g., where a loan has been agreed and the customer can choose whether to draw down or not) effectively provide the customer with an option that will most likely be exercised when market conditions least suit the institution (negative convexity). Management of pipeline exposures relies on accurate data on applications received, and modelling of expected drawdowns.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 28 appropriate escalation procedures for any exceeded limits. The reviews and evaluations should be conducted regularly by individuals or units that are independent of the function under review. When revisions or enhancements to internal controls are warranted, there should be an internal review mechanism in place to ensure that these are implemented in a timely manner. 53.Institutions should have their IRRBB identification, measurement, monitoring and control processes reviewed by an independent auditing function, which may be an internal or external auditor, on a regular basis. In such cases, reports written by internal or external auditors or other equivalent external parties should be made available to relevant competent authorities. IRRBB IT system and data quality 54.The IT systems and applications used by the institution to carry out, process and record operations, to identify, measure and aggregate IRRBB exposures, and to generate reports should be capable of supporting the management of IRRBB in a timely and accurate manner. In particular, the systems should: (a) Capture interest rate risk data on all the institution’s material IRRBB exposures including exposures to gap, basis, and option risk. This should support the institution’s measurement system to identify, measure and aggregate the major sources of IRRBB exposures. (b) Be capable of fully and clearly recording all transactions made by the institution, taking into account their IRRBB characteristics. (c) Be tailored to the complexity and number of transactions creating IRRBB. (d) Offer sufficient flexibility to accommodate a reasonable range of IRRBB shock and stress scenarios and any additional scenarios. (e) Enable the institutions to fully measure, assess and monitor the contribution of individual transactions to their overall exposure. (f) Be able to compute the IRRBB measures (i.e., economic value and net interest income measures plus market value changes) as well as other measures of IRRBB prescribed by their competent authorities, based on the interest rate shock and stress scenarios set out in sections 4.3.3 and 4.3.4. (g) Be sufficiently flexible to incorporate supervisory-imposed constraints on institutions’ internal risk parameter assumptions. 55.The IT system and transaction system should be capable of recording the repricing profile, interest rate characteristics (including spread) and option characteristics of the products to enable measurement of gap risk, basis risk and option risk. In particular, the transaction system should be able to gather detailed information on the repricing date(s) of a given transaction,

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 29 interest rate type or index, any options (including early repayment or redemption) and the fees relating to the exercise of these options. The systems used to measure IRRBB should be capable of capturing the IRRBB characteristics of all products. The systems should also allow the disaggregation of the impact of individual IRRBB instruments and portfolios at the risk level of the non-trading book. 56.For complex, structured products in particular, the transaction system should be able to gather information about the separate parts of the product and to capture their IRRBB characteristics (e.g., the characteristics of assets and liabilities grouped by certain characteristics such as repricing dates or optionality elements). The institution should ensure that the IT system is able to keep pace with the introduction of new products. 57.Adequate organisational controls of IT systems should be in place to prevent the corruption of data used by IRRBB computer systems and applications, and to control changes to the coding used in those applications, so as to ensure, in particular: (a) the reliability of data used as input, and the integrity of processing systems for IRRBB models; (b) that the likelihood of errors occurring in the IT system, including those occurring during data processing and aggregation, is minimised; and (c) that adequate measures are taken if market disruptions or slumps occur. 58.Risk measures should be based on reliable market and internal data. Institutions should scrutinise the quality of external sources of information used to establish the historical databases of interest rates, as well as the frequency at which databases are updated. 59.To ensure the high quality of data, institutions should implement appropriate processes that ensure that the data entered into the IT system is correct. Data inputs should be automated as much as possible to reduce administrative errors, and data mapping should be periodically reviewed and tested against an approved model version. In addition, there should be sufficient documentation of the major data sources used in the institution’s risk measurement process. Institutions should also establish appropriate mechanisms to verify the correctness of the aggregation process and the reliability of model results. These mechanisms should confirm the accuracy and reliability of data. 60.Where institutions slot cash flows into different time buckets (e.g., for gap analyses) or assign the cash flows to different vertex points to reflect the different tenors of the interest rate curve, the slotting criteria should be stable over time to allow a meaningful comparison of risk figures over different periods. 61.Institutions should identify potential reasons for discrepancies and irregularities that may arise at the time of data processing. Institutions should have procedures in place to handle those

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 30 discrepancies and irregularities, including procedures for the mutual reconciliation of positions to enable these discrepancies and irregularities to be eliminated. 62.Institutions should set up appropriate processes to ensure that the data used to feed models measuring the IRRBB across the group is consistent with the data used for financial planning. Internal reporting 63.Institutions’ internal risk-reporting systems should provide timely, accurate and comprehensive information about their exposures to IRRBB. The frequency of internal reports should be at least quarterly. 64.The internal reports should be provided to the management body or its delegates with information at relevant levels of aggregation (by consolidation level and currency), and reviewed regularly. The reports should contain a level of information adapted to the particular management level (e.g., management body, senior management) and to the specific situation of the institution and the economic environment. 65.The IRRBB reports should provide aggregate information as well as sufficient supporting detail to enable the management body or its delegates to assess the sensitivity of the institution to changes in market conditions and other important risk factors. The content of the reports should reflect changes in the risk profile of the institution and in the economic environment, and compare current exposure with policy limits. 66.The IRRBB reports should, on a regular basis, include the results of the model reviews and audits as well as comparisons of past forecasts or risk estimates with actual results to inform potential modelling shortcomings. In particular, institutions should assess the modelled prepayment losses against historical realised losses. Portfolios that may be subject to significant mark-to-market movements should be clearly identified and the impact should be monitored within the institution’s MIS and subject to oversight in line with any other portfolios exposed to market risk. 67.While the types of reports prepared for the management body or its delegates will vary based on the institution’s portfolio composition, they should include, taking into account paragraphs 65 and 66, the following: (a) Summaries of the institution’s aggregate IRRBB exposures, including information on exposures to gap, basis and option risk. Assets, liabilities, cash flows, and strategies that are driving the level and direction of IRRBB should be identified and explained. (b) Reports demonstrating the institution’s compliance with policies and limits. (c) Key modelling assumptions and parameters, such as characteristics of non-maturity deposits (NMDs), prepayments on fixed rate loans, early withdrawals of fixed term deposits, drawing of commitments, currency aggregation and treatment of commercial margins.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 31 (d) Details of the impact of key modelling assumptions made on the IRRBB measures including changes in assumptions under various interest rate scenarios. (e) Details of the impact of interest rate derivatives on the IRRBB measures. (f) Details of the impact of fair value instruments, including Level 3 assets and liabilities, on the IRRBB measures. (g) Results of stress tests as referred to in section 4.3.4, the shocks as referred to in section 4.3.3, the supervisory outlier tests as referred to in paragraph 5 of Article 98 of Directive 2013/36/EU, and assessments of sensitivity to key assumptions and parameters; and (h) Summaries of the reviews of IRRBB policies, procedures and adequacy of the measurement systems, including any findings of internal and external auditors or other equivalent external parties (such as consultants). 68.Based on these reports, the management body or its delegates should be able to assess the sensitivity of the institution to changes in market conditions and other important risk factors, with particular reference to portfolios that may potentially be subject to significant mark-to￾market movements. 69.The internal measurement system should generate reports in a format that allows the different levels of the institution’s management to understand the reports easily and to make appropriate decisions in a timely manner. The reports should constitute the basis for regular monitoring of whether or not the institution operates in line with its strategy and the interest rate risk limits it has adopted. Model governance 70.Institutions should ensure that the validation of IRRBB measurement methods — which should be reviewed and validated independently of their development — and the assessment of corresponding model risk are included in a formal policy process that should be reviewed and approved by the management body or its delegates. The policy should be integrated within the governance processes for model risk management and should specify: (a) the management roles and designate who is responsible for the development, validation, documentation, implementation and use of models; and (b) the model oversight responsibilities as well as policies including the development of initial and ongoing validation procedures, evaluation of results, approval, version control, exception, escalation, modification and decommission processes. 71.The validation framework should include the following five core elements:

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 32 (a) evaluation of conceptual and methodological soundness, including developmental evidence; (b) ongoing model monitoring, including process verification and benchmarking; (c) outcomes analysis, including back-testing of key internal parameters (e.g., stability of deposits, loan prepayment rates, early redemptions of deposits, pricing of instruments); (d) thorough assessment of any expert opinions and judgements used in internal models; and (e) Validation of diversification assumptions. 72.In addressing the expected initial and ongoing validation activities, the policy should establish a hierarchical process for determining model risk soundness based on both quantitative and qualitative dimensions such as size, impact, past performance and staff expertise with the modelling technique employed. 73.Model risk management for IRRBB measures should follow a holistic approach that begins with motivation, development and implementation by model owners and users. Prior to receiving internal approval for usage, the process for determining model inputs, assumptions, modelling methodologies and outputs should be reviewed and validated independently of the development of IRRBB models. 74.The review and validation results and any recommendations on model usage should be presented to and approved by the management body or its delegates. Upon approval, the model should be subject to ongoing review, process verification and validation at a frequency that is consistent with the level of model risk determined and approved by the institution. 75.The ongoing review process should establish a set of exception trigger events that obligate the model reviewers to notify the management body or its delegates in a timely fashion, in order to determine corrective actions and restrictions on model usage. Clear version control authorisations should be designated, where appropriate, to model owners. 76.On the basis of observations and new information gained over time, an approved model may be modified or withdrawn. Institutions should articulate policies for model transition, including change and version control authorisations and documentation. 77.Institutions may rely on third-party IRRBB models to manage and control IRRBB, provided that these models are adequately customised to properly reflect the specific characteristics of the institution in question. Institutions are expected to fully understand the underlying analytics, assumptions and methodologies of the third-party models and to ensure that they are adequately integrated into the institutions’ overall risk management systems and processes. Where third parties provide input for market data, behavioural assumptions or model settings,

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 33 the institution should have a process in place to determine if those inputs are reasonable for its business and the risk characteristics of its activities. Institutions should ensure there is adequate documentation of their use of third-party models, including any specific customisation. 78.Model inputs or assumptions, whether stemming from internal model processes or from third parties, should be included in the validation process. The institution should document and explain model specification choices as part of the validation process. 4.3 Measurement of IRRBB by an institution’s internal system 4.3.1 General approach to measurement of IRRBB 79.Institutions should implement robust internal measurement systems (IMSs) that capture all components and sources of IRRBB which are relevant for the institution’s business model. 80.Institutions should measure their exposure to IRRBB in terms of potential changes to both the economic value and net interest income measures plus market value changes. Institutions should use complementary features of the IRRBB measures to capture the complex nature of IRRBB over the short-term and long-term time horizons. In particular, institutions should measure and monitor (i) the overall impact of key modelling assumptions on the measurement of IRRBB under the different IRRBB measures, and (ii) the IRRBB of their banking book interest rate derivatives where relevant for the business model. 81.If commercial margins and other spread components are excluded from economic value measures, institutions should (i) use a transparent methodology for identifying the risk-free interest rate at inception of each instrument; and (ii) use a methodology that is applied consistently across all interest rate sensitive instruments and all business units. 82.When calculating net interest income measures to evaluate IRRBB exposures, institutions should include commercial margins. 83.Institutions should consider non-performing exposures (net of provisions) as interest rate sensitive instruments reflecting expected cash flows and their timing. 84.When measuring their exposure to IRRBB, institutions should not purely rely on the calculation and outcomes of the supervisory outlier tests described in paragraph 5 of Article 98 of Directive 2013/36/EU, or any additional outlier test developed by the competent authority, but should develop and use their own assumptions and calculation methods. However, the supervisory outlier tests should be fully integrated into the internal framework for the management of IRRBB and should be used as complementary tools for measuring exposure to IRRBB.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 34 4.3.2 Methods for measuring IRRBB 85.Institutions should not rely on a single measure of risk but should instead use the range of quantitative tools and models that corresponds to their specific risk exposure. To that end, institutions should consider the application of the methods listed in Annex I but not limited to those, to ensure that various aspects of interest rate risk are captured adequately. 86.The limitations of each quantitative tool and model used should be fully understood by the institution, and these limitations should be taken into account in the IRRBB risk management process. In assessing IRRBB, institutions should be aware of the risks that may arise as a consequence of accounting treatment of transactions in the non-trading book. 87.Institutions should identify and measure all components of IRRBB. In order to identify different components of IRRBB, institutions should at least consider those approaches as shown in Table 1. Table 1: Identification of sub-components of interest rate risk in the non-trading book Component Method Focus Gap risk Gap analysis Partial duration for yield curve risk The volume of mismatches in different time bands. The dispersion and concentration of mismatches in different time bands. Basis risk Inventory of instrument groups based on different interest rates Use of derivatives and other hedging instruments in terms of different bases, convexity and timing difference neglected by gap analysis. Option risk (automatic and behavioural options) Inventory of all instruments with embedded or explicit options Behavioural options: The volume of mortgages, current accounts, savings and deposits where the customer has the option to deviate from the contractual maturity; the volume of commitments with interest rate sensitive customer drawings. Automatic interest rate options: Caps and floors embedded in assets and liabilities; swaptions or prepayment options embedded in wholesale assets

