Final Report on Guidelines on common procedures and methodologies for SREP and supervisory stress testing

GL ON COMMON PROCEDURES AND METHODOLOGIES FOR SREP AND SUPERVISORY STRESS TESTING EBA/GL/2022/03 18 March 2022 Final Report Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing under Directive 2013/36/EU

Contents
Executive summary 6
Background and rationale 8
Guidelines 16
Compliance and reporting obligations 18
Status of these guidelines 18
Reporting requirements 18
Subject matter, definitions, level of application and implementation 19
1.1. Subject matter 19
1.2. Definitions 19
1.3. Level of application 23
1.4. Date of application 24
1.5. Repeal 24
The common SREP 25
2.1. Overview of the common SREP framework 25
2.2 Scoring in the SREP 29
2.2.1 Risk scores 29
2.2.2 Viability scores including an overall SREP score 30
2.3 Organisational arrangements 31
2.4 Proportionality and supervisory engagement 32
2.4.1 Category 1 institutions 33
2.4.2 Category 2 institutions 33
2.4.3 Category 3 institutions 33
2.4.4 Category 4 institutions 34
2.4.5 Minimum requirements for supervisory engagement 34
2.4.6 Focus and granularity of the assessment 36
Monitoring of key indicators 37
Business model analysis 39
4.1 General considerations 39
4.2 Preliminary assessment 41
4.3 Identifying the areas of focus for the BMA 42
4.4 Assessing the business environment 42
4.5 Analysis of the current business model 43
4.5.1 Quantitative analysis 43
4.5.2 Qualitative analysis 44
4.6 Analysis of the strategy and financial plans 45
4.7 Assessing business model viability 45

4.8 Assessing the sustainability of the institution’s strategy 46
4.9 Identification of key vulnerabilities 47
4.10 Summary of findings and scoring 47
Assessing internal governance and institution-wide controls 50
5.1 General considerations 50
5.2 Overall internal governance framework 51
5.3 Organisation and functioning of the management body 52
5.4 Corporate values and risk culture 53
5.5 Remuneration policies and practices 54
5.6 Internal control framework 55
5.7 Risk management framework 58
5.7.1 Risk appetite framework and strategy 59
5.7.2 ICAAP and ILAAP frameworks 59
5.7.3 Assessment of institutions’ stress testing 62
5.7.4 New products and significant changes 66
5.8 Information and communication technologies and business continuity management 66
Assessing risks to capital 74
6.1 General considerations 74
6.2 Assessment of credit and counterparty risk 76
6.2.1 General considerations 76
6.2.2 Assessment of inherent credit risk 77
6.2.3 Assessment of credit risk management and controls 88
6.2.4 Summary of findings and scoring 95
6.3 Assessment of market risk 97
6.3.1 General considerations 97
6.3.2 Assessment of inherent market risk 98
6.3.3 Assessment of market risk management and controls 101
6.3.4 Summary of findings and scoring 107
6.4 Assessment of operational risk 109
6.4.1 General considerations 109
6.4.2 Assessment of inherent operational risk 110
6.4.3 Assessment of reputational risk 116
6.4.4 Assessment of operational risk management, measurement and controls 118
6.4.5 Summary of findings and scoring 124
6.5 Assessment of interest rate risk arising from non-trading book activities 126
6.5.1 General considerations 126
6.5.2 Assessment of inherent IRRBB 127
6.5.3 Assessment of IRRBB management and controls (both risk management and
compliance, and internal audit control functions) 131
6.5.4 Summary of findings and scoring 136
SREP capital assessment 139

7.1 General considerations 139
7.2 Determining additional own funds requirements for risks other than the risk of excessive
leverage 140
7.2.1 Determining additional own funds to cover unexpected losses 140
7.2.2 Determining own funds or other measures to cover model deficiencies 144
7.2.3 Determining own funds or other measures to cover other deficiencies 145
7.2.4 Determining the composition of additional own funds requirements 145
7.3 Additional own funds requirements for the risk of excessive leverage 145
7.3.1 Assessment of risk of excessive leverage 146
7.3.2 Determination of additional own funds requirement to address the risk of excessive
leverage 147
7.3.3 Composition of additional own funds requirement to address the risk of excessive
leverage 148
7.4 Reconciliation with the capital buffers and any macroprudential requirements 148
7.5 Determining the TSCR, TSLRR, OCR and OLRR 148
7.6 Articulation and justification of own funds requirements 150
7.7 Meeting requirements in stressed conditions 152
7.7.1 Using P2G to address the quantitative outcomes of stress testing 153
7.7.2 Capital planning and other supervisory measures to address capital adequacy in
stressed conditions 157
7.8 Summary of findings and scoring 158
Assessing risks to liquidity and funding 161
8.1 General considerations 161
8.2 Assessing liquidity risk 163
8.3 Assessing inherent funding risk 167
8.4 Assessing liquidity and funding risk management 171
8.5 Summary of findings and scoring 182
SREP liquidity assessment 186
9.1 General considerations 186
9.2 Overall assessment of liquidity 186
9.3 Determining the need for specific liquidity requirements 188
9.4 Determination of specific quantitative liquidity requirements 188
9.5 Articulation of specific quantitative liquidity requirements 192
9.6 Summary of findings and scoring 194
Overall SREP assessment and application of supervisory measures 197
10.1 General considerations 197
10.2 Overall SREP assessment 198
10.3 Application of capital measures 201
10.4 Application of liquidity measures 202
10.5 Application of other supervisory measures 202

10.6 Supervisory reaction to a situation where TSCR or OCR is not met 211
10.7 Supervisory reaction to a situation where P2G is not met 211
10.8 Interaction between supervisory and early intervention measures 213
10.9 Interaction between supervisory and macroprudential measures 213
10.10 Interaction between supervisory and AML/CFT measures 213
Application of the SREP to cross-border groups 215
11.1 Application of the SREP to cross-border groups 215
11.2 SREP capital assessment and institution-specific prudential requirements 217
11.3 SREP liquidity assessment and institution-specific prudential requirements 219
11.4 Application of other supervisory measures 219
Supervisory stress testing 221
12.1 Use of supervisory stress testing by competent authorities 221
12.2 Key elements of supervisory stress testing 222
12.3 Organisational and governance arrangements within competent authorities 223
12.4 Process and methodological considerations 225
Annexes 227
Annex 1. Operational risk, examples of the link between losses and risk drivers 227
Annex 2. Key features and differences between P2R and P2G 228
Accompanying documents 230
1.1 Draft cost-benefit analysis / impact assessment 230
I. Introduction 230
II. Policy objectives 230
III. Baseline scenario 231
IV. Options considered 231
V. Impact assessment (data collection) 237
1.2 Feedback on the public consultation and on the opinion of the BSG 244

Executive summary
These guidelines, drawn up pursuant to Article 107(3) of Directive 2013/36/EU, are addressed to competent authorities and are intended to promote common procedures and methodologies for the supervisory review and evaluation process (SREP), which is an ongoing supervisory process bringing together findings from all supervisory activities into a comprehensive supervisory overview of an institution. These guidelines also aim to achieve convergence of practices followed by competent authorities in supervisory stress testing across the EU in accordance with Article 100 of Directive 2013/36/EU. The EBA has developed these revised SREP Guidelines in order to implement the changes brought by Directive (EU) 2019/878 amending Directive 2013/36/EU and Regulation (EU) 2019/876 amending Regulation (EU) No 575/2013. The revision of the SREP Guidelines, while keeping the original framework with the main SREP elements intact, reflects the amendments at Level 1, which include, among other things, the introduction of the assessment of the risk of excessive leverage and the revision of the methodology for the determination of the Pillar-2 Guidance. This revision is also aimed at aligning the text with other relevant guidelines, technical standards, as well as enhancing the guidance by incorporating identified best practices. Additional relevant changes are related to the enhancement of the principle of proportionality as well as the encouragement of cooperation among prudential supervisory authorities and AML/CFT supervisors, as well as resolution authorities. The common SREP framework presented in these guidelines is built on:
a. business model analysis; b. assessment of internal governance arrangements and institution-wide controls;
c. assessment of risks to capital and adequacy of capital to cover these risks; and
d. assessment of risks to liquidity and adequacy of liquidity resources to cover these risks. Regular monitoring of key indicators is used to identify material changes in the risk profile and to support the SREP framework. The specific elements of the SREP framework are assessed and scored on a scale of 1 to 4. The outcome of the assessments, both individually and considered as a whole, forms the basis for the overall SREP assessment, which represents the up-to-date supervisory view of the institution’s overall viability. It should also form the basis for supervisory measures and dialogue with the institution. These guidelines make a link between ongoing supervision, as addressed in Directive 2013/36/EU, and determining whether the institution is ‘failing or likely to fail’, as addressed in Directive 2014/59/EU. This is through the SREP assessment of the institution’s viability, as measured by the overall SREP assessment and the overall SREP score. The overall SREP score has four positive grades to be applied to viable institutions (1 to 4) and one negative grade (‘F’) indicating that the

competent authority has determined that the institution is ‘failing or likely to fail’ within the meaning of Article 32 of Directive 2014/59/EU, which activates the procedure for interaction with resolution authorities stipulated in that Article. These guidelines recognise the principle of proportionality by:
a. categorising institutions in four distinct categories according to their systemic importance and the extent of any cross-border activities; b. building a minimum supervisory engagement model, where the frequency, depth and intensity of the assessments vary depending on the category of the institution; and
c. providing further clarifications on the application of the proportionality principle in
the context of the assessment of some specific sources of risks.
The minimum engagement model also helps to structure the dialogue with institutions to assess the individual SREP elements and the overall SREP assessment. These revised guidelines are issued to update the latest version of the Guidelines, whose provisions will be repealed and replaced by these guidelines. Next steps The guidelines will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report whether they comply with the guidelines will be 2 months after the publication of the translations. The guidelines will apply from 1 January 2023.

Background and rationale
The EBA is mandated to foster sound and effective supervision and to drive supervisory convergence across the EU arising from the requirements specified in Directive 2013/36/EU (CRD) and more generally from its obligations under its founding regulation. The Supervisory Review and Evaluation Process (SREP) is one of the main tools for supervision, through which competent authorities form a comprehensive view on the risk profile of the institutions, as well as on their overall viability and sustainability, and may impose adequate supervisory measures to ensure material risks are properly addressed.
Article 107 of the CRD mandates the EBA to draft guidelines for competent authorities, specifying
the common procedures and methodologies for the SREP and for the assessment of the organisation and treatment of risks referred to in Articles 76 to 87 of the CDR, in a manner that is appropriate to the size, structure and internal organisation of institutions, and the nature, scope, and complexity of their activities. Additionally, Article 100(2) of the CRD empowers the EBA to issue guidelines to ensure that common methodologies are used by competent authorities when conducting annual supervisory stress tests for SREP purposes. Based on that mandate, the EBA’s primary objective for the guidelines is the improvement of the quality and consistency of SREP practices, and consequently, of their outcomes. The consequences of the adoption of the guidelines should be that institutions with similar risk profiles, business models and geographic exposures are reviewed and assessed by competent authorities consistently and subject to broadly equivalent supervisory expectations, actions and measures, where applicable, including institution-specific prudential requirements. To achieve this objective, in addition to specifying the SREP procedures and methodologies, these guidelines also provide guidance for subsequent supervisory measures that competent authorities should consider, as specified in the CRD. In accordance with Article 16 of Regulation (EU) No 1093/2010, the EBA issues guidelines addressed to competent authorities, with a view to establishing consistent, efficient and effective supervisory practices and ensuring that there is common, uniform, and consistent application of European Union law. The aim of these guidelines is to ensure the harmonisation of the SREP framework, while not imposing restrictive granular SREP procedures and methodologies, as this would not be in line with the CRD, mandating the drafting of guidelines rather than of binding technical standards. Competent authorities should, however, apply these guidelines in a way that will not compromise intended harmonisation and convergence thereof, particularly ensuring that high supervisory standards are implemented in the EU and that there is no room for supervisory arbitrage. These guidelines set out the common SREP framework, taking into account the requirements of Regulation (EU) 575/2013 (CRR) and the CRD, ensuring consistency with other EU regulatory products including other EBA guidelines, as well as considering the outcomes of the EBA monitoring and assessment of convergence and supervisory practices, as requested by Article 107 of the CRD.

The SREP Guidelines were first published in December 2014 and became applicable since January
2016. The first update took place in 2017 and the revised Guidelines became applicable since 2019.
The second review carried out in 2021 aims at aligning the Guidelines with other regulatory developments that took place since the latest revision of the SREP Guidelines. In particular, these revised guidelines take into account changes stemming from Directive (EU) 2019/878 amending the CRD and Regulation (EU) 2019/876 amending the CRR, as well as the issuance by the EBA of other relevant guidelines and technical standards. The cyclical nature of the SREP assessment advocates the overall SREP framework to be applicable at the beginning of a SREP cycle. Against this background, considering that the SREP cycle often corresponds to a calendar year, these guidelines apply from 1 January 2023. However, competent authorities are encouraged to consider the revised guidance and introduce into the current cycle as many elements as possible. The common SREP framework The common SREP framework is built around the following major components (as presented in
Figure 1):
Figure 1. Overview of the common SREP framework

Categorisation of institutions:
The application of the principle of proportionality in the SREP is driven by the categorisation of institutions, the minimum engagement model, as well as targeted flexibility allowing for adjusted granularity of assessments. The categorisation of institutions into four categories should be based

on their size, risk profile, structure, internal organisation, scope and on the nature and complexity of their activities. Such categorisation impacts the minimum engagement level, graduating the frequency of assessment, which drives the dialogue with the institution for the purposes of assessing individual SREP elements and the overall SREP assessment. In addition, the categorisation takes into account the definitions of small and non-complex institutions as well aslarge institutions, as set out in the CRR, to ensure consistency in the scope of application of proportionality within the overall regulatory framework.
2. Monitoring of key indicators:
Regular monitoring of key quantitative and qualitative indicators supports the SREP by flagging changes in the institution’s financial conditions and risk profile. Such monitoring should prompt updates to the assessment of the SREP elements where it highlights new material information outside of planned supervisory activities.
3. Business model analysis:
Without undermining the responsibility of the institution’s management body for organising and running its business, the supervisory business model analysis should be the assessment of the viability of the current business model and the sustainability of the strategic plans. This analysis should also assist in revealing key vulnerabilities the institution is facing that may not be revealed by other elements of the SREP, including vulnerabilities stemming from ML/TF and ESG risks. Such analysis does not aim to rank the institutions’ various business models.
4. Assessment of internal governance and institution-wide controls:
As part of the overall governance assessment, competent authorities should determine whether the internal governance framework of an institution is adequate given its risk profile, size, nature and complexity, and whether the institution sufficiently adheres to the requirements and standards of good internal governance and risk controls arrangements, including aspects such as diversity, non-discrimination and sound code of conduct. As part of the risk management framework, competent authorities should review the institution’s internal capital adequacy assessment process (ICAAP) and internal liquidity adequacy assessment process (ILAAP). The assessment should focus on the soundness, effectiveness and comprehensiveness of these processes, as well as on the reliability of the institution’s internal estimates to support the supervisory determination of capital and liquidity adequacy. Furthermore, competent authorities should also assess the adequacy of institution’s stress testing programmes, including scenarios and assumptions, and outcomes.
5. Assessment of risks to capital:
The SREP Guidelines provide guidance for the assessment of the most common risks to capital, encompassing credit and counterparty risk, market risk, operational risk and interest rate risk from non-trading activities (IRRBB), further split into sub-risk categories. Competent authorities should focus their assessment on the material risks the institution is or might be exposed to, including any

additional institution-specific risks that are not described in detail in the guidelines. The assessment should be performed in terms of the risk exposure as well as the quality of management and controls employed to mitigate the impact of the risk.
6. Assessment of the adequacy of institution’s own funds:
Since an institution may face risks that are not covered or not fully covered by the own funds requirements in accordance with the CRR or the capital buffers specified in the CRD, the SREP Guidelines include guidance on the determination of the quantity and composition of additional own funds requirements (P2R) determined to cover such risks, emphasising on their institutionspecific nature. As a separate stack of own funds requirements, the SREP Guidelines also include guidance on the assessment of the risk of excessive leverage and on the determination of the quantity and composition of additional own funds required to cover that risk (P2R-LR). Such P2R and P2R-LR should be set in a legally binding way, and institutions should be expected to meet them at all times. The determination of P2R and P2R-LR should be duly justified to institutions. Aiming to enhance the supervisory dialogue, the SREP Guidelines include guidance on the minimum scope of information and justification of the results of the SREP to be provided to institutions. Separate justification is expected for the leverage ratio capital layer and the risk-based capital layer. Where the outcomes of the relevant stress tests suggest that an institution may not be able to meet the applicable own funds requirements under stress conditions, or is excessively sensitive to the assumed scenarios, competent authorities should take appropriate supervisory measures to ensure the institution is adequately capitalised, including the imposition of guidance on additional own funds, separately, to address the risk of excessive leverage and other risks (P2G-LR and P2G). The SREP Guidelines provide guidance clarifying the setting of the P2G and P2G-LR, encompassing both the use of the results of the stress tests, where the maximum anticipated stress test impact should be considered, and possible adjustments depending on institution-specific circumstances. As P2G and P2G-LR are positioned above the combined buffer requirements, a failure to meet such requirements does not trigger automatic restrictions on distribution provided for in Article 141 of the CRD. To increase convergence and level the playing field between institutions, the SREP Guidelines specify the quality of capital competent authorities should require institutions to hold to meet their guidance on additional own funds, CET1 capital for P2G coverage, and Tier 1 for P2G-LR coverage, respectively.
7. Assessment of liquidity and funding risks:
The SREP Guidelines provide guidance for the assessment of the risks to liquidity and funding the institution is or might be exposed to over various time horizons, as well for the related risk management controls. Competent authorities should focus their assessment on risks identified as material for the institution.

Assessment of the adequacy of the institution’s liquidity and funding resources:
Competent authorities should determine whether the liquidity resources held by the institution ensure an appropriate coverage of risks to liquidity and funding, where applicable, taking adequate supervisory measures. Among such measures, competent authorities may consider imposing specific liquidity requirements to address concerns related to the institution’s liquidity and funding resources.
Overall SREP assessment and application of supervisory measures:
Having conducted the assessment of the above SREP elements, competent authorities should form a comprehensive overview of the risk profile and viability of the institution concluding with the overall SREP assessment. Competent authorities should also consider any necessary supervisory measures to address concerns. These Guidelines provide practical guidance on the application of the supervisory measures listed in Articles 104a and 105 of the CRD, including the application of institution-specific additional own funds and liquidity requirements, as well as other measures of a qualitative nature. Scoring framework To help facilitate communication with the competent authorities and colleges of supervisors, foster comparability and a level playing field across institutions as well as to adequately prioritise supervisory resources and measures in the assessment of SREP elements, competent authorities should score from a range of ‘1’ (low risk) to ‘4’ (high risk), to reflect the supervisory view for reach element-specific title of the guidelines. Scores should be assigned based on supervisory judgement, taking into account assessment considerations provided in the guidelines. These guidelines introduce two types of scores, the first one indicating the likelihood that the risks to capital, liquidity and funding will have a significant impact on the institution, while the second type indicates the magnitude of risks to the institution’s viability to be applied to the four SREP elements and overall SREP score. These guidelines do not suggest any automatic link between the scores and the level of supervisory response, nor do they link additional own funds requirements to the scores.

Figure 2. Overview of the scoring framework
Link between SREP and other supervisory processes Competent authorities should reflect in the SREP assessment available information and outcomes from other supervisory activities, including on-site inspections, approvals of internal models, authorisation approvals, outcomes of supervisory stress testing, assessment of recovery and resolution plans, market conduct and consumer protection activities, AML/CFT activities, etc. Likewise, the findings from the SREP assessment should inform other supervisory processes. Such cross-utilisation of findings from various activities to inform each other allows for truly integrated analysis and supervision of institutions, enhancing overall supervisory overview of institutions, their viability and risks, as well as maximises synergies in various areas of assessments. These guidelines also identify the relevant building blocks required for an effective supervisory stress testing programme. They focus on different forms of supervisory stress testing and objectives, the respective use for SREP purposes, aspects related to the organisation, resources and communication, and possible methodologies. In particular, the supervisory stress testing section complements the assessment on capital adequacy by further clarifying and operationalising procedures for setting P2G and P2G-LR. Assessment of the risk of money laundering and terrorism financing These guidelines provide common guidance on how to factor in the anti-money laundering and countering the financing of terrorism AML/CFT-related aspects into the SREP. Such common guidance is important in view of the fact that failure to address money laundering and terrorist financing risks by institutions can have detrimental effects on the financial soundness of these institutions, the integrity of the internal market and financial stability as a whole. Therefore prudential supervisors should consider, to the extent known to them, ML/TF risks from a prudential

perspective throughout their work, including in the SREP, and cooperate with the authorities and bodies responsible for ensuring compliance with AML/CFT requirements under Directive (EU) 2015/849 in this respect. The requirement for institutions to have in place policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing, is set out in Directive (EU) 2015/849. Consequently, AML/CFT supervisors are responsible for supervising the institutions’ compliance with those requirements, in accordance with the risk-based approach, including that the policies, controls and procedures, which have been put in place by institutions are sufficiently robust to mitigate the ML/TF risks to which they are exposed. In addition, AML/CFT supervisors are also required to carry out their own ML/TF risk assessments of the sector and also individual institutions within the sector. Prudential competent authorities are tasked, within the SREP, with reviewing the arrangements, strategies, processes and mechanisms implemented by the institutions to comply with Directive 2013/36/EU and Regulation (EU) No 575/2013 and evaluate, inter alia, the risks to which the institution is or might be exposed. In view of the specific mandate and expertise of AML/CFT supervisors, which is not expected to be duplicated by prudential supervisors, the input of AML/CFT supervisors into the SREP with regard to ML/TF risks and how effectively they are managed by institutions is important. In addition to the information available to them, prudential competent authorities should also consider information concerning ML/TF risk and other relevant input received from the AML/CFT supervisors to the extent that it affects compliance with the requirements under Directive 2013/36/EU and Regulation (EU) No 575/2013. Conversely, deficiencies in governance requirements, uncovered by the prudential competent authorities, may also imply deficiencies in the AML/CFT policies, controls and procedures, which may be relevant for AML/CFT supervision and therefore cooperation between the AML/CFT and prudential supervisors is crucial. SREP is one example where the information from AML/CFT supervision may also be beneficial for prudential supervisors and vice versa. Therefore, the outcomes of the relevant ML/TF risk assessments or findings from inspections conducted by AML/CFT supervisors should feed into the SREP, where they relate to requirements assessed by the competent authorities under Directive 2013/36/EU and Regulation (EU) No 575/2013. In the meantime, where the SREP assessment of business models, operational risk, credit risk, liquidity and funding and internal governance and institution-wide controls reveals information related to the institutions’ exposure to increased ML/TF risks or the management of the ML/TF risk by institutions, the relevant information should be shared with AML/CFT supervisors to inform the supervision of the requirements
under Directive (EU) 2015/849, including the imposition of AML/CFT supervisory measures or sanctions. In addition Article 97(6) of Directive 2013/36/EU requires competent authorities to immediately notify the EBA and the relevant AML/CFT supervisors where their supervisory review, in particular the evaluation of the governance arrangements, the business model, or the activities of an institution, gives competent authorities reasonable grounds to suspect that, in connection with that institution, money laundering or terrorist financing is being or has been committed or attempted,

or there is increased risk in this regard. In the event of potential increased risk of money laundering or terrorist financing, competent authorities and AML/CFT supervisors should liaise with each other and notify their common assessment immediately to the EBA 1 . Link between the SREP and early intervention measures and resolution The SREP assessment may also be used in setting triggers for early intervention measures, as provided for in Article 27 of Directive 2014/59/EU (BRRD). It also allows for the determination of an institution as ‘failing or likely to fail’, which activates the formal interaction procedure with resolution authorities pursuant to Article 32 of that Directive. To this end, these guidelines should be read together with the EBA Guidelines on triggers for use of early intervention measures 2 and guidelines on the interpretation of the different circumstances when an institution shall be considered as failing or likely to fail 3 .
Figure 3. Link between ongoing supervision, early intervention and failing or likely to fail
The modalities for the cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units (FIUs) are set out in the EBA Guidelines on cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Directive 2013/36/EU (EBA/GL/2021/15). EBA Guidelines on triggers for use of early intervention measures (EBA/GL/2015/03). EBA Guidelines on the interpretation of the different circumstances when an institution shall be considered as failing or likely to fail (EBA/GL/2015/07).

Guidelines

EBA/GL/2022/03
18 March 2022
Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing

Compliance and reporting obligations
Status of these guidelines

This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No
1093/2010 4
. In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the guidelines.
Guidelines set the EBA view of appropriate supervisory practices within the European System
of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements
According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify
the EBA as to whether they comply or intend to comply with these guidelines, or otherwise with reasons for non-compliance, by ([dd.mm.yyyy]). In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website with the reference ‘EBA/GL/2022/03’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to EBA.
Notifications will be published on the EBA website, in line with Article 16(3).
Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJ L 331, 15.12.2010, p.12).

Subject matter, definitions, level of application and implementation
1.1. Subject matter
5. These guidelines specify the common procedures and methodologies for the functioning of the
supervisory review and evaluation process (SREP) referred to in Articles 97 and 107(1)(a) of Directive 2013/36/EU 5 , including those for the assessment of the organisation and treatment of risks, including money laundering and terrorist financing, referred to in Articles 76 to 87 of that Directive and processes and actions taken with reference to Articles 98, 100, 101, 102, 104, 104a, 104b, 104c, 105, 107(1)(b) and 117 of that Directive. In addition, these guidelines aim to provide common methodologies to be used by competent authorities when conducting supervisory stress tests in the context of their SREP as referred to in Article 100(2) of Directive 2013/36/EU.
6. These guidelines do not set methodologies for the stress tests conducted by the EBA in
cooperation with other competent authorities in accordance with Article 22 of Regulation (EU) No 1093/2010; however, they do describe the range of stress tests to help set the appropriate context for the consideration of future EBA stress tests as one part of the supervisory stress tests.
7. These guidelines are addressed to the competent authorities referred to in Article 4(2), points
(i) and (viii), of the EBA Regulation.
1.2. Definitions
8. Unless otherwise specified, terms used and defined in Regulation (EU) No 575/2013 6
, Directive
2013/36/EU, Directive 2014/59/EU 7 or the EBA Guidelines on institutions’ stress testing 8 , have the same meaning in the guidelines. For the purposes of the guidelines, the following definitions apply:
5 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176 27.6.2013, p. 338). Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJ L 176 27.6.2013, p. 1). 7 Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012 of the European Parliament and of the Council (OJ L 173 12.6.2014, p. 190). EBA Guidelines on institutions’ stress testing (EBA/GL/2018/04)

‘AML/CFT supervisor’ means a competent authority responsible for the supervision of institutions’ compliance with the provisions of Directive (EU) 2015/849. ‘Capital buffer requirements’ means the own fundsrequirements specified in Chapter 4 of Title VII of Directive 2013/36/EU. ‘Consolidating institution’ means an institution that is required to abide by the prudential requirements on the basis of the consolidated situation in accordance with Part 1, Title 2,
Chapter 2 of Regulation (EU) No 575/2013.
‘Conduct risk’ means the current or prospective risk of losses to an institution arising from cases of wilful or negligent misconduct, including inappropriate supply of financial services. ‘Counterbalancing capacity’ means the institution’s ability to hold, or have access to, excess liquidity over short-term, medium-term and long-term time horizons in response to stress scenarios. ‘Credit spread risk’ means the risk arising from changes in the market value of debt financial instruments due to fluctuations in their credit spread. ‘Funding risk’ means the risk that the institution will not have stable sources of funding in the medium and long term, resulting in the current or prospective risk that it cannot meet its financial obligations, such as payments and collateral needs, as they fall due in the mediumto-long term, either at all or without increasing funding costs unacceptably. ‘FX lending’ means lending to borrowers, regardless of the legal form of the credit facility (e.g. including deferred payments or similar financial accommodations), in currencies other than the legal tender of the country in which the borrower is domiciled. ‘FX lending risk’ means the current or prospective risk to the institution’s earnings and own funds arising from FX lending to unhedged borrowers. ‘Internal capital adequacy assessment process (ICAAP)’ means the process for the identification, measurement, management and monitoring of internal capital implemented by the institution pursuant to Article 73 of Directive 2013/36/EU. ‘Internal liquidity adequacy assessment process (ILAAP)’ means the process for the identification, measurement, management and monitoring of liquidity implemented by the institution pursuant to Article 86 of Directive 2013/36/EU. ‘Institution’s category’ means the indicator of the institution’s systemic importance assigned based on the institution’s size and complexity and the scope of its activities. ‘Interest rate risk’ (IRR) means the current or prospective risk to the institution’s earnings and own funds arising from adverse movements in interest rates.

‘Intraday liquidity’ means the funds that can be accessed during the business day to enable the institution to make payments in real time. ‘Intraday liquidity risk’ means the current or prospective risk that the institution will fail to manage its intraday liquidity needs effectively. ‘Information and communication technology (ICT) risk’ means the risk of loss due to breach of confidentiality, failure of integrity of systems and data, inappropriateness or unavailability of systems and data, or inability to change IT within a reasonable time and costs when the environment or business requirements change (i.e. agility). ‘Macro-prudential requirement’ or ‘measure’ means a requirement or measure imposed by a competent or designated authority to address macroprudential or systemic risk. ‘Material currency’ means a currency in which the institution has material balance-sheet or off-balance-sheet positions. ‘Money laundering and terrorist financing (ML/TF) risk’ means the risk as defined in the EBA Risk-Based Supervision Guidelines 9 . ‘Overall capital requirement (OCR)’ means the sum of the total SREP capital requirement (TSCR), capital buffer requirements and macroprudential requirements, when expressed as own funds requirements. ‘Overall leverage ratio requirement (OLRR)’ means the sum of the total SREP leverage ratio requirement (TSLRR) and the G-SII leverage ratio buffer requirement in accordance with Article 92(1a) of Regulation (EU) No 575/2013. ‘Overall SREP assessment’ means the up-to-date assessment of the overall viability of an institution based on assessment of the SREP elements. ‘Overall SREP score’ means the numerical indicator of the overall risk to the viability of the institution based on the overall SREP assessment. ‘Pillar 2 guidance (P2G)’ means the level and quality of own funds the institution is expected to hold in excess of its OCR, determined in accordance with the criteria specified in these guidelines. ‘Pillar 2 guidance for the risk of excessive leverage (P2G-LR)’ means the level and quality of own funds the institution is expected to hold in excess of its OLRR, determined in accordance with the criteria specified in these guidelines. EBA Guidelines on the characteristics of a risk-based approach to anti-money laundering and terrorist financing supervision, and the steps to be taken when conducting supervision on a risk-sensitive basis under Article 48(10) of Directive (EU) 2015/849 (amending the Joint Guidelines ESAs 2016 72) (‘The Risk-Based Supervision Guidelines’) ( EBA/GL/2021/16).