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 35 Component Method Focus and liabilities; and explicit caps, floors and swaptions. 88.For measuring and monitoring of IRRBB, institutions should use at least one net interest income measure plus market value changes and at least one economic value measurement method that, in combination, capture all components of IRRBB. Large institutions with cross￾border activities, in particular institutions under categories 1 and 2 of the SREP Guidelines, and institutions with complex or sophisticated business models, should use multiple measurement methods for IRRBB, as further specified in Annex II. 4.3.3 Interest rate shock scenarios for ongoing management 89.Institutions should regularly, at least quarterly and more frequently in times of increased interest rate volatility or increased IRRBB levels, measure their exposure to IRRBB in the context of the different IRRBB measures under various interest rate shock scenarios for potential changes in the level and shape of the interest rate yield curves, and to changes in the relationship between different interest rates (i.e., basis risk). 90.Institutions should consider whether to apply a conditional or unconditional cash flow modelling approach. Larger and more complex institutions, in particular institutions under categories 1 and 2 of the SREP Guidelines, should also take into account scenarios where different interest rate paths are computed and where some of the assumptions (e.g., relating to behaviour, contribution to risk, and balance sheet size and composition) are themselves functions of changing interest rate levels. 91.Institutions should assess exposures in each currency in which they have positions. For the material currency exposures, the interest rate shock scenarios should be currency-specific and consistent with the underlying economic characteristics. Under the IRRBB internal measurement system (IMS), currency-specific interest rate shock scenarios, should be considered, at least, for each currency where the accounting value of financial assets or liabilities denominated in a currency amounts to 5% or more of the total non-trading book financial assets or liabilities, or less than 5% if the sum of financial assets or liabilities included in the calculation is lower than 90% of total non-trading book financial assets (excluding tangible assets) or liabilities. Institutions should include in their internal measurement systems methods to aggregate their IRRBB across different currencies. Where institutions make use of assumptions about dependencies between interest rates in different currencies, they should have the necessary level of skills and sophistication to do so. Institutions should take into account the impact of assumptions regarding dependencies between interest rates across different currencies. 92.When selecting interest rate shock scenarios, institutions should consider the following:

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 36 (a) That their own internally developed interest rate shock scenarios be commensurate with the nature, scale and complexity of their activities as well as their risk profile, taking into account sudden and gradual parallel and non-parallel shifts and changes in the yield curves. Scenarios should be based on the historical movements and behaviour of interest rates, as well as simulations of future interest rates; (b) Interest rate scenarios that reflect changes in the relationships between key market rates in order to address basis risk; (c) The prescribed interest rate shock scenarios as referred to in paragraph 5 of Article 98 of Directive 2013/36/EU; (d) Any additional interest rate-shock scenarios required by supervisors; (e) That the validity of diversification assumptions is appropriately stressed; and (f) In low interest rate environments, institutions should also consider negative interest rate scenarios and the possibility of asymmetrical effects of negative interest rates on their interest rate sensitive instruments. 93.The results of shock scenarios should feed into the decision-making at appropriate management level. This includes strategic or business decisions, the allocation of internal capital, and risk management decisions by the management body or its delegates. The results should also be considered when establishing and reviewing the policies and limits for IRRBB. 4.3.4 Interest rate stress scenarios 94.IRRBB stress testing should be considered in the ICAAP, where institutions should undertake rigorous, forward-looking stress testing that identifies the potential adverse consequences of severe changes in market conditions on their capital or net interest income measures plus market value changes. For the purpose of IRRBB stress testing institutions should include changes in the behaviour of their customer base. Stress testing for IRRBB should be integrated into institutions’ overall stress-testing framework, including reverse stress testing, and should be commensurate with their nature, size and complexity, as well as their business activities and overall risk profile. 95.IRRBB stress testing should be performed regularly, at least annually and more frequently in times of increased interest rate volatility and increased IRRBB levels. 96.The IRRBB stress-testing framework should include clearly defined objectives, scenarios tailored to the institution’s businesses and risks, well-documented assumptions and sound methodologies. 97.In enterprise-wide stress tests, the interaction of IRRBB with other risk categories (credit risk, liquidity risk, market risk, etc.), and any material second-round effects, should be computed.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 37 98.Institutions should perform reverse stress tests in order to (i) identify interest rate scenarios that could severely threaten an institution’s capital, economic value and net interest income measures plus market value changes; and (ii) reveal vulnerabilities arising from its hedging strategies and the potential behavioural reactions of its customers. 99.For IRRBB assessment purposes, in testing vulnerabilities under stressed conditions, institutions should use larger and more extreme shifts and changes in interest rates than those used for the purpose of ongoing management, including at least the following: a) Substantial changes in the relationships between key market rates (basis risk); b) Sudden and substantial shifts in the yield curve (both parallel and non-parallel); c) Breakdowns of key assumptions about the behaviour of asset and liability classes; d) Changes in key interest rate correlation assumptions; e) Significant changes to current market and macro conditions and to the competitive and economic environment, and their possible development; and f) Specific scenarios that relate to the individual business model and profile of the institution. 100. The results of stress scenarios should feed into the decision-making at the appropriate management level. This includes strategic or business decisions, the allocation of internal capital, and risk management decisions by the management body or its delegates. The results should also be considered when establishing and reviewing the policies and limits for IRRBB. 101. For the purpose of sensitivity analysis under stress scenarios, institutions should evaluate, in the economic value metrics, the limitations associated with the use of a run-off assumption and the ability of the institution to capture the long-term interest rate risk. 102. In cases where balance sheet instruments have significant repricing restrictions (e.g., caps and floors) institutions should prudently consider, if material, the effect that the renewal of said instruments would have when replaced with others with comparable features, regardless of the run-off assumption. This must be done for a prudent time horizon and considering the business model of the bank. 4.3.5 IRRBB measurement assumptions 103. When measuring IRRBB, institutions should fully understand and document key behavioural and modelling assumptions. These assumptions should be aligned with business strategies and be regularly tested. The determination of these assumptions should be made in a proportionate manner and particularly taking into account the materiality thresholds established in Articles 7(12), 8(2), 9(4), 11(3) and 21(1) of the regulatory technical standards envisaged in Article 84(5) of the CRD.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 38 104. In assessing the risk of interest rate-sensitive products that are linked to inflation or other market factors, prudent assumptions should be applied. These assumptions can be based, for instance, on the current/last observed value, on forecasts of a reputable economic research institute or on other generally accepted market practices (in the case of inflation: forward inflation expectation curves, for instance). 105. When measuring IRRBB, pension obligations and pension plan assets should be included unless their interest rate risk is captured in another risk measure. 106. Institutions should, in relation to the different IRRBB measures, where applicable, take into account assumptions made for the purpose of risk quantification in relation to at least the following areas: a) The exercise of interest rate options (automatic or behavioural) by both the institution and its customer under specific interest shock and stress scenarios; b) The treatment of balances and interest flows arising from NMDs; c) The treatment of fixed term deposits with risk of early redemption; d) The treatment of fixed rate loans and fixed rate loan commitments; e) The treatment of own equity in internal economic value measures; f) The implications of accounting practices for the measurement of IRRBB, and in particular hedge-accounting effectiveness; and g) Validation of diversification assumptions. 107. As market conditions, competitive environments and strategies change over time, institutions should review significant measurement assumptions at least annually, and more frequently during rapidly changing market conditions. a) Behavioural assumptions for customer accounts with embedded customer optionality for the purpose of IRRBB 108. In assessing the implications of optionality, institutions should take into account: (a) The potential impact on current and future loan prepayment speeds arising from the interest rate scenario, underlying economic environment and contractual features. Institutions should take into account the various dimensions influencing the embedded behavioural options. (b) The elasticity of adjustment of product rates to changes in market interest rates. (c) The migration of balances between product types as a result of changes in their features, terms and conditions.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 39 109. Institutions should have policies in place governing the setting of, and the regular assessment of, the key assumptions for the treatment of on- and off-balance-sheet items that have embedded options in their interest rate risk framework. This means that institutions should: (a) Identify all material products and items subject to embedded options that could affect either the interest rate charged or the behavioural repricing date (as opposed to contractual maturity date) of the relevant balances; (b) Have appropriate pricing and risk mitigation strategies (e.g., use of derivatives) to manage the impact of optionality within the risk appetite, which may include early redemption penalties chargeable to the customer as an offset to the potential break costs (where permitted); (c) Ensure that modelling of key behavioural assumptions is justifiable in relation to the underlying historical data, and based on prudent hypotheses; (d) Be able to demonstrate that they have accurate modelling (back-tested against experience); (e) Maintain appropriate documentation of assumptions in their policies and procedures, and have a process for keeping them under review; (f) Understand the sensitivity of the institution’s risk measurement outputs to these assumptions, including undertaking stress testing of the assumptions and taking the results of such tests into account in internal capital allocation decisions; and (g) Perform regular internal validation of these assumptions to verify their stability over time and to adjust them if necessary. 110. Non-maturity deposits from financial customers should not be subject to behavioural modelling except if they are operational deposits as defined in Article 27(1)(a) LCR Delegated Regulation. 111. Except for the regulated savings referred to in paragraph (a) of Article 428f(2) of the CRR, but not limited to the centralised part, and for those with material economic or fiscal constraints in case of withdrawal, the assumed behavioural repricing date for retail deposits and wholesale deposits from non-financial customers and operational deposits referred to in paragraph 110, without any specific repricing dates (non-maturity deposits), should be constrained to a maximum weighted average repricing date of 5 years. The 5-year cap applies to the full amount (i.e., core and non-core) of the aggregate portfolio of those deposits and separately for each currency. 112. In making behavioural assumptions about accounts without specific repricing dates for the purposes of interest rate risk management, institutions should:

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 40 (a) Be able to identify ‘core’ balances – i.e., deposits that are stable and unlikely to reprice even under significant changes in interest rate environment, and/or other deposits whose limited elasticity to interest rate changes could be modelled by banks. (b) Modelling assumptions for these deposits should reflect depositor characteristics (e.g., retail/wholesale) and account characteristics (e.g., transactional/non-transactional). A high-level description of the above categories can be found below: i. Retail transactional deposits include non-interest-bearing and other retail accounts whose remuneration component is not relevant in the client’s decision to hold money in the account. ii. Retail non-transactional deposits include retail accounts (including regulated ones) whose remuneration component is relevant in the client’s decision to hold money in the account. iii. Wholesale deposits include accounts from corporate and other wholesale clients, excluding interbank accounts or other fully price-sensitive ones. (c) Assess the potential migration between deposits without specific repricing dates and other deposits that could modify, under different interest rate scenarios, key behavioural modelling assumptions. (d) Consider potential constraints on the repricing of retail deposits in low or negative interest rate environments and the effect that such constraints may have on the stability of deposits under different interest rate scenarios. (e) Ensure that assumptions about the decay of core and other modelled balances are prudent and appropriate in balancing the benefits to net interest incomes against the additional economic value risk entailed in locking in a future interest rate return on the assets financed by these balances, and the potential forgone revenue under a rising interest rate environment. (f) Emphazising the importance of statistical or quantitative methods to determine the behavioural repricing dates and the cash flow profile of NMDs, the determination of appropriate modelling assumptions for NMDs may require (i.e., in a forward-looking perspective) the complementary contribution from different experts within an institution (e.g., risk management and risk control department, sales and treasury). (g) Have appropriate documentation of these assumptions in their policies and procedures, and a process for keeping them under review. (h) Understand the impact of the assumptions on the institution’s own chosen risk measurement outputs and internal capital allocation decisions, including by periodically calculating sensitivity analyses on key parameters (e.g., percentage and maturity of core

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 41 balances on accounts and pass-through rate) and the measures using contractual terms rather than behavioural assumptions to isolate the impact of assumptions on the different IRRBB measures. (i) Undertake stress testing to understand the sensitivity of the chosen risk measures to changes in key assumptions, taking the results of such tests into account in internal capital allocation decisions. b) Corporate planning assumptions for own equity capital for the purpose of IRRBB 113. Where institutions decide to adopt a policy intended to stabilise earnings arising from their own equity, they should: (a) Have an appropriate methodology for determining what elements of equity capital should be considered eligible for such treatment; (b) Determine what would be a prudent investment maturity profile for the eligible equity capital that balances the benefits of income stabilisation arising from taking longer-dated fixed-return positions against the additional economic value sensitivity of those positions under an interest rate stress, and the risk of earnings underperformance should rates rise; (c) Include appropriate documentation of these assumptions in their policies and procedures, and include a process for keeping them under review; (d) Understand, the impact of the chosen maturity profile on the institution’s own chosen risk measurement outputs, including by regular calculation of the measures without inclusion of the equity capital to isolate the effects on the different IRRBB measures perspectives; and (e) Undertake stress testing to understand the sensitivity of risk measures to changes in key assumptions for equity capital, taking the results of such tests into account in their IRRBB internal capital allocation decisions. 114. In deciding the investment term assumptions for equity capital, institutions should avoid taking income stabilisation positions that significantly reduce their capability to adjust to significant changes in the underlying economic and business environment. 115. The investment term assumptions used to manage the risks to the different IRRBB measures sensitivities arising from equity capital should be considered as part of the normal corporate planning cycle, and such assumptions should not be altered just to reflect a change in the institution’s expectations of the path of future interest rates. Any use of derivative or asset portfolios to achieve the desired investment profile should be clearly documented and recorded. 116. Where an institution has not set explicit assumptions for the investment term of equity capital or sets assumptions that are explicitly short-term, the institution should make sure that

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 42 its systems and management information can identify the implications of its chosen approach for the volatility of both interest income and economic value. 4.4 Non-satisfactory IRRBB internal systems 117. Paragraph 3 of Article 84 of Directive 2013/36/EU empowers competent authorities to require an institution to use the standardised methodology referred to in paragraph 1 of Article 84 CRD “where the internal systems implemented by that institution for the purpose of evaluating the risks referred to in that paragraph are not satisfactory”. 118. As a minimum, satisfactory internal systems should be implemented in compliance with these Guidelines, taking into account the principle of proportionality. 119. More specifically, internal systems should be considered as not satisfactory in the following cases at least: (a) An IMS should be considered non-satisfactory for the purposes of paragraph 3 of Article 84 CRD if competent authorities assess, on a case by case basis, that the implemented methods do not cover all the material components of the interest rate risk (gap risk, basis risk, option risk), and/or measures do not capture in a robust manner all material dimensions of risks for significant assets, liabilities and off￾balance sheet type instruments (e.g., NMD, loans, options) of the bank’s non-trading book. Annex I describes a non-restrictive list of methods for IRRBB measurement with an indication of their limitations. When measuring their exposure to IRRBB, institutions should not limit themselves to the methods listed in Annex I in order to ensure that material aspects of interest rate risk are captured adequately. (b) IMS should be considered as non-satisfactory if they are not calibrated, back-tested and reviewed in all their relevant parameters on an appropriate frequency and supported by a due governance and documentation that considers the nature, scale and complexity of the IRRBB inherent in the business model and the institution's activities. Institutions should duly comply with para. 71 to 79 of these Guidelines in particular with review and validation (at their appropriate frequency, including back testing), governance, risk policies as well as controls. 4.5 Identification and assessment of CSRBB 4.5.1 Perimeter of CSRBB

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 43 120. CSRBB captures a combination of two elements: (a) The changes of the “market credit spread” or “market price of credit risk” (distinct from the idiosyncratic credit spread) 14 representing the credit risk premium required by market participants for a given credit quality; 15 (b) The changes of the “market liquidity spread” representing the liquidity premium that sparks market appetite for investments and presence of willing buyers and sellers; 121. CSRBB does not include the effect of credit quality changes during the observation period (i.e., rating category downgrade/upgrade of a specific counterparty or instrument, considered as migration risk). In particular, the deterioration of an institution’s credit quality should not have any positive impact on the credit spread risk measure. Institutions should avoid any overlap with the credit valuation adjustment risk management framework when assessing the CSRBB. 122. CSRBB excludes non-performing exposures. 123. When assessing changes in credit risk premium and liquidity premium movements, institutions can consider currency specific dimensions (i.e., EUR, USD, etc.) as a relevant dimension for market credit spread and market liquidity spread. 124. Institutions should not exclude any instrument in the banking book from the perimeter of CSRBB ex ante, including assets, liabilities, derivatives and other off-balance sheet items such as loan commitments, irrespective of their accounting treatment. Any potential exclusion of instruments from the relevant perimeter should be done in the case of the absence of sensitivity to credit spread risk and should be appropriately documented and justified. In any case, institutions should not exclude assets accounted at fair value. 125. Without prejudice to paragraph 12, small trading book business, as defined by paragraph 1 of Article 94 of Regulation (EU) No 575/2013, shall be included unless its credit spread risk is captured in another risk measure. 4.5.2 CSRBB governance and strategy 126. The CSRBB strategy of the institution, including the risk appetite for CSRBB should be part of the overall strategy, in particular the strategic objectives and risk objectives, which the management body must approve as laid down in subparagraph (2), letter (a) of Article 88(1) of Directive 2013/36/EU. 14 Idiosyncratic credit spread reflects the specific credit risk associated with the credit quality of the individual borrower (which will also reflect assessments of risks arising from the sector and geographical location of the borrower) and the specifics of the credit instrument (e.g., whether a bond or a derivative). 15 For instance, the additional yield that a debt instrument issued by an AA-rated entity must produce over a risk-free alternative.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 44 127. The institution’s risk appetite for CSRBB should be expressed in terms of the impact of fluctuating credit spreads on the different CSRBB measures. Institutions significantly exposed to CSRBB should reflect this appropriately within their risk appetite. 128. Institutions should ensure that procedures to identify, measure and monitor CSRBB have been established when proposing new products or activities. It should be ensured that the CSRBB characteristics of these new products and activities are well understood. 129. Consolidating institutions should ensure that internal governance arrangements and processes for the management of CSRBB are consistent and well-integrated on a consolidated and a sub-consolidated basis. 4.5.3 CSRBB risk assessment framework and responsibilities 130. In view of having internal governance arrangements pursuant to Article 74 and 88 of Directive 2013/36/EU, institutions should, in relation to CSRBB, ensure the following: (a) That their management body bears the ultimate responsibility for the oversight of the CSRBB management framework and the institution’s risk appetite framework to adequately cover the risks. The management body may, however, delegate the monitoring and management of CSRBB to senior management, expert individuals or an asset and liability management committee under the conditions further specified in paragraph 132. (b) That they have in place a CSRBB management framework that establishes clear lines of responsibilities and that consists of policies, processes and internal controls including regular independent reviews and evaluations of the effectiveness of the framework. (c) That the arrangements, processes and mechanisms referred for the assessment of CSRBB are comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and the institution's activities. 131. The management body or its delegates should, in particular, be responsible for the following: (a) Understanding the nature and the level of the CSRBB exposure. The management body should ensure that there is clear guidance regarding the risk appetite for CSRBB in respect of the institution’s business strategies. (b) Establishing that the appropriate actions are taken to assess and monitor CSRBB, consistent with the approved strategies and policies. In this regard, the management body or its delegates are responsible for setting: i. Systems and standards for monitoring CSRBB, valuing positions and assessing performance, including procedures for updating shock, parameters and stress scenarios and key underlying assumptions driving the institution’s CSRBB analysis;

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 45 ii. A comprehensive CSRBB reporting and review process; and iii. Effective internal controls and management information systems (MISs). (c) Approving major CSRBB risk-taking initiatives in advance of implementation. Positions related to internal risk transfers between the non-trading book and the trading book should be properly documented. (d) Carrying out the oversight of the approval, implementation and review of CSRBB management policies and procedures. The level of and changes in the institution’s CSRBB exposure should be provided regularly to the management body. (e) Ensuring that the validation of CSRBB measurement methods and assessment of corresponding model risk are included in a formal policy process that should be reviewed and approved by the management body or its delegates. (f) Understanding and assessing the functioning of its delegates in monitoring and controlling CSRBB, consistent with policies approved by the management body, on the basis of regular reviews of timely and sufficiently detailed information. (g) Understanding the implications of the institution’s CSRBB strategies and their potential linkages with market, liquidity, credit and operational risk but without requiring all the management body members to be experts in the area. Some of the members should have sufficient technical knowledge to question and challenge the reports made to the management body. The institution should establish that management body members are responsible for ensuring that senior management has the competence to understand CSRBB and that CSRBB management are provided with adequate resources. 132. Institutions should have delegation arrangements and procedures in place for any delegation by the management body of the assessment and monitoring of CSRBB, including, but not limited to, the following: (a) Persons or committees to which tasks of the management body are delegated for developing CSRBB policies and practices, such as senior management, expert individuals or an ALCO, should be identified and have objectives clearly set out by the management body; (b) The management body should ensure that there is an adequate separation of responsibilities in the risk management process. The CSRBB identification, assessment, monitoring and control functions should have clearly defined responsibilities, should be independent from risk-taking functions on CSRBB and should report CSRBB exposures directly to the management body or its delegates; (c) The institution should ensure that the management body’s delegates have clear lines of authority over the units responsible for risk taking on CSRBB. The communication channel to convey the delegates’ directives to these line units should be clear; and

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 46 (d) The management body should establish that the institution’s structure enables its delegates to carry out their responsibilities, and facilitates effective decision-making and governance. In this regard, an ALCO, or its equivalent, should meet regularly and its composition should reflect each major department linked to CSRBB. The management body should foster discussion regarding the CSRBB management process, both between its members and its delegates and between its delegates and others in the institution. The management body should also ensure that regular communication between the risk management and strategic planning areas facilitate the monitoring of the risk arising from future business. 4.5.4 CSRBB risk policies, processes and controls Risk policies and processes 133. The management body should, based on its overall CSRBB strategy, adopt robust risk policies, processes and systems which should ensure that: (a) Procedures for updating scenarios for the assessment and monitoring of CSRBB are set up; (b) the measurement approach and the corresponding assumptions for assessing and monitoring CSRBB risks, are appropriate and proportional; (c) the assumptions of the models used are regularly reviewed and, if necessary, amended; (d) standards for the evaluation of positions and the measuring of performance are defined; and (e) the lines of authority and responsibility for managing CSRBB exposures are defined. 134. The policies should be well reasoned, robust and documented and should address all CSRBB components that are important to the institution’s individual circumstances. Without prejudice to the proportionality principle, the CSRBB policies should include the following: (a) The application of the boundary between ‘non-trading book’ and ‘trading book’. Internal risk transfers between the banking book and the trading book should be properly documented and monitored; (b) The size and the form of the spread shocks to be used for internal CSRBB calculations respectively. 135. To ensure that the institution’s CSRBB management policies and procedures remain appropriate and sound, the management body or its delegates should review the CSRBB management policies and procedures in the light of the outcomes of regular reports.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 47 136. The management body or its delegates should ensure that analysis and risk management activities related to CSRBB are conducted by sufficient and competent staff with technical knowledge and experience, consistent with the nature and scope of the institution’s activities. Internal controls 137. With regard to CSRBB control policies and procedures, institutions should have appropriate approval processes, reviews and other mechanisms designed to provide a reasonable assurance that risk management objectives are being achieved. 138. Institutions should have their CSRBB identification, measurement, monitoring and control processes reviewed by an independent auditing function, which may be an internal or external auditor, on a regular basis. In such cases, reports written by internal or external auditors or other equivalent external parties should be made available to relevant competent authorities. CSRBB IT system and data quality 139. The IT systems and applications used by the institution to carry out, process and record operations, to identify, measure and aggregate CSRBB exposures, and to generate reports should be capable of supporting the management of CSRBB in a timely and accurate manner. In particular, the systems should: (a) Capture credit spread data on all the institution’s CSRBB exposures. This should support the institution’s measurement system to identify, measure and aggregate the major sources of CSRBB exposures; (b) Be capable of fully and clearly recording all transactions made by the institution, taking into account their CSRBB characteristics; (c) Be tailored to the complexity and number of transactions creating CSRBB; (d) Offer sufficient flexibility to accommodate a reasonable range of CSRBB shock and stress scenarios and any additional scenarios; (e) Enable the institutions to fully measure, assess and monitor the contribution of individual transactions to their overall exposure; and (f) Be able to compute the CSRBB measures. 140. The IT system should be capable of recording the credit spread characteristics of the products. 141. The systems used to measure CSRBB should be capable of capturing the CSRBB characteristics of all products.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 48 142. Risk measures should be based on reliable market and internal data. Institutions should scrutinise the quality of external sources of information used to establish the historical databases of credit spreads, as well as the frequency at which databases are updated. 143. To ensure the high quality of data, institutions should implement appropriate processes that ensure that the data entered into the IT system is correct. Data inputs should be automated as much as possible to reduce administrative errors, and data mapping should be periodically reviewed and tested against an approved model version. In addition, there should be sufficient documentation of the major data sources used in the institution’s risk measurement process. Institutions should also establish appropriate mechanisms to verify the correctness of the aggregation process and the reliability of model results. These mechanisms should confirm the accuracy and reliability of data. Internal reporting 144. Institutions’ internal risk-reporting systems should provide timely, accurate and comprehensive information about their exposures to CSRBB. The frequency of internal reports should be at least quarterly. 145. The internal reports should be provided to the management body or its delegates with information at relevant levels of aggregation (by consolidation level) and reviewed regularly. The reports should contain a level of information adapted to the particular management level (e.g., management body, senior management) and to the specific situation of the institution and the economic environment. 146. The CSRBB reports should provide aggregate information as well as sufficient supporting detail to enable the management body or its delegates to assess the sensitivity of the institution to changes in market conditions and other important risk factors. The content of the reports should reflect changes in the risk profile of the institution and in the economic environment and compare current exposure with policy limits. 147. The CSRBB reports should, on a regular basis, include the results of the model reviews and audits as well as comparisons of past forecasts or risk estimates with actual results to inform potential modelling shortcomings. Portfolios that may be subject to significant mark-to-market movements should be clearly identified and the impact should be monitored within the institution’s MIS and subject to oversight in line with any other portfolios exposed to market risk. 148. While the types of reports prepared for the management body or its delegates will vary based on the institution’s portfolio composition, they should include, taking into account paragraphs 146 and 147, the following: (a) Summaries of the institution’s aggregate CSRBB exposures in terms of the different CSRBB measures. Assets, liabilities and off-balance-sheet exposures and strategies that are driving the level and direction of CSRBB should be identified and explained; and