‘Pillar 2 requirement (P2R)’ or ‘additional own funds requirements’ means the additional own funds requirements imposed in accordance with Article 104(1)(a) of Directive 2013/36/EU to address risks other than the risk of excessive leverage. ‘Pillar 2 requirement for the risk of excessive leverage (P2R-LR)’ or ‘additional own funds requirements to address the risk of excessive leverage’ means the additional own funds requirements imposed in accordance with Article 104(1)(a) of Directive 2013/36/EU to address the risk of excessive leverage. ‘Reputational risk’ means the current or prospective risk to the institution’s earnings, own funds or liquidity arising from damage to the institution’s reputation. ‘Risk appetite’ means the aggregate level and types of risk the institution is willing to assume within its risk capacity, in line with its business model, to achieve its strategic objectives. ‘Risk score’ means the numerical expression summarising the supervisory assessment of an individual risk to capital, liquidity and funding representing the likelihood that a risk will have a significant prudential impact on the institution (e.g. potential loss) after considering risk management and controls and before consideration of the institution’s ability to mitigate the risk through available capital or liquidity resources. ’Risks to capital’ means distinct risks that, should they materialise, will have a significant prudential impact on the institution’s own funds over the next 12 months. These include but are not limited to risks covered by Articles 79 to 87 of Directive 2013/36/EU. ‘Risks to liquidity and funding’ means distinct risks that, should they materialise, will have a significant prudential impact on the institution’s liquidity over different time horizons. ‘SREP element’ means one of the following: business model analysis, assessment of internal governance and institution-wide risk controls, assessment of risks to capital, SREP capital assessment, assessment of risks to liquidity and funding, or SREP liquidity assessment. ‘Structural FX risk’ means the risk arising from equity held that has been deployed in offshore branches and subsidiaries in a currency other than the parent undertaking’s reporting currency. ‘Supervisory benchmarks’ means risk-specific quantitative tools developed by the competent authority to provide an estimation of the own funds required to cover risks or elements of risks not covered by Regulation (EU) No 575/2013. ‘Survival period’ means the period during which the institution can continue operating under stressed conditions and still meet its payments obligations. ‘Total risk exposure amount (TREA)’ means total risk exposure amount as defined in Article 92 of Regulation (EU) No 575/2013.

‘Total SREP capital requirement (TSCR)’ means the sum of own fundsrequirements as specified in Article 92(1), points (a) to (c) of Regulation (EU) No 575/2013 and additional own funds requirements determined in accordance with the criteria specified in these guidelines to address risks other than the risk of excessive leverage. ‘Total SREP leverage ratio requirement (TSLRR)’ means the sum of own funds requirements as specified in Article 92(1), point (d) of Regulation (EU) No 575/2013 and additional own funds requirements determined in accordance with the criteria specified in these guidelines to address the risk of excessive leverage. ‘Unhedged borrowers’ means retail and SME borrowers without a natural or financial hedge that are exposed to a currency mismatch between the loan currency and the hedge currency; natural hedges include in particular cases where borrowers receive income in a foreign currency (e.g. remittances/export receipts), while financial hedges normally presume that there is a contract with a financial institution. ‘Viability score’ means the numerical expression summarising the supervisory assessment of a SREP element and representing an indication of the risk to the institution’s viability stemming from the SREP element assessed.
1.3. Level of application
9. Competent authorities should apply these guidelines in accordance with the level of application
determined in Article 110 of Directive 2013/36/EU following the requirements and waivers used pursuant to Articles 108 and 109 of Directive 2013/36/EU.
10. For parent undertakings and subsidiaries included in the consolidation, competent authorities
should adjust the depth and the level of granularity of their assessments to correspond to the level of application established in the requirements of Regulation (EU) No 575/2013 specified in Part One, Title II of that Regulation, in particular recognising waivers applied pursuant to Articles 7, 10 and 15 of Regulation (EU) No 575/2013 and Article 21 of Directive 2013/36/EU.
11. Where an institution has a subsidiary in the same Member State, but no waivers specified in
Part One of Regulation (EU) No 575/2013 have been granted, a proportionate approach for the
assessment of capital and liquidity adequacy may be applied by focusing on the assessment of allocation of capital and liquidity across the entities and potential impediments to the transferability of capital or liquidity within the group.
12. For cross-border groups, procedural requirements should be applied in a coordinated manner
within the framework of colleges of supervisors established pursuant to Article 116 or 51 of Directive 2013/36/EU. Title 11 explains the details of how these guidelines apply to crossborder groups and their entities.
13. When an institution has established a liquidity subgroup pursuant to Article 8 of Regulation
(EU) No 575/2013, competent authorities should conduct their assessment of risks to liquidity

and funding, and apply supervisory measures, for the entities covered by such a subgroup at the level of the liquidity subgroup.
1.4. Date of application
14. These updated guidelines apply from 1 January 2023.
1.5. Repeal
15. The EBA Guidelines on common procedures and methodologies for the supervisory review and
evaluation process (SREP) and supervisory stress testing of 19 December 2014 (EBA/GL/2014/13) and the amending guidelines of 19 July 2018 (EBA/GL/2018/03) are repealed with effect from 1 January 2023. The references to the Guidelines repealed shall be construed as reference to these guidelines.

The common SREP
2.1. Overview of the common SREP framework
16. Competent authorities should ensure that the SREP of an institution covers the following
components:
a. categorisation of the institution and periodic review of this categorisation; b. monitoring of key indicators;
c. business model analysis (BMA);
d. assessment of internal governance and institution-wide controls; e. assessment of risks to capital; f. assessment of risks to liquidity; g. assessment of the adequacy of the institution’s own funds; h. assessment of the adequacy of the institution’s liquidity resources;
i. overall SREP assessment; and
j. supervisory measures (and early intervention measures, where necessary).
2.1.1. Categorisation of institutions
17. Competent authorities should categorise all institutions under their supervisory remit into the
following categories:

Category 1 – all institutions defined as ‘large institutions’ pursuant to Article 4(1),
point (146) of Regulation (EU) No 575/2013 and, as appropriate, other institutions determined by competent authorities, based on an assessment of the institution’s size and internal organisation and the nature, scope and complexity of its activities. Competent authorities can decide to classify ‘large institutions’ under Article 4(1)(146) of Regulation (EU) No 575/2013 that are not G-SIIs or O-SIIs as Category2 institutions as appropriate based on the assessment of the institution’s risk profile.
Category 2 – medium to large institutions other than those included in Category 1
which are not a ‘small and non-complex institution’ as defined in Article 4(1) point (145) of Regulation (EU) No 575/2013 and operate domestically or with sizable

cross-border activities, in several business lines, including non-banking activities, and offering credit and financial products to retail and corporate customers; nonsystemically important specialised institutions with significant market shares in their lines of business or payment systems, or financial exchanges; institutions considered important, due to their size, activities, or business model (e.g. central institutions of an IPS, CCPs, CSDs, central cooperative banks or central savings banks), for the economy (e.g. in terms of total assets over gross domestic product – TA/GDP) or for the banking sector in a particular Member State.

Category 3 – small to medium institutions other than those included in Categories
1 and 2, which are not ‘small and non-complex institution’ as defined in Article 4(1) point (145) of Regulation (EU) No 575/2013 and operating domestically or with non-significant cross-border operations, and operating in a limited number of business lines, offering predominantly credit products to retail and corporate customers with a limited offering of financial products;specialised institutions with less-significant market shares in their lines of business or payment systems, or financial exchanges.
Category 4 – all institutions defined as ‘small and non-complex institution’ pursuant
to Article 4(1), point (145) of Regulation (EU) No 575/2013 and all other small noncomplex institutions that do not fall into Categories 1 to 3 (e.g. with a limited scope of activities and non-significant market shares in their lines of business).

The categorisation should reflect the assessment of systemic risk posed by institutions to the
financial system. It should be used by competent authorities as a basis for applying the principle of proportionality, as specified in Section 2.4, and not as a means to reflect the quality of an institution.
Competent authorities should base the categorisation on supervisory reporting data and on
information derived from the preliminary business model analysis (see Section 4.2). The categorisation should be reviewed periodically, or in the event of a significant corporate event, such as a large divestment, a merger or acquisition, an important strategic action, etc.
2.1.2. Continuous assessment of risks
Competent authorities should continuously assess the risks to which the institution is or might
be exposed through the following activities:
a. monitoring of key indicators as specified in Title 3; b. business model analysis as specified in Title 4;
c. assessment of internal governance and institution-wide controls as specified in
Title 5;

d. assessment of risks to capital as specified in Title 6; and e. assessment of risks to liquidity and funding as specified in Title 8.
21. The assessments should be conducted in accordance with the proportionality criteria specified
in Section 2.4. The assessments should be reviewed in light of new information.
22. Competent authorities should ensure that the findings of the assessments outlined above:
a. are clearly documented in a summary of findings; b. are reflected in a score assigned in accordance with the specific guidance provided in the element-specific title of these guidelines;
c. support the assessments of other elements or prompt an in-depth investigation
into inconsistencies between the assessments of these elements; d. contribute to the overall SREP assessment and score; and e. result in supervisory measures, where appropriate, and inform the decisions taken for these measures.
2.1.3. Periodic assessment of capital and liquidity adequacy
23. Competent authorities should periodically review the adequacy of the institution’s own funds
and liquidity to provide sound coverage of the risks to which the institution is or might be exposed through the following assessments:
a. SREP capital assessment as specified in Title 7; and b. SREP liquidity assessment as specified in Title 9.
24. The periodic assessments should be conducted in accordance with the proportionality criteria
specified in Section 2.4. Competent authorities may perform more frequent assessments. Competent authorities should review the assessment in light of material new findings from the SREP risk assessment where competent authorities determine that the findings may have a material impact on the institution’s own funds and/or liquidity resources.
25. Competent authorities should ensure that the findings of the assessments:
a. are clearly documented in a summary; b. are reflected in the score assigned to the institution’s capital adequacy and liquidity adequacy, in accordance with the guidance provided in the element-specific title;
c. contribute to the overall SREP assessment and score; and

d. take into account and inform the supervisory requirement for the institution to hold own funds and/or liquidity resources in excess of the minimum requirements specified in Regulation (EU) No 575/2013, or for other supervisory measures, as appropriate.
2.1.4. Overall SREP assessment
26. Competent authorities should continuously assess the risk profile of the institution and its
viability through the overall SREP assessment as specified in Title 10. Through the overall SREP assessment, competent authorities should determine the potential for risks to cause the failure of the institution given the adequacy of its own funds and liquidity resources, governance, controls and/or business model or strategy, and from this, the need to take early intervention measures, and/or determine whether the institution can be considered to be failing or likely to fail.
27. The assessment should be continuously reviewed in light of findings from the risk assessments
or the outcome of the SREP capital and SREP liquidity assessments.
28. Competent authorities should ensure that the findings of the assessment:
a. are reflected in the score assigned to the institution’s overall viability, in accordance with the guidance provided in Title 10; b. are clearly documented in a summary of the overall SREP assessment that includes the SREP scores assigned (overall and for individual elements) and any supervisory findings made over the course of the previous 12 months; and
c. form the basis for the supervisory determination of whether the institution can be
considered to be ‘failing or likely to fail’ pursuant to Article 32 of Directive 2014/59/EU.
2.1.5 Dialogue with institutions, application of supervisory measures and
communicating findings
29. Following the minimum engagement model, as specified in Section 2.4, competent authorities
should engage in dialogue with institutions to assess individual SREP elements, as provided in the element-specific titles.
30. Based on the overall SREP assessment and building on assessments of the individual SREP
elements, competent authorities should take supervisory measures as specified in Title 10. Supervisory measures in these guidelines are grouped as follows:
a. capital measures; b. liquidity measures; and

c. other supervisory measures (including early intervention measures).
31. Where findings from the monitoring of key indicators, assessment of SREP elements or any
other supervisory activity necessitate the application of supervisory measures to address immediate concerns, competent authorities should not wait for the completion of the assessment of all SREP elements and update of the overall SREP assessment, but decide on the measures required to rectify the situation assessed, and then proceed with updating the overall SREP assessment.
32. Competent authorities should also engage in dialogue based on the outcomes of the overall
SREP assessment, alongside associated supervisory measures, and inform the institution at the end of the process about supervisory measures with which it is obliged to comply as outlined in Section 2.4.
2.2 Scoring in the SREP
33. Competent authorities should assign risk and viability scores to summarise the outcomes of the
assessment of various risk categories and elements in the SREP framework.
34. In the assessment of the individual risk categories and SREP elements, competent authorities
should use a range of scores – 1 (low risk), 2 (medium-low risk), 3 (medium-high risk), and 4 (high risk) – reflecting the supervisory view based on the relevant scoring tables in each element-specific title. Competent authorities should use the accompanying ‘considerations’ provided in these tables for guidance to support supervisory judgement (i.e. it is not necessary for the institution to fulfil all the ‘considerations’ linked to a score of ‘1’ to achieve a score of ’1’), and/or further develop them or add additional considerations. Competent authorities should assign a score of ‘4’ to reflect the worst possible assessment (i.e. even if the institution’s position is worse than that envisaged by the ‘considerations’ for a score of ‘4’, a score of ‘4’ should still be assigned).
35. In their implementation of the guidelines, competent authorities may introduce more granular
scoring for their internal purposes, such as planning of resources, provided that the overall scoring framework set out in these guidelines is respected.
36. Competent authorities should ensure that all scores are regularly reviewed, at least with the
frequency defined in Section 2.4 and without undue delay on the basis of material new findings or developments.
2.2.1 Risk scores
37. Competent authorities should assign risk scores to individual risks to capital in accordance with
the criteria specified in Title 6, and scores to risks to liquidity and funding in accordance with the criteria specified in Title 8. These scores represent the likelihood that a risk will have a significant prudential impact on the institution (e.g. potential loss), after considering the quality

of risk controls to mitigate this impact (i.e. residual risk), but before consideration of the institution’s ability to mitigate the risk through available capital or liquidity resources.
38. Competent authorities should determine the risk score predominantly through an assessment
of inherent risk, but they should also reflect considerations about risk management and controls. In particular, the adequacy of management and controls may increase or – in some cases – reduce the risk of significant prudential impact (i.e. considerations relating to inherent risk may under- or overestimate the level of risk depending on the adequacy of management and controls). The assessment of inherent risk and the adequacy of management and controls should be made with reference to the considerations specified in Tables 4 to 7 and 9 and 10.
39. In implementing these guidelines, competent authorities may use different methods to decide
on individual risk scores. Inherent risk levels and the quality of risk management and controls may be scored separately (resulting in an intermediate and final score) or in aggregate. Competent authorities may also introduce aggregation methodologies for aggregating individual risks to capital and liquidity and funding scores.
2.2.2 Viability scores including an overall SREP score
40. Competent authorities should separately assign scores to summarise the level of risk posed to
the viability of the institution based on the outcomes of the assessment of the four SREP elements:
a. business model and strategy, in accordance with the criteria specified in Title 4; b. internal governance and institution-wide controls, in accordance with the criteria specified in Title 5;
c. capital adequacy, in accordance with the criteria specified in Title 7; and
d. liquidity adequacy, in accordance with the criteria specified in Title 9.
41. For capital adequacy and liquidity adequacy, these scores represent the supervisory view of the
capacity of the institution’s capital and liquidity resources to mitigate/cover individual risks to capital and liquidity and funding, as set out in Titles 6 and 8, and /or other elements for which additional own funds have been determined as set out in Title 7.
42. Competent authorities should also assign an overall SREP score in accordance with the criteria
specified in Title 10. This score should be assigned based on supervisory judgement and should represent the supervisory view of the overall viability of the institution.
43. Competent authorities should ensure that the scoring of the business model, internal
governance and institution-wide controls, capital adequacy, liquidity adequacy and the overall SREP score achieves the following objectives:

a. indicating the likelihood that supervisory measures may need to be taken to address concerns in accordance with the criteria specified in Title 10; b. acting as a trigger for the decision on whether to apply early intervention measures in accordance with the EBA Guidelines on triggers for use of early intervention measures 10; and
c. helping with the prioritisation and planning of supervisory resources and the
setting of priorities in the supervisory examination programme (SEP).
44. Competent authorities should ensure that the overall SREP score assigned on the basis of the
aggregate view of the threats from the four SREP elements provides an indication of the institution’s overall viability, including whether the institution is ‘failing or likely to fail’ within the meaning of Article 32 of Directive2014/59/EU, also having regard to the EBA Guidelines on ‘failing or likely to fail’11.When the outcome of the overall SREP assessment suggests that an institution can be considered to be ‘failing or likely to fail’, competent authorities should apply a score of ‘F’ and follow the process of engaging with resolution authorities as specified in
Article 32 of Directive 2014/59/EU.
2.3 Organisational arrangements
45. Competent authorities should ensure that, for conducting the SREP, their organisational
arrangements include at least the following:
a. a description of the roles and responsibilities of their supervisory staff with respect to performing the SREP, as well as the relevant reporting lines, in both normal and emergency situations; b. procedures for documenting and recording findings and supervisory judgements;
c. arrangements for the approval of the findings and scores, as well as escalation
procedures where there are of dissenting views within the competent authority, in both normal and emergency situations; d. arrangements for organising dialogue with the institution following the model of minimum engagement as stipulated in Section 2.4 to assess individual SREP elements; and e. arrangements for consultations with an institution and communicating the outcomes of the SREP to the institution, also reflecting the interaction within 10 EBA Guidelines on triggers for use of early intervention measures (EBA/GL/2015/03) 11 EBA Guidelines on the interpretation of the different circumstances when an institution shall be considered as failing or likely to fail under Article 32(6) of Directive 2014/59/EU (EBA/GL/2015/07)

colleges of supervisors for cross-border groups and their entities, also in accordance with Commission Implementing Regulation (EU) No 710/2014 12 .
46. When defining arrangements for dialogue with institutions, competent authorities should
consider potential implications of providing the scores to the institutions in terms of their disclosure obligations pursuant to the requirements of Regulation (EU) No 596/2014 13 and Directives 2014/57/EU 14 and 2004/109/EC 15 .
2.4 Proportionality and supervisory engagement
47. Competent authorities should apply the principle of proportionality in the scope, frequency and
intensity of supervisory engagement and dialogue with an institution, and supervisory expectations of the standards the institution should meet, in accordance with the category of the institution. In all cases, the assessment of risks to capital and risks to liquidity and funding should include an assessment of at least the most material individual risks.
48. Regardless of the institution’s category, when informing about the outcome of the overall SREP
assessment, competent authorities should provide in particular:
a. a statement on the quantity and composition of the own funds the institution is required to hold in excess of the requirements specified in Regulation (EU) No 575/2013 and in Chapter 2 of Regulation (EU) 2017/2402 16 , relating to elements of risks and risks not covered by these Regulations; b. a statement on the quantity and composition of the own funds the institution is guided to hold in excess of the requirements specified in point (a) and in Chapter 4 of Title VII of Directive 2013/36/EU;
c. a statement on the liquidity held and any specific liquidity requirements set by the
competent authority; and
12 Commission Implementing Regulation (EU) No 710/2014 of 23 June 2014 laying down implementing technical standards with regard to conditions of application of the joint decision process for institution-specific prudential requirements according to Directive 2013/36/EU of the European Parliament and of the Council (OJ L 188, 27.6.2014, p. 19). 13 Regulation (EU) No 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse (marketabuse regulation) and repealing Directive 2003/6/EC of the European Parliament and of the Council and Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/EC (OJ L 173, 12.6.2014, p. 1). 14 Directive 2014/57/EU of the European Parliament and of the Council of 16 April 2014 on criminal sanctions for market abuse (market-abuse directive) (OJ L 173, 12.6.2014, p. 179). 15 Directive 2004/109/EC of the European Parliament and of the Council of 15 December 2004 on the harmonisation of transparency requirements in relation to information about issuers whose securities are admitted to trading on a regulated market and amending Directive 2001/34/EC (OJ L 390, 31.12.2004, p. 38). 16 Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation, and amending Directives 2009/65/EC, 2009/138/EC and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No 648/2012 (OJ L 347, 28.12.2017, p. 35).

d. a statement on other supervisory measures, including any early intervention measures that the competent authority intends to take.
49. For the frequency and intensity of the supervisory engagement aspect of proportionality, when
planning SREP activities, competent authorities should adhere to a minimum level of engagement model, as follows (and as outlined in Table 1).
2.4.1 Category 1 institutions
50. In order to ensure appropriate frequency of supervisory activities related to SREP for Category
1 institutions, competent authorities should:
a. monitor key indicators on a quarterly basis; b. produce a documented summary of the overall SREP assessment at least annually;
c. update the assessments of all individual SREP elements at least annually;
d. inform the institution of the outcome of the overall SREP assessment at least annually; e. have ongoing engagement and dialogue with the institution’s management body and senior management, as defined in paragraph 3(9) of Directive 2013/36/EU, to assess each SREP element.
2.4.2 Category 2 institutions
51. In order to ensure appropriate frequency of supervisory activities related to SREP for Category
2 institutions, competent authorities should:
a. monitor key indicators on a quarterly basis; b. produce a documented summary of the overall SREP assessment at least annually;
c. update the assessments of all individual SREP elements at least every 2 years;
d. inform the institution of the outcome of the overall SREP assessment at least every 2 years; e. have ongoing engagement and dialogue with the institution’s management body and senior management to assess each SREP element.
2.4.3 Category 3 institutions
52. In order to ensure appropriate frequency of supervisory activities related to SREP for Category
3 institutions, competent authorities should:

a. monitor key indicators on a quarterly basis; b. produce a documented summary of the overall SREP assessment at least annually;
c. update the assessments of all individual SREP elements at least every 3 years, or
sooner in light of material new information emerging on the risk posed; d. inform the institution of the outcome of the overall SREP assessment at least every 3 years; e. have risk-based engagement and dialogue with the institution’s management body and senior management (i.e. where necessary) to assess the material-risk element(s).
2.4.4 Category 4 institutions
53. In order to ensure appropriate frequency of supervisory activities related to SREP for Category
4 institutions, competent authorities should:
a. monitor key indicators on a quarterly basis; b. produce a documented summary of the overall SREP assessment at least annually;
c. update the assessments of all individual SREP elements at least every 3 years, or
sooner in light of material new information emerging on the risk posed, tailoring the scope and depth of the review of such an update to the specific risk profile of the institution; d. inform the institution of the outcome of the overall SREP assessment at least every 3 years; e. have engagement and dialogue with the institution’s management body and senior management at least every 3 years.
2.4.5 Minimum requirements for supervisory engagement
Table 1. Application of SREP to different categories of institutions
Category
Monitoring of key indicators
Assessment of all
SREP elements (at least)
Summary of the overall
SREP assessment
Minimum level of engagement/dialogue
1 Quarterly Annual Annual
Ongoing engagement with institution’s management body and senior management; engagement with institution

Category
Monitoring of key indicators
Assessment of all
SREP elements (at least)
Summary of the overall
SREP assessment
Minimum level of engagement/dialogue for assessment of each element.
2 Quarterly Every 2 years Annual
Ongoing engagement with institution’s management body and senior management; engagement with institution for assessment of each element. 3 Quarterly Every 3 years Annual Risk-based engagement with institution’s management body and senior management; engagement with institution for assessment of material risk element(s). 4 Quarterly Every 3 years with the scope and depth of the review tailored to the specific risk profile of the institution Annual Engagement with institution’s management body and senior management at least every 3 years.
54. Where competent authorities determine that institutions have similar risk profiles, they may
conduct thematic SREP assessments on multiple institutions as a single assessment (e.g. a BMA may be conducted on all small mortgage lenders given that it is likely to identify the same business viability issues for all these institutions). Competent authorities may also use tailored methodologies for the application of the SREP for institutions with similar risk profiles, such as similar business models or geographical location of exposures in accordance with Article 97(4a) of Directive 2013/36/EU.
55. Competent authorities should determine an additional level of engagement based on the
findings from previous assessments of one or more SREP elements, whereby more extensive supervisory resources and a higher intensity and frequency of engagement should be required, tailored to the situation of the individual institution in terms of risks and vulnerabilities, regardless of the category of the institution, for institutions with a poor overall SREP score (at least on a temporary basis).
56. For institutions covered by the supervisory examination programme required by Article 99 of
Directive 2013/36/EU, competent authorities should ensure that the level of engagement and application of the SREP is determined by that programme.

When planning SREP activities, competent authorities should pay special attention to
coordinating activities with other parties directly or indirectly involved in the assessment, in particular when input is required from the institution and/or other competent authorities involved in the supervision of cross-border groups as specified in Title 11 of these guidelines.
2.4.6 Focus and granularity of the assessment
For the scope of proportionality, when conducting the SREP by applying these guidelines,
competent authorities should recognise that different elements, methodological aspects and assessment components as provided in Titles 4, 5, 6 and 8 do not have the same relevance for all institutions; competent authorities should, where relevant, apply different degrees of granularity to the assessment depending on the category to which the institution is assigned and to the extent appropriate for the size and business model of the institution, and the nature, scale and complexity of its activities.
Having regard to paragraphs 57 and 58, competent authorities may also determine the specific
focus of SREP, where more detailed assessment is carried out in selected areas, while less scrutiny, but sufficient for meaningful assessment, is devoted to all other SREP elements. Such a focus of SREP may be based on multi-year planning, economic circumstances or specific situation of an institution. In determining the focus and granularity of the assessment, competent authorities should take into account the risk profile of the institution, the materiality of the different risks and any changes thereof, including those observed in the monitoring of key indicators as outlined in Title 3, stress testing as outlined in Title 12 or in the outcome of previous SREP assessments.

Monitoring of key indicators
60. Competent authorities should engage in regular monitoring of key financial and non-financial
indicators to monitor changes in the financial conditions and risk profiles of institutions. Competent authorities should also use this monitoring to identify the need for updates to the assessment of SREP elements in light of new material information outside of planned supervisory activities. Where monitoring reveals a material change in the risk profile of the institution, or any anomalies in the indicators, competent authorities should investigate the causes, and, where relevant, review the assessment of the relevant SREP element in light of the new information.
61. Following the model of minimum engagement discussed in Title 2, competent authorities
should monitor key financial and non-financial indicators at least on a quarterly basis for all institutions. However, depending on the specific features of the institutions or situation, competent authorities may establish more frequent monitoring, taking into consideration the availability of the underlying information (e.g. market data).
62. Competent authorities should establish monitoring systems and patterns allowing for the
identification of material changes and anomalies in the behaviour of indicators, and should set thresholds, where relevant. Competent authorities should also establish escalation procedures for all relevant indicators (or combinations of indicators) covered by the monitoring to ensure that anomalies and material changes are investigated.
63. Competent authorities should tailor the set of indicators and their thresholds to the specific
features of individual institutions or groups of institutions with similar characteristics (peer groups). The framework of indicators, monitoring patterns and thresholds should reflect the institution’s size, complexity, business model and risk profile and should cover geographies, sectors and markets where the institution operates.
64. Competent authorities should identify the indicators to be tracked through regular monitoring
primarily from regular supervisory reporting and using definitions from common reporting standards. Where relevant, EBA dashboards or indicators being monitored by the EBA may be used as a source of information against which individual institutions can be monitored.
65. The framework of indicators established and the outcomes of the monitoring of key indicators
should also be used as input for the assessment of risks to capital and risks to liquidity and funding under the respective SREP elements.
66. Indicators used for monitoring should include at least the following institution-specific
indicators:

a. financial and risk indicators addressing all risk categories covered by these guidelines (see Titles 6 and 8); b. all the ratios derived from the application of Regulation (EU) No 575/2013 and from the national law implementing Directive 2013/36/EU for calculating the minimum prudential requirements (e.g. Core Tier 1 (CT1), liquidity coverage ratio (LCR), net stable funding ratio (NSFR), etc.);
c. the minimum requirements for own funds and eligible liabilities (MREL) as specified
by Directive 2014/59/EU; d. relevant market-based indicators (e.g. equity price, credit default swap (CDS) spreads, bond spreads, etc.); e. where available, recovery indicators used in the institution’s own recovery plans; and f. where available, indicators based on quantitative or qualitative information from reporting provided to competent authorities that may point to ML/TF risk.
67. Competent authorities should accompany institution-specific indicators with relevant
macroeconomic indicators, where available, in the geographies, sectors and markets where the institution operates.
68. Identification of material changes or anomalies in indicators, especially in cases where changes
are outliers to the peer-group performance, should be considered by competent authorities as a prompt for further investigation. Specifically, competent authorities should:
a. determine the cause and make an assessment of materiality of the potential prudential impact on the institution; b. document the cause and the outcome of the assessment; and
c. review the risk assessment and SREP score, where relevant, in light of any new
findings.
69. Competent authorities should also consider supplementing the regular monitoring of key
financial and non-financial indicators with review of independent market research and analysis, where this is available, which can be a helpful source of alternative points of view.

Business model analysis
4.1 General considerations
70. This title specifies criteria for the assessment of the business model and strategy of the
institution. Competent authorities should apply this assessment to an institution at the same level as the overall SREP assessment, but it can also be applied at business or product-line level, or on a thematic basis.
71. Without undermining the responsibility of the institution’s management body for running and
organising the business, or indicating preferences for specific business models, competent authorities should conduct regular business model analysis (BMA) to assess business and strategic risks and determine:

the viability of the institution’s current business model on the basis of its ability to
generate acceptable returns over the following 12 months; and
the sustainability of the institution’s strategy on the basis of its ability to generate
acceptable returns over a forward-looking period of at least 3 years, based on its strategic plans and financial forecasts.