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 49 (b) Key modelling assumptions. 149. Based on these reports, the management body or its delegates should be able to assess the sensitivity of the institution to changes in market conditions and other important risk factors, with particular reference to portfolios that may potentially be subject to significant mark-to￾market movements. 150. The internal measurement system should generate reports in a format that allows the different levels of the institution’s management to understand the reports easily and to make appropriate decisions in a timely manner. The reports should constitute the basis for regular monitoring of whether or not the institution operates in line with its strategy. Model governance 151. Institutions should ensure that the validation of CSRBB measurement methods — which should be reviewed and validated independently of their development — and the assessment of corresponding model risk are included in a formal policy process that should be reviewed and approved by the management body or its delegates. The policy should be integrated within the governance processes for model risk management and should specify: (a) the management roles and designate who is responsible for the development, validation, documentation, implementation and use of models; and (b) the model oversight responsibilities as well as policies including the development of initial and ongoing validation procedures, evaluation of results, approval, version control, exception, escalation, modification and decommission processes. 4.6 Monitoring of CSRBB 4.6.1 General approach for the monitoring of CSRBB 152. Institutions should implement robust internal measurement systems (IMSs) that capture all components and sources of CSRBB which are relevant for the institution’s business model. 153. Institutions should monitor their exposure to CSRBB in terms of potential changes to the different CSRBB measures. Institutions should use complementary features of the different approaches to capture the complex nature of CSRBB over the short-term and long-term time horizons. In particular, institutions should measure and monitor (i) the overall impact of key modelling assumptions on the different CSRBB measures, and (ii) the CSRBB of their banking book derivatives where relevant for the business model. 4.6.2 Methods for monitoring CSRBB 154. Institutions should develop and use their own assumptions and calculation methods for the assessment of CSRBB. The choice of measurement methodology should be adequate for the complexity of the bank itself.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 50 155. The limitations of each quantitative tool and model used should be fully understood by the institution, and these limitations should be taken into account in the CSRBB risk management process. In assessing CSRBB, institutions should be aware of the risks that may arise as a consequence of accounting treatment of transactions in the non-trading book. 156. As an exception, in the practical implementation of paragraph 120 and for proportionality reasons, institutions may include idiosyncratic credit spread components for the monitoring of CSRBB, as long as it is ensured that the measures will yield more conservative results. 4.6.3 CSRBB monitoring assumptions 157. When measuring CSRBB, institutions should fully understand and document key modelling assumptions. These assumptions should be aligned with business strategies and be regularly tested. 158. Institutions should take into account the implications of accounting practices for the measurement of CSRBB, in particular for net interest income measures plus market value changes. 159. If the reliability and stability of diversification assumptions are appropriately validated and documented; diversification between CSRBB and IRRBB may be possible. Under the same condition, diversification assumptions between CSRBB and other risks may be possible. The diversification effects should be estimated conservatively enough to be assumed to be sufficiently stable even in economic downturns and under market conditions that are unfavourable for the institution’s business and risk structure. In any case institutions should have separate assessments of CSRBB and other risks (including IRRBB). 160. As market conditions, competitive environments and strategies change over time, institutions should review significant measurement assumptions at least annually, and more frequently during rapidly changing market conditions. 161. For the purpose of CSRBB, institutions should set-up prudent documentation supporting their policies assumptions and procedures, and include a process for keeping them under review. Institutions should understand, for the purpose of CSRBB, the impact of the chosen CSRBB-related investment strategies.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 51 Annex I — IRRBB measurement methods (non-exhaustive list) Cash flow modelling Metric Description Risks captured Limitations of metric Unconditional cash flows (it is assumed that the timing of cash flows is independent of the specific interest rate scenario) Net Interest Income￾based: •Gap analysis: Repricing gap •Focus on net interest income (NII) component: Change of NII Gap analysis allocates all relevant interest rate sensitive instruments into predefined time buckets according to their repricing or maturity dates, which are either contractually fixed or based on behavioural assumptions. It calculates the net positions (‘gaps’) in each time bucket. It approximates the change in net interest rate income ensuing from a yield curve shift by multiplying each net position with the corresponding interest rate change. Gap risk (only parallel risk) • The metric approximates the gap risk only linearly. • It is based on the assumption that all positions within a particular time bucket mature or reprice simultaneously. • It fails to measure basis and option risk. Economic value: •Duration analysis: Modified duration/PV01 of equity The modified duration approximates the relative change in the net present value of a financial instrument due to a marginal parallel shift of the yield curve by one percentage point. The modified duration of equity measures the exposure of an institution to gap risk in its non-trading book. PV01 of equity is derived from the modified duration of equity and measures the absolute change of the equity value resulting from a 1 basis point (0.01%) parallel shift of the yield curve. The starting point is the allocation of all cash flows of interest rate sensitive instruments into time buckets. For each instrument type, an appropriate yield curve is selected. The modified duration of each instrument is calculated from the change of its net present value due to a 1 percentage point parallel shift of the yield curve. The modified duration of equity is determined as the modified duration of assets times assets divided by Gap risk (only parallel risk) • The metric only applies to marginal shifts of the yield curve. In the presences of convexities, it may underestimate the effect of larger interest rate movements. • It only applies to parallel shifts of the yield curve. • It fails to measure option risk and captures basis risk at best partially.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 52 Cash flow modelling Metric Description Risks captured Limitations of metric equity minus the modified duration of liabilities times liabilities divided by equity. PV01 of equity is obtained by multiplying the modified duration of equity by the value of equity (i.e., assets minus liabilities) and dividing by 10 000 to arrive at the value change per basis point. •Partial modified duration/partial PV01 The partial modified duration of an instrument for a specific time bucket is calculated as the modified duration above, except that not the entire yield curve is shifted in parallel, but only the yield curve segment corresponding to the time bucket. These partial measures show the sensitivity of the market value of the banking book to a marginal shift of the yield curve in particular maturity segments. To each time bucket’s partial measure a different magnitude of a shift can be applied, such that the effect of a change of the yield curve’s shape can be computed for the entire portfolio. Gap risk (parallel and non-parallel risk) • The metric only applies to marginal interest rate changes. In the presence of convexity, the metric may underestimate the effect of larger interest rate movements. • It fails to measure the basis and option risk. Cash flows partially or fully conditional on interest rate scenario (it is assumed that the timing of cash flows of options, of instruments with embedded, explicit options and – in more sophisticated approaches – of instruments of Net Interest Income￾based: Focus on net interest income (NII) component: •Change of NII The change of NII is an earnings-based metric and measures the change of the net interest income over a particular time horizon (usually 1-5 years) resulting from a sudden or gradual interest rate movement. The starting point is the mapping of all cash flows of interest rate sensitive instruments to (granular) time buckets (or using the exact repricing dates of individual positions in more sophisticated systems). The base scenario for the calculations reflects the institution’s current corporate plan to project the volume, pricing and repricing dates of future business transactions. The interest rates used to calculate future cash flows in the base scenario are derived from forward rates, appropriate spreads or market expected rates for different instruments. Gap risk (parallel and non-parallel), basis risk and, provided all cash flows are modelled scenario dependent, also option risk • Sensitivity of the outcome to the modelling and behavioural assumptions. • Complexity.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 53 Cash flow modelling Metric Description Risks captured Limitations of metric which the maturity depends on clients’ behaviour, is modelled conditional on the interest rate scenario) In assessing the possible extent of NII changes, banks use assumptions and models to predict the path of interest rates, the maturing of existing assets, liabilities and off-balance-sheet items, and their potential replacement. Net interest income-based metrics can be differentiated according to the sophistication of projecting future cash flows: simple run-off models assume that existing assets and liabilities mature without replacement; constant balance sheet models assume that maturing assets and liabilities are replaced by comparable instruments; while the most complex dynamic cash flow models reflect business responses to differing interest rate environments in the size and composition of the banking book. All earnings-based metrics can be used in a scenario or stochastic analysis. Earnings at risk (EaR) is an example of the latter, which measures the maximum NII change at a given confidence level. Economic value: Focus on economic value of equity (EVE) •Change in EVE The change in EVE is the change in the net present value of all cash flows originating from banking book assets, liabilities and off-balance-sheet items resulting from a change in interest rates, assuming that all banking book positions run off. The interest rate risk can be assessed by the ∆EVE for specific interest rate scenarios or by the distribution of ∆EVE using Monte Carlo or historical simulations. Economic value at risk (EVaR) is an example of the latter, which measures the maximum equity value change for a given confidence level. Gap risk (parallel and non-parallel), basis risk and, if all cash flows are modelled scenario dependent, also option risk • Sensitivity of the outcome to the modelling and behavioural assumptions. • Stochastic metrics, which apply distributional assumption, may fail to capture tail risks and non￾linearities. • Full revaluation Monte Carlo approaches are computationally demanding and may be difficult to interpret (‘black-box’). • Complexity.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 54 Annex II – Sophistication matrix for IRRBB measurement Institutions should apply at least the level of sophistication in their risk measures shown in the table below corresponding to their categorisation under the SREP Guidelines. Where the complexity or scope of an institution’s business model is significant, the institution should, notwithstanding its size, apply and implement risk measures that correspond to its specific business model and adequately capture all sensitivities. All material sensitivities to the interest rate changes should be adequately captured, including sensitivity to behavioural assumptions. Institutions that offer financial products containing embedded optionalities should use measurement systems that can adequately capture the dependence of options to interest rate changes. Institutions with products that provide behavioural optionalities to clients should use adequate conditional cash flow modelling approaches to quantify IRRBB with regard to the changes in client behaviour that could occur under different interest rate stress scenarios. The four categories referred to in the sophistication table below reflect the categorisation of institutions laid down in the EBA SREP Guidelines. The different categories reflect different size, structure and the nature, scope and complexity of activities of institutions; with Category 1 corresponding to the most sophisticated institutions.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 55 IRRBB metric and modelling Indicative supervisory expectations regarding IRRBB metric and modelling depending on the institution’s sophistication category Cash flow modelling Metric Category 4 institution Category 3 institution Category 2 institution Category 1 institution Unconditional cash flows (it is assumed that the timing of cash flows is independent of the specific interest rate scenario) Net Interest Income￾based: Gap analysis: •Repricing gap Time buckets advised in the Basel Committee on Banking Supervision’s Standards ‘Principles for the Management and Supervision of Interest Rate Risk in the banking book’ from April 2016 BCBS Standards. [Gap based on evolving size and composition of the banking book due to business responses to differing interest rate environments. Including projected commercial margins consistent with the interest rate scenario (see section 4.3 on measurement of IRRBB).] Economic value: Duration analysis: •Modified duration/PV01 of equity •Partial modified duration/partial PV01 Time buckets advised in BCBS Standards. Application of standard shocks. Yield curve model with tenors corresponding to the time buckets. Time buckets advised in BCBS Standards, application of partial duration weights. Application of standard shocks and other interest rate shock and stress scenarios (see section 4.3 on measurement of IRRBB). Yield curve model with tenors corresponding to the time buckets. [Partial duration computed per instrument type and time bucket. Application of standard and other interest rate shock and stress scenarios (see section 4.3 on measurement of IRRBB). Yield curve model with tenors corresponding to the time buckets.] [Partial duration computed per transaction and time bucket. Application of standard and other interest rate shock and stress scenarios (see section 4.3 on measurement of IRRBB). Yield curve model with tenors corresponding to the time buckets.]

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 56 IRRBB metric and modelling Indicative supervisory expectations regarding IRRBB metric and modelling depending on the institution’s sophistication category Cash flows partially or fully conditional on interest rate scenario (timing of cash flows of options, of instruments with embedded, explicit options and – in more sophisticated approaches – of instruments of which the maturity depends on clients’ behaviour, is modelled conditional on the interest rate scenario) Net Interest Income￾based: •Net interest income (NII) Standard shocks applied to earnings under a constant balance sheet. Based on time buckets advised in the BCBS Standards. Standard and other interest rate shock and stress scenarios for the yield curve (see section 4.3 on measurement of IRRBB) applied to earnings, reflecting constant balance sheet or simple assumptions about future business development. Standard and other interest rate shock and stress scenarios for the yield curve and between key market rates separately (see section 4.3 on measurement of IRRBB) applied to earnings projected by business plan or constant balance sheet. Including projected commercial margins consistent with the interest rate scenario (see section 4.3 on measurement of IRRBB). Comprehensive interest rate and stress scenarios, combining shifts of yield curves with changes in basis and credit spreads, as well as changes in customer behaviour, are applied to reforecast business volumes and earnings to measure the difference compared with the underlying business plan. Including projected commercial margins consistent with the interest rate scenario (see section 4.3 on measurement of IRRBB).

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 57 IRRBB metric and modelling Indicative supervisory expectations regarding IRRBB metric and modelling depending on the institution’s sophistication category Economic value: •Economic value of equity (EVE) Application of standard and other interest rate shock and stress scenarios for the yield curve (see section 4.3 on measurement of IRRBB), using time buckets as advised in the BCBS Standards; yield curve tenors corresponding to the time buckets. Measure computed on transaction or cash flow basis. Application of standard and other interest rate shock and stress scenarios for the yield curve and between key market rates separately (see section 4.3 on measurement of IRRBB). Adequate tenors in yield curves. Full optionality valuation. Comprehensive interest rate and stress scenarios, combining shifts of yield curves with changes in basis and credit spreads, as well as changes in customer behaviour. Adequate tenors in all yield curves. Full optionality valuation. Scenario analysis complemented by Monte Carlo or historical simulations on portfolios with material optionality. Daily updating of risk factors.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON￾TRADING BOOK ACTIVITIES 58 5. Accompanying documents 5.1 Cost-benefit analysis / impact assessment

1. Article 16(2) of the EBA Regulation (Regulation (EU) No 1093/2010 of the European Parliament and of the Council) provides that, where appropriate, the EBA should analyse ‘the related potential costs and benefits’ of Guidelines issued by the EBA. Such analysis shall be proportionate in relation to the scope, nature and impact of the Guidelines. The following section provides an impact assessment of the Guidelines. It includes an overview of the findings regarding the problems to be dealt with, options available to tackle the problems, and cost-benefit analysis compared with the baseline scenario.
2. Following paragraph 6 of Article 84 Directive 2013/36/EU, the Guidelines cover a wide number of items included in the EBA/GL/2018/02, Guidelines on the management of interest rate risk arising from non-trading book activities published on 18 July 2018 and generally applicable from 30 June 2019. Therefore, the items related to the identification, management and evaluation of IRRBB are maintained, with slight amendments as appropriate, and expanded to CSRBB to the extent that deemed necessary. These Guidelines mainly introduce a further developed analysis of the definition and perimeter of the CSRBB. Thus, this impact assessment focuses on these abovementioned aspects. The analysis is mainly of qualitative nature but also builds on the QIS data collection during the first half of 2021 where some quantitative input on CSRBB has been collected. 5.1.1 Policy options a. Definition of CSRBB Policy option 1:
3. CSRBB relates to the changes of market credit and market liquidity spreads as components of the yield (curve) for instruments of a specific credit worthiness/rating. They are considered as a general market risk premium paid to access the capital markets and pricing of instruments.
4. More specifically the CSRBB targets to capture the changes of the “market credit spread” and the changes of the “market liquidity spread”. It does not include the effect of rating changes situations during the observation period or instruments under default situation. This is illustrated as follows:

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON￾TRADING BOOK ACTIVITIES 59 Policy option 2: 5. Option 2 would follow the approach on the CSRBB definition envisaged in Option 1 and would add some idiosyncratic elements. 6. The argument to include some idiosyncratic elements here is that they would not be covered in other risk framework. For example, under Option 1, the CSRBB in the case of a AAA bond would be explained by the changes in the spread of the bond, remaining as AAA, due to market credit and market liquidity reasons. However, in the definition proposed under Option 2, the CSRBB would also be explained by idiosyncratic factors that are not covered in other risk framework. This is illustrated as follows:

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON￾TRADING BOOK ACTIVITIES 60 b. Perimeter of CSRBB Policy option A: 7. Under Option A institutions should not exclude any instruments in the banking book from the perimeter of CSRBB ex ante. Any potential exclusion of instruments from the relevant perimeter should be appropriately documented. The perimeter is not dependent on accounting treatment, but rather on sensitivity of an instruments to credit spread changes. The deterioration of a bank’s creditworthiness should not have any positive impact on the credit spread risk measure. 8. In summary, in order to derive the relevant perimeter of instruments subject to credit spread volatility, institutions should perform a top-down approach of their own: (a) Institutions should identify all instruments in the banking book subject to credit spread volatility. No specific assets or liabilities should be excluded from the relevant perimeter ex ante. (b) The perimeter is not dependent on accounting treatment, but rather on the sensitivity of an instrument to credit spread changes and its impact on the institution. In general, institutions are expected to include in the perimeter instruments sensitive, or expected to be sensitive, to volatility in credit spreads that may potentially impact the institutions income and / or capital; (c) In the determination of the perimeter, a worsening of credit worthiness of the institution should not have any positive impact on the credit spread risk measure; (d) Any potential exclusion of instruments from the relevant perimeter should be appropriately documented; Policy option B 9. Policy option B would be identical to option A but would introduce an additional element to ensure a minimum harmonization. 10.A minimum harmonization is ensured by requiring that assets accounted at fair value would always be included in the perimeter of CSRBB. Any exclusion of other asset or any liability should still be demonstrated to be insensitive to CSRBB. 5.1.2 QIS Analysis 11.The EBA undertook a QIS referred to December 2020 which included data on the CSRBB exposures banks have. 12.121 banks participated in this QIS but only 48 banks provided sufficient data for the CSRBB￾related analysis. For these reasons, the EBA has made an assessment on a best-effort basis to inform its policy alternatives.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON￾TRADING BOOK ACTIVITIES 61 13.From the data received, banks consider that their CSRBB exposures are concentrated in the asset side and particularly in debt securities. On average, CSRBB exposures in the form of debt securities represent more than 90% of all the assets exposed to CSRBB. Still, it is relevant to show that banks report liabilities exposed to CSRBB, mainly under the categories of debt securities issued and other liabilities, including deposits taken. 14.In addition to this, the QIS participating banks report that, on average, almost all (more than 99%) of their debt securities exposed to CSRBB are accounted at fair value. 15.Most of the debt securities exposed to CSRBB (on average, 77%), are instruments whose pricing is based on direct market observation, i.e. instruments that can be priced using quoted prices, or quoted prices of financial instruments with similar characteristics. 16.The EBA requested banks to provide the own qualitative assessment, as per their degree of CSRBB exposure, in the scale between 0% to 100%, for all their exposure categories. Debt securities in the asset side estimated, on average, at 48%. Participants also provide a similar assessment on other asset categories, such as securitisations, debt securities and credit derivatives, on the liability side. 17.Banks also provided data on the impact of a 1 basis point parallel upward shift of the credit spread curve on the present value of the respective exposures. Generally, the impact reported is negligible except for some outlier. 18.On a more qualitative basis, 12 out of 23 banks, explained that in their current assessment and monitoring of CSRBB exposures they include, but find it difficult to disentangle, the idiosyncratic component. This is a relevant input for the exception envisaged in the Guidelines for including idiosyncratic elements in the monitoring of CSRBB as long as the results are more conservative. 19.30 out of 40 banks explained that they apply internal limits on exposures to CSRBB. Generally, banks explained that they reduce their positions when breaching the limits rather than setting up hedging strategies. 5.1.3 Final option 20.The EBA takes note that the majority of the exposures to CSRBB, as communicated by banks, are in the form of debt securities in the asset side and accounted at fair value. The EBA understands that this might be very much linked to the fact that the current EBA GL on IRRBB and the EBA GL on SREP envisage precisely this exposure category in the CSRBB framework16 . 16 Paragraph 18 of the EBA GL on IRRBB states that “Institutions should monitor and assess their CSRBB-affected exposures, by reference to the asset side of the non-trading book, where CSRBB is relevant for the risk profile of the institution.” Paragraph 4 of the EBA GL on SREP provide a definition of ‘Credit spread risk’ as “the risk arising from changes in the market value of debt financial instruments due to fluctuations in their credit spread.”

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON￾TRADING BOOK ACTIVITIES 62 21.Based on this, the EBA understands that assets at fair value constitute a category that should always be included in the perimeter of CSRBB. This is in line with the current GL and also has practical evidence. This also provides a minimum harmonisation in the definition of the perimeter. 22.However, the EBA considers that CSRBB exposures should not be confined upfront to these categories only. Indeed, and despite the perimeter in the current EBA GL, banks report other categories as exposed to CSRBB in practice and therefore banks should pay attention to all potential exposures to CSRBB irrespective of the asset or liability category they are. For these reasons the EBA opts for Policy option B for the definition of the perimeter. 23.As regards the definition of CSRBB itself, the EBA considers that idiosyncratic elements should not be included since they are generally covered in other risk framework, mainly the credit risk. Considering these elements in the definition could trigger double counting issues. Also from a conceptual perspective, CSRBB is purely market related and therefore market and liquidity related elements should conform its definition. Nevertheless, after accounting for proportionality aspects and the qualitative QIS input mentioned in the previous item, the GL envisage some flexibility in the treatment of idiosyncratic elements, as long as the results would become more conservative. This is a good balance in the implementation between the pure definition of CSRBB and the operational difficulties that some banks might find in disentangling the idiosyncratic elements of credit spread risk.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON￾TRADING BOOK ACTIVITIES 63 5.2 Feedback on the public consultation The EBA publicly consulted on the draft proposal contained in this paper. The consultation period lasted for four months and ended on 4 April 2022. 28 responses were received, of which 21 were published on the EBA website. A public hearing was held on 3 March 2022. This paper presents a summary of the key points and other comments arising from the consultation, the analysis and discussion triggered by these comments and the actions taken to address them if deemed necessary. In many cases several industry bodies made similar comments or the same body repeated its comments in the response to different questions. In such cases, the comments, and EBA analysis are included in the section of this paper where EBA considers them most appropriate. Changes to the draft Guidelines have been incorporated as a result of the responses received during the public consultation. Summary of key issues and the EBA’s response The EBA has continued working on the draft Guidelines during the consultation period. The EBA ensures continuity with the approach in place in the current 2018 Guidelines17 and in line with the Basel standards to ensure that internal systems implemented by institutions to identify, evaluate, manage and mitigate their exposures to IRRBB take into account the impact on economic value of equity and the net interest income of their non-trading book activities. Particularly, in the net interest income perspective, the Guidelines consider the impact on interest income and interest expenses but also includes supervisory expectations to consider market value changes of instruments at fair value under such analysis. The same applies when it comes to the envisaged assessment and monitoring of CSRBB. Feedback from respondents was received on the five years repricing maturity cap for non-maturity deposits, some of them expressing concerns on the impact that it might cause on some specific business models and arguing under internal systems institutions should be allowed to fully model behavioural assumption. Others argued that if understood as an average applied to the full amount of non-maturity deposits the impact is not expected to trigger unintended consequences. The Guidelines envisage that behavioural assumptions should be applied in the measurement of IRRBB exposures. The EBA considers that proportionality should be taken into account here and refers to the materiality thresholds in the determination of these assumptions as established in the upcoming regulatory technical standards envisaged in Article 84(5) of the CRD for the specification of the standardised approach. 17 EBA/GL/2018/02 - Guidelines on the management of interest rate risk arising from non-trading book activities.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON￾TRADING BOOK ACTIVITIES 64 The EBA clarifies also that the five years cap envisaged in the modelling of the repricing maturity under internal systems for retail and non-financial wholesale deposits should be applied as an average to the full amount, core and non-core, of the cited non-maturity deposits. These specificities are expected to also limit the impact of this unique behavioural assumption related specification in the Guidelines. In addition to this the EBA, consistently with other pieces of the regulatory framework and corresponding provisions from the CRR, recognises some exceptions to the cap to specific regulated products. That said, given the current lack of experience with the application of the 5 years cap under internal systems, as a difference with the previous Guidelines on the management of interest risk arising from non-trading book activities published in 2018, the EBA will exercise a close monitoring of the implementation of this behavioural assumption and potential undesirable effects. Some respondents argued that the CSRBB perimeter should be limited to marketable assets at fair value. The EBA would like to clarify that the proposed framework seeks to cover the credit spread risk both from an EVE and NII perspective – in line with the CRD mandate – and not only under normal, but also under exceptional and stressed situations. Therefore, the EBA does not rule out a priori any banking book item from the perimeter of CSRBB. It corresponds to institutions to demonstrate which items are credit spread risk non-sensitive except assets accounted at fair value that should also be included in the perimeter. The EBA would also like to clarify that the intention of the Guidelines is to exclude non-performing exposures, rather than those under default only, due to the inherent complexities of assessing credit spreads in non-performing exposures and in order to ensure comparability. A relevant amendment has been made. Some respondents requested for proportionality in the criteria to identify non-satisfactory internal systems and asked for clarification on potential direct implications to apply the standardized approach. The EBA clarifies that proportionality is indeed envisaged in the Guidelines and for the purposes of this analysis and also that it does not correspond to the Guidelines to refer to the specific actions in case of non-satisfactory internal systems whose determination is reserved to supervisors only in the CRD either by requiring the application of the standardized approach or other remedies envisaged in the CRD. In CSRBB governance related aspects some feedback was received to apply an approach similar as the envisaged for IRRBB with regards to delegation of responsibilities. The EBA assesses that indeed this delegation of power should be similar for the IRRBB and CSRBB frameworks.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 65 Summary of responses to the consultation and the EBA’s analysis Comments Summary of responses received EBA analysis Amendments to the proposals General comments In addition to the specific questions raised in the consultation paper some respondents asked some clarification on what market value changes mean and whether cash flows hedges should be considered therein. The EBA wishes to clarify that the term market value changes refer only to market value changes that will be reflected when risk-free interest rates shift. A few respondents acknowledged that even when hedge accounting should be included, accounting ineffectiveness cannot be calculated a priori. The EBA would also like to clarify that as changes in interest rates are reflected in items accounted at fair value, ineffectiveness per se is not considered, only accounting asymmetries. Some respondents requested that the Guidelines should envisage an implementation period particularly as regards the CSRRBB parts considering that the Guidelines, in addition to its definition, provide criteria on how CSRBB should be assessed and monitored and argued that some time is necessary for its implementation. These parts are new in the Guidelines as mandated to be included now by point (c) of Article 84(6) CRD. Responses to questions in Consultation Paper EBA/CP/2021/36 Question 1. In the context of the measurement of the impact of IRRBB under internal systems, paragraph 111 envisages a five year cap repricing maturity for retail and non￾financial wholesale deposits without a specified maturity. Would you foresee any unintended consequence or undesirable effect from this behavioural assumption in particular on certain business models or specific activities? If this is the case, please kindly provide concrete examples of it. General comments on the impact expected Some respondents do not expect any immediate unintended consequence if applied as a weighted average maturity for the full amount of the aggregate NMD portfolio (not to portfolios individually). They request this to be clear in the legal text. Furthermore, they state that such assumption is already implemented by the current IRRBB GL for the SOT EVE. The cap envisaged in the consultation paper was indeed intended to apply as a weighted average maturity for the full amount of the aggregate NMD portfolio. This is clarified in the legal text. The inclusion of this cap is the unique behavioural assumption envisaged in the Guidelines and responds to the particular current interest rate environment and the expectation of an interest rate increase and potential subsequent higher volatility Paragraph 111 has been amended as follows: “… The 5-year cap applies to the full amount (i.e., core and non-core) of the aggregate portfolio of those deposits and

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 66 Comments Summary of responses received EBA analysis Amendments to the proposals Other respondents argue that introducing this assumption in the IMS may conduct to a misrepresentation of the actual interest rate risk profile of the bank and may consequently impact the ALM strategy and profitability. They consider that modelling behavioural assumptions is inherent to an internal management system, with the best knowledge clients’ profiles, deposit type, geographical aspects… and that, therefore, it should not be standardised in the GL. Furthermore, they argue that the 5 years cap is not supported by empirical observations. Some respondents disagree with excluding NMDs from financial customers from behavioural assumptions, meaning to be modelled as overnight, since in their view they show some stability to be modelled serving as hedge for long￾term loans. in NMDs. It follows a prudent approach to control a potentially overestimated profitability in the short￾medium term and subsequently differentiates the profile of financial and non-financial depositors. The EBA notes that a weighted average maturity for the full amount of the aggregate NMDs portfolios does not seem to trigger unintended consequences in the short-medium term. However, the EBA will regularly monitor the implementation of this cap. separatelyindividuall y for each currency.” Specific business lines Long term retail saving deposits and long-term fixed rate loans. It is argued that, in the cases of retail deposits for saving purposes with high stability, posing a cap would not lead to a prudent management of the interest rate risk exposure, but to a structural under-hedge (or shorter investment of assets), which exposes the bank to the risk of decreasing interest rates. Some even consider that this cap might jeopardize the business models whereby the NMD’s are a natural offset of long-term fixed rate loans (e.g., fixed rate mortgages) since the cap The EBA takes into account the concerns raised on some specific business lines, particularly cases where affected regulated products envisage specific legal features or economic constraints for withdrawals, for which a specific treatment is recognised consistently with other exceptions established in other parts of the regulatory framework (in particular the LCR and NSFR). To enhance consistency and reflect their nature, changes are also made to allow for behavioural modelling of certain operational deposits (subject to conditions such as the 5 years cap). In particular, the EBA will monitor the implementation of this specific treatment for these Paragraph 111 has been split into two paragraphs (110 and 111 of the final guidelines): New paragraph 110: “Non￾maturity deposits from financial customers should not be subject to behavioural modelling except if they are operational deposits as defined in