Competent authorities should use the outcome of the BMA to support the assessment of all
other elements of the SREP. Competent authorities may assess specific aspects of the BMA, in particular the quantitative assessment of the business model, as part of the assessment of other SREP elements (e.g. understanding the funding structure can be part of the risks to liquidity assessment).
Competent authorities should also use the BMA to support the identification of the institution’s
key vulnerabilities, which are most likely to have a material impact on the institution/lead to its failure in the future.
Competent authorities should also use the BMA to assess prudential implications of ML/TF risks
known to them, linked to the business model of the institution. In this respect, competent authorities should use the input received from AML/CFT supervisors, in particular their assessments of ML/TF risks and any findings relating to material weaknesses in an institution’s AML/CFT controls, to complement their findings from ongoing supervision, and evaluate whether they give rise to prudential concerns related to ML/TF risk. Where the assessment indicates the business model of the institution gives rise to prudential concerns related to ML/TF risk, competent authorities should share the outcome of the prudential assessment of the business model with the AML/CFT supervisors 17 . 17 In accordance with the EBA AML/CFT Cooperation Guidelines (EBA/GL/2021/15).
Competent authorities should undertake the following steps as part of the BMA:
a. preliminary assessment; b. identification of the areas of focus;
c. assessment of the business environment;
d. quantitative analysis of the current business model; e. qualitative analysis of the current business model; f. analysis of the forward-looking strategy and financial plans (including planned changes to the business model); g. assessment of business model viability; h. assessment of sustainability of the strategy;
i. identification of key vulnerabilities to which the institution’s business model and
strategy expose it or may expose it; and j. summarising of the findings and scoring.
To conduct the BMA, competent authorities should use at least the following sources of
quantitative and qualitative information:
a. institution’s strategic plan(s) with current-year and forward-looking forecasts, and underlying economic assumptions; b. financial reporting (e.g. profit and loss (P&L), balance-sheet disclosures);
c. regulatory reporting (common reporting (COREP), financial reporting (FINREP) and
credit register, where available); d. internal reporting (management information, capital planning, liquidity reporting, internal risk reports); e. recovery and resolution plans, including the results of resolvability assessment provided by the resolution authority in accordance with Article 14 of Directive 2014/59/EU; f. third-party reports (e.g. audit reports, reports by equity/credit analysts); and g. other relevant studies/surveys (e.g. from the International Monetary Fund (IMF), macroprudential authorities and institutions, European institutions).

4.2 Preliminary assessment
77. Competent authorities should analyse the institution’s main activities, geographies and market
position to identify, at the highest level of consolidation in the jurisdiction, the institution’s:
a. major geographies; b. major subsidiaries/branches;
c. major business lines; and
d. major product lines.
78. For this purpose, competent authorities should consider a range of relevant metrics at the point
of assessment and changes over time. These metrics should include:
a. contribution to overall revenues/costs; b. share of assets;
c. share of TREA; and
d. market position.
79. Competent authorities should use this preliminary assessment to:
a. determine materiality of business areas/lines: competent authorities should determine which geographies, subsidiaries/branches, business lines and product lines are the most material based on profit contribution (e.g. based on P&L), risk (e.g. based on TREA or other measures of risk) and/or organisational/statutory priorities(e.g. specific obligations for public sector banksto offer specific products). Competent authorities should use this information as a basis for identifying what the BMA should focus on (covered further in Section 4.3); b. identify the peer group: competent authorities should determine the relevant peer group for the institution; to conducting a BMA, the competent authority should determine the peer group on the basis of the rival product/business lines targeting the same source of profits/customers (e.g. the credit-card businesses of different institutions targeting credit card users in country X);
c. support the application of the principle of proportionality: competent authorities
may use the outcomes of the preliminary assessment to help with the allocation of institutions to proportionality categories on the basis of the identified complexity of the institutions (as specified in Section 2.1.1).

4.3 Identifying the areas of focus for the BMA
80. Competent authorities should determine the focus of the BMA. They should focus on the
business lines that are most important in terms of viability or future sustainability of current business model, and/or most likely to increase the institution’s exposure to existing or new vulnerabilities. Competent authorities should take into account:
a. the materiality of business lines – whether certain business lines are more important in terms of generating profits (or losses); b. previous supervisory findings – whether the findings for other elements of the SREP can provide indicators on business lines requiring further investigation;
c. findings and observations from internal or external audit reports – whether the
audit function has identified specific issues regarding the sustainability or viability of certain business lines; d. importance to strategic plans – whether there are business lines that the institution wishes to grow substantially, or decrease; e. outcomes of thematic supervisory reviews – whether a sector-wide analysis has revealed common underlying issues that prompt additional institution-specific analysis; f. observed changes in the business model – whether there are observed de facto changes in the business model that have occurred without the institution declaring any planned changes or releasing new strategic plans; g. peer comparisons – whether a business line has performed atypically (been an outlier) compared to peers; h. findings and observations from the preliminary business model assessment including those that point to a potential exposure of the business model to ML/TF risks.
4.4 Assessing the business environment
81. To form a view on the plausibility of an institution’s strategic assumptions, competent
authorities should undertake an analysis of the business environment. This takes into consideration the current and future business conditions in which an institution operates or is likely to operate based on its main or material geographic and business exposures. As part of this assessment, competent authorities should develop an understanding of the direction of macroeconomic and market trends and the strategic intentions of the peer group.
82. Competent authorities should use this analysis to develop an understanding of:

a. the key macroeconomic variables within which the relevant entity, product or segment being assessed operates or will operate based on its main geographies. Examples of key variables include gross domestic product (GDP), unemployment rates, interest rates and house price indices. b. the competitive landscape and how it is likely to evolve, considering the activities of the peer group. Examples of areas for review include expected target-market growth (e.g. residential mortgage market) and the activities and plans of key competitors in the target market.
c. overall trends in the market that may have an impact on the institution’s
performance and profitability. This should include, as a minimum, regulatory trends (e.g. changes to retail banking product distribution legislation), technological trends (e.g. moves to electronic platforms for certain types of trading) and societal/demographic trends (e.g. greater demand for Islamic banking facilities).
4.5 Analysis of the current business model
83. To understand the means and methods used by an institution to operate and generate profits,
competent authorities should undertake quantitative and qualitative analyses.
4.5.1 Quantitative analysis
84. Competent authorities should undertake an analysis of quantitative features of the institution’s
current business model to understand its financial performance and the degree to which this is driven by its risk appetite being higher or lower than peers.
85. Areas for analysis by competent authorities should include:
a. profit and loss, including trends: competent authorities should assess the underlying profitability of the institution (e.g. after exception items and one-offs), the breakdown of income streams, the breakdown of costs, impairment provisions and key ratios (e.g. net interest margin, cost/income, loan impairment). Competent authorities should consider how the above items have evolved in recent years and identify underlying trends; b. the balance sheet, including trends: competent authorities should assess the asset and liability mix, the funding structure, the change in the TREA and own funds, and key ratios (e.g. return on equity, Core Tier 1, funding gap). Competent authorities should consider how the above items have evolved in recent years and identify underlying trends;
c. concentrations, including their trends: competent authorities should assess
concentrations in the P&L and balance sheet related to customers, sectors and

geographies. Competent authorities should consider how the above items have evolved in recent years and identify underlying trends; and d. risk appetite: competent authorities should assess the formal limits put in place by the institution by risk type (credit risk, funding risk, etc.) and its adherence to them to understand the risks that the institution is willing to take to drive its financial performance.
4.5.2 Qualitative analysis
86. Competent authorities should undertake an analysis of qualitative features of the institution’s
current business model to understand its success drivers and key dependencies.
87. Areas for analysis by competent authorities should include:
a. key external dependencies: competent authorities should determine the main exogenous factors that influence the success of the business model; these may include third-party providers, intermediaries and specific regulatory drivers; b. key internal dependencies: competent authorities should determine the main endogenous factors that influence the success of the business model; these may include the quality of IT platforms and operational and resource capacity;
c. franchise: competent authorities should determine the strength of relationships
with customers, suppliers and partners; this may include the institution’s reliance upon its reputation, the effectiveness of branches, the loyalty of customers and the effectiveness of partnerships; and d. areas of competitive advantage: competent authorities should determine the areas in which the institution has a competitive advantage over its peers; these may include any of the above, such as the quality of the institution’s IT platforms, or other factors, such as the institution’s global network, the scale of its business or its product proposition. e. In the analysis, competent authorities should consider any indications that the business model and activities give rise to increased ML/TF risks, including deposittaking or establishment or use of legal entities in high-risk third countries, as identified in accordance with Article 9 of Directive (EU) 2015/849. Where present, these indications should be complemented by quantitative analysis, as appropriate, focusing in particular on the materiality of the revenues and the income from operations run in such high-risk third countries, the concentrations of exposures to customers for which the institution apply enhanced customer due diligence as set out in Chapter II, Section 3 of Directive 2015/849. Competent authorities should exchange information with the AML/CFT supervisor on these indications as laid out in paragraph 74.

4.6 Analysis of the strategy and financial plans
88. Competent authorities should undertake a quantitative and qualitative forward-looking
analysis of the institution’s financial projections and strategic plan to understand the assumptions, plausibility and riskiness of its business strategy.
89. Areas for analysis by competent authorities should include:
a. overall strategy: competent authorities should consider the main quantitative and qualitative management objectives; b. projected financial performance: competent authorities should consider projected financial performance, covering the same or similar metrics as those covered in the quantitative analysis of the current business model;
c. success drivers of the strategy and financial plan: competent authorities should
determine the key changes proposed to the current business model to meet the objectives; d. assumptions: competent authorities should determine the plausibility and consistency of the assumptions made by the institution that drive its strategy and forecasts; these may include assumptions in areas such as macroeconomic metrics, market dynamics, volume and margin growth in key products, segments and geographies, etc.; and e. execution capabilities: competent authorities should determine the institution’s execution capabilities based on the management’s track record in adhering to previous strategies and forecasts, and the complexity and ambition of the strategy set compared to the current business model. In assessing the execution capabilities, competent authorities should also take into account the capabilities to execute the strategy from a risk management perspective.
90. Competent authorities may conduct parts of this analysis concurrently with the quantitative
and qualitative analysis of the current business model, particularly the analysis of the projected financial performance and of the success drivers of the strategy.
4.7 Assessing business model viability
91. Having conducted the analyses covered in Sections 4.4 and 4.5, competent authorities should
form, or update, their view on the viability of the institution’s current business model on the basis of its ability to generate acceptable returns over the following 12 months, given its quantitative performance, key success drivers and dependencies and business environment.
92. Competent authorities should assess the acceptability of returns against the following criteria:

a. return on equity (ROE) against cost of equity (COE) or equivalent measure:
competent authorities should consider whether the business model generates a return above cost (excluding one-offs) on the basis of ROE against COE; other metrics, such as return on assets or risk-adjusted return on capital, as well as considering changes in these measures through the cycle, may also support this assessment; b. funding structure: competent authorities should consider whether the funding mix is appropriate to the business model and to the strategy; volatility or mismatches in the funding mix may mean that a business model or strategy, even one that generates returns above costs, may not be viable or sustainable given the current or future business environment; and
c. risk appetite: competent authorities should consider whether the institution’s
business model or strategy relies on a risk appetite, for individual risks (e.g. credit, market) or more generally, that is considered high or is an outlier amongst the peer group to generate sufficient returns.
4.8 Assessing the sustainability of the institution’s strategy
93. Having conducted the analyses covered in Sections 4.4 to 4.6, competent authorities should
form, or update, their view on the sustainability of the institution’s strategy on the basis of its ability to generate acceptable returns, as defined above, over a forward-looking period of at least 3 years based on its strategic plans and financial forecasts and given the supervisory assessment of the business environment.
94. In particular, competent authorities should assess the sustainability of the institution’s strategy
based on:
a. the plausibility of the institution’s assumptions and projected financial performance compared to the supervisory view of the current and future business environment; b. the impact on the projected financial performance of the supervisory view of the business environment (where this differs from the institution’s assumptions); and
c. the risk level of the strategy (i.e. the complexity and ambition of the strategy
compared to the current business model) and the consequent likelihood of success based on the institution’s likely execution capabilities (measured by the institution’s success in executing previous strategies of a similar scale or the performance against the strategic plan so far and taking into account the capabilities to execute the strategy from a risk management perspective).

4.9 Identification of key vulnerabilities
95. Having conducted the BMA, competent authorities should assess the key vulnerabilities to
which the institution’s business model and strategy expose it or may expose it, considering any of the following:
a. poor expected financial performance; b. reliance on an unrealistic strategy;
c. excessive concentrations or volatility (e.g. of revenues, earnings, customers subject
to enhanced customer due diligence set out in Chapter II, Section 3 of Directive 2015/849, high-risk third countries in accordance with Article 9 of that Directive, deposits and assets under custody/management related to such high-risk third countries; d. excessive risk-taking; e. funding structure concerns; f. significant external issues (e.g. regulatory threats, such as mandating of ‘ringfencing’ of business units); and g. ESG risks and their impact on the viability and sustainability of the business model and long-term resilience of the institution.
96. Following the above assessment, competent authorities should form a view on the viability of
the institution’s business model and the sustainability of its strategy, and any necessary measures to address problems and concerns.
4.10 Summary of findings and scoring
97. Based on the assessment of the viability and sustainability of the business model, competent
authorities should form an overall view on the business model viability and strategy sustainability, and any potential risks to the viability of an institution stemming from this assessment. This view should be reflected in a summary of findings, accompanied by a viability score based on the considerations specified in Table 2.
Table 2. Supervisory considerations for assigning a business model and strategy score
Score Supervisory view Considerations
1 The business model and strategy pose low level of risk to the viability of the institution.

The institution generates strong and stable
returns which are acceptable given its risk appetite and funding structure.

Score Supervisory view Considerations

There are no material asset concentrations
or unsustainable concentrated sources of income.
The institution has a strong competitive
position in its chosen markets and a strategy likely to reinforce this.
The institution has financial forecasts
drawn up on the basis of plausible assumptions about the future business environment.
Strategic plans are appropriate given the
current business model and management execution capabilities.
2 The business model and strategy pose a medium-low level of risk to the viability of the institution.
The institution generates average returns
compared to peers and/or historic performance which are broadly acceptable given its risk appetite and funding structure.
There are some asset concentrations or
concentrated sources of income.
The institution faces competitive pressure
on its products/services in one or more key markets. Some doubt about its strategy to address the situation.
The institution has financial forecasts
drawn up on the basis of optimistic assumptions about the future business environment.
Strategic plans are reasonable given the
current business model and management execution capabilities, but not without risk. 3 The business model and strategy pose a medium-high level of risk to the viability of the institution.
The institution generates returns that are
often weak or not stable, or relies on a risk appetite or funding structure to generate appropriate returns that raise supervisory concerns.
There are significant asset concentrations
or concentrated sources of income.
The institution has a weak competitive
position for its products/services in its chosen markets, and may have few business lines with good prospects. The institution’s market share may be declining significantly. There are doubts about its strategy to address the situation.
The institution has financial forecasts
drawn up on the basis of overly optimistic

Score Supervisory view Considerations assumptions about the future business environment.

Strategic plans may not be plausible given
the current business model and management execution capabilities.
4 The business model and strategy pose a high level of risk to the viability of the institution.
The institution generates very weak and
highly unstable returns, or relies on an unacceptable risk appetite or funding structure to generate appropriate returns.
The institution has extreme asset
concentrations or unsustainable concentrated sources of income.
The institution has a very poor competitive
position for its products/services in its chosen markets and participates in business lines with very weak prospects. Strategic plans are very unlikely to address the situation.
The institution has financial forecasts
drawn up on the basis of very unrealistic assumptions about the future business environment.
Strategic plans are not plausible given the
current business model and management execution capabilities.

Assessing internal governance and institution-wide controls
5.1 General considerations
98. Competent authorities should assess whether or not an institution’s internal governance
arrangements are adequate for and commensurate with the institution’s risk profile, business model, nature, size and complexity. They should identify the extent to which the institution complies with the applicable EU and national requirements regarding sound internal governance arrangements and identify any shortcomings. Competent authorities should evaluate, in particular, whether or not the internal governance arrangements ensure the sound management of risks and include appropriate internal controls and oversight. Competent authorities should establish if there are material risks posed by poor internal governance arrangements and their potential effect on the risk profile and sustainability of the institution.
99. For SREP, the assessment of institution’s internal governance and institution-wide controls
should include an assessment of the following areas:
a. the overall internal governance framework, which should include a clear organisational structure; b. the composition, organisation and functioning of the management body and its committees, where established;
c. corporate and risk culture;
d. remuneration policies and practices; e. the internal control framework, which should include well-functioning independent risk management, compliance and internal audit functions; f. the risk management framework, including ICAAP, ILAAP, new product approval process, including material changes to products, systems and processes and exceptional transactions; g. the integrity of administrative and accounting procedures; h. outsourcing policy and strategy;
i. information and communication technologies and business continuity; and
j. the recovery plan.

The assessment of internal governance should inform the specific assessment of risk
management and controls as specified in Titles 6 and 8, as well as the assessment of ICAAP and ILAAP in the SREP capital assessment (Title 7) and the SREP liquidity assessment (Title 9). Likewise, a risk-by-risk analysis of ICAAP calculations/capital estimates reviewed under Title 7, and any deficiencies identified thereby, should inform the assessment of the overall ICAAP framework assessed under this title.
In line with the EBA Guidelines on internal governance 18, the assessment of the internal
governance framework should include the verification of the existence of governance arrangements and mechanisms to ensure that the institution complies with applicable AML/CFT requirements and take into account any supplementary information received from the AML/CFT supervisor on the assessment of these arrangements and mechanisms.
5.2 Overall internal governance framework
In line with the EBA Guidelines on internal governance, the Joint ESMA and EBA Guidelines
on the assessment of the suitability of members of the management body and key function holders 19, the EBA Guidelines on disclosure requirements 20, the EBA Guidelines on outsourcing arrangements 21 and the EBA Guidelines on sound remuneration policies 22, the assessment of the internal governance framework by competent authorities should include an assessment of whether the institution demonstrates at least that:
a. the duties of the management body are clearly defined, distinguishing between the duties of the management (executive) function and of the supervisory (non-executive) function and that appropriate governance arrangements have been implemented; b. a suitable and transparent organisational and operational structure with well-defined, transparent and consistent lines of responsibility, including those of the management body and its committees has been set up;
c. the management body has set and ensured the implementation of the overall business
and risk strategies, including the setting of the institution’s risk appetite, on an individual and a consolidated basis with the appropriate involvement of the management body; d. risk culture through policies and their implementation, including communication and training, are appropriate; 18 EBA Guidelines on internal governance under Directive 2013/36/EU (EBA/GL/2021/05). 19 Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU (EBA/GL/2021/06) 20 EBA Guidelines on disclosure requirements under Part Eight of Regulation (EU) No 575/2013 (EBA /GL/2016/11). 21 EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02). EBA Guidelines on sound remuneration policies under Articles 74(3) and 75(2) of Directive 2013/36/EU and disclosures under Article 450 of Regulation (EU) No 575/2013 (EBA/GL/2021/04).

e. a selection and suitability assessment process for the members of the management body and key function holders has been implemented; f. an adequate and effective internal governance and internal control framework is in place with independent risk management, compliance and internal audit functions that have sufficient authority, stature and resources to perform their functions; g. a remuneration policy and remuneration practices that are in line with the remuneration principles set out in Articles 92 to 95 of Directive 2013/36/EU and the EBA Guidelines on sound remuneration policies have been implemented; h. arrangements aimed at ensuring the integrity of the accounting and financial reporting systems, including financial and operational controls and compliance with the law and relevant standards have been implemented;
i. an outsourcing policy and strategy that consider the impact of outsourcing on the
institution’s business and the risks it faces have been implemented; j. the internal governance framework is set, overseen and regularly assessed by the management body; and k. that the internal governance framework is transparent to stakeholders, including shareholders.
5.3 Organisation and functioning of the management body
103. In accordance with Articles 74 and 91 of Directive 2013/36/EU and with the EBA Guidelines
on internal governance and the Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders, competent authorities should assess whether:
a. arrangements aimed at ensuring that the individual and collective suitability of the management body and the individual suitability key function holders are implemented and carried out effectively upon appointment, when material changes happen (e.g. those having an impact on the conditions assessed in the context of the initial fit and proper assessment) and on an ongoing basis, including notification to the relevant competent authorities; b. the composition and succession planning of the management body are appropriate;
c. the management body has a policy in place to promote diversity within the management
body, without prejudice to anti-discrimination rules, and whether such a diversity policy is reflected in the recruitment policy for the management body, ensuring a sufficiently diverse pool of candidates;; and, as regards significant institutions, whether they have set a quantitative target for the representation of the underrepresented gender;

d. effective interaction exists between the management body in its management and supervisory functions; e. the management body in its management function appropriately directs the business and the supervisory function oversees and monitors management decision-making and actions; f. all members of the management body act independently; g. there is sufficient time commitment by the members of the management body to perform their functions; h. the limitation on the number of directorship for significant institutions as set out in Article 91(3) of Directive 2013/36/EU is complied with;
i. appropriate internal governance practices and procedures are in place for the
management body and its committees, where established; and j. the management body in its management function and in its supervisory function and the risk committee, where established, have appropriate access to information on the risk situation of the institution.
5.4 Corporate values and risk culture
104. Competent authorities should assess whether the institution has an appropriate and
transparent corporate structure that is suitable and sound, consistent corporate values and a risk culture that is comprehensive and proportionate to the nature, scale and complexity of the risks inherent to the business model and the institution’s activities, and consistent with the institution’s risk appetite.
105. In line with the EBA Guidelines on internal governance, competent authorities should
assess whether:
a. the management body fully knows and understands the legal, organisational and operational structure of the institution (‘know your structure’) and ensures that it is consistent with its approved business and risk strategy and risk appetite; b. institutions have not set up opaque or unnecessarily complex structures that have no clear economic rationale or legal purpose, or such structures raise concerns that they might be used for a purpose connected with financial crime. When setting up complex structures, the management body understands them, their purpose and the particular risks associated with them and ensures that the internal control functions are appropriately involved;

c. institutions have developed an integrated and institution-wide risk culture, based on a full
understanding and holistic view of the risks they face and how they are managed, taking into account the institution’s risk appetite; d. the institution’s ethical corporate and risk culture promotes an environment of constructive challenge in which decision-making processes encourage a broad range of views; e. institutions have implemented independent internal whistleblowing procedures and processes that allow information to be submitted in an anonymised way to the management body and other responsible functions; f. institutions appropriately manage conflicts of interests at an institutional level and have established a conflict-of-interest policy for staff to manage conflicts between the private interests of the staff and the interests of the institution; g. institutions appropriately identify, document and manage potential conflicts of interest resulting from loans or other transactions with members of the management body and their related parties; h. institutions ensure that there is no discrimination of staff and that there are equal opportunities for all genders;
i. there is clear, strong and effective communication of strategies, corporate values, a code
of conduct and/or other similar instrument, risk and other policies to all relevant staff, and the risk culture is applied across all levels of the institution; and j. as part of the code of conduct, institutions set out principles on and provide examples of acceptable and unacceptable behaviours linked in particular to financial misreporting and misconduct, economic and financial crime, including but not limited to fraud, ML/TF, antitrust practices, financial sanctions, bribery and corruption, market manipulation, misselling and other violations of consumer protection laws, tax offences, whether committed directly or indirectly, including through unlawful or banned dividend arbitrage schemes.
5.5 Remuneration policies and practices
106. Competent authorities should assess whether the institution has a remuneration policy and
practices, as specified in Articles 92 to 95 of Directive 2013/36/EU, for staff whose professional activities have a material impact on the institution’s risk profile and appropriate remuneration policies for all staff members that are gender neutral. In line with the EBA Guidelines on internal governance and the EBA Guidelines on sound remuneration policies, competent authorities should assess whether:

a. the remuneration policy is consistent with the institution’s business and risk strategies, corporate culture and values, the long-term interests of the institution and the measures taken to avoid conflicts of interest, does not encourage excessive risk-taking and is maintained, approved and overseen by the management body; b. the remuneration policy is gender neutral and institutions have taken appropriate measures to monitor the development of the gender pay gap over time;
c. staff whose professional activities have a material impact on the institution’s risk profile
(identified staff) are appropriately identified and the criteria set out in Article 92(3) of Directive 2013/36/EU and in Commission Delegated Regulation (EU) 2021/923, are properly applied, in particular with regard to:
i. the application of the qualitative and quantitative criteria for the identification of
staff; and
ii. the provisions on exclusion of staff who are identified only under the quantitative
criteria specified in Article 6 of Commission Delegated Regulation (EU) 2021/923; d. institutions have carried out a proper allocation between the fixed and variable elements of remuneration, paying particular attention to the treatment of allowances or role-based payments, guaranteed variable remuneration, severance pay etc.; e. the combination of variable and fixed remuneration is appropriate, the provisions on the limitation of the variable remuneration component to 100% of the fixed remuneration component (200% with shareholders’ approval) are complied with and variable remuneration is not paid through vehicles or methods that facilitate non-compliance with Directive 2013/36/EU or Regulation (EU) No 575/2013; f. variable remuneration for identified staff is based on performance, the requirements on deferral, retention, pay out in instruments and the application of malus and clawback are respected and the institution does not use vehicles or practices to circumvent remuneration requirements; g. institutions properly apply the remuneration requirements on a consolidated or subconsolidated basis in accordance with Article 109 of Directive 2013/36/EU; and h. institutions give adequate consideration to restrictions regarding variable remuneration as a consequence of receiving state support or due to recommendations or decisions of competent authorities.
5.6 Internal control framework
107. Competent authorities should assess whether the institution has an appropriate internal
control framework. This assessment should include, at least whether:

a. the institution has adequate written internal control policies in place and has implemented an internal control framework within the business units, other relevant units and within independent internal control functions; b. there is a clear, transparent and documented decision-making process with a clear allocation of responsibilities for implementation of the internal control framework and its components;
c. there is an adequate segregation of duties and information barriers where necessary;
d. all independent internal control functions are effective and have appropriate and sufficient resources, authority and stature to fulfil their mission, and where necessary direct access to the management body in its supervisory function; e. the internal control framework covers all areas of the institution, with a clear allocation of business and support units being responsible in the first instance for establishing and maintaining adequate internal controls and risk management procedures; f. there is exchange of the necessary information, including policies, mechanisms and procedures and their updates, in a timely manner that ensures that the management body, business lines and internal units, including each independent internal control function, are able to carry out their duties; g. the institution has a new product approval policy and process (NPAP), including a process for material changes or exceptional transactions, with a clearly specified role for the independent risk management and compliance functions, approved by the management body; h. the institution has the capacity to produce written risk reports, uses them for management purposes and such risk reports are:
i. timely, accurate, concise, comprehensive, clear and useful; and
ii. produced and communicated to the relevant parties with the appropriate
frequency; and
i. internal audit recommendations are subject to a formal follow-up procedure by the
appropriate levels of management to ensure and report on their effective and timely resolution. Risk management function
108. In line with the EBA Guidelines on internal governance, competent authorities should
assess whether the institution has established an independent risk management function and at least whether such a function:

a. is a central organisational feature covering the whole institution and structured so that it can implement risk policies and control the risk management framework and is actively involved in all material risk management decisions; b. ensures that all group-wide risks are identified, measured, assessed, monitored and properly reported on by the relevant business lines or internal units and that the risk strategy is complied with;
c. independently assesses breaches of risk appetite or limits and informs the business
units and management body, recommending possible remedies.
109. Taking into account the EBA Guidelines on internal governance, competent authorities
should assess whether the head of the risk management function has sufficient expertise, authority, stature and independence. Compliance function
110. In line with the EBA Guidelines on internal governance, competent authorities should
assess whether the institution has established a permanent, independent and effective compliance function and at least whether such a function:
a. is subject to a well-documented compliance policy which is communicated to all staff and overseen by the management body; b. ensures that compliance monitoring is carried out through a structured and welldefined compliance monitoring programme and that the compliance policy is observed.
111. Taking into account the EBA Guidelines on internal governance, competent authorities
should assess whether institutions appointed a person responsible for the compliance function across the institution. Where such a person is at the same time the head of the risk management function or performs another senior role, competent authorities should assess whether there may be any conflict of interest. Internal audit function
112. In line with the EBA Guidelines on internal governance, competent authorities should
assess whether the institution has established an effective independent internal audit function that:
a. adheres to national and international professional standards; b. has its purpose, authority and responsibility defined in a mandate that recognises professional standards and that is approved by the management body;

c. has its organisational independence and the internal auditors’ objectivity protected,
including by an appropriate segregation of duties and direct reporting lines to the management body; d. assesses the appropriateness of the institution’s governance framework, including whether existing policies and procedures remain adequate and comply with legal and regulatory requirements, with decisions of the management body and with the risk appetite and strategy of the institution; e. assesses whether procedures are correctly and effectively implemented (e.g. compliance with conduct requirements of transactions, compliance of the level of risk effectively incurred with the risk appetite and limits, etc.); f. assesses the adequacy, quality and effectiveness of the controls performed and the reporting done by the business units and the internal risk management and compliance functions; g. adequately covers all areas in a risk-based audit plan, including ICAAP, ILAAP and NPAP; and h. determines if the institution adheres to internal policies and relevant EU and national legislation and addresses any deviations from either.
5.7 Risk management framework
113. Competent authorities should assess whether the institution has established an
appropriate risk management framework and risk management processes. Competent authorities should review, at least:
a. whether the risk strategy, risk appetite and risk management framework are appropriate and implemented on an individual and a consolidated basis; b. the ICAAP and ILAAP frameworks;
c. stress testing capabilities and results;
d. whether the institution has established an independent risk management function covering the whole institution, which is actively involved in drawing up the institution’s risk strategy and all material risk management decisions, and which provides the management body and business units with all relevant risk-related information; e. whether the institution has a head of the risk management function with sufficient expertise, independence and seniority, and, where necessary, direct access to the management body in its supervisory function;

f. whether the independent risk management function ensures that the institution’s risk measurement, assessment and monitoring processes are appropriate; g. whether the institution has put in place policies and procedures to identify, measure, monitor, mitigate and report risk and associated risk concentrations and whether these are in line with the institution’s risk limits and risk appetite or are approved by the management body; and h. whether the institution has established strengthened processes for the approval of decisions on which the head of the risk management function or head of compliance have expressed a negative view.
5.7.1 Risk appetite framework and strategy
114. When assessing the risk management framework, competent authorities should consider
the extent to which it is embedded in, and how it influences, the overall strategy of the institution. Competent authorities should, in particular, assess if there are appropriate and consistent links between the business strategy, the risk strategy, risk appetite and risk management framework, and the capital and liquidity management frameworks.
115. When reviewing the risk strategy, risk appetite and risk management framework of an
institution, competent authorities should assess whether:
a. the responsibility of the management body in respect of the risk strategy, risk appetite and risk management framework is exercised in practice by providing appropriate direction and oversight; b. the risk strategy and risk appetite consider all material risks to which the institution is exposed and contain risk limits, tolerances and thresholds;
c. the risk strategy and risk appetite are consistent and implemented;
d. the risk appetite framework is forward-looking, in line with the strategic planning horizon set out in the business strategy and regularly reviewed; e. the risk strategy and appetite appropriately consider the risk tolerance and financial resources of the institution (i.e. the risk appetite should be consistent with supervisory own funds and liquidity requirements and other supervisory measures and requirements); and f. the risk strategy and risk appetite statement are documented in writing and there is evidence that they have been communicated to the staff of the institution.
5.7.2 ICAAP and ILAAP frameworks