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 67 Comments Summary of responses received EBA analysis Amendments to the proposals would modify the capacity of the bank to offer fixed rate long-term loans to customers. Here, special emphasis is put to some regulated savings which stability is argued to be ensured due to legal features or material economic constraints for withdrawal expectations. Operational deposits in custody banks. It is also argued that this cap would be particularly inaccurate for the operational deposits of custody and trust banks, as the majority of their deposits do not have contractual maturities and are from financial customers. These financial customers maintain a stable level of deposits at custody and trust banks to ensure that the bank can carry out day-to-day payment, settlement, and other operational services for the customer. They suggest a differentiation of the treatment of these operational deposits similarly to the LCR regulation, including those from financial customers. business lines and regulated products, liaising with competent authorities and institutions as far as needed, and with the view to assess any potential unintended or undesirable effect. Article 27(1)(a) LCR Delegated Regulation.” New paragraph 111: “Except for the regulated savings referred to in paragraph (a) of Article 428f(2) of the CRR, but not limited to the centralised part, and for those with material economic or fiscal constraints in case of withdrawal, Tthe assumed behavioural repricing date for retail deposits, and non-financial wholesale deposits from non-financial customers and operational deposits referred to in paragraph 110, without any specific repricing dates (non￾maturity deposits), should be constrained to a maximum weighted average

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 68 Comments Summary of responses received EBA analysis Amendments to the proposals repricing date of 5 years. The 5-year cap applies to the full amount (i.e., core and non-core) of the aggregate portfolio of those deposits and separately individually for each currency. Non￾maturity deposits from financial customers should not be subject to behavioural modelling” Others One respondent asks if the cap on the average repricing maturity of NMD could apply also to CSRBB or only to IRRBB, and if is the case how this restriction could impact in the reinvestment assumptions for CSRBB. The EBA wishes to clarify that providing guidance on the measurement of CSRBB is out of the scope of the mandate. Therefore, the GL specifies the provision of a 5Y cap in NMDs only in the context of IRRBB. No changes made. Question 2. Do respondents find that the criteria to identify non-satisfactory IRRBB internal models provide the minimum elements for supervisors’ assessment? Objective criteria for the identification of non￾satisfactory institution’s internal system Many respondents underlined the importance for banks to manage their IRRBB via risk sensitive and tailor-made Internal Measurement Systems (IMS). Respondents called for more objective conditions and procedures to discriminate satisfactory vs. non￾satisfactory IRRBB IMS. They suggested the definition of clear and predictable triggers for being The Guidelines focus in an objective manner on the specific items and criteria that needs to be observed in the analysis of whether or not an internal system is satisfactory. However, the final assessment necessitates an individual analysis for each case. No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 69 Comments Summary of responses received EBA analysis Amendments to the proposals required to use the IRRBB standardized approach (SA) methodology, in order to eradicate supervisory discretion from the Guidelines. They fear the subjective criteria defined under section 4.4 for the purpose of non-satisfactory IRRBB internal systems will expose banks to large variations of interpretation criteria among and within EU jurisdictions. The EBA understand that this is a good balance to ensure good harmonisation in an analysis that still needs to be undertaken on a case-by-case basis. Materiality of the IRRBB IMS weaknesses Many respondents suggested IRRBB internal models shall be deemed as “not satisfactory” only in case the observed deficiencies of the internal models materially affect the reliability of the results so that in that case it can be subsequently and reasonably assumed that the SA is actually better suited to measure the IRRBB. Materiality is envisaged in the guidelines as to the analysis of the internal systems. For example, paragraph 119 (a) of the Guidelines refers to cases where “the implemented methods do not cover all the material components of the interest rate risk (gap risk, basis risk, option risk), and/or measures do not capture in a robust and economically justified manner all material dimensions of risks for significant assets, liabilities and off-balance sheet type instruments…” Also, in the context of the necessary calibration, review and validation of internal systems, paragraph 119(b) refers to the need to observe at the “all their relevant parameters on an appropriate frequency and supported by a due governance and documentation that considers the nature, scale and complexity of the IRRBB inherent in the business model and the institution's activities.” Materiality will be assessed considering the specificities and complexities of each bank. No change made. Requirement to use the standardized approach in case of non-satisfactory Internal systems – Various aspects: Some respondents suggested to authorize the partial use of SA parameters if some very limited and targeted elements of the Institution’s IRRBB Paragraph 3 of Article 84 of CRD empower competent authorities directly to “require an institution to use the standardised methodology No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 70 Comments Summary of responses received EBA analysis Amendments to the proposals potential targeted elements when limited IMS deficiencies are identified, transitory period to move from the IRRBB IMS to the IRRBB SA, warning and probation period before requiring to move to the IRRBB SA, conditions to revert to the IRRBB IMS, IRRBB SA should not be used as a benchmark to IRRBB IMS. IMS are considered as non-satisfactory. This should be considered in the context where many answers underlined the SA could be more resource intensive to deliver than the requirement to remediate non￾satisfactory internal model targeted and limited weaknesses. For respondents, corrective measures on IRRBB IMS should always be privileged to the supervisory requirement to apply the SA for the computation of the IRRBB. Some respondents suggested the Guidelines to specify the timeline to move from the IRRBB IMS to the IRRBB SA. Answers called for a reasonable period to remedy identified IRRBB IMS weaknesses before being obliged to move to IRRBB SA (i.e. transitional period, clear and straightforward road map for reverting to a (satisfactory) internal system). Some respondents suggested the framework should define under which conditions a return to IRRBB IMS should be allowed for banks obliged to use the SA. Indeed, once identified shortcomings have been remedied, it should be possible for an institution to revert to an IRRBB IMS without undue delay. Some respondents suggested to clarify in the Guidelines that the SA is considered a fallback solution and not as a benchmark for assessing if the IRRBB IMS is satisfactory or not. Institutions should not be expected to justify why they consider their IRRBB IMS is better than the IRRBB SA. referred to in paragraph 1 where the internal systems implemented by that institution for the purpose of evaluating the risks referred to in that paragraph are not satisfactory.” It is out of the scope of this mandate to envisage if and how that requirement should be imposed. Competent authorities should assess on a case-by￾case basis the best way to handle non-satisfactory internal systems by requiring banks to apply the standardised methodology or by asking banks to engage remediating actions on non-satisfactory internal measures. The Guidelines do not refer to the RTS on the standardised approach or look at their features when establishing the criteria to identify a non￾satisfactory internal system.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 71 Comments Summary of responses received EBA analysis Amendments to the proposals Proportionality: For small and non-complex institutions and banks with simple IRRBB exposure, respondents called for the definition of minimum elements for supervisors’ assessment of non-satisfactory IRRBB IMS. One respondent underlined for proportionality purposes the separate assessment of basis risk, option risk and gap risk under paragraph 119(a) should not be a condition to differentiate satisfactory from non-satisfactory IRRBB IMS. Some answers underline the extensive requirements for the “review” as well as “validation” of the IRRBB IMS would represent a disproportionate effort for small banks (in particular the isolation of effects resulting from behavioral assumptions or the analysis of elasticities). Respondents suggested to introduce simplifications and adjustments in line with the underlying moderate IRRBB risk materiality of small and non￾complex institutions. Paragraph 119(b) appears too detailed for some respondents as the modeling framework is already referred in paragraphs 71 to 79 [paragraphs 70 to 78 of the final guidelines]. It is also potentially misleading as it may be understood as requiring each single parameter to be subject to back-testing rather than models as a whole, and as some assumptions are necessarily discretionary (e.g., choice of the duration of equity). Proportionality is envisaged as a general rule in the analysis of satisfactory internal systems. Paragraph 118 is clear that “As a minimum, satisfactory internal systems should be implemented in compliance with these Guidelines, taking into account the principle of proportionality”. This is even reinforced in some specific aspect like in point b of paragraph 119 where the calibration, back testing and review of all the relevant parameters should be made “on an appropriate frequency and supported by a due governance and documentation that considers the nature, scale and complexity of the IRRBB inherent in the business model and the institution's activities.” The EBA considers that, in point b of paragraph 119, that the calibration, back testing and review “in all the relevant parameters” should be read as in the internal model as a whole and not on every single parameter individually necessarily. No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 72 Comments Summary of responses received EBA analysis Amendments to the proposals Definitions of some terms Under paragraph 119(a) some respondents asked the EBA to define the concept of “economically justified manner” in the phrase “An IMS should be considered non-satisfactory […] on a case-by-case basis, that the implemented methods […] do not capture in a robust and economically justified manner all material dimensions of risks” Some respondents underlined it is not always clear where the criteria apply to “internal models” only (i.e., behavioural models) or to the “internal measurement system” (of which internal models are part). In particular, it was underlined that the governance, the strategy and the risk assessment framework are not defined under the IRRBB SA framework, which imply the requirements defined for the purpose of IRRBB IMS also apply to IRRBB SA and S-SA. As such IRRBB governance, strategy and risk assessment cannot be considered as criteria for the identification of non-satisfactory IRRBB IMS. For all these reasons the concept of “internal models” should be privileged to the concept of “internal measurement system”. Indeed, only the internal models should be subject to “calibration” and “back testing procedures” and not the outcomes of the methods listed in Annex I. For the purpose of paragraph 119(b) some respondents underlined it is not clear what is meant by “calibrated” and “reviewed”. They also asked who is supposed to be reviewing what (i.e., risk controlling, internal audit, …). Under paragraph 119 respondents suggested it would also make more The EBA considers that the wording “economically justified manner” can be deleted in avoidance of confusion. Its target was only to ensure that economic fundaments and rationale were considered in the analysis of whether measures capture all material dimensions of risks for significant assets, liabilities and off-balance sheet type instruments. However, this might be understood implicitly in the analysis. Paragraph 63 [paragraph 62 of the final guidelines] of the draft Guidelines asks for consistency between the IRRBB and the financial planning set up by the bank which is based on economic forecasts. As such, the economic consistency of the IRRBB risk indicator cannot be discarded. As per point (b) of paragraph 6 of Article 84 of Directive 2013/36/EU, these Guidelines will specify the criteria to identify, manage and mitigate interest rate risk of an institution's non-trading book activities if the institutions implement internal systems or use the standardised methodology or the simplified standardised methodology. In point (d) of such paragraph the Guidelines are envisaged to provide the criteria for determining if the internal systems are not satisfactory. The CRD refers literally to internal systems. The fact that the same rules on Governance in the Guidelines apply to banks implementing an internal system or applying the standardised approach or the simplified standardised approach does not impede Point a of paragraph 119 [paragraph 118(a) of the final guidelines] is amended as follows: “An IMS should be considered non￾satisfactory for the purposes of paragraph 3 of Article 84 CRD if competent authorities assess, on a case by case basis, that the implemented methods do not cover all the material components of the interest rate risk (gap risk, basis risk, option risk), and/or measures do not capture in a robust and economically justified manner all material dimensions of risks for significant assets, liabilities and off￾balance sheet type instruments (e.g., NMD, loans, options) of the bank’s non￾trading book.”

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 73 Comments Summary of responses received EBA analysis Amendments to the proposals sense to replace “back testing” with the broader term “validation”. that those rules serve for the purposes of assessing satisfactory internal systems. Respondents seem to argue that by requiring the application of the standardised approach in this case the same flaws would remain. It should be noted that requiring the application of the standardised approach is just a possible solution that a competent authority might take but it is also possible for the supervisor to decide to require a remedy to a specific flaw that might be observed in governance, for example, in order to keep an improved internal system as necessary. The EBA would like to clarify that as indicated in the draft Guidelines and in line with the EBA/GL/2018/02 on the management of IRRBB, the review and validation on the internal systems should be read in the context of paragraphs 71 to 79 [paragraphs 70 to 78 of the final guidelines]. Misunderstanding on the requirement to use the simplified standardized approach (S-SA): Some respondents seem to think that section 4.4 on the criteria for the identification of non-satisfactory IRRBB IMS could lead supervisory authorities to require the use of the simplified standardized approach (S-SA), while article 84(3) of Directive (EU) 2019/878 only authorizes competent authorities to require an institution to use the standardized approach (SA) where the IMS is considered not satisfactory. Article 84(5) of Directive (EU) 2019/878 authorises small and non-complex institutions to use the simplified standardized methodology (S-SA) but competent authorities are not empowered to require an institution to use it. This is no case suggested by the Guidelines. No changes made. Question 3. Is there any specific element in the definition of CSRBB that is not clear enough for the required assessment and monitoring of CSRBB by institutions?

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 74 Comments Summary of responses received EBA analysis Amendments to the proposals Methodological-neutrality of the CSRBB framework For consistency with the Pillar 2 general spirit, some answers recalled the freedom of methods should prevail for the monitoring of CSRBB. The future EBA Guidelines on CSRBB should be “method-neutral”. It should be possible for institutions to satisfy the NII and EVE requirements for the monitoring of CSRBB with the help of both scenario-based and VaR-based Internal Measurement Systems, for instance. On the contrary other respondents asked the EBA to further clarify or provide examples on the methodology to monitor the impact of CSRBB on EVE and NII. They fears the lack of well-established common practices, as well as of reliable market data for non-marketable instruments, might lead to very heterogeneous analysis frameworks among banks, hampering comparability of outcomes. One respondent suggested the usefulness to define a standard methodology for CSRBB on how this should be handled (eg. sensitivity to a 1bp independently from correlation with other risk factors). The mandate in Article 84 (6)(c) of CRD refers to the specification of criteria to assess and monitor CSRBB. The Guidelines provide definitional items of CSRBB for its harmonised identification for the purposes of its assessment and monitoring. The Guidelines also provide a dedicated item with general rules to ensure a minimum harmonisation with regards to the approach, method and assumptions for monitoring CSRBB. The EBA considers that in the mandate envisaged in Article 84(6)(c) the criteria to specify the evaluation of CSRBB is not included and corresponds to institutions to model parameters and assumptions of their internal models. No changes made. Analysis axis to analyse the CSRBB Paragraph 123 states that “when assessing changes in credit risk premium and liquidity premium movements, institutions can consider currency specific dimensions (i.e., EUR, USD, etc.) as a relevant dimension for market credit spread and market liquidity spread.” Some respondents wonder if the currency is the only dimension to be considered in building the generic yield curve with a certain rating or if there are other “dimensions” The EBA would like to clarify that currency may not be the only dimension to be considered in building the generic yield curve with a certain rating. Other dimensions should be explored by banks. As established in the draft Guidelines, as regards the perimeter of CSRBB, the idiosyncratic credit spread reflects, among others, risks arising from sectors and geographical locations. No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 75 Comments Summary of responses received EBA analysis Amendments to the proposals that should be considered. Indeed, analysing currency-specific dimensions will not make sense for every institution. For larger portfolios, further clustering (such as by rating class, sector, region, product, or possibly also more granular, issuer￾specific mapping) could make sense for internal risk management purposes and become market standard. It should be up to institutions to choose which type of clustering is most appropriate. Some business models and requested exemptions One respondent underlined that mortgage lending funded by covered bonds where the values of mortgage loans have a close correspondence with the values of the corresponding covered bonds could be excluded from the CSRBB and the IRRBB since the market risk is very restricted. Another respondent considers that a CSRBB management system based on market pricing of liquidity and credit risk is not compatible with promotional and public bank business models. The EBA considers that it does not correspond to the Guidelines to establish exemptions to Article 84(1) and (2) CRD and the necessary implementation of systems to identify, evaluate, manage and mitigate IRRBB and assess and monitor CSRBB. There is no mandate for this. Analysis of exposures to IRRBB and CSRBB are expected to be undertaken in the context of the supervisory dialogue during the SREP. No changes made. Definition of the risk free curve Some respondents mentioned that credit spread data is sector and/or country specific and there is no general market credit spread curve for each rating class. The respondent suggested that clarification is needed on how the general curve can be obtained. Moreover, when considering credit spread risk, institution-specific circumstances (portfolio composition, design of internal systems, availability of reference data, etc.) should be taken into account. The EBA considers that CSRBB relates to the changes of market credit and market liquidity spreads as components of the yield (curve) for instruments of a specific credit worthiness/rating. The specific evaluation and determination of modelling parameters and assumption corresponds to institutions in their internal systems. No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 76 Comments Summary of responses received EBA analysis Amendments to the proposals Impact of the Benchmark Regulation Some respondents underlined with the implementation of the Benchmark Regulation, the market indicator that represented the liquidity premium that was the Libor will disappear for most major currencies with the current exception of EUR. It will no longer be possible to differentiate between purely idiosyncratic and systemic premiums. The EBA considers the best proxies should be identified and applied for the definition of the yield curve for the computation of CSRBB. No changes made. Exclusion of migration and default risk Respondents support excluding the migration and default risk from CSRBB. The EBA takes note of this comment. No changes made. Definition of CSRBB under paragraph 7 Some respondents underlined that the Guidelines should make clear that that CSRBB excludes IRRBB. The EBA would like to clarify that explicit and separate identification, assessment and monitoring of CSRBB is envisaged in the Guidelines in paragraphs 11 to 14 [paragraphs 10 to 13 of the final guidelines]. Paragraph 160 [paragraph 159 of the final guidelines] envisages diversification between CSRBB and IRRBB but ensuring a separate assessment of both in all cases. The definition of CSRBB in paragraph 7 excludes IRRBB from it explicitly. No changes made. Control and risk appetite on CSRBB Some respondents consider asking institutions to control CSRBB is beyond the mandate of the EBA and not deemed proportionate. A similar observation is done for paragraphs 126 and 127, where the Guidelines state that CSRBB should be part of the risk appetite of an institution. Doubts also arise from respondents if CSRBB should be subject to risk assessment framework limits or not. The control of the CSRBB is inherent to a reliable CSRBB monitoring framework. The Guidelines, in line with paragraph 1 of Article 74 of Directive 2013/36/EU envisages the existence of mechanisms of internal control as regards CSRBB, based on the risk appetite of the institution, the same as for any risk the institution is or might be No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 77 Comments Summary of responses received EBA analysis Amendments to the proposals For one respondent, it should be clearly stated that under no circumstance it should be allocated any capital charge derived from the NII impacts in the context of the CSRBB computation. exposed to. However, the Guidelines do not establish any specific quantitative limit or capital requirements derived from it. Choice in the yield curve for deriving market prices One respondent does not consider the use of traded-bond indices a reasonable alternative for deriving market prices of credit-spread risk. Practically, the respondent does not monitor these as they are irrelevant to the institution’s business. Unless yield data are readily available, it requires insight into the underlying portfolio and cash flows from it to derive yields and risk premiums. Furthermore, the use of indices compiled on ratings assigned by rating agencies ignores any criticism on past failure to capture credit deteriorations and the sticky nature of such ratings. It, furthermore, is questionable whether any available index is sufficiently diversified. The EBA considers that the choice of the yield curve must provide the view of the general level of price for credit and/or liquidity risk for a given level of creditworthiness, excluding migration and idiosyncratic risks as per definitions provided in the draft Guidelines section 4.5.1. No changes made. Question 4. As to the suggested perimeter of items exposed to CSRBB, would you consider any specific conceptual or operational challenge to implement it? Perimeter: Assets, liabilities, and marketability of instruments The majority of respondents recommend CSRBB to be assessed only with reference to instruments traded in deep and liquid markets with observable market prices. Some respondents indicate assessing other kind of instruments would be doubtful and imply material conceptual challenges and costly calculations. Several respondents go further specifying that CSRBB only relate to assets measured at fair-value and consider incorporating amortized cost items in The EBA notes the comments and wishes to clarify that the proposed framework seeks to cover the credit spread risk both from an EVE and NII perspective – in line with the CRDV mandate – and not only under normal, but under exceptional and stressed situations (c.f. par 131b and 139d). The EBA wishes to clarify that the assessment of the CSRBB is expected to be performed for both assets No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 78 Comments Summary of responses received EBA analysis Amendments to the proposals the perimeter of CSRBB an extension of the Basel standards. CSRRBB assessment for liquid assets at fair value is also deemed the most common banking practice. Several respondents consider there is the need to ensure consistency with the business model of the institution, where amortized cost items – including market/liquid debt securities held in a collect mode – must be excluded as not intended to be sold before maturity. One respondent suggests including items at amortized cost overlaps with the credit risk assessment and the credit risk Pillar 1 requirements. Some respondents admit credit spread risk could materialize in amortized cost items – either bonds, loans or deposits – if they were sold/transferred in exceptional cases such as during mergers and acquisition processes, under cases of business model reclassifications or under stressed conditions, such us a resolution scenario. Some respondents consider credit spread changes in the market irrelevant to the conditions applicable to private mortgage lending and deposits whose margin (administrative rate) is under control of the bank, and recommend mentioning explicitly that Loans and Deposits are excluded from the scope of CSRBB. Others raise doubts and ask for examples on how the CSRBB could be assessed for these kind of products. One respondent suggests that in contrast to the EVE approach, from an NII perspective, the scope of and liabilities, and ultimately assessed on a net basis. The EBA acknowledges that non-trading book assets at fair value should always be considered in the CSRBB perimeter. However, the EBA does not rule out other non-trading book assets as well as liabilities, including bank’s own liabilities, that may be exposed to CSRBB. As per paragraph 124, any exclusion of products from the EVE or NII perimeter should be demonstrated to be insensitive to CSRBB. The EBA acknowledges that in practice decomposing credit spread rates into theoretical components may be conceptually challenging, more in particular for institutions seeking advanced methodologies for the assessment of CSRBB. The EBA wishes to clarify that the reason in providing guidance on this matter is for excluding the idiosyncratic credit spread as to avoid overlap with the credit risk framework. The EBA wishes to clarify that the general market￾credit and market-liquidity spreads are not intended to capture the specifics of the credit instruments (either bonds, loans or other kind of “marketable” or “non-marketable” instrument), as these are expected to be part of the idiosyncratic credit spread, according to definition. Moreover, a separate assessment of market-credit and market￾liquidity spreads is not suggested, nor particularly limited, by the CSRBB framework. Having this in mind, under a value perspective institutions might assess in the context of the