Competent authorities should periodically review the institutions’ ICAAP and ILAAP based
on the information collected from the institutions in accordance with the EBA Guidelines on ICAAP and ILAAP information collected for SREP purposes 23 and determine their soundness, effectiveness and comprehensiveness according to the criteria specified in this section. Competent authorities should also assess how ICAAP and ILAAP are integrated into overall risk management and strategic management practices, including capital and liquidity planning.
These assessments should contribute to the determination of additional own funds
requirements and the assessment of capital adequacy as outlined in Title 7, as well as to the evaluation of liquidity adequacy as outlined in Title 9. Soundness of the ICAAP and ILAAP
To evaluate the soundness of the ICAAP and ILAAP, competent authorities should consider
whether the policies, processes, inputs and models constituting the ICAAP and ILAAP are proportionate to the nature, scale and complexity of the activities of the institution. To do so, competent authorities should assess the appropriateness of the ICAAP and ILAAP for assessing and maintaining an adequate level of internal capital and liquidity to cover risks to which the institution is or might be exposed and to make business decisions (e.g. in relation to allocating capital under the business plan), including under stressed conditions in line with the EBA Guidelines on institutions’ stress testing.
In the assessment of the soundness of the ICAAP and ILAAP, competent authorities should
consider, where relevant:
a. whether methodologies and assumptions applied by institutions are appropriate and consistent across risks, are grounded in solid empirical input data, use robustly calibrated parameters and are applied equally for risk measurement and capital and liquidity management; b. whether the confidence level is consistent with the risk appetite and whether the internal diversification assumptions reflect the business model and the risk strategies;
c. whether the definition and composition of available internal capital or liquidity resources
considered by the institution for the ICAAP and ILAAP are consistent with the risks measured by the institution and are eligible for the calculation of own funds and liquidity buffers; and d. whether the distribution/allocation of available internal capital and liquidity resources among business lines or legal entities properly reflects the risk to which each of them is or may be exposed, and properly takes into account any legal or operational constraints on the transferability of these resources. 23 EBA Guidelines on ICAAP and ILAAP information collected for SREP purposes (EBA/GL/2016/10)

Effectiveness of the ICAAP and ILAAP
120. When assessing the effectiveness of the ICAAP and ILAAP, competent authorities should
examine their use in the decision-making and management processes at all levels in the institution (e.g. limit setting, performance measurement, etc.). Competent authorities should assess how the institution usesthe ICAAP and ILAAP in its risk, capital and liquidity management (use test). The assessment should consider the interconnections and interrelated functioning of the ICAAP and ILAAP with the risk appetite framework, risk management, and liquidity and capital management, including forward-looking funding strategies, and whether they are appropriate for the business model and complexity of the institution.
121. To this end, competent authorities should assess whether the institution has policies,
procedures and tools to facilitate:
a. clear identification of the functions and/or relevant committees responsible for the different elements of the ICAAP and ILAAP (e.g. modelling and quantification, internal auditing and validation, monitoring and reporting, issue escalation, etc.); b. capital and liquidity planning: the calculation of capital and liquidity resources on a forward-looking basis (including in assumed stress scenarios) in connection with the overall strategy or significant transactions;
c. the allocation and monitoring of capital and liquidity resources among business lines and
risk types (e.g. risk limits defined for business lines, entities or individual risks are consistent with the objective of ensuring the overall adequacy of the institution’s internal capital and liquidity resources); d. the regular and prompt reporting of capital and liquidity adequacy to senior management and to the management body (in particular, the frequency of reporting should be adequate with respect to risks and business-volume development, existing internal buffers and the internal decision-making process to allow the institution’s management to put in place remedial actions before capital or liquidity adequacy is jeopardised); and e. senior management or management body awareness and actions, where business strategy and/or significant individual transactions may be inconsistent with the ICAAP and available internal capital (e.g. senior-management approval of a significant transaction where the transaction is likely to have a material impact on available internal capital) or with the ILAAP and available internal liquidity resources ILAAP.
122. Competent authorities should assess whether the management body demonstrates
appropriate commitment to and knowledge of the ICAAP and ILAAP and their outcomes. In particular, they should assess whether the management body approves the ICAAP and ILAAP frameworks and outcomes and, where relevant, the outcomes of internal validation of the ICAAP and ILAAP.

Competent authorities should assess the extent to which the ICAAP and ILAAP are forwardlooking in nature. Competent authorities should do this by assessing the consistency of the
ICAAP and ILAAP with capital and liquidity plans and strategic plans.
Comprehensiveness of the ICAAP and ILAAP
Competent authorities should assess the ICAAP’s and ILAAP’s coverage of business lines,
legal entities and risks to which the institution is or might be exposed, and the ICAAP’s and ILAAP’s compliance with legal requirements. In particular, they should assess:
a. whether the ICAAP and ILAAP are implemented homogenously and proportionately for all the relevant institution’s business lines and legal entities with respect to risk identification and assessment; b. whether the ICAAP and ILAAP cover all material risks regardless of whether the risk arises from entities not subject to consolidation (special-purpose vehicles (SPVs), specialpurpose entities (SPEs)); and
c. where any entity has different internal governance arrangements or processes from the
other entities of the group, whether these deviations are justified (e.g. the adoption of advanced models by only part of the group may be justified by a lack of sufficient data to estimate parameters for some business lines or legal entities, provided that these business lines or legal entities do not represent a source of risk concentration for the rest of the portfolio).
5.7.3 Assessment of institutions’ stress testing
Competent authorities should review and assess institutions’ stress testing programmes
and their compliance with the EBA Guidelines on institutions’ stress testing, taking into account the size and internal organisation of institutions and the nature, scale and complexity of their activities, in particular in relation to governance arrangements, data infrastructure, use of stress testing in ICAAP and ILAAP and management actions as referred to in Title 4 of those guidelines.
Competent authorities should perform a qualitative assessment of stress testing
programmes, as well as a quantitative assessment of the results of stress tests. Competent authorities should consider the outcomes of qualitative and quantitative assessments together with the results of supervisory stress tests (see Title 12) for the purposes of assessing capital and liquidity adequacy and determining the appropriate supervisory response to the deficiencies identified.
Furthermore, supervisory assessments of institutions’ stress testing programmes, and the
outcomes of various stress tests performed by an institution as part of its stress testing programme, could inform the assessment of various SREP elements and, in particular:

a. The identification of possible vulnerabilities or weaknesses in risk management and controls on individual risk areas. These should be used as an additional source of information to be taken into account by the competent authorities when assessing individual risks to capital as referred to in Title 6 of these Guidelines, or risks to liquidity and funding as referred to in Title 8 of these Guidelines. Scenario and sensitivity analyses performed by an institution can be used to assess the exposure to individual risks and the related sensitivities to underlying risk factors. b. The identification of possible deficiencies in overall governance arrangements or institution-wide controls. These should be considered by competent authorities as an additional source of information for the purposes of the SREP assessment of internal governance and institution-wide controls. Furthermore, the results of an institution’s stress tests can be used in assessing the institution’s capital planning, and in particular its time dimension.
c. The quantification of specific quantitative liquidity requirements in the context of the
assessment of liquidity adequacy, especially where a competent authority has not developed specific supervisory benchmarks for liquidity requirements, or does not apply liquidity supervisory stress testing. Qualitative assessment of institutions’ stress testing programmes
128. When assessing institutions’ stress testing programmes, competent authorities should
consider all relevant sources of information about stress testing programmes and methodologies, including institutions’ own internal assessments and validation or reviews undertaken by independent internal control functions, as well as information and estimations provided by third parties, where available.
129. Competent authorities should assess how institutions design, manage and oversee their
stress testing programmes and they should assess the adequacy of these programmes, by taking into account in particular:
a. the institution’s ability and the infrastructure available, including with regard to data availability and data aggregation, to implement the stress testing programme in individual business lines and entities and across the group, where relevant; b. the adequacy of possible interlinkages between solvency and liquidity stress tests;
c. the adequacy of the institutions’ assessment of stress testing programmes to determine
their effectiveness and robustness; and d. the adequacy of the frequency of stress tests, having regard to the scope and type of the stress test, the nature, scale, size and complexity of the activities of the institutions, portfolio characteristics and macroeconomic environment.

Competent authorities should also assess the use of stress test results in institutions’ risk
and strategic management, and in particular:
a. the extent to which stress testing is embedded in an institution’s risk management framework and in the process of setting up the risk appetite and limits; b. the involvement of senior management and of the management body in the stress testing programme and the related internal reporting of the institution;
c. the integration of stress testing and its outcomes into decision-making throughout the
institution;
When assessing stress testing programmes, the results of stress tests and proposed
management actions, competent authorities should consider both idiosyncratic and systemwide perspectives. In particular, management actions should be primarily assessed from an internal perspective with regard to their plausibility, considering the specificities of an individual institution. Competent authorities should also consider management actions from a system-wide perspective, as other institutions are likely to consider similar actions, which in a system-wide context may be implausible.
When assessing management actions with an effect on an institution’s capital or general
financial position, competent authorities should consider their feasibility in stress situations and the timelines for the implementation of the action. In particular, management actions should be completed and implemented during the time horizon of the stress test. Competent authorities may also consider, where relevant, management actions that will be completed later than the time horizon of the stress test.
Competent authorities should take into account the effectiveness of institutions’ stress
testing programmes in identifying relevant business vulnerabilities and take this into consideration when assessing institutions’ business model viability and sustainability of their strategies (see Title 4).
When assessing stress testing programmes and their results in the case of cross-border
groups, competent authorities should consider the transferability of capital and liquidity between the legal entities or business units during stressed conditions, as well as the functioning of any established intra-group financial support arrangements, taking into account the funding difficulties that might be expected in stressed conditions. Quantitative assessment of institutions’ stress tests
Competent authorities, in addition to carrying out the qualitative assessment specified
above, should assess and challenge the choice and use of scenarios, assumptions and methodologies, and should assess in particular:

a. their severity of scenarios, also taking into account the scenarios outlined in the reverse stress testing, their occurrence probability and their relevance to the business model of the institution; b. whether the scenarios are severe but plausible, internally consistent and forwardlooking;
c. whether the scenarios address all major institution-specific vulnerabilities and
include all material products and business lines; d. the impact of the assumptions on the outputs of stress tests.
136. When challenging scenarios, assumptions and the outcomes of institutions’ stress tests,
competent authorities should use, where appropriate, the outcomes, scenarios and assumptions from supervisory stress tests, including relevant regional stress test exercises done by various authorities, such as the EBA, the IMF and the ESCB/ESRB, as well the qualitative assessment as specified above, to determine the extent to which the institution’s stress testing programme and its outcomes can be relied on.
137. If competent authorities identify deficiencies in the design of the scenarios or assumptions
used by institutions, they may require institutions to rerun their stress tests, or some specific parts of the stress testing programme using modified assumptions provided by the competent authorities, or specific prescribed scenarios (e.g. the anchor scenarios defined in the EBA Guidelines on institutions’ stress testing).
138. Competent authorities should assess the results of stress tests, in particular with regard to
stress tests performed in the context of capital and liquidity risk management, including the ones for ICAAP and ILAAP purposes (see also Section 5.7.2) and they should ensure that in a stress scenario used for capital adequacy purposes the capital ratio is negatively affected as the result of, for example, credit rating migrations, a reduction in net interest margins or trading losses.
139. In their reviews of stress tests performed in the context of capital and liquidity risk
management, including for ICAAP and ILAAP purposes, competent authorities should carry out a combined assessment of the impact of stress test outcomes on capital and liquidity needs, as well as on other relevant regulatory requirements. To that end, competent authorities should assess whether the institution is able to maintain the applicable TSCR, at all times, in an adverse scenario and if it has identified a set of management actions to address any potential breaches of TSCR.
140. Competent authorities should also consider the impact of stress tests on an institution’s
leverage ratio, as well as its eligible liabilities held for the purposes of minimum requirements for eligible liabilities (MREL) as referred to in Directive 2014/59/EU.

In the assessment of stress test results, competent authorities should also consider all
known future regulatory changes affecting institutions within the scope and time horizon of the stress test exercise. Likewise, competent authorities should also consider all known changes in future capital requirements (e.g. fully loaded assessments) when assessing stress test results and business-model viability.
5.7.4 New products and significant changes
Competent authorities should assess whether the institution has in place a welldocumented NPAP, approved by the management body, that addresses the development of
new markets, products and services, including their underlying processes and systems, and significant changes to existing ones, as well as exceptional transactions.
Competent authorities should assess whether the risk management function and
compliance function are appropriately involved in approving new products or significant changes to existing products, processes and systems, and that approval of new products is linked to the adequateness of respective controls.
5.8 Information and communication technologies and business
continuity management
In line with the EBA Guidelines on internal governance and the EBA Guidelines on ICT and
security risk management
24, competent authorities should assess whether the institution’s information and communication technologies are effective and reliable and whether these systems fully support risk data aggregation capabilities at normal times, as well as during times of stress. In particular, competent authorities should assess whether the institution is at least able to:
a. generate accurate, consistent, complete and reliable aggregated risk data for business units and the entire institution; b. capture and aggregate all material risk data across the institution;
c. generate aggregate and up-to-date risk data and risk reports in a timely manner with
sufficient frequency; and d. generate adaptable aggregate risk data and risk reporting to meet a broad range of ondemand requests from the management body or competent authorities, including ad hoc requests due to changing internal or external needs.
Competent authorities should assess whether the institution has established effective
business continuity management with tested contingency and business continuity plans, as well 24 EBA Guidelines on ICT and security risk management (EBA/GL/2019/04).

as disaster recovery plans for all its critical functions, including outsourced critical functions and resources, and whether those plans can credibly recover these.
5.9 ML/TF risks and prudential concerns
146. When analysing the internal governance framework and institution-wide controls,
competent authorities should also take into account the assessments received from AML/CFT supervisors, and evaluate whether these give rise to prudential concerns. This could be the case in particular where findings point to material weaknesses in an institution’s AML/CFT systems and controls. Conversely, where the competent authority’s assessment indicates the shortcomings in an institution’s internal controls and governance framework and institutionwide controls give rise to prudential concerns related to ML/TF risk, competent authorities should share the outcome of that assessment with AML/CFT supervisors 25 .
147. Competent authorities should assess whether the institution’s overall governance
framework includes also the management of the ML/TF risks.
148. In line with the EBA Guidelines on internal governance 26 and Joint ESMA and EBA Guidelines
on the assessment of the suitability of the members of the management body and key function holders 27 competent authorities should assess from a prudential perspective whether the responsibilities of the management body with regard to ML/TF risks are being complied with. Competent authorities should take into account any supplementary information received from the AML/CFT supervisors following their assessment in line with the EBA Guidelines on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer 28 .
5.10 Recovery planning
149. To assess internal governance and institution-wide controls, competent authorities should
consider any findings and deficiencies identified in the assessment of recovery plans and recovery planning arrangements conducted in accordance with Articles 6 and 8 of Directive 2014/59/EU.
150. Similarly, findings from the assessment of SREP elements, including internal governance
and institution-wide control arrangements, should inform the assessment of recovery plans. 25 In accordance with the EBA AML/CFT Cooperation Guidelines (EBA/GL/2021/15) 26 EBA Guidelines on internal governance under Directive 2013/36/EU (EBA/GL/2021/05). 27 Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU (EBA/GL/2021/06). 28 EBA Guidelines on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer under Article 8 and Chapter VI of Directive (EU) 2015/849 (EBA/GL/2022/05).

5.11 Application at the consolidated level and implications for
group entities
151. At the consolidated level, in addition to the elements covered in the sections above,
competent authorities should assess whether:
a. the management body of the consolidating institution understands both the organisation of the group and the roles of its different entities, and the links and relationships among them; b. the organisational and legal structure of the group – where relevant – is clear and transparent, and suitable for the size and the complexity of the business and operations;
c. the institution has established an effective group-wide management information and
reporting system applicable to all business units and legal entities, and this information is available to the management body of the institution’s parent undertaking on a timely basis; d. the management body of the consolidating institution has established consistent groupwide strategies, including a group wide risk strategy and appetite framework; e. group risk management covers all material risks regardless of whether the risk arises from entities not subject to consolidation (including SPVs, SPEs, property firms, legal arrangements, entities managed on behalf of customers as trustee or nominee) and establishes a comprehensive view on all risks; f. the institution carries out regular stress testing covering all material risks and entities in accordance with the EBA Guidelines on institutions’ stress testing; and g. the group-wide internal audit function is independent, has a group-wide risk based audit plan, is appropriately staffed and resourced, has appropriate stature and has a direct reporting line to the management body of the consolidating institution.
152. When conducting the assessment of internal governance and institution-wide controls at
subsidiary level, in addition to the elements listed in this title, competent authorities should assess whether group-wide policies and procedures are implemented consistently at subsidiary level and whether group entities have taken steps to ensure that their operations are compliant with all applicable laws and regulations.
5.12 Summary of findings and scoring
153. Following the above assessments, competent authorities should form a view on the
adequacy of the institution’s internal governance arrangements and institution-wide controls.

This view should be reflected in a summary of findings, accompanied by a viability score based on the considerations specified in Table 3.
Table 3. Supervisory considerations for assigning a score for internal governance and institutionwide controls
Score Supervisory view Considerations
1 Deficiencies in internal governance and institution-wide control arrangements pose a low level of risk to the viability of the institution.

The institution has a robust and
transparent organisational structure with clear responsibilities and separation of risk-taking from risk management and control functions.
There is a sound corporate culture,
management of conflicts of interest and whistleblowing processes.
The composition and functioning of the
management body are appropriate.
The time commitment of members of the
management body is appropriate and they comply with the limitation on the number of directorships, where relevant.
The institution has adopted a diversity
policy that fosters a diverse board composition and complies with the targets set.
The remuneration policy is in line with
the institution’s risk strategy and longterm interests.
The risk management framework and risk
management processes, including the
ICAAP, ILAAP, NPAP, stress testing framework, capital planning and liquidity planning, are appropriate.
The internal control framework and
internal controls are appropriate.
The risk management, compliance and
internal audit functions are independent and have sufficient resources, and the internal audit function operates effectively in accordance with established international standards and requirements.
Information and communication
technologies and business continuity arrangements are appropriate.
The recovery plan is credible and
recovery planning arrangements are appropriate.

Score Supervisory view Considerations
2 Deficiencies in internal governance and institution-wide control arrangements pose a medium-low level of risk to the viability of the institution.

The institution has a largely robust and
transparent organisational structure with clear responsibilities and separation of risk-taking from risk management and control functions.
There is a largely sound corporate
culture, management of conflicts of interest and whistleblowing processes.
The composition and functioning of the
management body are largely appropriate.
The time commitment of members of
the management body is largely appropriate, and, where relevant, they comply with the limitation on the number of directorships.
The institution has adopted a diversity
policy that fosters a diverse board composition, and largely complies with the targets set or has implemented appropriate measures to achieve the targets defined in the policy.
The remuneration policy is largely in line
with the institution’s risk strategy and long-term interests.
The risk management framework and risk
management processes, including the
ICAAP, ILAAP, NPAP, stress testing framework, capital planning and liquidity planning, are largely appropriate.
The internal control framework and
internal controls are largely appropriate.
The risk management, compliance and
internal audit functions are independent and their operations are largely effective.
Information and communication
technologies and business continuity arrangements are largely appropriate.
The recovery plan is largely credible. The
recovery planning arrangements are largely appropriate.
3 Deficiencies in internal governance and institution-wide control arrangements pose a medium-high
The institution’s organisational structure
and responsibilities are not fully transparent and risk-taking is not fully separated from risk management and control functions.

Score Supervisory view Considerations level of risk to the viability of the institution.

There are doubts about the
appropriateness of the corporate culture, management of conflicts of interest and/or whistleblowing processes.
There are doubts about the
appropriateness of the composition and functioning of the management body.
There are doubts about the appropriate
time commitment of members of the management body and where relevant they do not comply with the limitation on the number of directorships.
The institution has not adopted a
diversity policy or has not put measures in place to achieve an appropriate level of diversity.
There are concerns that the
remuneration policy may conflict with the institution’s risk strategy and longterm interests.
There are doubts about the
appropriateness of the risk management framework and risk management processes, including the ICAAP, ILAAP, NPAP, stress testing framework, capital planning and/or liquidity planning.
There are doubts about the
appropriateness of the internal control framework and internal controls.
There are doubts about the
independence and effective operation of the risk management, compliance and internal audit functions.
There are doubts about the
appropriateness of information and communication technologies and business continuity arrangements.
The recovery plan was assessed as
potentially having material deficiencies and/or having material impediments to its implementation and supervisory concerns have not been fully addressed. There are doubts about the appropriateness of arrangements for recovery planning.

Score Supervisory view Considerations
4 Deficiencies in internal governance and institution-wide control arrangements pose a high level of risk to the viability of the institution.

The institution’s organisational structure
and responsibilities are not transparent and risk-taking is not separated from risk management and control functions.
The corporate culture, management of
conflicts of interest and/ or whistleblowing processes are inappropriate.
The composition and functioning of the
management body are inappropriate.
The time commitment of members of the
management body is insufficient, and, where relevant, they do not comply with the limitation on the number of directorships.
The institution has not adopted a
diversity policy, the management body is not diverse and the institution has not put measures in place to aim for an appropriate level of diversity.
The remuneration policy conflicts with
the institution’s risk strategy and longterm interests.
The risk management framework and the
risk management processes, including the ICAAP, ILAAP, NPAP, stress testing framework, capital planning and/or liquidity planning, are inappropriate.
The risk management, compliance
and/or internal audit function is not independent and/or the internal audit functions are not operating in accordance with established international standards and requirements; operations are not effective.
The internal control framework and
internal controls are inappropriate.
The information systems and business
continuity arrangements are inappropriate.
The recovery plan was assessed as having
material deficiencies and/or having material impediments to its implementation and supervisory concerns have not been fully addressed.

Score Supervisory view Considerations
The recovery planning arrangements are inappropriate.

Assessing risks to capital
6.1 General considerations
154. Competent authorities should assess and score the risks to capital that have been identified
as material for the institution.
155. The purpose of this title is to provide common methodologies to be considered for
assessing individual risks and risk management and controls. It is not intended to be exhaustive and gives leeway to competent authorities to take into account other additional criteria that may be deemed relevant based on their experience and the specific features of the institution.
156. This title provides competent authorities with guidelines for the assessment and scoring of
the following risks to capital:
a. credit and counterparty risk; b. market risk;
c. operational risk;
d. interest rate risk from non-trading activities (IRRBB).
157. The title also identifies a set of subcategories within each risk category above, which need
to be taken into account when risks to capital are assessed. Depending on the materiality of any these subcategoriesto a particular institution, they can be assessed and scored individually.
158. The decision on materiality depends on the supervisory judgement. However, for FX
lending risk, in light of the ESRB Recommendation on lending in foreign currencies 29 , materiality should be determined taking into account the following threshold:
Loans denominated in foreign currency to unhedged borrowers constitute at least 10% of an institution’s total loan book (total loans to non-financial corporations and households), where such a total loan book constitutes at least 25% of the institution’s total assets.
159. Competent authorities should also assess other risks that are identified as material to a
specific institution but are not listed above (e.g. pension risk, reputational risk, strategic and business risk, step-in risk, intra- and inter-risk concentration). The following may assist with the identification process:
a. drivers of TREA;
29 ESRB Recommendation on lending in foreign currencies (ESRB/2011/1), OJ C 342, 22.11.2011, p. 1.

b. risks identified in the institution’s ICAAP;
c. risks arising from the institution’s business model (including those identified by
other institutions operating a similar business model); d. information stemming from the monitoring of key indicators; e. findings and observations from internal or external audit reports; and f. recommendations and guidelines issued by the EBA, as well as warnings and recommendations issued by macroprudential authorities or the ESRB.
160. The above elements should also be taken into account by competent authorities when they
are planning the intensity of their supervisory activity in relation to the assessment of a specific risk.
161. For credit, market and operational risk, competent authorities should verify the
institution’s compliance with the minimum requirements specified in the relevant EU and national implementing legislation. However, these guidelines extend the scope of the assessment beyond those minimum requirements to allow competent authorities to form a comprehensive view on risks to capital.
162. When evaluating risks to capital, competent authorities should also consider the potential
impact of funding cost risk following the methodology included in Title 8 and may decide on the necessity of measures to mitigate this risk.
163. In their implementation of the methodologies specified in this title, competent authorities
should identify relevant quantitative indicators and other metrics, which could also be used to monitor key indicators, as specified in Title 3.
164. For each material risk, competent authorities should assess and reflect in the risk score:
a. inherent risk (risk exposures); and b. the quality and effectiveness of risk management and controls.
165. This assessment flow is represented in Figure 4 below.

Figure 4. Assessment workflow for risks to capital
166. When performing their assessments, competent authorities should use all available
information sources, including regulatory reporting, ad hoc reporting agreed with the institution, the institution’s internal metrics and reports (e.g. internal audit report, risk management reports, information from the ICAAP), on-site inspection reports and external reports (e.g. the institution’s communications to investors, rating agencies). While the assessment is intended to be institution-specific, comparison with peers should be considered to identify potential exposure to risks to capital. For such purposes, peers should be defined on a risk-by-risk basis and might differ from those identified for BMA or other analyses.
167. In the assessment of risks to capital, competent authorities should also evaluate the
accuracy and prudency of the calculation of minimum own fund requirements to identify situations where minimum own funds calculations may underestimate the actual level of risk. This assessment would inform the determination of additional own funds requirements as provided in Section 7.2.3.
168. The outcome of the assessment of each material risk should be reflected in a summary of
findings that provides an explanation of the main risk drivers, and a risk score, as specified in the following sections.
6.2 Assessment of credit and counterparty risk
6.2.1 General considerations
169. Competent authorities should assess credit risk arising from all banking book exposures
(including off-balance sheet items). They should also assessthe counterparty credit risk and the settlement risk that could fall under both banking and trading books.
170. In assessing credit risk, competent authorities should consider all the components that
determine potential credit losses, and in particular: the probability of a credit event (i.e. default), or correlated credit events, that mainly concerns the borrowers and their ability to repay relevant obligations; the size of exposures subject to credit risk; and the recovery rate of Assessment of risks management and controls Assessment of inherent individual risks Assessment of individual risks and controls Risk score Inherent risk assessment Risk management and controls assessment

the credit exposures in the event of borrowers defaulting. For all these components, competent authorities should take into account the possibility that these components may deteriorate over time and worsen compared to expected outcomes.
171. In addition, competent authorities should also pay attention to whether ML/TF risks are
considered within the context of the credit-granting process, including whether the institution has systems and controls in place to ensure funds used to repay loans are from legitimate sources in accordance with the EBA Guidelines on loan origination and monitoring.
6.2.2 Assessment of inherent credit risk
172. Through the assessment of inherent credit risk, competent authorities should determine
the main drivers of the institution’s credit risk exposure and evaluate the significance of the prudential impact of this risk for the institution. The assessment of inherent credit risk should therefore be structured around the following main steps:
a. preliminary assessment; b. assessment of the nature and composition of the credit portfolio;
c. assessment of portfolio credit quality;
d. assessment of the level and quality of credit risk mitigation; and e. assessment of the level of provisions and of credit valuation adjustments (CVAs).
173. Competent authorities should assess credit risk in both current and prospective terms.
Competent authorities should combine the analysis of the current portfolio’s credit risk with the assessment of the institution’s credit risk strategy, credit risk appetite and credit risk limits (potentially as part of the wider assessment of strategy carried out as part of the BMA). Competent authorities should also consider how the expected, as well as the stressed, macroeconomic developments could affect those elements and ultimately the institution’s earnings and own funds.
174. Competent authorities should primarily conduct the assessment at both portfolio and
asset-class level. Where relevant, competent authorities should also conduct a more granular assessment, potentially at the level of single borrowers or transactions. Competent authorities may also use sampling techniques when assessing portfolio risk.
175. Competent authorities may perform the assessment vertically (i.e. by considering all the
dimensions for relevant sub-portfolios) or horizontally (i.e. by considering one dimension, for example credit quality, for the overall portfolio). 30 EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06)

Preliminary assessment
176. To determine the scope of the assessment of credit risk, competent authorities should first
identify the sources of credit risk to which the institution is or may be exposed. To do so, competent authorities should leverage the knowledge gained from the assessment of other SREP elements, from the comparison of the institution’s position to peers and from any other supervisory activities.
177. As a minimum, competent authorities should consider the following:
a. the credit risk strategy and appetite and relevant limits; b. the own funds requirement for credit risk compared to the total own funds requirement, and – where relevant – the internal capital allocated for credit risk compared to the total internal capital, including the historical change in this figure and forecasts, if available;
c. the nature, size, composition and quality of the institution’s on- and off-balance
sheet credit-related items; d. the level and change over time of impairments and write-offs and of the default rates of the credit portfolio; and e. the risk-adjusted performance of the credit portfolio.
178. Competent authorities should perform the preliminary analysis considering the change in
the above over time to form an informed view of the main drivers of the institution’s credit risk.
179. Competent authorities should focus their assessments on those drivers and portfolios
deemed the most material.
Nature and composition of the credit portfolio
180. Competent authorities should assess the nature of the credit exposures (i.e. the types of
borrowers and exposures) to identify the underlying risk factors and they should analyse the composition of the institution’s credit portfolio. Competent authorities should perform this analysis in both current and prospective terms, in light of the general macroeconomic situation.
181. In performing this assessment, competent authorities should also consider how the nature
of credit risk exposure can affect the size of exposure (e.g. credit lines/undrawn commitments drawn down by borrowers, foreign currency denomination, etc.), taking into consideration the institution’s legal capacity to unilaterally cancel undrawn amounts of committed credit facilities.

To assess the nature of credit risk, competent authorities should consider at least the
following subcategories of credit risk by carrying out a more detailed assessment of those subcategories which are considered most relevant for the institution:
a. credit concentration risk; b. counterparty credit risk and settlement risk;
c. country risk;
d. credit risk from securitisations; e. FX lending risk; f. specialised lending; g. equity risk in the banking book; h. real estate risk; and
i. model risk for regulatory approved models.
Credit concentration risk
Competent authorities should form a view on the degree of credit concentration risk, as
referred to in Article 81 of Directive 2013/36/EU, to which the institution is exposed. Specifically, competent authorities should assess the risk that the institution will incur significant credit losses stemming from a concentration of exposures to a small group of borrowers, to a set of borrowers with similar default behaviour or to highly correlated financial assets.
Competent authorities should conduct this assessment by considering different categories
of credit concentration risk, including:
a. single-name concentrations (including a client or group of connected clients as defined for large exposures); b. sectoral concentrations;
c. geographical concentrations;
d. product concentration; and e. collateral and guarantees concentration.
To identify credit concentrations, competent authorities should consider the common
drivers of credit risk across exposures and should focus on those exposures that tend to exhibit similar behaviour (i.e. high correlation).
Competent authorities should pay particular attention to hidden sources of credit
concentration risk that can materialise under stressed conditions, when the level of credit risk correlation can increase compared to normal conditions and when additional credit exposures can arise from off-balance sheet items.
For groups, competent authorities should consider the credit concentration risk that can
result from consolidation, which may be not evident at an individual level.
When assessing credit concentrations, competent authorities should consider the
possibility of overlaps (e.g. a high concentration to a specific government will probably lead to a country concentration and single-name concentration), and should therefore avoid applying a simple aggregation of the different types of credit concentration, and should instead consider underlying drivers.
To assess the level of concentration, competent authorities can use different measures and
indicators, the most common being the Herfindahl-Hirschman Index (HHI) and Gini coefficients, which may then be included in more or less complex methodologies to estimate the additional credit risk impact. Counterparty credit and settlement risks
Competent authorities should assess the counterparty credit risk arising from exposures to
derivatives and securities financing transactions and settlement risks faced by institutions.
For this assessment, the following aspects should be considered, as relevant:
a. the quality of counterparties and relevant CVAs, see also Section 6.3; b. the complexity of transactions;
c. the wrong-way risk arising when the exposure to a counterparty is adversely
correlated with the credit quality of that counterparty; d. the exposure to counterparty credit and settlement risks in terms of both current market values and nominal amount, compared to the overall credit exposure and to own funds; e. the proportion of transactions processed through financial market infrastructures (FMIs) that provide payment versus delivery settlement; f. the proportion of transactions to central counterparties (CCPs) and the effectiveness of loss protection mechanisms for them, the proportion of

transactions to CCPs established in third countries, the effectiveness of loss protection mechanisms for them, and how any excessive exposure to non-EU CCPs is reduced, in particular in the context of Commission Implementing decision (EU) 2020/1308 of 21 September 2020 31 to give financial market participants until 30 June 2022 to reduce their exposure to UK CCPs; g. the proportion of non-centrally cleared OTC transactions and the effectiveness of loss protection mechanisms for them; and h. the existence, significance, effectiveness and enforceability of netting agreements. Country risk
192. Competent authorities should assess:
a. the degree of concentration within all types of exposures to country risk, including sovereign exposures, in proportion to the whole institution’s credit portfolio (per obligor and amount); b. the economic strength and stability of the borrower’s country and its track record in terms of punctual payment and occurrence of serious default events;
c. the risk of other forms of sovereign intervention that can materially impair the
creditworthiness of borrowers (e.g. deposit freezes, expropriation or punitive taxation); d. the risk arising from a potential event (e.g. a natural or social/political event) affecting the whole country to lead to default by a large group of debtors (collective debtor risk); and e. the transfer risk linked to cross-border foreign currency lending for material crossborder lending and exposures in foreign currencies. While country risk should be reflected under the credit risk, its assessment may also inform the analysis of other types of risk. Credit risk from securitisation
193. Competent authorities should assess the credit risk related to securitisations where
institutions act as originators, investors, sponsors or credit-enhancement providers. 31 Commission Implementing Decision (EU) 2020/1308 determining, for a limited period of time, that the regulatory framework applicable to central counterparties in the United Kingdom of Great Britain and Northern Ireland is equivalent, in accordance with Regulation (EU) No 648/2012 of the European Parliament and of the Council.

To appreciate the nature of relevant exposures and their potential development,
competent authorities should:
a. understand the strategy, risk appetite and business motivations of institutions in terms of securitisations; and b. analyse securitisation exposures taking into consideration both the role played and the seniority of tranches held by institutions, as well as the type of securitisation (e.g. traditional vs. synthetic, securitisation vs. re-securitisation).
In assessing the credit risk arising from securitisation exposures, where they are considered
material, competent authorities should assess, as a minimum:
a. the appropriateness of allocation of securitisation exposures to the banking book and trading book and the consistency with the institution’s securitisation strategy; b. whether the appropriate regulatory treatment is applied to securitisations;
c. the rating and the performance of the securitisation tranches held by the
institution, as well as the nature, composition and quality of the underlying assets; d. the consistency of the capital relief with the actual risk transfer for originated securitisations. Competent authorities should also verify whether the institution provides any form of implicit (non-contractual) support for the transactions and the potential impact on own funds for credit risk; e. whether there is a clear distinction between drawn and undrawn amounts for liquidity facilities provided to the securitisation vehicle; and f. the existence of contingency plans for Asset-Backed Commercial Paper conduits managed by the institution in the event that an issuance of commercial paper is not possible because of liquidity conditions, and the impact on the total credit risk exposure of the institution. FX lending risk
Competent authorities should assess the existence and materiality of the additional credit
risk arising from FX lending exposures to unhedged retail and SME borrowers .In particular, competent authorities should assess any non-linear relationship between market risk and credit risk where exchange rates (market risk) may have a disproportional impact on the credit risk of an institution’s FX loans portfolio. Where relevant, competent authorities should extend the scope of this assessment to other types of customers that are unhedged. In particular, competent authorities should assess the higher credit risk arising from:

a. a material increase in both the outstanding value of debt and the flow of payments to service such debt; and b. an increase in the outstanding value of debt compared to the value of collateral assets denominated in the domestic currency.
197. In evaluating FX lending risk, where it is considered material, competent authorities should
assess:
a. the type of exchange-rate regime and how this could affect the changes in the FX rate between domestic and foreign currencies; b. the institution’s risk management of FX lending, measurement and control frameworks, policies and procedures, including the extent to which they cover nonlinear relationships between market and credit risk. In particular, competent authorities should assesses whether:
i. the institution explicitly identifies its FX lending risk appetite and operates
within the specified thresholds;
ii. the FX lending risk is taken into account when borrowers are assessed and
FX loans are underwritten also considering the guidance for creditworthiness assessment of borrowers applying for foreign currency loans as specified in the EBA Guidelines on loan origination and monitoring 32;
iii. the FX lending risk, including risk concentration in one or more currencies,
is appropriately addressed in the ICAAP;
iv. the institution periodically reviews the hedging status of borrowers;
v. the impact of exchange rate movements is taken into account in default
probabilities;
c. the sensitivity impact of exchange rate movements on borrowers’ credit
ratings/scoring and debt-servicing capacities; and d. possible concentrations of lending activity in a single foreign currency or in a limited number of highly correlated foreign currencies. Specialised lending
198. Competent authorities should assess specialised lending separately from other lending
activities since the risk of such exposures lies in the profitability of the asset or project financed EBA Guidelines on Loan origination and monitoring (EBA/GL/2020/06).

(e.g. commercial real estate, energy plant, shipping, commodities, etc.) rather than the borrower (which is generally a special purpose vehicle).
199. Generally, these exposures tend to be of a significant size relative to the portfolio and so
represent a source of credit concentration, of long maturity, which makes it difficult to make reliable projections of profitability.
200. In assessing the specialised lending exposures, where they are considered material,,
competent authorities should consider:
a. the profitability of the projects and the conservativeness of the assumptions underlying the business plans (including the credit risk of the main customers); b. the impact of changes in regulation, especially for subsidised sectors, on future cash flows;
c. the impact of changing market demand, where relevant, and the existence of a
market for the potential future sale of the object financed; d. the existence of a syndicate or of other lenders sharing the credit risk; and e. any form of guarantee pledged by the sponsors. Equity risk in the banking book
201. Competent authorities should assess the risk of decline in the value of the institution’s
equity investments and ensure that this risk is appropriately captured by the institution’s risk framework. Such an assessment should particularly focus, where relevant, on participation risk in strategic holdings (both insurance and non-insurance). Real-estate risk
202. Competent authorities should assess the risk of decline in the value of the institution’s real
estate investments and ensure that this risk is appropriately captured by the institution’s risk framework. Such an assessment should also focus, where relevant, on the value of financial instruments linked to real estate assets (e.g. real estate investment trusts, REITs). Model risk for regulatory approved models
203. In cases where institutions are using regulatory approved internal models for the purpose
of calculating own funds requirements for credit risk, competent authorities should monitor whether the institution continues to fulfil the minimum requirements and ensure that related own funds requirements are not underestimated. The assessment of model risk may be based on the insights gained in other supervisory actions, including those carried out in accordance with Article 101 of Directive 2013/36/EU.

Assessment of the portfolio credit quality
204. In assessing inherent credit risk, competent authorities should consider the quality of the
credit portfolio, by carrying out an analysis to distinguish between performing, non-performing and forborne exposure categories, taking into account requirements of the EBA Guidelines on management of non-performing and forborne exposures 33 .
205. Competent authorities should assess the overall credit quality at portfolio level and the
different quality grades within each of the above categories to determine the institution’s overall credit risk. As part of this assessment competent authorities should analyse default and migration risk by exposure classes, taking into account trends in the credit quality over time, and they should consider whether the actual credit quality is consistent with the stated risk appetite, and establish reasons for any deviations.
206. When assessing portfolio credit quality, competent authorities should pay particular
attention to the adequacy of the classification of credit exposures and assess the impact of potential misclassification, with the subsequent delay in the provisioning and recognition of losses by the institution. In conducting this assessment, competent authorities may use peer analysis and benchmark portfolios, where available. Competent authorities may also use sampling of loans when assessing portfolio credit quality. Performing exposures
207. In evaluating the credit quality of performing exposures, competent authorities should
consider the change in the portfolio in terms of composition, size and creditworthiness, its profitability and the risk of future deterioration, by analysing the following elements, where available:
a. borrowers’ credit grade distribution (e.g. by internal and/or external ratings or other information suitable for measuring creditworthiness, such as leverage ratio, ratio of revenues devoted to the payment of instalments, etc.); b. growth rates by types of borrowers, sectors and products and consistency with credit risk strategies;
c. sensitivity of borrowers’ credit grades, or more generally of borrowers’ repayment
capacities, to the economic cycle; d. historical migration rates across credit grades, delinquency and default rates for different time horizons; and e. profitability (e.g. credit spread vs. credit losses). 33 EBA/GL/2018/06

In performing these analyses, competent authorities should consider both the number of
obligors and the relevant amounts/volumes and take into account the level of portfolio concentration. Forborne exposures
Competent authorities should assess the extent of forborne exposures, and the potential
losses that may stem from them. As a minimum, this should include:
a. the forbearance rates per portfolio and changes over time, also compared to peers; b. the forbearance rates for different types of forbearance measures, including time horizons of the measures;
c. the level and quality of collateralisation of forborne exposures; and
d. the migration rates of forborne exposures to performing and non-performing exposures, also compared with peers. Non-performing exposures
Competent authorities should assess the materiality of non-performing exposures,
including per portfolio and the potential losses that may stem from them. As a minimum, this should include:
a. the non-performing rates and coverage per portfolio, sector, geography and changes over time, also taking into account the changes in the portfolios (e.g. growing portfolios vs expiring portfolios) and strategy with regard to nonperforming exposures (e.g. recent sales of non-performing exposures); b. the distribution of the exposures across classes of non-performing exposures (i.e. past-due, doubtful, etc.);
c. the types and values of collateral, where relevant;
d. the migration rates from non-performing classes to performing, forborne exposures, and across non-performing classes; e. foreclosed assets and changes over time; f. historical recovery rates by portfolio, sector, geography or type of collateral and the duration of the recovery process; and g. the time since exposures were classified as non-performing, analysed by time buckets (vintage).
In conducting the above analysis, competent authorities should employ peer analysis and
use benchmark portfolios(i.e. portfolios of borrowers common to groups of institutions) where appropriate and possible. Assessment of the level and quality of credit risk mitigation
To assess the potential impact of credit risk on the institution, competent authorities
should also consider the level and quality of guarantees (including credit derivatives) and of available collateral that would mitigate credit losses where credit events occur, including those not accepted as eligible credit risk mitigation techniques for own funds calculations.
Specifically, competent authorities should consider:
a. the coverage provided by collateral and guarantees by portfolio, borrower type, rating, sector and other relevant aspects; b. collateral values, for performing and non-performing exposures, including to what degree they meet the requirements of the EBA Guidelines on management of nonperforming and forborne exposures (for collateral used to secure non-performing exposures) and EBA Guidelines on loan origination and monitoring (for all collateral);
c. historical recovery ratios by type and amount of collateral and guarantees; and
d. the materiality of the dilution risk (see Article 4 of Regulation (EU) 575/2013) for purchased receivables.
Competent authorities should also assess the materiality of the residual risk (see Article 80
of Directive 2013/36/EU) and in particular:
a. the adequacy and enforceability of collateral agreements and of guarantees; b. the timing and the ability to realise collateral and execute guarantees under the national legal framework;
c. the liquidity and volatility in asset values for collateral;
d. the recoverable value of collateral under any credit enforcement actions (e.g. foreclosure procedures); and e. where relevant, the guarantors’ creditworthiness following the requirements of the EBA Guidelines on loan origination and monitoring.
Competent authorities should also assess the concentration of guarantors and collateral,
as well as the correlation with borrowers’ creditworthiness (i.e. wrong-way risk) and the potential impact in terms of the effectiveness of protection.

Assessment of the level of loan loss provisions and credit valuation adjustments
216. Competent authorities should assess whether the level of loan loss provisions and credit
valuation adjustments are appropriate for the quality of the exposures and, where relevant, for the level of collateral. Competent authorities should assess:
a. whether the level of loan loss provisions is consistent with the level of risk in different portfolios, over time and compared with the institution’s relevant peers; b. whether the credit valuation adjustments to derivatives’ market values reflect the creditworthiness of relevant counterparties;
c. whether accounting loan loss provisions are in line with applicable accounting
principles and are assessed as sufficient to cover expected losses; d. whether non-performing, forborne exposures and foreclosed assets have been subject to sufficient loan loss provisions, taking into account the level of existing collateral and the vintage of such exposures and applicable legal requirements for the minimum loss coverage of non-performing exposures; and e. whether loan loss provisions are consistent with historical losses and relevant macroeconomic developments and reflect any changes to relevant regulations(e.g. foreclosure, repossession, creditor protection, etc.).
217. Where deemed necessary, competent authorities should use on-site inspections or other
appropriate supervisory actions to assess whether or not the level of loan loss provisioning and risk coverage is adequate, by assessing a sample of loans, for example.
218. Competent authorities should also take into consideration any findings raised by internal
and external auditors, where available.
Stress testing
219. When evaluating the inherent credit risk of an institution, competent authorities should
take into account the results of stress tests performed by the institution to identify any previously unidentified sources of credit risk, such as those emerging from changes in credit quality, credit concentrations, collateral value and credit exposure during a stressed period.
6.2.3 Assessment of credit risk management and controls
220. To achieve a comprehensive understanding of the institution’s credit risk profile,
competent authorities should also review the governance and risk management framework underlying its credit activities throughout the life cycle of a loan. To this end, competent authorities should assess the following elements, also having regard to the EBA Guidelines on loan origination and monitoring and the EBA Guidelines on management of non-performing and forborne exposures:

a. the credit risk strategy and appetite; b. the organisational framework;
c. policies and procedures;
d. risk identification, measurement, management, monitoring and reporting; and e. the internal control framework.
221. For the institutions subject to the application of the NPE (reduction) strategies and the
associated governance and operational guidance in accordance with the EBA Guidelines on management of non-performing and forborne exposures, competent authorities should also assess whether institutions meet specific requirements set out in those guidelines for such strategies and their operationalisation, including with respect to meeting the consumer protection obligations. Credit risk strategy and appetite
222. Competent authorities should assess whether the institution has a sound, clearly
formulated and documented credit risk appetite, strategy and limits approved by the management body. For this assessment, among other factors, competent authorities should take into account:
a. whether the management body clearly expresses the credit risk strategy and appetite, as well as the process for their review; b. whether senior management properly implements and monitors the credit risk strategy approved by the management body, ensuring that the institution’s activities are consistent with the established strategy, that written procedures are drawn up and implemented, and that responsibilities are clearly and properly assigned;
c. whether the institution’s credit and counterparty risk strategy reflects the
institution’s appetite levels for credit risk and whether it is consistent with the overall risk appetite; d. whether the institution’s credit risk strategy is appropriate for the institution given its:

business model;
overall risk appetite;
market environment and role in the financial system; and
financial condition, funding capacity and adequacy of own funds;
e. whether the institution’s credit risk strategy covers its credit-granting activities and collateral management, as well as the management of non-performing exposures, and whether this strategy supports risk-based decision-making, reflecting aspects that may include, for example, exposure type (commercial, consumer, real estate, sovereign), economic sector, geographical location, currency and maturity, including concentration limits; f. whether the institution’s credit risk strategy broadly covers all the activities of the institution where credit risk can be significant; g. whether the institution’s credit risk strategy takes into account cyclical aspects of the economy, including under stress conditions, and the resulting shifts in the composition of the credit risk portfolio; and h. whether the institution has an appropriate framework in place to ensure that the credit risk strategy is effectively communicated to all relevant staff. Organisational framework

Competent authorities should assess whether the institution has an appropriate
organisational framework and governance arrangements to enable effective credit risk taking, management, measurement and control, with sufficient (both qualitative and quantitative) human and technical resources to carry out the required tasks. Among other factors, they should take into account whether:
a. there are clear lines of responsibility for taking on, measuring, monitoring, managing and reporting credit risk; b. the credit risk control and monitoring systems are subject to independent review and there is a clear separation between risk-takers and risk managers;
c. the risk management, measurement and control functions cover credit risk
throughout the institution; and d. the staff involved in credit-granting activities, credit risk management and management of NPEs, in particular NPE workout units (both in business areas and in management and control areas) have appropriate skills and experience to perform their tasks. Policies and procedures
Competent authorities should assess whether the institution has appropriate policies for
the credit granting, identification, management, measurement and control of credit risk, including collateral valuation, the recovery or sales processes, and whether such policies are in

line with the EBA Guidelines on loan origination and monitoring and the EBA Guidelines on management of non-performing and forborne exposures. For this assessment, among other factors, competent authorities should take into account whether:
a. the management body approves the policies for managing, measuring and controlling credit risk and discusses and reviews them regularly, in line with risk strategies; b. senior management is responsible for drawing up and implementing the policies and procedures for managing, measuring and controlling credit risk, as defined by the management body;
c. the policies and procedures are sound and consistent with the credit risk strategy,
and cover all the main businesses and processes relevant to managing, measuring and controlling credit risk, in particular:

credit granting and pricing: for example, borrowers, guarantors and
collateral eligibility; credit limits; selection of FMIs, CCPs and correspondent banks; types of credit facilities available; terms and conditions (including collateral and netting agreements requirement) to be applied;
credit risk measurement and monitoring: for example, criteria for
identifying groups of connected counterparties; criteria for assessing borrowers’ creditworthiness and collateral evaluation and frequency for their review; criteria for quantifying impairments, credit valuation adjustments and provisions; and
credit management: for example, criteria for reviewing products,
terms and conditions; criteria for applying forbearance practices or restructuring; criteria for loan classification and management of NPLs; d. the policies and procedures also specify how ML/TF risks to which the institution is exposed as a result of the credit granting activities are identified, assessed and managed both at the level of the business (in terms of types of customers served, lending products provided, geographies to which they are exposed and distribution channels used) and at the level of the individual relationship (considering the purpose of the credit, the extent to which the counterparty gives rise to ML/TF risk, and the legitimacy of the source of funds used to repay the credit); e. such policies are compliant with relevant regulations and adequate for the nature and complexity of the institution’s activities, and enable a clear understanding of the credit risk inherent to the different products and activities under the scope of the institution; f. such policies are clearly formalised, communicated and applied consistently across the institution; and

g. these policies are applied consistently across banking groups and allow proper management of shared borrowers and counterparties. Risk identification, measurement, monitoring and reporting
225. Competent authorities should assess whether the institution has an appropriate
framework for identifying, understanding, measuring, monitoring and reporting credit risk, in line with the institution’s size and complexity, and that this framework is compliant with the requirements of the relevant EU and national implementing legislation.
226. In this regard, competent authorities should consider whether the institutions have
adequate data infrastructure that meets the requirements of the EBA Guidelines on loan origination and monitoring, and of the EBA Guidelines on management of non-performing and forborne exposures and whether analytical techniques are appropriate to enable the institution to adequately manage their credit risk, and to fulfil supervisory reporting requirements, and to detect, measure and regularly monitor the credit risk inherent in all on- and off-balance-sheet activities (where relevant at group level), in particular with regard to:
a. the borrower/counterparty/transaction’s credit risk and eligibility; b. credit exposures (irrespective of their nature) of borrowers and, where relevant, of groups of connected borrowers;
c. guarantee and collateral coverage (including netting agreements) and eligibility of
this coverage; d. ongoing compliance with the contractual terms and agreements (covenants); e. unauthorised overdrafts and conditions for reclassification of credit exposures; and f. relevant sources of credit concentration risk.
227. Competent authorities should assess whether the institution has a clear understanding of
the credit risk related to the different types of borrowers, transactions and credit granted.
228. They should also assess whether the institution has appropriate skills, systems and
methodologies to measure this risk at borrower/transaction and portfolio level, in accordance with the size, nature, composition and complexity of the institution’s activities involving credit risk. In particular, competent authorities should ensure that such systems and methodologies:
a. enable the institution to differentiate between different levels of borrower and transaction risk; b. provide a sound and prudent estimation of the level of credit risk and of collateral value with a distinct focus on exposures secured by residential and commercial immovable property collateral;

c. identify and measure credit concentration risks (single-name, sectoral,
geographical, etc.); d. enable the institution to project credit risk estimates for planning purposes and for stress testing; e. enable the institution to determine the level of provision and credit valuation adjustments required to cover expected and incurred losses; and f. where material, aim to capture those risk elements not covered or not fully covered by the requirements of Regulation (EU) No 575/2013.
229. Competent authorities should assess whether the institution’s management body and
senior management understand the assumptions underlying the credit measurement system and whether they are aware of the degree of relevant model risk.
230. Competent authorities should assess whether the institution has undertaken stress testing
to understand the impact of adverse events on its credit risk exposures and on the adequacy of its credit risk provisioning. They should take into account:
a. stress test frequency; b. relevant risk factors identified;
c. assumptions underlying the stress scenario; and
d. the internal use of stress testing outcomes for capital planning and credit risk strategies.
231. Competent authorities should assess whether the institution has defined and implemented
continuous and effective monitoring of credit risk exposures (including credit concentration) throughout the institution, amongst others, by means of specific indicators and relevant triggers to provide effective early warning alerts.
232. Competent authorities should assess whether the institution has implemented regular
reporting of credit risk exposures, including the outcome of stress testing, to the management body, senior management and the relevant credit risk managers. Internal control framework
233. Competent authorities should assess whether the institution has a strong and
comprehensive control framework and sound safeguards to mitigate its credit risk in line with its credit risk strategy and appetite and whether such a control framework is line with the requirements of the EBA Guidelines on loan origination and monitoring and Guidelines on management of non-performing and forborne exposures. For this purpose, among other factors, competent authorities should pay particular attention to whether:

a. the scope covered by the institution’s control functions includes all consolidated entities, all geographical locations and all credit activities; b. there are internal controls, operating limits and other practices aimed at keeping credit risk exposures within levels acceptable to the institution, in accordance with the parameters set by the management body and senior management and the institution’s risk appetite;
c. the institution has appropriate internal controls and practices to ensure that
breaches of and exceptions to policies, procedures and limits are reported in a timely manner to the appropriate level of management for action; and d. there are checks in place to identify, assess and manage ML/TF risks to which the institution is exposed as a result of the credit-granting activities.
234. Competent authorities should assess the limit system, including whether:
a. the limit system is adequate for the complexity of the institution’s organisation and credit activities, as well as its capability for measuring and managing credit risk; b. the limits established are absolute or whether breaches of limits are possible. In the latter case, the institution’s policies should clearly describe the period of time during which and the specific circumstances under which such breaches of limits are possible;
c. the institution has procedures to keep credit managers up to date with regard to
their limits; and d. the institution has adequate procedures to update its limits regularly (e.g. for consistency with changes in strategies).
235. Competent authorities should also assess the functionality of the internal audit function.
To this end, they should assess whether:
a. the institution conducts internal audits of the credit risk management framework on a periodic basis; b. the internal audit function covers the main elements of credit risk management, measurement and controls across the institution; and
c. the internal audit function is effective in determining adherence to internal policies
and relevant external regulations and addressing any deviations from either.
236. For institutions adopting an internal approach to determining minimum own funds
requirements for credit risk, competent authorities should also assess whether the internal validation process is sound and effective in challenging model assumptions and identifying any

potential shortcomings with respect to credit risk modelling, credit risk quantification and the credit risk management system and to other relevant minimum requirements as specified in the relevant EU and national implementing legislation.
6.2.4 Summary of findings and scoring
237. Following the above assessment, competent authorities should form a view on the
institution’s credit and counterparty risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerationsspecified in Table 4. If, based on the materiality of certain risk subcategories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy.
Table 4. Supervisory considerations for assigning a credit and counterparty risk score
Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls There is a low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.

The nature and composition of
credit risk exposure implies nonmaterial risk/very low risk.
Exposure to complex products
and transactions is not material/very low.
The level of credit concentration
risk is not material/very low.
The level of forborne and nonperforming exposures is not
material/very low.
The credit risk posed by
performing exposures is not material/very low.
The level of coverage of
provisions and of credit valuation adjustments is very high.
The level of coverage and quality
of guarantees and collateral are very high.
Risk management and
controls are adequate with respect to the requirements set out in the EBA Guidelines on loan origination and monitoring and Guidelines on management of nonperforming and forborne exposures.
There is consistency
between the institution’s credit risk policy and strategy and its overall strategy and risk appetite.
The organisational
framework for credit risk is robust with clear responsibilities and a clear separation of tasks between risk-takers and management and control functions.
Credit risk measurement,
monitoring and reporting systems are appropriate.
Internal limits and the
control framework for credit risk are sound.
There is a mediumlow risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The nature and composition of
credit risk exposure implies low to medium risk.
Exposure to complex products
and transactions is low to medium.
The level of credit concentration
risk is low to medium.

Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls

The level of forborne and nonperforming exposures is low to
medium.
The credit risk posed by
performing exposures is low to medium.
The level of coverage of
provisions and of credit valuation adjustments is high.
The level of coverage and quality
of guarantees and collateral are high.
Limits allowing the credit
risk to be mitigated or limited are in line with the institution’s credit risk management strategy and risk appetite. There is a mediumhigh risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The nature and composition of
credit risk exposure implies medium to high risk.
Exposure to complex products
and transactions is medium to high.
The level of credit concentration
risk is medium to high.
The level of forborne and nonperforming exposures is medium
to high.
The credit risk posed by
performing exposures is medium to high and subject to further deterioration under stressed conditions.
The level of coverage of
provisions and of credit valuation adjustments is medium.
The level of coverage and quality
of guarantees and collateral are medium.
Risk management and
controls are not compliant with respect to the requirements set out in the EBA Guidelines on loan origination and monitoring and Guidelines on management of nonperforming and forborne exposures.
There is a lack of
consistency between the institution’s credit risk policy and strategy and its overall strategy and risk appetite.
The organisational
framework for credit risk is not sufficiently robust; there is no clear separation of tasks between risk-takers or management and control functions.
Credit risk measurement,
monitoring and reporting systems are not appropriate.
Internal limits and the
control framework for credit risk are not sufficiently sound.
Limits allowing the credit
risk to be mitigated or

Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls limited are not in line with the institution’s credit risk management strategy and risk appetite There is a high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.