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 79 Comments Summary of responses received EBA analysis Amendments to the proposals instruments may be interpreted to apply to a broader scope of assets and liabilities and strongly recommend applying a simplified approach by setting a single (common) market credit shock by currency for all the Balance Sheet items. A few respondents suggest considering asset securities as a starting point, while the supervisory authority could still assess the other balance sheet items for CSRBB relevance in specific cases and/or business models. A few respondents suggest leaving at the consideration of banks the potential inclusion of products different than fair value assets according to the identification or existence of CSRBB. Some respondents ask whether CSRBB risks from the asset and liability side must be assessed separately or in a net basis, and suggest providing guidance on this matter. One respondent asked for further clarification on the expectations of paragraph 159 [paragraph 158 of the final guidelines]. where it is mentioned that institutions should, in relation to both economic value and net interest income based measures of CSRRBB, take into account the implications of accounting practices for the measurement of CSRBB, and in particular hedge-accounting effectiveness. provisions related to the monitoring of CSRBB (item 4.6) those cases where a general market-credit and/or market-liquidity spread obtained from observable markets (e.g., benchmark indexes) well may be a pragmatic approach representing the minimum compensation sought by risk-averse market participants for the market price for credit risk, for liquidity and for potentially other characteristics of credit-risky instruments (either bonds, loans or other kind of “marketable” or “non￾marketable” instrument), in situations in which there is little, if any, market for the particular asset or liability. From an NII perspective, and again in the context of the provisions related to the monitoring of CSRBB (section 4.6), institutions might assess certain products (e.g., Loans, deposits) where the margins in new business are under control of the bank and consider if it may be reasonable to introduce other drivers or assumptions which reflect potential lower correlations between administered rate margins and general market spreads.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 80 Comments Summary of responses received EBA analysis Amendments to the proposals Perimeter: Derivatives Some respondents suggest clarifying the treatment of derivatives in the assessment of CSRBB. A few respondents suggest derivatives hedging CSRBB should be included in the scope, while other hedging derivatives in the Banking Book - which are typically collateralized - should not be subject to CSRBB as already subject to the Counterparty Credit Risk framework. One respondent suggests credit derivatives should generally be included in scope, while other respondents suggest derivatives do not have a credit spread element and ask for examples of CSRRB in interest rate, currency and credit risk derivatives. The EBA welcomes the comments and wishes to clarify that any overlapping or inconsistency with the Counterparty risk and/or the CVA framework is not intended and should be avoided. Indeed, no overlap with the counterparty credit risk framework exists since, as part of the credit risk, it is already excluded with the explicit exclusion in the Guidelines of the idiosyncratic risk. A new paragraph has been included in the GL aiming to clarify the point related to the credit valuation adjustment risk. A new sentence has been incorporated after paragraph 121: “Institutions should avoid any overlap with the credit valuation adjustment risk management framework when assessing the CSRBB.” Perimeter: Non-Performing Exposures One respondent asks whether non-performing exposures should be considered in the perimeter of CSRBB or not. The EBA would like to clarify that the intention was to exclude non-performing exposures due to the difficulties to calculate credit spreads in these exposures and for comparability purposes. Paragraph 122 has been amended as follows: “CSRBB excludes instruments under default situation non￾performing exposures”. Perimeter: Pension obligations and pension plan assets A few respondents suggested pension obligations and pension plan assets must be out of the scope of CSRBB and asked for clarification on this matter. The EBA notes the comments, and wishes to clarify that institutions may exclude positions from the perimeter of CSRBB if demonstrated to be insensitive to CSRBB following paragraph 124 of the GL. No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 81 Comments Summary of responses received EBA analysis Amendments to the proposals Definition of market Several respondents suggest that by definition, the scope of CSRBB is limited to those instruments with exposure to market credit and market liquidity spread risk and observable credit spread activity. Respondents consider the perimeter should therefore be explicitly reduced to this definition, in particular to instruments negotiated in active and liquid markets. One respondent considers that the word “market” used in the definition of CSRBB may be misleading and suggests clarifying the definition. One respondent considers unclear the impact of the change introduced to the definition of CSRRBB with respect to current EBA GL and whether a material change is intended. The EBA notes the comments, and wishes to clarify that the definition of CSRBB is not intended to explicitly reduce the perimeter to instruments only negotiated in active and liquid markets. In this regard, the word “market” may refer under a value perspective, to either a reference liquid market generally used for pricing a particular kind of asset or liability, or, in the absence of such a market, to the assumptions market participants would use when pricing the asset or liability, including assumptions about risk (e.g., credit and or liquidity premiums). From an NII perspective, regarding changes in coupon payments caused by changes in spreads, the word “market” may refer, depending on the kind of product, for instance to reference organized markets (e.g., for Liquid Bonds), or to other kind of market (e.g., Retail markets) that may not be particularly organized nor directly accessible through trading platforms, but still observable (e.g., Retail Loans and Deposits). In the absence of such a market reference, the word “market” may also refer to assumptions market participants would use when setting spreads to assets or liabilities, including assumptions about risk (e.g., credit and or liquidity premiums). No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 82 Comments Summary of responses received EBA analysis Amendments to the proposals Net interest income in CSRBB Some respondents raise general questions on what should be the treatment of credit spreads in the net interest income measure. The EBA notes the comment and as highlighted in the CP through an explanatory box, under the NII perspective, CSRBB embed changes in coupon payments caused by changes in credit spreads stemming from existing positions and new business assumptions (i.e., through the impact on revised spreads, coupons and premiums paid). Additionally, institutions should also consider the effects of changes in the fair-value due to credit spread changes. No changes made. CSRBB Own Liabilities Some respondents ask for clarification on what are the expectations in terms of the changes in credit spread affecting to the bank’s own liabilities. The EBA notes the comments and wishes to clarify that changes in the general market credit and liquidity spreads may also affect banks own liabilities, both from an EVE and NII perspective. It should be considered that according to the definition, CSRRB does not include idiosyncratic nor migration risks. In this context, and by the same definition, the deterioration of an institution’s credit quality should not have an impact in the credit spread risk measures (c.f. par. 121). No changes made. CSRBB Risk Management A few respondents suggest the EBA to clarify the goal and expected use of the CSRBB assessment. Some respondents consider is not clear how the risk measures and controls on a wider perimeter would be beneficial in the steering process of the banking book nor what would be the added value. A few respondents are concerned about potential distortions in the way banks will define their The EBA notes the comments and wishes to clarify that the proposed framework seeks assessing the credit spread risk both from an EVE and NII perspective – in line with the CRDV mandate – and not only under normal, but under exceptional and stressed situations (c.f. par 131b and 139d). The current wording of the guidelines is deemed to leave sufficient room for institutions to develop their own risk management framework for CSRBB, in No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 83 Comments Summary of responses received EBA analysis Amendments to the proposals strategies and provide credit to the market. One respondent considers that with a wide perimeter, CSRBB mitigants could significantly impact the credit creation given that they can’t be managed via financial instruments. One respondent expects a considerable increase in the costs of compliance (e.g compliance of mitigation actions on retail loans). Another respondent suggested that while CSRBB must be measured and steered, the specific design including integrated or isolated measurement should be up to the banks and suggests reflecting this aspect in the final text. terms of risk management strategy and steering of the banking book. Conceptual, Operational challenges and proportionality Several respondents consider that the proposed wider perimeter will imply significant conceptual and operational challenges and would result in material changes to the IT systems, evaluations and methodologies, while requiring a considerable effort in time and investments. Some respondents refer to changes hardly feasible to implement, while others don’t see clear added value in terms of assessing CSRBB for a wide perimeter of assets and liabilities. Some respondents consider developing and implementing a whole CSRBB process for instruments that are never traded (i.e., institution retail deposit base) or seldom traded (loan portfolio) seems pointless for improving interest rate risk management process. The EBA notes the comments and wishes to clarify that a wide perimeter – including assets and liabilities - is proposed for CSRBB since the evaluation of the credit spread risk is expected from both an EVE and NII perspective – in line with the CRDV mandate. The EBA acknowledges that in practice a wider perimeter may be conceptually and operationally challenging, more in particular for institutions seeking more advanced methodologies for the assessment of the CSRBB. The EBA wishes to clarify that positions sensitive to CSRBB – also those that may be considered part of another risk measure - should in principle be included in the assessment of CSRBB (as per paragraph 124). No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 84 Comments Summary of responses received EBA analysis Amendments to the proposals Some respondents suggest the possibility to perform materiality assessments to exclude positions which turn to be immaterial without the necessity of cumbersome verifications. Others suggest to introduce the possibility to exclude positions if the institution can demonstrate that the respective risk is already measured and manage elsewhere (e.g., in credit risk). Some respondents consider the approach to document and justify exclusions would be cumbersome and time-consuming. Respondents ask for a pragmatic approach and recommend enhancing the application of the principle of proportionality in this case. One respondent suggests EBA to identify classes of products that may be excluded from the CSRBB assessment. Some respondents consider the need to document and justify the exclusion of instruments would be in fact a requirement that would apply to a large part of instruments in the banking book. One respondent believes the current framework is too complex and challenging to implement for smaller institutions with non-complex operations and limited market risk exposure. Another respondent recommends allowing the introduction of a threshold to ensure that small banks, and more generally banks with immaterial risk exposures, can be excluded from the CSRBB calculation process. Some respondents suggest the EBA to clarify if, and how, a principle of proportionality could apply to banks for which the majority of instruments in their Any diversification with other risk measures potentially affecting other processes (e.g., business and/or liquidity risk) are not part of the mandate. The EBA wishes to clarify the intention of excluding idiosyncratic spread, as suggested by the Basel Standards, is to avoid overlapping with the credit risk framework. Regarding proportionality, the EBA considers section 4.1.2 provides sufficient guidance and flexibility for institutions to apply proportional measures in the assessment and monitoring of CSRBB.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 85 Comments Summary of responses received EBA analysis Amendments to the proposals BB do not trade in deep and liquid markets and have no close substitutes. Level playing field Some respondents suggest that a wider and open perimeter for CSRBB allows for differences in interpretation which would lead to an unlevelled playing field for European banks, while one respondent suggests that enlarging the perimeter would expose EU banks to a competitive disadvantage also towards other jurisdictions. One respondent suggests the EBA to identify classes of products that may be excluded from the CSRBB assessment, as to better ensure the level playing field. A Couple of respondents suggest a clearly defined perimeter (e.g., a standardised framework) may help ensure consistency. The EBA notes the comments and considers that the GL makes a significant progress in terms of the definition of the CSRBB risk, with further clarification on elements to be considered or not as part of the risk assessment. Moreover, the EBA opinion is that the current wording of the guidelines leaves sufficient room for institutions to develop their own risk management framework for CSRBB, for what is meant to be a Pillar 2 risk. For this matter, a standardized framework for CSRBB is not being proposed. No changes made. Capital Requirements for CSRBB A few respondents raised doubts on how CSRRB will be taken into account in the context of capital requirements and show concerns in the fact that extending the perimeter to the whole banking book could lead to a significant impact in terms of Pillar 2 internal capital. The EBA notes the comments and wish to clarify that the CRDV mandate for the EBA to develop the guidelines refers in particular to the assessment and monitoring of the CSRRBB. Providing guidance on capital adequacy is therefore out of scope of the mandate. No changes made. Overlap of CSRBB in NII with Business Risk and/or Liquidity Risk Some respondents consider that the proposed definition and perimeter of CSRBB may overlap with the measurement of Business Risk as it takes into account, among other factors, the margin compression. One respondent suggests clarifying that no capital requirements should be derived The EBA notes the comments and wishes to clarify that, in the context of the provisions related to the monitoring of CSRBB (section 4.6), the GL introduces in the possibility for institutions to consider diversification assumptions between CSRBB and Paragraph 159 has been amended as follows: “In any case institutions should have separate

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 86 Comments Summary of responses received EBA analysis Amendments to the proposals from the NII impacts in CSRBB, as to avoid double￾counting. One respondent suggests there is also overlap with Liquidity risk. other risks if the reliability and stability of diversification assumptions are appropriately validated and documented. In any case institutions should have separate assessments of CSRBB and other risks, including IRRBB. The GL has been amended to include further clarification on this matter. The EBA wish to clarify also that providing guidance on capital adequacy is out of scope of the CRD V mandate. assessments of CSRBB and IRRBB and other risks (including IRRBB)”. Question 5. Is the separation of IRRBB and CSRBB sufficient to understand where the Guidelines apply to: • IRRBB only • CSRBB only • Both IRRBB and CSRBB? Scope of the Guidelines A few respondents highlighted a discrepancy between Article 84(6) Directive 2013/36/EU (CRD) and paragraph 14 of the Guidelines [paragraph 13 of the final guidelines], where the latter prescribes to institutions also managing and mitigating CSRBB. Institutions are required to monitor and assess CSRBB, however, the management and control of CSRBB are implicit. The management and control of CSRBB is supported by Article 74 of the Directive 2013/36/EU (CRD). There is no reference to mitigation of CSRBB in paragraph 14 [paragraph 13 of the final guidelines] or anywhere else in the guidelines. No changes made. Net interest income One respondent asked if the NII definition (encompassing interest income, interest expenses Paragraph 15 [paragraph 14 of the final guidelines] of the Guidelines provides a common definition of No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 87 Comments Summary of responses received EBA analysis Amendments to the proposals and market value changes) is common for both IRRBB and CSRBB. Many respondents recommended maintaining a restricted definition of NII (interest income and interest expenses) excluding market value changes also considering that the expanded definition is too complex to be implemented and would generate an overlap between NII and EVE metrics. net interest income upon which to calculate the impact of interest rate or credit spread movements. The 2018 Guidelines follow an earnings definition. Paragraph 14 of the 2018 guidelines states that institutions should consider not only the effects on interest income and expenses, but also the effects of the market value changes of instruments. The EBA considers that interest income, interest expenses and market value changes of fair value instruments should be considered in the assessment of the impact on the net interest income. In the case where any of these elements is not considered, institutions might not be capturing a material part of their IRRBB or CSRRBB exposures. Inflation It was also noted that the treatment of inflation behaviour as scenario independent premise is not adherent to real life evidence, considering that usually inflation is highly correlated with interest rates levels. The EBA takes note and acknowledges the comment that inflation and interest rates correlation should be able to be considered in banks’ internal systems and would like to amend the guidelines consistently. However, the scenario independence assumption remains in the draft RTS on supervisory outlier tests for comparability purposes. Paragraph 105 of the Guidelines [paragraph 104 of the final guidelines] has been amended as follows: “In assessing the risk of interest rate￾sensitive products that are linked to inflation or other market factors, prudent assumptions should be applied. These assumptions can be based, for instance, on the current/last observed

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 88 Comments Summary of responses received EBA analysis Amendments to the proposals value, on forecasts of a reputable economic research institute or on other generally accepted market practices (in the case of inflation: forward inflation expectation curves, for instance) and should be generally scenario￾independent”. Economic value measure for IRRBB A respondent suggested to amend paragraph 82 of the guidelines [paragraph 81 of the final guidelines] in order to include different methodologies between more and less complex product that overall produce a consistent output across all interest rate sensitive instruments and all business units, instead of the current formulation that mentions a unique methodology. The EBA acknowledges that complex instruments may require more sophisticated methodologies. The reference to a consistent methodology is not meant as a single/unique methodology, rather it implies the use of consistent methodologies that consider the risk sensitivity and the characteristics of the exposures. No changes made. CSRBB governance One respondent suggested that also for CSRBB there should be the possibility for the management body to delegate its responsibilities as for IRRBB. Paragraphs 130 and 131 in section 4.5.3 CSRBB governance and strategy, provide details on the responsibilities of the management body or its delegates. Additional references for management body to be able to delegate its responsibility for CSRBB as for IRRBB have been introduced. The following amendments have been made: Paragraph 130(a) “That their management body bears the ultimate responsibility for the oversight of the CSRBB management

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 89 Comments Summary of responses received EBA analysis Amendments to the proposals framework and the institution’s risk appetite framework to adequately cover the risks. The management body may, however, delegate the monitoring and management of CSRBB to senior management, expert individuals or an asset and liability management committee under the conditions further specified in paragraph 132. Paragraph 131: “The management body or its delegates […]” Interaction between IRRBB and CSRBB A few respondents asked EBA to clarify if CSRBB and IRRBB should be managed separately and to provide examples of diversification benefits between the two risks. With reference to the first point a respondent asked: • if separated NII simulations for shift of yield curves and for spread shifts should be considered as well as separate The specific measurement of CSRBB is out of scope of the Guidelines. Institutions are required to monitor and assess credit spread risk, and to identify, evaluate, manage and mitigate interest rate risk. Institutions should have separate assessments of credit spread risk and interest rate risk. The EBA deems it overly prescriptive to provide examples of potential diversification benefits between CSRBB and IRRBB. The EBA considers that No changes made.

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 90 Comments Summary of responses received EBA analysis Amendments to the proposals measurement of IRRBB and CSRBB for net present value. • What the baseline and stress scenarios should look like. A respondent proposed to combine all the paragraphs that are valid for both IRRBB and CSRBB into one individual guideline while having a specific section for CSRBB only. institutions may investigate whether potential diversification benefits exist between their CSRBB and IRRBB. The EBA acknowledges that some paragraphs are repeated for both IRRBB and CSRBB. In drafting the guidelines, the EBA considered combining the paragraphs that are valid for both IRRBB and CSRBB into one individual guideline. Nevertheless, for the purposes of clarity and to allow a full understanding, separate sections were created in the guidelines to describe each risk in full. Others Some respondents highlighted the provisions for CSRBB are not so detailed as for IRRBB, for example there is no annex describing measurement methods or a sophistication matrix, asking for a clearer and proportionate expectation (based on bank’s size and/or complexity) regarding the implementation of the guideline or to reconsider the regulatory expectation for IMSs capabilities. A respondent recommended to cancel the indication in paragraph 126 of a separate strategy for CSRBB since it is normally assessed as a part of the overall IRRBB and CSRBB strategy. The limited specifications for CSRBB compared to IRRBB are due to legal mandates. For IRRBB the requirements for institutions are to measure, monitor and control IRRBB but to assess and monitor CSRBB. The extended requirements for IRRBB are supported in the annex to the guidelines. Since the specific measurement of CSRBB is out of scope of the guidelines, the guidelines do not specify any expectations on this topic. Credit spread risk is a separate risk from interest rate risk. An institution should be able to identify those elements of its governance and strategy that are specific to CSRBB and distinct from IRRBB. No changes made. Application of the Guidelines Some respondents highlighted that the Guidelines introduce significant innovations in particular on CSRBB and on the definition of NII and based on this suggest a delayed introduction of the text. The EBA notes the comments and acknowledges that the updated guidelines may require significant undertakings to implement the new CSRBB related approaches and definitions. In this regard, the implementation date of the Guidelines is delayed to The implementation date of the Guidelines is delayed to 31 December 2023 for the parts related to

FINAL REPORT ON GUIDELINES ON THE MANAGEMENT OF INTEREST RATE RISK AND CREDIT SPREAD RISK ARISING FROM NON-TRADING BOOK ACTIVITIES 91 Comments Summary of responses received EBA analysis Amendments to the proposals 31 December 2023 for the parts related to CSRBB (6 more months than the implementation date of the IRBBB related parts). This timeline is based on an estimation of the final adoption of the regulatory technical standards on the Supervisory Outlier Tests and on the Standardized Approach, that have been published concomitantly to these Guidelines, seeking consistent application dates. CSRBB (6 more months than the implementation date of the IRBBB related parts).