The nature and composition of
credit risk exposure implies high risk.
Exposure to complex products
and transactions is high.
The level of credit concentration
risk is high.
The level of forborne and nonperforming exposures is high.
The credit risk posed by
performing exposures is high.
The level of coverage of
provisions and of credit valuation adjustments is low.
The level of coverage and quality
of guarantees and collateral are low.
6.3 Assessment of market risk
6.3.1 General considerations

Competent authorities should assessthe market risk concerning those on- and off-balancesheet positions which are subject to losses arising from movements in market prices. When
assessing market risk for institutions which do not meet the conditions of the small trading book as set out in Article 94 of Regulation (EU) 575/2013 competent authorities should consider the relevance and materiality of at least the following subcategories carrying out a more detailed assessment of those subcategories which are considered the most relevant for the institution :
a. interest rate risk in the trading book; b. credit spread and default risk in the trading book;
c. equity risk in the trading book;
d. foreign-exchange risk; e. commodities risk;

f. credit valuation adjustment risk; g. non-delta risk; h. basis risk;
i. market liquidity risk;
j. model risk for regulatory approved models.
6.3.2 Assessment of inherent market risk
239. Through the assessment of inherent market risk, competent authorities should determine
the main drivers of the institution’s market risk exposure and evaluate the risk of significant prudential impact on the institution. The assessment of inherent market risk should be structured around the following main steps:
a. preliminary assessment; b. assessment of the nature and composition of the institution’s positions subject to market risk;
c. assessment of profitability;
d. assessment of market concentration risk; and e. outcome of stress testing.
240. Competent authorities may perform a less granular analysis for institutions which
meet the conditions of the small trading book as set out in Article 94 of Regulation (EU) 575/2013. Preliminary assessment
241. To determine the scope of the assessment of market risk, competent authorities should
first identify the sources of market risk to which the institution is or may be exposed. To do so, competent authorities should leverage the knowledge gained from the assessment of other SREP elements, from the comparison of the institution’s position to peers and from any other supervisory activities.
242. As a minimum, competent authorities should consider:
a. the institution’s market activities, business lines and products; b. the main strategy of the market risk portfolio and the risk appetite in market activities;

c. the relative weight of market risk positions in terms of total assets, changes over
time and the institution’s strategy for these positions; d. the relative weight of net gains on market positions in total operating income; and e. the own funds requirement for market risk compared to the total own funds requirement, and – where relevant – the internal capital allocated for market risk compared to the total internal capital, including the historical change in this figure and forecasts.
243. In their initial assessments, competent authorities should also consider significant changes
in the institution’s market activities with the focus on potential changes in the total exposure to market risk. As a minimum, they should assess:
a. significant changes in market risk strategy, policies and sizes of limits; b. the potential impact on the institution’s risk profile of those changes; and
c. major trends in the financial markets and the institution’s strategy towards it
(including potential risks in case the trends unexpectedly reverse).
Nature and composition of the institution’s market risk activities
244. Competent authorities should analyse the nature of the institution’s market risk exposures
by considering the subcategories defined in paragraph 238 to identify particular risk exposures and related market risk factors/drivers (e.g. exchange rates, interest rates or credit spreads) for further in-depth assessment.
245. Competent authorities should analyse market risk exposures by relevant asset classes
and/or financial instruments according to their size, complexity and level of risk. For the most relevant exposures, competent authorities should assess their related risk factors and drivers.
246. While analysing market risk activities, competent authorities should also consider the
complexity of the financial products (e.g. over-the-counter (OTC) products or products valued using mark–to-model techniques) and of specific market operations (e.g. high-frequency trading). The following points should be considered:
a. if the institution holds derivatives positions, competent authorities should assess both the market value and the notional amount; and b. when the institution is engaged in OTC derivatives, competent authorities should evaluate the weight of these transactions in the total derivatives portfolio and the breakdown of the OTC portfolio by type of contract (swap, forward, etc.), underlying financial instruments, etc. (the counterparty credit risk associated with these products is covered under the credit risk methodology).

When appropriate, competent authorities should assess the institution’s evaluation of
distressed and/or illiquid positions (e.g. ‘legacy portfolios’, i.e. portfolios of illiquid assets related to the discontinued banking practices/activities that are managed on a run-off model) and the impact of such positions on the institution’s profitability.
For those institutions using the internal model approach (IMA) to calculate their regulatory
own funds requirements, competent authorities should also consider the following indicators to identify particular risk areas and related risk drivers:
a. the split of market risk own funds requirements between the value at risk (VaR), stressed VaR (SVaR), incremental risk charge (IRC) and charge for correlation trading portfolio; b. the VaR broken down by risk factors;
c. the change in the VaR and SVaR (possible indicators could be the day-to-day/weekto-week change, the quarterly average and back-testing results); and
d. the multiplication factors applied to VaR and SVaR e. the results of the calculations performed for the purpose of the specific reporting requirements for market risk, based on using the alternative standardised approach set out in Chapter 1a of Title IV of Part Three of Regulation (EU) No 575/2013; and f. where relevant, the results of the calculations performed for the purpose of the specific reporting requirements for market risk, based on using the alternative internal model approach (IMA) set out in Chapter 1b of Title IV of Part Three of Regulation (EU) No 575/2013.
When appropriate, competent authorities should also consider the internal risk measures
of institutions. These could include the internal VaR or expected shortfall not used in the calculations of own funds requirements or sensitivities of the market risk to different risk factors and potential losses.
When analysing inherent market risk, competent authorities should consider ‘point-intime’ figures and trends, both on an aggregate basis and by portfolio. Where possible, this
analysis should be completed with a comparison of the institution’s figures to peers and to relevant macroeconomic indicators. Profitability analysis
Competent authorities should analyse the historic profitability, including volatility of
profits, of market activities to gain a better understanding of the institution’s market risk profile. This analysis could be performed at portfolio level as well as being broken down by

business line, asset class or desk (potentially as part of the wider assessment carried out as part of the BMA).
252. While assessing profitability, competent authorities should pay specific attention to the
main risk areas identified during the examination of market risk activities. Competent authorities should distinguish between trading revenues and non-trading revenues (such as commissions, clients’ fees, etc.) on one hand and realised and unrealised profits/losses on the other hand.
253. For those asset classes and/or exposures generating abnormal profits or losses, competent
authorities should assess profitability in comparison to the level of risk assumed by the institution (e.g. VaR/net gains on financial assets and liabilities held for trading) to identify and analyse possible inconsistencies. Where possible, competent authorities should compare the institution’s figures to its historical performance and its peers. Market concentration risk
254. Competent authorities should form a view on the degree of market concentration risk to
which the institution is exposed, either from exposures to a single risk factor or from exposures to multiple risk factors that are correlated.
255. When evaluating possible concentrations, competent authorities should pay special
attention to concentrations in complex products (e.g. structured products), illiquid products (e.g. collateralised debt obligations (CDOs)) or products valued using mark-to-model techniques. Stress testing
256. When evaluating the inherent market risk of an institution, competent authorities should
take into account the results of stress tests performed by the institution to identify any previously unidentified sources of market risk. This is especially important for tail-risk events, which may be underrepresented or entirely absent from historical data because of their low frequency of occurrence. Another source of potential hidden vulnerabilities that competent authorities should consider is the potential for jumps in pricing parameters, such as a sudden change in certain prices or price bubbles in commodities.
6.3.3 Assessment of market risk management and controls
257. To achieve a comprehensive understanding of the institution’s market risk profile,
competent authorities should review the governance and risk management framework underlying its market activities. To this end, competent authorities should assess the following elements:
a. market risk strategy and risk appetite;

b. organisational framework;
c. policies and procedures;
d. risk identification, measurement, monitoring and reporting; and e. internal control framework. Market risk strategy and appetite
258. Competent authorities should assess whether institutions have a sound, clearly formulated
and documented market risk strategy, approved by their management body. For this assessment, competent authorities should, in particular, take into account whether:
a. the management body clearly expresses the market risk strategy and appetite and the process for their review (e.g. in the event of an overall risk strategy review, or profitability and/or capital adequacy concerns); b. senior management properly implements the market risk strategy approved by the management body, ensuring that the institution’s activities are consistent with the established strategy, written procedures are drawn up and implemented, and responsibilities are clearly and properly assigned;
c. the institution´s market risk strategy properly reflects the institution’s appetite for
market risk and is consistent with the overall risk appetite; d. the institution’s market risk strategy and appetite are appropriate for the institution, given its:

business model;
overall risk strategy and appetite;
market environment and role in the financial system; and
financial condition, funding capacity and capital adequacy;
e. the institution´s market risk strategy establishes guidance for the management of the different instruments and/or portfolios that are subject to market risk, and supports risk-based decision-making; f. the institution’s market risk strategy broadly covers all the activities of the institution where market risk is significant;

g. the institution’s market risk strategy takes into account the cyclical aspects of the economy and the resulting shifts in the composition of the positions subject to market risk; and h. the institution has an appropriate framework in place to ensure that market risk strategy is effectively communicated to all relevant staff. Organisational framework
259. Competent authorities should assess whether the institution has an appropriate
organisational framework for market risk management, measurement, monitoring and control functions, with sufficient (both qualitative and quantitative) human and technical resources. They should take into account whether:
a. there are clear lines of responsibility for taking, monitoring, controlling and reporting market risk; b. there is a clear separation, in the business area, between the front office (position takers) and the back office (responsible for allocating, recording and settling transactions);
c. the market risk control and monitoring system is clearly identified in the
organisation, and functionally and hierarchically independent of the business area, and whether it is subject to independent review; d. the risk management, measurement, monitoring and control functions cover market risk in the entire institution (including subsidiaries and branches), and in particular all areas where market risk can be taken, mitigated or monitored; and e. the staff involved in market activities (both in business areas and in management and control areas) have appropriate skills and experience. Policies and procedures
260. Competent authorities should assess whether the institution has clearly defined policies
and procedures for the identification, management, measurement and control of market risk. They should take into account:
a. whether the management body approves the policies for managing, measuring and controlling market risk and discusses and reviews them regularly, in line with risk strategies; b. whether senior management is responsible for developing them, ensuring adequate implementation of the management body’s decisions;

c. whether market policies are compliant with relevant regulations and adequate for
the nature and complexity of the institution’s activities, enabling a clear understanding of the market risk inherent to the different products and activities under the scope of the institution, and whether such policies are clearly formalised, communicated and applied consistently across the institution; and d. for groups, whether these policies are applied consistently across the group and allow proper management of the risk.
261. Competent authorities should assess whether the institution’s market policies and
procedures are sound and consistent with the market risk strategy and cover all the main businesses and processes relevant for managing, measuring and controlling market risk. In particular, the assessment should cover:
a. the nature of operations, financial instruments and markets in which the institution can operate; b. the positions to include in, and to exclude from, the trading book for regulatory purposes;
c. policies regarding internal hedges;
d. the definition, structure and responsibilities of the institution’s trading desks, where appropriate; e. requirements relating to trading and settlement processes; f. procedures for limiting and controlling market risk; g. the framework for ensuring that all positions measured at fair value are subject to additional valuation adjustments in accordance with Commission Delegated Regulation (EU) 2016/101 (RTS on prudent valuation); h. the criteria applied by the institution to avoid association with individuals/groups involved in fraudulent activities and other crimes; and
i. procedures for new market activities and/or products; competent authorities
should ensure that:

new market activities and/or products are subject to adequate procedures
and controls before being introduced or undertaken;
the institution has undertaken an analysis of their possible impact on its
overall risk profile.
Risk identification, measurement, monitoring and reporting

Competent authorities should assess whether the institution has an appropriate
framework for identifying, understanding and measuring market risk, in line with the institution’s size and complexity, and that this framework is compliant with relevant minimum requirements in accordance with the relevant EU and national implementing legislation. They should consider whether:
a. the data, information systems and measurement techniques enable management to measure the market risk inherent in all material on- and off-balance sheet activities (where relevant at group level), including both trading and banking portfolios, as well as complying with supervisory reporting requirements; b. institutions have adequate staff and methodologies to measure the market risk in their trading and banking portfolios, taking into account the institution’s size and complexity and the risk profile of its activities;
c. the institution’s risk measurement system takes into account all material risk
factors related to its market risk exposures (including basis risk, credit spreads in corporate bonds or credit derivatives, and vega and gamma risks in options). Where some instruments and/or factors are excluded from the risk measurement systems, competent authorities should assess the materiality of the exclusions and determine whether such exclusions are justified; d. the institution’s risk measurement systems are able to identify possible market risk concentrations arising either from exposures to a single risk factor or from exposures to multiple risk factors that are correlated; e. risk managers and the institution’s senior management understand the assumptions underlying the measurement systems, in particular for more sophisticated risk management techniques; and f. risk managers and the institution’s senior management are aware of the degree of model risk that prevails in the institution’s pricing models and risk measurement techniques and whether they periodically check the validity and quality of the different models used in market risk activities.
Competent authorities should assess whether an institution has implemented adequate
stress tests that complement its risk measurement system. For this purposes, they should take into account the following elements:
a. stress test frequency; b. whether relevant risk drivers are identified (e.g. illiquidity/gapping of prices, concentrated positions, one-way markets, etc.);
c. assumptions underlying the stress scenario; and

d. internal use of stress testing outcomes for capital planning and market risk strategies.
264. For the purposes of Article 101 of Directive 2013/36/EU, if the institution is authorised to
use internal models to determine minimum own funds requirements for market risk, competent authorities should verify that the institution continues to fulfil the minimum requirements specified in the relevant EU and national implementing legislation and that such internal models do not involve any underestimation of material risk.
265. Competent authorities should assess whether institutions have in place an adequate
monitoring and reporting framework for market risk that ensures there will be prompt action at the appropriate level of the institution’s senior management or management body where necessary. The monitoring system should include specific indicators and relevant triggers to provide effective early warning alerts. Competent authorities should take into account whether:
a. the institution has effective information systems for accurate and timely identification, aggregation, monitoring and reporting of market risk activities; and b. the management and control area reports regularly to the management body and senior management with, as a minimum, information on current market exposures, P&L results and risk measures (e.g. VaR) compared to policy limits. Internal control framework
266. Competent authorities should assess whether the institution has a strong and
comprehensive control framework and sound safeguards to mitigate its market risk in line with its market risk management strategy and risk appetite. They should take into account whether:
a. the scope covered by the institution’s control function includes all consolidated entities, all geographical locations and all financial activities; b. there are internal controls, operating limits and other practices aimed at ensuring market risk exposures do not exceed levels acceptable to the institution, in accordance with the parameters set by the management body and senior management and the institution’s risk appetite; and
c. the institution has appropriate internal controls and practices to ensure that
breaches of and exceptions to policies, procedures and limits are reported in a timely manner to the appropriate level of management for action. They should take into account whether the institution’s internal controls and practices:

are able to identify breaches of individual limits set at desk or business-unit
level, as well as breaches of the overall limit for the market activities; and
allow daily identification and monitoring of breaches of limits and/or
exceptions.

Competent authorities should assess the limit system, including whether:
a. the limits established are absolute or whether breaches of limits are possible. In the latter case, the institution’s policies should clearly describe the period of time during which and the specific circumstances under which such breaches of limits are possible; b. the limit system sets an overall limit for market activities and specific limits for the main risk subcategories; where appropriate, it should allow allocation of limits by portfolio, desk, business unit or type of instrument; the level of detail should reflect the characteristics of the institution’s market activities;
c. the set of limits (limits based on risk metric, notional limits, loss control limits, etc.)
established by the institution suits the size and complexity of its market activities; d. the institution has procedures to keep traders up to date about their limits; and e. the institution has adequate procedures to update its limits regularly.
Competent authorities should assess the functionality of the internal audit function. They
should assess whether:
a. the institution conducts internal audits of the market risk management framework on a regular basis; b. the internal audit function covers the main elements of market risk management, measurement and control across the institution; and
c. the internal audit function is effective in determining adherence to internal policies
and any relevant external regulations, and addressing any deviations from either.
For institutions using internal models to determine own funds requirements for market
risk, competent authorities should assess whether the internal validation process is sound and effective in challenging model assumptions and identifying any potential shortcomings with respect to market risk modelling, market risk quantification, the market risk management system and other relevant minimum requirements as specified in the relevant EU and national implementing legislation.
6.3.4 Summary of findings and scoring
Following the above assessment, competent authorities should form a view on the
institution’s market risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerationsspecified in Table 5. Where, based on the materiality

of certain risk subcategories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy.
271. Since factors such as complexity, level of concentration and the volatility of market
exposures’ returns may not be perfect indicators of the market risk level, in assessing and scoring inherent market risk, competent authorities should consider all these factors in parallel and not in isolation and understand the drivers behind volatility trends.
Table 5. Supervisory considerations for assigning a market risk score
Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls There is a low level of risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.

The nature and composition of
market risk exposures imply not material/very low risk.
The institution’s exposures to
market risk are non-complex.
The level of market risk
concentration is not material/very low.
The institution’s market risk
exposures generate non-volatile returns.
There is consistency
between the institution’s market risk policy and strategy and its overall strategy and risk appetite.
The organisational
framework for market risk is robust, with clear responsibilities and a clear separation of tasks between risk-takers and management and control functions.
Market risk measurement,
monitoring and reporting systems are appropriate.
Internal limits and the
control framework for market risk are sound and in line with the institution’s risk management strategy and risk appetite. There is a mediumlow risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The nature and composition of
market risk exposures imply low to medium risk.
The complexity of the
institution’s market risk exposures is low to medium.
The level of market risk
concentration is low to medium.
The institution’s market risk
exposures generate returns that have a low to medium degree of volatility. There is a mediumhigh risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The nature and composition of
market risk exposures imply medium to high risk.
The complexity of the
institution’s market risk exposures is medium to high.
The level of market risk
concentration is medium to high.
The institution’s exposures to
market risk generate returns that
There is not full
consistency between the institution’s market risk policy and strategy and its overall strategy and risk profile.
The organisational
framework for market risk does not sufficiently separate responsibilities

Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls have a medium to high degree of volatility. and tasks between risktakers and management and control functions.

Market risk measurement,
monitoring and reporting systems are not undertaken with sufficient accuracy and frequency.
Internal limits and the
control framework for market risk are not in line with the institution’s risk management strategy or risk appetite. There is a high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The nature and composition of
market risk exposures imply high risk.
The complexity of the
institution’s market risk exposures is high.
The level of market risk
concentration is high.
The institution’s exposures to
market risk generate returns that have a high degree of volatility.
6.4 Assessment of operational risk
6.4.1 General considerations

Competent authorities should assess operational risk throughout all the business lines and
operations of the institution, taking into account findings from the assessment of internal governance arrangements and institution-wide controls as specified in Title 5. In conducting this assessment, they should determine how operational risk may materialise (economic loss, near miss, loss of future earnings, gain) and should also consider potential impacts in terms of other related risks (e.g. credit-operational risk, market-operational risk ‘boundary cases’).
Competent authorities should assess the materiality of operational risk arising from
outsourced services and activities, and whether these could affect the institution’s ability to process transactions and/or provide services, or cause legal liabilities for damage to third parties (e.g. customers and other stakeholders).
When assessing operational risk, competent authorities should assess ICT risk, as ICT
performance and security are considered paramount for an institution to conduct its business. Thus, competent authorities should assess potential impact of ICT risks on the critical activities of an institution and consider the potential financial, reputational, regulatory and strategic impact on the institution as well as the potential for business disruption.
Competent authorities should assess reputational risk jointly with operational risk because
of the strong links between the two (e.g. most operational risk events have a strong impact in terms of reputation). However, the outcome of reputational risk assessment should not be reflected in the scoring of operational risk but, where relevant, should be considered as part of the BMA and/or the liquidity risk assessment, since the main effects it can have are reductions

in earnings and loss of confidence in or disaffection with the institution by investors, depositors or interbank-market participants.
276. In assessing operational risk, competent authorities should use, to the extent possible, the
event-type classification for the advanced measurement approaches provided in Article 324 of Regulation (EU) No 575/2013 and specified in Commission Delegated Regulation (EU) 2018/959 34to gain a clearer view of the spectrum of operational risks and to achieve a level of consistency in analysing these risks across institutions, irrespective of the approach adopted to determine own funds requirements for operational risk. When assessing operational risk, competent authorities should also consider conduct risk, model risk and ICT risk.
6.4.2 Assessment of inherent operational risk
277. Competent authorities should conduct an assessment of the nature and the extent of the
operational risk to which the institution is or might be exposed. To this end, competent authorities should develop a thorough understanding of the institution’s business model, its operations, its risk culture and the environment in which it operates, since all these factors determine the institution’s operational risk exposure.
278. The assessment of inherent operational risk comprises two steps, which are described in
more detail in this section:
a. preliminary assessment; and b. assessment of the nature and significance of the operational risk exposures and operational risk subcategories faced by the institution. Preliminary assessment
279. To determine the scope of the assessment of operational risk, competent authorities
should first identify the sources of operational risk to which the institution is exposed. To do so, competent authorities should also leverage the knowledge gained from the assessment of other SREP elements, from the comparison of the institution’s position to peers (including relevant external data, where available), from any other supervisory activities including the input from the AML/CFT supervisors and from other relevant information sources.
280. As a minimum, competent authorities should consider:
a. the main strategy for operational risk and operational risk appetite; 34 Commission Delegated Regulation(EU) 2018/959 of 14 March 2018 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards of the specification of the assessment methodology under which competent authorities permit institutions to use Advanced Measurement Approaches for operational risk (OJ L 169, 6.7.2018, p. 1).

b. the business and external environments (including geographical location of the parent company and its entities as well as of ICT operations and data centres) in which the institution operates and distribution channels used;
c. the own funds requirement for operational risk (distinguished by the basic
indicator approach (BIA), the standardised approach (TSA) and the advanced measurement approaches (AMA)) compared to the total own funds requirement, and – where relevant – the internal capital for operational risk compared to the total internal capital, taking into account the historical trends and forecasts, if available; d. the level of and change in gross income, assets and operational risk losses over the past few years at the aggregated level but also for material entities and business lines; e. recent significant corporate events (such as mergers, acquisitions, disposals and restructuring), which might determine a change in the institution’s operational risk profile in the short or medium to long term (e.g. because systems, processes and procedures would not be fully aligned with the risk management policies of the parent undertaking in the short term); f. changes to significant elements of the IT systems and/or of processes that might determine a change in the operational risk profile (e.g. because a new or changed IT system has not been properly tested, or because insufficient training on the new systems/processes and procedures might lead to errors); g. failures to comply with applicable legislation or with internal regulations as reported by other supervisors (including AML/CFT supervisors), external auditors and the internal audit function or brought to light by public information (bearing in mind both the current situation and changes in regulatory compliance behaviour over time); h. the ambitiousness of business plans and aggressive incentives and compensation schemes (e.g. in terms of sales targets, including accepting customers identified as high ML/TF risk by the institution or expansion to high ML/TF risk jurisdictions or distribution of new products/services bearing a high level of inherent ML/TF risk, headcount reduction, etc.), which might increase the risk of non-compliance, human error and employee malpractice;
i. the processes, procedures, products (sold to customers or dealt in)and IT systems
(including the use of new technologies), to the extent that they might lead to incidents, errors, delays, misspecification, security breaches, increased exposure to fraud, ML/TF and other types of financial crime, etc.; and

j. the potential impact of outsourcing arrangements, and in general all arrangements with third parties, on institutions’ operational risk as well as the institutions’ oversight on the performance of the service providers in delivering all the outsourced services, including the level of awareness of operational risk related to outsourced activities and of service providers’ overall risk exposure in line with the EBA Guidelines on outsourcing arrangements.
281. Where relevant, the competent authority should analyse the aspects above by business
line/legal entity and geography as well as by event type category, provided that data are available, and compare the institution’s position to its peers. Nature of operational risk exposures
282. Competent authorities should determine the nature of operational risk exposures by
analysing exposures to the main drivers of operational risk to form a forward-looking view on potential risk and losses. Such an analysis may require consideration of business lines, products, processes and geographies relevant to the institution, as well as an assessment of operational risk exposures to primary risk drivers (e.g. processes, people, systems and external factors), with use of the institution’s self-risk assessment and peer analysis.
283. In performing this analysis, competent authorities should consider the interactions of such
risk drivers in determining the institution’s operational risk exposures (e.g. exposure to more risk drivers might increase the likelihood of an operational event and consequent loss, including the possibility to impose sanctions). Significance of operational risk exposure
284. Once the major sources and drivers of operational risk have been identified, the competent
authority should focus on those that might have the most material impact on the institution. The competent authority should assess the institution’s ‘potential exposure’ to the operational risk by using both expert judgement and qualitative and quantitative indicators relating to either the institution or its peers, and also include information from other supervisors (e.g. AML/CFT supervisors).
285. In assessing the significance of operational risk exposures, competent authorities should
consider both the frequency and the severity of the events to which the institution is exposed, and distinguish those causing high-severity losses and those occurring with high frequencies. Based on this distinction, competent authorities should assess the trends of operational risk losses and their concentration.
286. A primary source of information competent authorities should consider is the institution’s
operational losses and event database, which, where available and reliable (i.e. accurate and complete), provides the historical operational risk profile of the institution.

For institutions adopting internal models for operational risk, the competent authority
should also consider the output of the internal approach, provided that this approach is capable of measuring the operational risk exposure in the desired level of detail (e.g. product, process, etc.) and assuming that the model is sufficiently forward-looking. However, competent authorities should also take into account the limitations and potential weaknesses of the internal models.
In addition, competent authorities should perform a more qualitative analysis and leverage
the institution’s risk assessment, peer analysis data and public and/or consortium databases, if available and relevant. Competent authorities may also consider other factors, specific to the relevant business units, etc. affected by the potential deficiencies, which can provide a measure of the risk exposure.
In performing the assessment of an institution’s risk exposure, competent authorities
should employ a forward-looking approach, leveraging scenario analyses performed by the institution, where available, and taking into consideration any corrective measures and mitigation actions already implemented and effective. Assessment of operational risk subcategories
Competent authorities should identify and assess operational risk across all operational risk
subcategories (including those defined by event types and further breakdowns of these event types) and the associated risk drivers. Competent authorities should focus the assessment on those subcategories, which are considered the most significant for the institution. The significance of a subcategory should be evaluated by leveraging the quantitative information collected during the preliminary assessment, including the level of losses per subcategory with regard to capital requirement and gross income. Competent authorities should also apply their expert judgement to identify significant subcategories, based on all available internal and external information sources.
In conducting the assessment, competent authorities should pay particular attention to
some specific aspects of operational risk because of their pervasive nature and their relevance to the majority of institutions, and also because of their potential prudential impact. Such aspects which should always be in the focus of assessment include:
a. ICT risk; b. conduct risk; and
c. model risk.
ICT risk
Competent authorities should assess the ICT risk in accordance with the EBA Guidelines on
ICT Risk Assessment under the SREP 35 and having regard to the EBA Guidelines on ICT and security risk management, taking into account that ICT risk is a key driver of operational risk. Conduct risk
Competent authorities should assess the relevance and significance of the institution’s
exposures to conduct risk, considering the factors listed in points a to g which are relevant to the institution. For Category-1 and Category-2 institutions, competent authorities should consider all of the following:
a. mis-selling of products, in both retail and wholesale markets, including pushed cross-selling of products to retail customers, such as packaged bank accounts or add-on products customers do not need; b. conflicts of interest in conducting business;
c. manipulation of benchmark interest rates, foreign exchange rates or any other
financial instruments or indices to enhance the institution’s profits; d. barriers to switching financial products during their lifetime and/or to switching financial service providers; e. poorly designed distribution channels that may enable conflicts of interest with false incentives; f. automatic renewals of products or exit penalties; and/or g. unfair processing of customer complaints.
Since conduct risk covers a wide range of issues and may arise from many business
processes and products, competent authorities should leverage the outcome of the BMA and scrutinise incentive policies to gain a high-level insight into sources of conduct risk.
Where relevant, the competent authority should consider the level of competition in the
markets in which the institution operates and determine whether any dominant position, either alone or within a small group, presents a material risk of misconduct (e.g. as a result of cartellike behaviour).
Possible indicators to flag the existence of conduct risk are:
a. sanctions applied by relevant authorities to the institution for misconduct practices; 35 EBA Guidelines on ICT Risk Assessment under the Supervisory Review and Evaluation process (SREP) (EBA/GL/2017/05)

b. sanctions applied to peers for misconduct practices; and
c. complaints against the institution in terms of numbers and amounts at stake.
297. However, the competent authority should apply a forward-looking approach, also
considering the possible impact of regulatory developments and the activity of relevant authorities in respect of consumer protection and the supply of financial services in general. Model risk
298. Under the operational risk competent authorities should assess two distinct forms of model
risk:
a. risk relating to the underestimation of own funds requirements by regulatory advanced measurement approaches; and b. risk of losses relating to the development, implementation or improper use of any other models by the institution for decision-making (e.g. product pricing, evaluation of financial instruments, monitoring of risk limits, etc.), where competent authorities should establish an overview of such models and evaluate their significance and assess the model risk management framework adopted by the institution.
299. For the purpose of point (a) of paragraph 298, competent authorities should assess the
institution’s exposure to model risk arising from the use of internal models in the main business areas and operations, following the definition and requirements specified in Commission Delegated Regulation (EU) 2018/959 as far as they are applicable. The assessment of model risk may be based on the insights gained in other supervisory actions, including those carried out in accordance with Article 101 of Directive 2013/36/EU.
300. For the purpose of point (b) of paragraph 298 competent authorities should consider:
a. to what extent and for which purposes the institution uses models to make decisions and the business significance of such decisions. Competent authorities should determine the business/activity for which the institution makes material use of models. In conducting this assessment, competent authorities may look at the following areas, where institutions commonly make extensive use of models:
i. trading in financial instruments (including assets evaluation and trading
strategies);
ii. risk measurement and management; and
iii. capital allocation (including lending policies and product pricing).

b. the institution’s level of awareness of and how it manages model risk by assessing whether:
i. the institution has implemented control mechanisms (e.g. marketparameter calibration, internal validation or back-testing, counterchecking with expert judgement, etc.)that are sound in terms of methods,
frequency, follow-up, etc., and that include a model approval process; and
ii. the institution uses models in a conservative manner (e.g. by increasing or
decreasing relevant parameters based on the direction of the positions, etc.) if it is aware of model deficiencies or market and business developments.
301. When conducting the model risk assessment, competent authorities should consider the
assessment of other risks to capital and risks to liquidity and funding, in particular with respect to the adequacy of methodologies used for measuring risk, pricing and evaluating assets and/or liabilities. The results of such an assessment should inform the findings on operational risk.
302. For those business areas that make significant use of models, the competent authority
should then assess how significant the impact of model risk might be, amongst others, through sensitivity and scenario analyses or stress testing.
6.4.3 Assessment of reputational risk
303. Competent authorities should assess the reputational risk to which the institution is
exposed, by leveraging their understanding of the institution’s governance, its business model, its products, its customer base and the environment in which it operates. Such an assessment should also focus on the overall reputational risk framework, ensuring the ability of the institution to manage and mitigate any reputation events through appropriate communication strategies.
304. Reputational risk is more relevant for large institutions, in particular those with listed
equities or debts or those that operate in interbank markets. Accordingly, when assessing reputational risk, competent authorities should pay more attention to institutions that present those characteristics.
305. Competent authorities should consider both internal and external factors or events that
might give rise to reputational concerns in respect of the institution considering those of the factors listed in points a to i which are relevant to the institution. For Category-1 and Categpry2 institutions, competent authorities should consider all of the following indicators in their assessment of the institution’s exposure to reputational risk:
a. the number of sanctions from official bodies (not only those from competent authorities, but also sanctions arising from tax or other settlements);

b. ongoing known investigations by official bodies in respect of the institution or its representatives, and sanctions imposed or ongoing known investigations or legal disputes related to tax matters or other settlements, or due to materialisation of ML/TF risk or breaches of AML/CFT legislation;
c. media campaigns and consumer-association initiatives that contribute to a
deterioration in the public perception and reputation of the institution; d. the number of and changes in customer complaints or sudden loss of customers or investors; e. negative events affecting the institution’s peers when they are associated by the public with the whole financial sector or a group of institutions; f. the reputation of individuals involved in the management of the institution assessed in line with the Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders and the reputation of individuals with qualifying shareholding in the institution assessed in line with the ESAs Joint Guidelines on the prudential assessment of acquisitions and increases of qualifying holdings in the financial sector 36; g. its dealing with sectors or jurisdictions that are highly exposed to money laundering and terrorist financing 37 or individuals associated with high risk from an ML/TF perspective; h. the reputational impact of affected ICT systems and services and of cybersecurity incidents; and
i. other ‘market’ indicators, if available (e.g. rating downgrades or changes in the
share price throughout the year).
306. Competent authorities should assess the significance of the institution’s reputational risk
exposure and how it is connected with the other risks (i.e. credit, market, operational and liquidity risks) by leveraging the other risk assessments (including from other supervisory authorities) to identify any possible secondary effects in either direction (from reputation to other risks and vice versa).
307. In the context of the operational risk analysis, competent authorities should take into
account the relevance and significance of the institution’s exposures to ML/TF risk from a prudential perspective under the scope of operational risk. In this respect, competent authorities should use the relevant input received from AML/CFT supervisors to supplement 36 ESAs Joint Guidelines on the prudential assessment of acquisitions and increases of qualifying holdings in the financial sector (JC/GL/2016/01). 37 Refer to EBA Guidelines on ML/TF risk factors (EBA/GL/2021/02).

their findings from ongoing supervision and evaluate whether they give rise to prudential concerns related to ML/TF risk.
308. Competent authorities should bear in mind that any institution can be exposed to ML/TF
risk regardless of the institution’s size or financial soundness. Therefore, sufficient attention should also be paid to institutions that are perceived to be financially sound and may have a good reputation given that these institutions might be specifically targeted for ML/TF purposes. Attention should also be paid to institutions that are very successful in attracting new customers / expanding market share – especially by using non-traditional distribution channels

since this could be related to weak customer due diligence controls at the on boarding phase.

Competent authorities should share relevant information on operational risk issues
identified that can give rise to ML/TF risks and concerns such as deficiencies in the institutions’ IT system or internal control framework with AML/CFT supervisors.
6.4.4 Assessment of operational risk management, measurement and controls
Competent authorities should assess the framework and arrangements that the institution
has specifically to manage and control operational risk as an individual risk category. This assessment should take into account the outcome of the analysis of the overall risk management and internal-control framework addressed in Title 5, as this will influence the institution’s operational risk exposures. Regarding ML/TF risk, the competent authority should take into account the assessment provided by the AML/CFT supervisor.
Competent authorities should approach this review having regard to the key operational
risk drivers (i.e. people, processes, external factors, systems), which can also act as mitigating factors, and should consider:
a. the operational risk management strategy and appetite; b. the organisational framework;
c. policies and procedures;
d. operational risk identification, measurement, monitoring and reporting; e. business resilience and continuity plans; and f. the internal control framework as it applies to the management of operational risk. Operational risk management strategy and appetite
Competent authorities should assess whether the institution has defined and formalised a
sound operational risk management strategy and appetite level, approved by the management body. For this assessment, competent authorities should take into account whether:

a. the management body clearly expresses the operational risk management strategy and appetite level, as well as the process for the review thereof (e.g. in the event of an overall risk strategy review, a loss trend and/or capital adequacy concerns, etc.); b. senior management properly implements and monitors the operational risk management strategy approved by the management body, ensuring that the institution´s operational risk mitigation measures are consistent with the strategy established;
c. these strategies are appropriate and efficient with respect to the nature and
materiality of the operational risk profile and whether the institution monitors their effectiveness over time and their consistency with the operational risk appetite level; d. the institution’s operational risk management strategy covers all the activities, processes and systems of the institution – including on a forward-looking basis through the strategic plan – where operational risk is or may be significant; and e. the institution has an appropriate framework in place to ensure that the operational risk management strategy is effectively communicated to relevant staff.
313. To assess the credibility of such strategies, competent authorities should also assess
whether the institution has allocated sufficient resources to their implementation, and whether relevant decisions taken are irrespective of minimum own funds requirements benefits that might accrue (in particular for institutions adopting the BIA or TSA approaches to determine minimum own funds requirements). Organisational framework for management and oversight of operational risk
314. Competent authorities should assess the soundness and effectiveness of the organisational
framework with respect to the management of operational risk. In this regard, the competent authority should determine whether:
a. there are clear lines of responsibility for the identification, analysis, assessment, mitigation, monitoring and reporting of operational risk; b. the operational risk control and monitoring systems are subject to independent review and there is a clear separation between risk-takers and risk managers, between these and the risk control and oversight risk functions;
c. the risk management, measurement, and control functions cover operational risk
across the entire institution (including branches) in an integrated manner,

irrespective of the measurement approach adopted to determine minimum own funds, and also cover outsourced business functions and other activities; and d. the operational risk management framework is structured with sufficient and qualitatively appropriate human and technical resources. Policies and procedures
315. Competent authorities should assess whether the institution has appropriate policies and
procedures for the management of operational risk, including residual risk after mitigation techniques have been applied. For this assessment, competent authorities should take into account whether:
a. the management body approves the policies for managing operational risk and reviews them regularly, in line with the operational risk management strategies; b. senior management is responsible for developing and implementing the policies and procedures for managing operational risk;
c. operational risk management policies and procedures are clearly formalised and
communicated throughout the institution and are applied consistently across the institution, or at least those processes and businesses most exposed to operational risk; d. policies and procedures cover all the elements of operational risk management, measurement and control including, where relevant, loss data collection, quantification methodologies, mitigation techniques (e.g. insurance policies), causal analysis techniques in respect of operational risk events, limits and the handling of exceptions to those limits; e. the institution has implemented an approval process for new products, processes and systems that requires assessment and mitigation of potential operational risks raised by the implementation and the development of the related new products, processes and systems; f. such policies are adequate for the nature and complexity of the institution’s activities, and enable a clear understanding of the operational risk inherent to the different products and activities under the scope of the institution; g. the institution promotes an operational risk management culture throughout the organisation, by means of training and by setting targets for operational loss reduction. Risk identification, measurement, monitoring and reporting

Competent authorities should assess whether the institution has an appropriate
framework for identifying, assessing, measuring and monitoring operational risk, in line with the institution’s size and complexity, and whether the framework is compliant, as a minimum, with the relevant minimum own funds requirements under the relevant EU and national implementing legislation. Competent authorities should take into account whether:
a. the institution has implemented effective processes and procedures for comprehensive identification and assessment of operational risk exposure (e.g. Risk and Control Self-Assessments (RCSA)) and for the detection and accurate categorisation of relevant events (i.e. loss data collection, ‘near misses’ with no loss impact or even events that generate unexpected gains), including boundary cases with other risks (e.g. credit loss caused or augmented by an operational risk event); in this regard, competent authorities should also determine the ability of the institution to identify the key drivers of relevant operational losses and use this information for operational risk management purposes; b. for the purposes of Article 101 of Directive 2013/36/EU, if the institution is authorised to use an internal model to determine minimum own funds requirements for operational risk, the institution continues to fulfil the minimum requirements specified in the relevant EU and national implementing legislation and whether such an internal model involves any material risk underestimation;
c. the institution has appropriate information systems and methodologies to quantify
or assess the operational risk, which comply, as a minimum, with requirements for determining relevant minimum own funds as specified in the relevant EU and national implementing legislation (e.g. for TSA, mapping of relevant profit and loss items to the eight regulatory business lines; for the AMA, the length of time series, treatment of insurance, correlation, etc.); d. the institution has implemented adequate stress testing and scenario analysis, as appropriate, to understand the impact of adverse operational events on its profitability and own funds, also taking into due consideration the potential failure of internal controls and mitigation techniques; where relevant, competent authorities should consider the consistency of these analyses with the RCSA and with the outcome of peer analysis; e. the institution’s management body and senior management understand the assumptions underlying the measurement system and whether they are aware of the degree of relevant model risk; f. the institution has defined and implemented continuous and effective monitoring of operational risk exposures throughout the institution, including outsourced activities and new products and systems, amongst others, by means of specific

forward-looking indicators (key risk indicators and key control indicators) and relevant triggers to provide effective early warning alerts; g. the institution has defined adequate actions to respond to residual risks to keep them within the limits defined in the risk appetite; h. the institution has implemented regular reporting on operational risk exposure, including stress testing outcomes, to the management body, senior management and the managers of relevant businesses and processes as appropriate.
317. Competent authorities should assess the institution’s ICT risk management framework in
accordance with the EBA Guidelines on ICT Risk Assessment under the SREP and having regard to the EBA Guidelines on ICT and security risk management. Business resilience and continuity plans
318. Competent authorities should assess whether the institution has in place comprehensive
and tested business resilience and continuity plans, covering at least critical and important functions, including those that are outsourced, to ensure that it is able to operate on an ongoing basis and limit losses in the event of severe business disruption. For outsourced activities, competent authorities should ensure that the service provider has a suitable business continuity plan in line with the EBA Guidelines on outsourcing arrangements.
319. Competent authorities should determine whether the institution has established business
continuity plans commensurate with the nature, size and complexity of its operations. Such plans should take into account different types of likely or plausible scenarios to which the institution may be vulnerable.
320. Competent authorities should assess the quality and effectiveness of the institution’s
continuity management planning process. In doing so, competent authorities should evaluate the quality of the institution’s adherence to recognised Business Continuity Management (BCM) processes. Accordingly, competent authorities should determine whether the institution’s continuity management planning process includes:
a. a Business Impact Analysis; b. appropriate recovery strategies incorporating internal and external dependencies and clearly defined recovery priorities;
c. the drafting of comprehensive and flexible plans to deal with plausible scenarios;
d. effective testing of the design and operational effectiveness of the plans; e. BCM awareness and training programmes; and f. communications and crisis-management documentation and training.

Internal control framework
321. Competent authorities should assess whether the institution has a strong control
framework and sound safeguards to mitigate its operational risk, in line with its operational risk management appetite and strategy. Competent authorities should take into account whether:
a. the scope covered by the institution’s control functions includes all consolidated entities and geographical locations; b. there are internal controls and other practices (e.g. risk responses, such as conduct policies, risk transfer techniques, etc.) aimed at mitigating operational risk exposures or curtailing potential impacts, and keeping them within levels acceptable to the institution, in accordance with the parameters set by the management body and senior management and the institution’s risk appetite level; and
c. the institution has appropriate internal controls and practices to ensure that
breaches of and exceptions to policies, procedures and limits are reported in a timely manner to the appropriate level of management for action, and to competent authorities as required.
322. Competent authorities should also assess the functionality of the internal audit function.
To this end, they should determine whether:
a. the institution conducts internal audits of the operational risk management framework on a regular basis; b. the internal audit covers the main elements of operational risk management measurement and control across the institution; and
c. such audits are effective in determining adherence to internal policies and any
relevant external regulations and addressing any deviations from them.
323. For institutions using the AMA to determine minimum own funds requirements for
operational risk, competent authorities should also assess whether the internal approachvalidation process is sound and effective in challenging model assumptions and identifying any potential shortcomings with respect to operational risk modelling, quantification and systems and other relevant minimum requirements specified in the relevant EU and national implementing legislation.
324. Irrespective of the approach adopted by the institution to determine regulatory minimum
own funds, when models are used for decision-making (e.g. credit lending, pricing, trading financial instruments, etc.), competent authorities should assess whether there is a sound internal validation process and/or model-review process to identify and mitigate model risk.

Management of reputational risk
325. Competent authorities should assess whether the institution has implemented adequate
arrangements, strategies, processes and mechanismsto manage reputational risk. In particular, competent authorities should take into account whether:
a. the institution has formalised policies and processes in place for the identification, management and monitoring of this risk, and whether these policies and processes are proportionate to its size and its relevance in the system; b. the institution addresses this risk in a precautionary manner, for example by setting limits or requiring approval for allocating capital to specific countries, sectors or persons and/or whether its contingency plans address the need to deal proactively with reputational issues in the event of a crisis;
c. the institution conducts stress testing or scenario analysis to assess any secondary
effects of reputational risk (e.g. liquidity, funding costs, access to correspondent banking service, etc.); d. the institution acts to protect its brand through prompt communication campaigns where specific events occur that might endanger its reputation; and e. the institution considers the potential impact of its strategy and business plans, and more generally of its behaviour, on its reputation.
6.4.5 Summary of findings and scoring
326. Following the above assessment, competent authorities should form a view on the
institution’s operational risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in Table 6. If, based on the materiality of certain risk subcategories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy.
Table 6. Supervisory considerations for assigning an operational risk score
Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls There is a low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.

The institution’s operational risk
exposures are limited to a few high-frequency/low-severity impact categories.
The significance of the
institution’s exposure to operational risk is not material/very low, as shown by
There is consistency
between the institution’s operational risk policy and strategy and its overall strategy and risk appetite.
The organisational
framework for operational risk is robust with clear

Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls scenario analysis and compared with the losses of peers.

The level of gross losses (before
recoveries and including losses on credit portfolio caused by operational risk) experienced by the institution in recent years has been not material/very low or has decreased from a higher level. responsibilities and a clear separation of tasks between risk-takers and management and control functions.
Operational risk
framework includes all relevant risks.
Operational risk
measurement, monitoring and reporting systems are appropriate.
The control framework for
operational risk is sound.
There is a mediumlow risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The institution’s operational risk
exposures are mainly in highfrequency/low-severity impact categories.
The significance of the
institution’s exposure to operational risk is low to medium, as shown by scenario analysis and compared with the losses of peers.
The level of gross losses
experienced by the institution in recent years has been low to medium, or is expected to increase from a lower historic level or decrease from a higher historic level. There is a mediumhigh risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The institution’s operational risk
exposures extend to some lowfrequency/high-severity impact categories.
The significance of the
institution’s exposure to operational risk is medium to high, as shown by scenario analysis and compared with the losses of peers.
The level of gross losses
experienced by the institution in recent years has been medium to high, or is expected to increase from a lower historic level or decrease from a higher historic level.
The consistency between
the institution’s operational risk policy and strategy and its overall strategy and risk appetite is not sufficiently developed or even inadequate.
The organisational
framework for operational risk is not sufficiently robust.
Operational risk
framework does not include all relevant risks.

Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls There is a high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.

The institution’s operational risk
exposures extend to all main categories.
The significance of the
institution’s exposure to operational risk is high and increasing, as shown by scenario analysis and compared with the losses of peers.
The level of gross losses
experienced by the institution over the last few years has been high, or risk has significantly increased.
Operational risk
measurement, monitoring and reporting systems are inappropriate.
The control framework for
operational risk is tenuous.
6.5 Assessment of interest rate risk arising from non-trading book
activities
6.5.1 General considerations

Competent authorities should assess interest rate risk arising from interest rate-sensitive
positions from non-trading on and off-balance sheet activities (commonly referred to as interest rate risk in the non-trading book, or IRRBB), including hedges for these positions, irrespective of their recognition and measurement, and irrespective of the recognition and measurement of losses and gains, for accounting purposes.
Competent authorities should consider the relevance and materiality of at least the
following subcategories when assessing IRRBB:
a. Gap risk – risk resulting from the term structure of interest rate sensitive instruments that arises from differences in the timing of their rate changes, covering changes to the term structure of interest rates occurring consistently across the yield curve (parallel risk) or differentially by period (non-parallel risk). b. Basis risk – risk arising from the impact of relative changes in interest rates on interest rate sensitive instruments that have similar tenors but are priced using different interest rate indices. It arises from the imperfect correlation in the adjustment of the rates earned and paid on different interest rate sensitive instruments with otherwise similar rate change characteristics.
c. Option risk – risk arising from options (embedded and explicit), whereby the
institution or its customer can alter the level and timing of their cash flows, namely

the risk arising from interest rate sensitive instruments where the holder will almost certainly exercise the option if it is in their financial interest to do so (embedded or explicit automatic options) and the risk arising from flexibility embedded implicitly or within the terms of interest rate sensitive instruments, such that changes in interest rates may affect a change in the behaviour of the client (embedded behavioural option risk).
329. Competent authorities should take into account whether the guidance established in the
EBA Guidelines on IRRBB 38 are implemented prudently by the institution. This applies particularly to the institution’s internal interest rate risk identification, evaluation, management and mitigation.
330. Assessment of IRRBB should be differentiated from assessment of credit spread risk arising
from positions in the non-trading book (commonly referred to as CSRBB) that competent authorities should also conduct. In particular, competent authorities should take into account whether institutions’ internal systems adequately assess and monitor the risk from CSRBB from an economic value and net interest income perspective 39 .
6.5.2 Assessment of inherent IRRBB
331. Through the assessment of the inherent level of IRRBB, competent authorities should
determine the main drivers of the institution’s IRRBB exposure and evaluate the potential prudential impact of this risk on the institution. The assessment of inherent IRRBB should be structured around the following main steps:
a. preliminary assessment; b. assessment of the nature and composition of the institution’s interest rate risk profile; and
c. assessment of the outcome of the supervisory outlier tests and supervisory stress
tests, as well as the institution’s interest rate shock scenarios and interest rate stress scenarios. Preliminary assessment
332. To determine the scope of the IRRBB assessment, competent authorities should first
identify the sources of IRRBB to which the institution is or might be exposed. To do so, competent authorities should leverage the knowledge gained from ICAAP and ILAAP information collected for SREP purposes, from reporting established on IRRBB, from the 38 EBA Guidelines on the management of interest rate risk arising from non-trading book activities (EBA/GL/2018/02) 39 Further guidance on the CSRBB framework will be provided in the revised EBA guidelines that will be developed in implementation of the mandate envisaged by Article 84 of Directive 2013/36/EU.

assessment of other SREP elements, from the comparison of the institution’s position with those of its peers and from any other supervisory activities.
333. As a minimum, competent authorities should consider:
a. the institution’s governance of interest rate risk, including its main IRRBB strategy and its risk appetite in relation to IRRBB; b. the impact of the supervisory outlier tests stipulated in Article 98(5) of Directive 2013/36/EU and further specified by means of the delegated regulation adopted in accordance with in Article 98(5a) of that Directive;
c. the impact on net interest income and economic value from a change in interest
rates according to the methodology used by the institution, either on the basis of the (simplified) standardised methodology or on the basis of internal systems further specified by means of the delegated regulation adopted and the EBA guidelines adopted in accordance with Article 84(5) and (6) of Directive 2013/36/EU; and d. the internal capital – where relevant – allocated to IRRBB, both in total and as a proportion of the institution’s total internal capital according to its ICAAP, including the historical trend and forecasts.
334. In their preliminary assessment, competent authorities should also consider significant
changes in the institution’s exposures to IRRBB. As a minimum, they should assess the following aspects:
a. significant changes in the institution’s overall IRRBB strategy, risk appetite, policy or limit sizes; b. the potential impact on the institution’s risk profile of those changes;
c. major changes in the institution’s modelling, customer behaviour or use of interest
rate derivatives and d. major market trends.
Nature and composition of the institution’s interest rate risk profile
335. Competent authorities should form a clear view on how changes in interest rates can have
an adverse impact on an institution’s net interest income (and, where relevant, its earnings) and economic value (the present value of expected cash flows) to gain both a short-term and a longer-term view on the possible threat to capital adequacy.

For this purpose, competent authorities should analyse and form a clear view on the
structure of the institution’s assets, liabilities and, where available, off-balance-sheet exposures. In particular:
a. the different positions in the non-trading book, their maturities or repricing dates, and behavioural assumptions (e.g. assumptions regarding products with uncertain maturity) in relation to these positions; b. the institution’s interest cash flows;
c. the proportion of products with uncertain maturity, and products with explicit
and/or embedded options, paying particular attention to products with embedded customer optionality; and d. the hedging strategy of the institution and the amount and use of derivatives for hedging purposes.
To better determine the complexity and the interest rate risk profile of the institution,
competent authorities should also understand the main features of the institution’s assets, liabilities and off-balance-sheet exposures, in particular:
a. loan portfolio (e.g. volume of loans with no maturity, volume of loans with prepayment options, volume of floating-rate loans with caps and floors, share of floating rate loan contracts that prevent repricing at negative rates, etc.); b. bond portfolio (e.g. volume of investments with options, possible concentrations);
c. non-performing exposures;
d. deposit accounts (e.g. sensitivity of the institution’s deposit base to changes in interest rates including core deposits, possible concentrations); e. derivatives (e.g. complexity of the derivatives, considerations relating to sold or bought interest rate options, impact of derivatives on the duration of non-trading book positions); and f. nature of IRRBB embedded in fair value instruments, including less liquid instruments such as Level 3 assets and liabilities.
When analysing the impact on the institution’s earnings, competent authorities should
consider the institution’s different sources of income and expenses and their relative weights to total revenues. They should be aware of how much the institution’s returns depend on interest rate-sensitive positions, and they should determine how different changes in interest rates would affect the institution’s net interest income, as well as determining the effects of changes in the market value of instruments – depending on accounting treatment – either

shown in the profit and loss (P&L) account or directly in equity (e.g. via other comprehensive income).
339. When analysing the impact on the institution’s economic value and earnings, competent
authorities should first consider the results of the supervisory outlier tests stipulated in Article 98(5) of Directive 2013/36/EU and further specified in the delegated regulation adopted in accordance with Article 98(5a) of that Directive, to get an initial benchmark against which to compare how interest rate changes would affect the institution. When performing this assessment, competent authorities should pay particular attention to the sensitivity of cash flows to repricing, in terms of both their timing and amount, to changes in the underlying key assumptions (particularly for customer accounts without specific repricing dates, customer accounts with embedded customer optionality and/or equity capital).
340. Competent authorities should seek to understand the impact of those assumptions and
then isolate the economic value and earnings risks arising from the institution’s behavioural adjustments.
341. Competent authorities should pay attention to the sensitivity of cash flows to changes in
the valuation of fair value instruments in the non-trading book, including interest rate derivatives used for the hedging of non-trading book instruments (e.g. impact of mark-tomarket changes in fair value instruments on P&L, hedge account effectiveness).
342. In addition to using the supervisory outlier test stipulated in Article 98(5) of Directive
2013/36/EU and further specified in the delegated regulation adopted in accordance with
Article 98(5a) of that Directive competent authorities may require institutions to take into
account other interest rate shock scenarios.
343. In their quantitative assessment, competent authorities should also consider the results of
the institution’s internal or standardised methodologies for measuring IRRBB, where appropriate. Through the analysis of these methodologies, competent authorities should gain a deeper understanding of the main risk factors underlying the institution’s IRRBB profile.
344. Competent authorities should assess whether those institutions operating in different
currencies perform an analysis of the interest rate risk in each currency in which they have a significant position. Competent authorities should also assess the approaches that these institutions use for the purpose of aggregating the results of economic value and earnings measures in individual currencies.
345. When analysing the results of both the impact of the supervisory outlier tests and the
institution’s internal or standardised methodologies, competent authorities should consider ‘point in time’ figures as well as historical trends. These rates should be compared to peers and considered in the context of the global market situation. Shock scenarios and stress testing

Competent authorities should assess and take into account the results of the interest rate
shock scenarios and stress tests (in addition to those ofthe supervisory outlier tests) performed by the institution as part of its ongoing internal management process. In this context, competent authorities should be aware of the main sources of the institution’s IRRBB.
If, when the outcome of the institution’s shock scenarios and stress tests is reviewed,
particular accumulations of repricing/maturity at different points on the curve are revealed or suspected, competent authorities may need to carry out additional analyses.
6.5.3 Assessment of IRRBB management and controls (both risk management and
compliance, and internal audit control functions)
To achieve a comprehensive understanding of the institution’s interest rate risk profile in
the non-trading book, competent authorities should review the governance and framework underlying its interest rate exposures.
Competent authorities should assess the following elements:
a. IRRBB strategy and appetite (as distinct elements or as part of the broader market risk strategy and appetite); b. organisational framework and responsibilities;
c. policies and procedures;
d. risk identification, measurement including internal models, monitoring and reporting; and e. internal control framework. IRRBB strategy and appetite
Competent authorities should assess whether the institution has a sound, clearly
formulated and documented IRRBB strategy, approved by the management body. For this assessment, competent authorities should take into account:
a. whether the management body clearly expresses the IRRBB strategy and appetite and the process for the review thereof (e.g. in the event of an overall review of risk strategy, or concerns about profitability or capital adequacy), and whether senior management properly implements the IRRBB strategy approved by the management body, ensuring that the institution’s activities are consistent with the established strategy, written procedures are drawn up and implemented, and responsibilities are clearly and properly assigned; b. whether the institution’s IRRBB strategy properly reflects the institution’s appetite for IRRBB and whether it is consistent with the overall risk appetite;

c. whether the institution’s IRRBB strategy and appetite are appropriate for the
institution considering:

its business model;
its overall risk strategy and appetite;
its market environment and role in the financial system; and
its capital adequacy;
d. whether the institution’s IRRBB strategy broadly covers all the activities of the institution where IRRBB is significant; e. whether the institution’s IRRBB strategy takes into account the cyclical aspects of the economy and the resulting shifts in the composition of IRRBB activities; and f. whether the institution has an appropriate framework in place to ensure that the IRRBB strategy is effectively communicated to relevant staff. Organisational framework and responsibilities

Competent authorities should assess whether the institution has an appropriate
organisational framework and clearly assigned responsibilities for IRRBB management, measurement, monitoring and control functions with adequate human and technical resources. They should take into account whether:
a. there are clear lines of responsibility for the overall management of IRRBB, and for taking, monitoring, controlling and reporting IRRBB; b. the IRRBB management and control area is subject to independent review and is clearly identified in the organisation and functionally and hierarchically independent of the business area; and
c. the staff dealing with interest rate risk (both in the business area and in the
management and control areas) have appropriate skills and experience.
Policies and procedures
Competent authorities should assess whether the institution has clearly defined policies
and procedures for the management of IRRBB that are consistent with its IRRBB strategy and appetite. They should take into account whether:
a. the management body approves the policies for managing, measuring and controlling IRRBB and discusses and reviews them regularly in line with risk strategies;

b. senior management is responsible for developing policies and procedures and ensuring adequate implementation of the management body’s decisions;
c. IRRBB policies are compliant with relevant regulations and adequate for the nature
and complexity of the institution’s activities, enabling a clear understanding of the inherent IRRBB; d. such policies are clearly formalised and communicated and applied consistently across the institution; e. these policies are applied consistently across banking groups and allow proper management of IRRBB; f. IRRBB policies define the procedures for new product development, major hedging or risk management initiatives and such policies have been approved by the management body or its appropriate delegated committee. In particular, competent authorities should ensure that:

new products and new major hedging and risk management initiatives are
subject to adequate procedures and controls before being introduced or undertaken; and
the institution has undertaken an analysis of their possible impact in its
overall risk profile.
Risk identification, measurement including internal models, monitoring and reporting

Competent authorities should assess whether the institution has an appropriate
framework for identifying, evaluating, managing and mitigating IRRBB, in line with the level, complexity and riskiness of non-trading book positions and the institution’s size and complexity. The assessment should encompass internal models, such as those related to customer behaviour (e.g. models of deposit stability and loan early repayment). They should consider the following:
a. Whether the information systems and measurement techniques enable management to measure the inherent IRRBB in all its material on- and off-balancesheet exposures (where relevant at group level), including internal hedges, in the non-trading book portfolio. b. Whether the institution has adequate staff and methodologies to measure IRRBB (in accordance with the requirements of the EBA Guidelines on IRRBB), taking into account the size, form and complexity of their interest rate risk exposure.

c. Whether the internal systems implemented by the institution for the purpose of
evaluating IRRBB in the context of Article 84(3) of Directive 2013/36/EU are satisfactory, also having regard to the EBA Guidelines on IRRBB. d. Whether the assumptions underlying internal models and methodologies take into account the guidance established by the EBA Guidelines on IRRBB. In particular, competent authorities should assess whether the institution’s assumptions regarding positions with no contractual maturity and embedded customer options are prudent. Competent authorities should also assess whether institutions include equity in the calculation of economic value and, if they do, analyse the impact of removing equity from that calculation. e. Whether the institution’s risk measurement systems take into account all material forms of interest rate risk to which the institution is exposed (e.g. gap risk, basis risk and option risk). If some instruments and/or factors are excluded from the risk measurement systems, institutions should be able to explain why to supervisors and to quantify the materiality of the exclusions. f. Whether institution’s internal models used for the measurement of IRRBB have been properly developed, independently validated (including whether any expert opinions and judgement employed in the internal models have been thoroughly assessed), backtested (to the extent possible) and reviewed regularly. g. The quality, detail and timeliness of the information provided by the information systems and whether the systems are able to aggregate the risk figures for all the portfolios, activities and entities included in the consolidation perimeter. Information systems should comply with the guidance established by the EBA Guidelines on IRRBB. h. The integrity and timeliness of the data that feed the risk measurement process, which should also comply with the guidance established by the EBA Guidelines on IRRBB.
i. Whether the institution’s risk measurement systems are able to identify possible
IRRBB concentrations (e.g. in certain time buckets). j. Whether risk managers and the institution’s senior management understand the assumptions underlying the measurement systems, especially with regard to positions with uncertain contractual maturity and those with implicit or explicit options, as well as the institution’s assumptions for equity capital. k. Whether risk managers and the institution’s senior management are aware of the degree of model risk that prevails in the institution’s risk measurement techniques.

l. Whether the use of interest rate derivatives is compliant with the IRRBB risk
strategy and whether those activities are performed within the risk appetite framework and with adequate internal governance arrangements in place.
354. Competent authorities should assess whether the institution has implemented adequate
stress test scenarios that complement its risk measurement system. In their assessment, they should evaluate compliance with the relevant guidance established in the EBA guidelines issued in accordance with Article 98(5) of Directive 2013/36/EU.
355. Competent authorities should assess whether the institution has an appropriate
monitoring and internal reporting framework for IRRBB that ensures there is prompt action at the appropriate level of the institution’s senior management or management body, where necessary. The monitoring system should include specific indicators and relevant triggers to provide effective early warning alerts. Competent authorities should take into account whether the management and control area reports regularly (the frequency will depend on the scale, complexity and level of IRRBB exposures) to the management body and senior management the following information, as a minimum:
a. an overview of the current IRRBB exposures, P&L results and risk calculation, and the drivers of level and direction of IRRBB; b. significant breaches of IRRBB limits;
c. changes in the major assumptions or parameters on which the procedures for
assessing IRRBB are based; d. changes in the interest rate derivatives position and whether these are related to changes in the underlying hedging strategy; and e. information on the performance of the models used. Internal control framework
356. Competent authorities should assess whether the institution has a strong and
comprehensive control framework and sound safeguards to mitigate its exposures to IRRBB in line with its risk management strategy and risk appetite. They should take into account:
a. whether the scope of the institution’s control function includes all consolidated entities, all geographical locations and all financial activities; b. whether there are internal controls, operating limits and other practices aimed at keeping IRRBB exposures at or below levels acceptable to the institution, in accordance with the parameters set by the management body and senior management and the institution’s risk appetite; and

c. whether the institution has appropriate internal controls and practices to ensure
that breaches of and exceptions to policies, procedures and limits are reported in a timely manner to the appropriate level of management for action.
357. Competent authorities should assess the limit system, including whether:
a. it is consistent with the risk management strategy and risk appetite of the institution; b. it is adequate for the complexity of the institution’s organisation and IRRBB exposures, and for its ability to measure and manage this risk;
c. it addresses the potential impact of changes in interest rates on earnings and the
institution’s economic value (from an earnings perspective, limits should specify acceptable levels of volatility for earnings under specified interest rate scenarios; the form of limits for addressing the effect of rates on an institution’s economic value should be appropriate for the size and complexity of the institution’s activities and underlying positions); d. the limits established are absolute or whether breaches of limits are possible (in the latter case, the institution’s policies should clearly set out the period of time during which and the specific circumstances under which such breaches of limits are possible; competent authorities should request information about measures that ensure limits are adhered to); and e. the institution has adequate procedures for reviewing its limits regularly.
358. Competent authorities should assess the functionality of the internal audit function. To this
end, they should assess whether:
a. the institution conducts internal audits of the IRRBB management framework on a regular basis; b. the internal audit covers the main elements of IRRBB management, measurement and control across the institution; and
c. the internal audit function is effective in determining adherence to internal policies
and the relevant external regulations and addressing any deviations.
6.5.4 Summary of findings and scoring
359. Following the above assessments, competent authorities should form a view on the
institution’s IRRBB. This view should be reflected in a summary of findings, accompanied by a score based on the considerations specified in Table 7. If, based on the materiality of certain risk subcategories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy.

Table 7. Supervisory considerations for assigning a score to IRRBB
Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls There is a low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.

The sensitivity of the economic
value to changes in interest rates is not material/very low.
The sensitivity of earnings to
changes in interest rates is not material/very low.
The sensitivity of the economic
value and earnings to changes in the underlying assumptions (e.g. in the case of products with embedded customer optionality) is not material/very low.
There is consistency
between the institution’s interest rate risk policy and strategy and its overall strategy and risk appetite.
The organisational
framework for interest rate risk is robust with clear responsibilities and a clear separation of tasks between risk-takers and management and control functions.
Interest rate risk
measurement, monitoring and reporting systems are appropriate.
Internal limits and the
control framework for interest rate risk are sound and are in line with the institution’s risk strategy and risk appetite. There is a mediumlow risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The sensitivity of the economic
value to changes in interest rates is low to medium.
The sensitivity of earnings to
changes in interest rates is low to medium.
The sensitivity of the economic
value and earnings to changes in the underlying assumptions (e.g. in the case of products with embedded customer optionality) is low to medium. There is a mediumhigh risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The sensitivity of the economic
value to changes in interest rates is medium to high.
The sensitivity of earnings to
changes in interest rates is medium to high.
The sensitivity of the economic
value and earnings to changes in the underlying assumptions (e.g. in the case of products with embedded customer optionality) is medium to high.
There is inconsistency
between the institution’s interest rate risk policy and strategy and its overall strategy and risk appetite.
The organisational
framework for interest rate risk does not sufficiently separate responsibilities and tasks between risk-takers and management and control functions.
Interest rate risk
measurement, monitoring and reporting systems are not undertaken with There is a high risk of significant prudential impact on the institution considering the level of inherent risk and
The sensitivity of the economic
value to changes in interest rates is high.
The sensitivity of earnings to
changes in interest rates is high.
The sensitivity of the economic
value and earnings to changes in

Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls the management and controls. the underlying assumptions (e.g. in the case of products with embedded customer optionality) is high. sufficient accuracy and frequency.

Internal limits and the
control framework for interest rate risk are not in line with the institution’s risk strategy and risk appetite.

SREP capital assessment
7.1 General considerations
360. Competent authorities should determine through the SREP capital assessment whether the
own funds held by the institution provide sound coverage of risks to capital to which the institution is or might be exposed, if such risks are assessed as material to the institution.
361. Competent authorities should do this by determining and setting the quantity (amount)
and quality (composition) of additional own funds the institution is required to hold to cover institution-specific risks and elements of risks that are not covered or not sufficiently covered by Parts Three, Four and Seven of Regulation (EU) No 575/2013 and Chapter 2 of Regulation (EU) 2017/2402 (‘Pillar 1 own funds requirements’), and, where necessary, own funds requirements to address deficiencies in models, controls, governance or other deficiencies, as well as risk arising from the institution’s business model (‘additional own funds requirements’). Additional own funds requirements should be met by the institution at all times.
362. To address potential capital inadequacies, including in stressed conditions, competent
authorities should take appropriate supervisory measures, including, where relevant, establishing and communicating P2G which is the quantity (amount) and quality (composition) of own funds that the institution is expected to hold over and above its OCR or its OLRR.
363. When setting the additional own funds requirements and, where relevant, guidance,
competent authorities should:
a. take into account any supervisory measures that the competent authority has applied or is planning to apply to an institution in accordance with Chapter 10 and having regard to paragraphs 386 to 389; b. clearly justify all elements of additional own funds requirements for P2R and P2R-LR as well as for P2G and P2G-LR;
c. apply P2R and P2R-LR as well as P2G and P2G-LR in a consistent manner to ensure
broad consistency of prudential outcomes across institutions.
364. Competent authorities should assess the adequacy of the institution’s own funds and the
impact of economic stress thereon, as well as risks posed by excessive leverage, as a key determinant of the institution’s viability. This determination should be summarised and reflected in a score based on the criteria specified at the end of this title. The SREP capital assessment process

After considering the outcomes of the assessment of risks to capital as specified in Title 6,
competent authorities should undertake the following steps as part of the SREP capital assessment process:
a. determination of additional own funds requirements for risks other than the risk of excessive leverage; b. assessment of the risk of excessive leverage and determination of additional own funds requirements to address this risk;
c. reconciliation of P2R, P2R-LR, P2G and P2G-LR with the capital buffers and any
macroprudential requirements; d. determination of TSCR, TSLRR and OCR, OLRR; e. articulation and justification of own funds requirements; f. assessment of whether TSCR, TSLRR and OCR, OLRR can be met in stressed conditions; g. determination of P2G and P2G LR; h. determination of the capital adequacy score.
7.2 Determining additional own funds requirements for risks other
than the risk of excessive leverage
Competent authorities should determine additional own fundsrequirements for risks other
than the risk of excessive leverage, where they identify any of the situations listed in Article 104a(1) of Directive 2013/36/EU for an institution, including in particular:
a. the risk of unexpected losses, and of expected losses insufficiently covered by provisions, over a 12-month period (except where Regulation (EU) No 575/2013 specifies own funds requirements over a different period) (‘unexpected losses’), which individual institutions are facing due to their activities, including those reflecting the impact of certain economic and market developments; b. model deficiencies as assessed in the context of Article 101 of Directive 2013/36/EU; and
c. deficiencies in internal governance, including internal control arrangements and
other deficiencies, as well as risk arising from the institution’s business model, identified following the risk assessment outlined in Titles 4 to 6.
7.2.1 Determining additional own funds to cover unexpected losses
When setting additional own fundsrequirements for the risk of unexpected losses pursuant
to point (a) of paragraph 366, competent authorities should consider each type of risk that may pose a material risk to the institution’s capital. Competent authorities should set additional own funds required to cover the risk of unexpected losses by determining the capital considered adequate to cover the type of risk and deducting the relevant part of own funds requirements set out in Parts Three and Four of Regulation (EU) No 575/2013 and Chapter 2 of Regulation (EU) 2017/2402.
For the purpose of the previous paragraph, competent authorities should determine on a
risk-by-risk basis, the amounts of capital considered adequate, by identifying, assessing and quantifying the risks to which the institution is exposed and they should take into account the full risk profile of an institution. The determination of the amounts of capital considered adequate should include:
a. institution-specific risks or elements of such risks that are explicitly excluded from or not explicitly addressed by the Pillar 1 own funds requirements; b. institution-specific risks or elements of such risks that are considered not to be sufficiently covered by the applicable Pillar 1 own funds requirements.
Competent authorities should ensure that the amount of capital considered adequate to
cover each risk identified in accordance with Articles 79 to 85 of Directive 2013/36/EU is not lower than the relevant part of the applicable Pillar 1 own funds requirement covering that risk. In exceptional cases where it is overly burdensome, especially for small institutions, to meaningfully disentangle the amount of capital considered adequate for two or more types of risk quantified together, competent authorities should comply with the first sentence of this paragraph on a best-effort basis, using the ICAAP calculations, supervisory judgement and other sources of information, by determining the level of additional own funds requirements in a conservative manner, having regard to paragraphs 372 to 374.
The identification, assessment and quantification of risks to which the institution is exposed
should be supported by the following sources of information:
a. the ICAAP and the outcomes of its assessment by the competent authority, including the ICAAP calculations where deemed reliable or partially reliable in accordance with paragraphs 375 to 377; b. supervisory reporting;
c. the outcome of supervisory assessment and benchmarking;
d. the outcomes of any relevant previous supervisory activities; and e. other relevant inputs, including those arising from interaction and dialogue with the institution.
The ICAAP and outcomes of its assessment should be taken into account by competent
authorities as one of the key inputs for the identification and assessment of risks relevant for the institution. The determination of the amount of capital considered adequate and additional own funds requirements on a risk-by-risk basis should take into account the ICAAP calculations if deemed reliable or partially reliable, as well as the outcomes of supervisory benchmarking and other relevant inputs as appropriate, including the supervisory judgement.
Competent authorities should not allow own funds held pursuant to Article 92 of
Regulation (EU) No 575/2013 to be used to meet or offset additional own funds requirements both on an aggregate and on a risk-by-risk basis.
For the purposes of Article 98(1), point (f) of Directive 2013/36/EU and the determination
of additional own funds requirements, competent authorities should assess and consider diversification effects arising from geographical, sectoral or any other relevant drivers within each material risk category (intra-risk diversification). For each of the risks to capital covered by Regulation (EU) No 575/2013, such diversification effects should not reduce the minimum own funds requirements calculated in accordance with Article 92 of Regulation (EU) No 575/2013.
However, diversification between risks in different categories, including those covered by
Regulation (EU) No 575/2013 (inter-risk diversification) should not be considered as part of the determination of additional own funds requirements. ICAAP calculations
Competent authorities should assess the reliability of the ICAAP calculations by assessing
whether they are:
a. Granular: the calculations/methodologies should allow the calculations to be broken down by risk type, rather than presenting a single (economic capital) calculation covering all risks. This breakdown should be enabled by the ICAAP methodology itself. Risks should not be excluded from the ICAAP where they are difficult to quantify or where relevant data are not available; estimates may be provided based on available information and including expert judgement. Where deemed appropriate by the competent authority, estimates may be provided through marginal contribution calculations, for example, for risks that cannot be measured on a standalone basis (e.g. credit concentration risk). b. Credible: the calculations/methodologies used should demonstrably cover the risk they are looking to address (e.g. the credit concentration risk calculation should use appropriate sector breakdowns that reflect actual correlations and portfolio compositions) and should be sufficiently robust, stable, risk sensitive and conservative to adequately quantify losses associated with the risks. Such

calculations/methodologies should be consistent with the institutions’ strategic processes, including the institutions’ risk appetite.
c. Understandable: the underlying drivers of the calculations/methodologies should
be clearly specified. A ‘black box’ calculation should not be acceptable. Competent authorities should ensure that the institution provides an explanation of the key assumptions used, including at least time horizon, confidence levels, correlation assumptions, key parameters, the most fallible areas of the models used, and how these are accounted for and corrected in the final ICAAP calculation. d. Comparable: the calculations/methodologies should clearly mention the main assumptions in terms of the overall level of conservatism, the holding periods/risk horizons and confidence levels (or equivalent measurement) in order to allow the adjustment that may be requested or enacted by competent authorities in order to facilitate comparability with peers and supervisory benchmarking.
376. Competent authorities should further assess the reliability of the ICAAP calculations by
comparing them against the outcome of the supervisory benchmarks for the same risks, and other relevant inputs.
377. An ICAAP calculation should be considered partially reliable where, despite not meeting all
the above criteria, the calculation still seems highly credible, though this should be on an exceptional basis and accompanied by steps to improve deficiencies identified in the ICAAP calculation. Supervisory benchmarks
378. Competent authorities should develop and apply risk-specific supervisory benchmarks as a
means to challenge ICAAP calculations for those material risks, or elements of such risks, that are not covered or not sufficiently covered by Regulation (EU) No 575/2013, or to further support the determination of risk-by-risk additional own funds requirement, especially where ICAAP calculations for those material risks, or elements of such risks, are deemed unreliable or are unavailable.
379. The supervisory benchmarks should be developed to provide a prudent, consistent (i.e., as
applicable, calibrated to equivalent holding periods/risk horizons and confidence levels as required by Regulation (EU) No 575/2013), transparent and comparable measure with which to calculate and compare across institutions the capital considered adequate for a given type of risk.
380. Given the variety of different business models operated by institutions, the outcome of the
supervisory benchmarks may not be appropriate in every instance for every institution. Competent authorities should address this by using the most appropriate benchmark where alternatives are available, and by applying judgement to the outcome of the benchmark to account for business-model-specific and institution-specific considerations.

When competent authorities take supervisory benchmarks into consideration for the
determination of additional own funds requirements, as part of the dialogue, they should explain to the institution the rationale and general underlying principles behind the benchmarks. Other relevant inputs
Competent authorities should use other relevant inputs to support the determination of
risk-by-risk additional own funds requirements. Other relevant inputs may include the outcomes of risk assessments (following the criteria specified in Title 6), peer-group comparisons, including report(s) issued by the EBA pursuant to the requirements of Article 78 of Directive 2013/36/EU, benchmarks issued by the EBA pursuant to Article 101 of Directive 2013/36/EU, etc.
Other relevant inputs should prompt the competent authority to reassess the
appropriateness/reliability of an ICAAP/supervisory benchmarks for a specific risk, and/or make adjustments to the outcome, where they prompt doubts about its accuracy (e.g. where the risk score implies a significantly different level of risk relative to the calculation, or where peer reviews reveal that the institution differs significantly from peers in terms of the own funds requirement to cover a comparable risk exposure).
To ensure consistency in determining additional risk-by-risk own funds requirements,
competent authorities should use the same peer groups established to analyse risks to capital as specified in Title 6.
When competent authorities take other relevant inputs into consideration for the
determination of additional own funds requirements, as part of the dialogue, they should explain to the institution the rationale and general underlying principles behind the inputs used.
7.2.2 Determining own funds or other measures to cover model deficiencies
If, during the ongoing review of internal approaches pursuant to the requirements of
Article 101 of Directive 2013/36/EU, or through the peer analysis conducted pursuant to
Article 78 of Directive 2013/36/EU, competent authorities identify model deficiencies that
could lead to underestimation of the minimum own funds requirements set by Regulation (EU) No 575/2013, they should set additional own funds requirements for model deficiencies that could lead to underestimation of risk where this is determined to be more appropriate than other supervisory measures. Competent authorities should only set additional own funds requirements to cover these deficiencies, where it is not possible to address them under Pillar 1 own funds requirements through other supervisory measures, such as requiring institutions to adjust their models or apply an appropriate margin of conservatism to their estimates. Such additional own funds requirements should only be set as an interim measure while the deficiencies are addressed.

7.2.3 Determining own funds or other measures to cover other deficiencies
387. Competent authorities should set additional own funds to cover deficiencies in governance,
controls, business model or other deficiencies – identified following the risk assessment outlined in Titles 4 to 6 – where other supervisory measures are considered insufficient or not appropriate to ensure compliance with the requirements. Competent authorities should only set such additional own funds requirements as an interim measure while the deficiencies are addressed.
388. Competent authorities should only set additional own funds requirements to cover funding
risk – identified following the risk assessment outlined in Title 8 – where this is determined to be more appropriate than other supervisory measures applied in accordance with Title 9.
389. Where an institution repeatedly fails to establish or maintain an adequate level of own
funds to cover the guidance communicated in accordance with Article 104b(3) of Directive 2013/36/EU, competent authorities should set additional own funds requirements to cover that additional risk not later than 2 years after the breach of guidance. Competent authorities may postpone that decision where they allow institutions to operate below the level of guidance due to economic or market conditions or institution-specific circumstances, in line with paragraphs 584 and 585.
7.2.4 Determining the composition of additional own funds requirements
390. Competent authorities should set the composition of additional own funds requirements
as at least 56.25% Common Equity Tier 1 (CET1) and at least 75% Tier 1. Competent authorities may set the composition of additional own funds requirements for all risks other than the risk of excessive leverage on an aggregated level.
391. Where necessary, and having regard to the specific circumstances of an institution,
competent authorities may require institutions to cover additional own funds requirements with a higher quality of capital than that referred to in paragraph 390. Any imposition of a higher quality of capital should be justified, taking into account the individual risk situation of the institution and consideration of risks that may require high quality of capital to cover potential losses.
7.3 Additional own funds requirements for the risk of excessive
leverage
392. In accordance with Article 104a (3) and (4) of Directive 2013/36/EU 40 , competent
authorities should assess the risk of excessive leverage separately from other types of risk. Where, as a result of such an assessment, competent authorities determine additional own 40 Further explained in recital 15 of Directive (EU) 2019/878 of the European Parliament and of the Council of 20 May 2019 amending Directive 2013/36/EU as regards exempted entities, financial holding companies, mixed financial holding companies, remuneration, supervisory measures and powers and capital conservation measures, OJ L 150, 7.6.2019, p. 253.

funds requirement to address the risk of excessive leverage, they should add this requirement to the own funds requirement based on the leverage ratio as set out in Article 92(1) point (d) of Regulation (EU) No 575/2013 and not to the own funds requirements based on the total risk exposure amount (TREA) as set out in points (a) to (c) of that paragraph of the article. Competent authorities should consider the leverage ratio requirement and the additional own funds requirement to address the risk of excessive leverage as a separate stack from the TREAbased requirements and additional own funds requirements for all other types of risk (i.e. available own funds can simultaneously be used to meet requirements in the TREA-based stack and in the leverage ratio-based stack of own funds requirements).
7.3.1 Assessment of risk of excessive leverage
393. In line with the concept of the leverage ratio (and its stack of requirements) as a backstop
to the TREA-based own funds requirements, in the assessment of the risk of excessive leverage as defined in Article 4(1), point (93) and (94) of Regulation (EU) No 575/2013, competent authorities should focus on potential material vulnerabilities not covered or not sufficiently covered by the own funds requirements as set out in Article 92(1) point (d) of Regulation (EU) 575/2013 that may require corrective measuresto the business activities of the institution, that were not envisaged in its business plan.
394. In assessing the risk of excessive leverage, competent authorities should consider all of the
following aspects and they should adapt the depth of the assessment of each aspect depending on its relevance for the institution:
a. elements of risk of excessive leverage that are considered not covered or not sufficiently covered by the leverage ratio own funds requirement set out in Article 92(1) point (d) of Regulation (EU) No 575/2013, as a result of in particular:
i. regulatory arbitrage / optimisation of the leverage ratio by exchanging
exposures counted in the leverage ratio for economically similar exposures that may be less counted in the leverage ratio exposure calculation;
ii. regulatory arbitrage / optimisation by minimising the leverage ratio
exposure in the form of temporary reductions of transaction volumes in key financial markets (particularly in the money market, of certain activities such as SFTs, but also in the derivative market) around reference dates resulting in the reporting 41 and public disclosure of elevated leverage ratios (‘window-dressing activities’); and
iii. specific features of the business model, business activities or other bank
idiosyncrasies that either increase or decrease the extent to which the 41 To provide insight, Commission Implementing Regulation (EU) 2021/451 of 17 December 2020 introduces template C48.00 with daily values for SFTs in COREP in regard of large institutions. Further note that extensive daily data is reported to trade repositories in accordance with Commission Implementing Regulation (EU) 2019/363 of 13 December 2018 (regarding SFTs) and in accordance with Commission Implementing Regulation (EU) No 1247/2012 of 19 December 2012 (regarding derivatives).

institution is exposed to the risk of excessive leverage (e.g. as per the aspects in paragraph 393) but are not covered or not sufficiently covered in the calculation of the leverage ratio. Competent authorities should consider, where applicable, high exposures to written options on equity or short positions via credit derivatives that may have an elevated exposure to peak losses, as these positions are not fully captured in the leverage ratio exposure (in contrast to, for example, written credit derivatives), and concentrations in certain off-balance sheet items where the idiosyncrasies inherent to the business activities of the institution may lead to increased volatility in drawdowns. b. elements of risk of excessive leverage that are explicitly excluded from or not explicitly addressed by the leverage ratio own funds requirement, including due to the exclusions listed in Article 429a of Regulation (EU) No 575/2013, particularly where there are concerns about the assessment of continued compliance with the conditions for these exclusions and where the reliance on a single exclusion is highly significant for the institution and the amount excluded is unduly volatile;
c. the changes in the institution’s leverage ratio and its components, including the
foreseeable impact of current and future expected losses on the leverage ratio, taking into account the business model of the institution.
7.3.2 Determination of additional own funds requirement to address the risk of
excessive leverage
395. On the basis of the assessment performed under Section 7.3.1 of these Guidelines,
competent authorities should determine the additional own fundsrequirements to address the risk of excessive leverage as the difference between the capital considered adequate to cover the risk of excessive leverage and the leverage ratio own funds requirements as set out in
Article 92(1) point (d) of Regulation (EU) No 575/2013. This amount cannot be negative.
396. When setting additional own funds requirements to address the risk of excessive leverage
competent authorities should consider in particular:
a. elements of risk of excessive leverage that are considered not covered or not sufficiently covered by the leverage ratio own funds requirement set out in Article 92(1), point (d) of Regulation (EU) No 575/2013, particularly where the assessment of the aspects described in paragraphs 393 or 394 indicate a high vulnerability when compared to the leverage ratio exposure. b. elements of risk of excessive leverage that are explicitly excluded from or not explicitly addressed by the leverage ratio own funds requirement, including due to the exclusions listed in Article 429a(1) of Regulation (EU) No 575/2013 assessed in accordance with paragraph 394b. Competent authorities should set additional own funds requirements only in those cases, where particularly extensive use of a

certain exclusion results in a level of leverage ratio that does not appropriately reflect the risk faced by the institution.
397. Competent authorities should ensure that the capital considered adequate to cover the risk
of excessive leverage is not lower than the leverage ratio own funds requirements (i.e. the additional own funds requirements to address the risk of excessive leverage cannot be negative).
398. Competent authorities should identify, assess and quantify the risk of excessive leverage
following the sources of information and methods set out in paragraphs 370 and 371, using the available sources of information to the extent that they are relevant for the risk of excessive leverage.
7.3.3 Composition of additional own funds requirement to address the risk of excessive
leverage
399. Competent authorities should add the additional own funds requirement to address the
risk of excessive leverage to the minimum leverage ratio Tier 1 requirement. In order to meet this additional requirement institutions should also be able to use any Tier 1 capital.
400. Where necessary, and having regard to the specific circumstances of an institution,
competent authorities may require institutions to cover additional own funds requirements with a higher quality of capital than that referred to in paragraph 399. Any imposition of a higher quality of capital should be justified, taking into account the individual risk situation of the institution and considering situations where materialisation of the risk of excessive leverage may require a higher quality of capital to cover potential losses.
7.4 Reconciliation with the capital buffers and any macroprudential
requirements
401. In determining additional own funds requirements (or other capital measures), competent
authorities should reconcile the additional own funds requirements with any existing capital buffer requirements by addressing the same risks or elements of those risks. Competent authorities should not set additional own funds requirements or other capital measures (including P2G) where the same risk is already covered by specific capital buffer requirements. Any additional own funds requirements or other capital measures should be institution-specific and should not cover macroprudential or systemic risks. However, in line with Article 104a(1), point (f) of Directive 2013/36/EU, they can cover the risks reflecting the impact of certain economic conditions and market developments on the risk profile of an individual institution.
7.5 Determining the TSCR, TSLRR, OCR and OLRR
402. Competent authorities should determine the TSCR (in terms of total own funds) as the sum
of:

a. the own funds requirement pursuant to Article 92(1), point (c) of Regulation (EU) No 575/2013; and b. the sum of the additional own funds requirements (determined in accordance with the criteria specified in Section 7.2) and any additional own funds determined to be necessary to cover material inter-risk concentrations.
403. Competent authorities should determine the TSCR (in terms of Tier 1 capital) as the sum
of:
a. the own funds requirement pursuant to Article 92(1), point (b) of Regulation (EU) No 575/2013; and b. the part of the additional own funds requirements referred to in point b of paragraph 402, which is required by the competent authority to be held in the form of Tier 1 capital.
404. Competent authorities should determine the TSCR (in terms of CET1) as the sum of:
a. the own funds requirement pursuant to Article 92(1), point (a) of Regulation (EU) No 575/2013; and b. the part of the additional own funds requirements, referred to in point b of paragraph 402, which is required by the competent authority to be held in the form of CET1 capital.
405. Competent authorities should determine the TSLRR (in terms of Tier 1 capital) as the sum
of:
a. the leverage ratio own funds requirement pursuant to Article 92(1), point (d) of Regulation (EU) No 575/2013; and b. the additional own funds required to address the risk of excessive leverage (determined in accordance with the criteria specified in Section 7.3).
406. Where competent authorities require institutions to cover P2R-LR with a higher quality of
capital in line with paragraph 400, they should determine the TSLRR (in terms of CET1) as the
part of the additional own fundsreferred to in point b of paragraph 405405405, that is required
by the competent authority to be held in the form of CET1 capital.
407. Competent authorities should determine the OCR as the sum of:
a. TSCR; and b. combined capital buffer requirements.

Competent authorities should determine the OLRR as the sum of:
a. TSLRR; and b. the G-SII leverage ratio buffer requirement in accordance with Article 92(1a) of Regulation (EU) No 575/2013.
Competent authorities should not consider items and instruments other than those eligible
for the determination of own funds (as defined in Part Two of Regulation (EU) No 575/2013) in the assessment/calculation of the TSCR, TSLRR, OCR or OLRR.
7.6 Articulation and justification of own funds requirements
Competent authorities should ensure there is consistency in setting additional own funds
requirements and communicating them to the institutions and/or, where relevant, other competent authorities. As a minimum, this should involve communication of:
a. the institution’s TSCR as a proportion (ratio) of the TREA, broken down in terms of the composition of the requirement; and b. the institution’s TSLRR as a proportion (ratio) of the leverage ratio exposure (LRE), broken down in terms of the composition of the requirement.
To communicate the TSCR as a ratio, competent authorities should express it using the
following formula:
𝑇𝑆𝐶𝑅 𝑟𝑎𝑡𝑖𝑜 =
𝑇𝑆𝐶𝑅
𝑇𝑅𝐸𝐴
To communicate the TSLRR as a ratio, competent authorities should express it using the
following formula:
𝑇𝑆𝐿𝑅𝑅 𝑟𝑎𝑡𝑖𝑜 =
𝑇𝑆𝐿𝑅𝑅
𝐿𝑅𝐸
To achieve further consistency, competent authorities should additionally communicate to
institutions and/or, where relevant, other competent authorities:
a. the OCR and its component parts – the Pillar 1 own funds requirements, additional own funds requirements to address risks other than the risk of excessive leverage and the buffer requirements – as a proportion (ratio) of the TREA, broken down in terms of the composition of the requirement;

b. the OLRR and its component parts – the leverage ratio own funds requirement, additional own fundsrequirements to address the risk of excessive leverage and GSII leverage ratio buffer requirement – as a proportion (ratio) of the LRE, broken down in terms of the composition of the requirement.
414. When communicating the prudential requirements to institutions, competent authorities
should justify their decisions to impose additional own funds requirements in accordance with
Article 104a(5) of Directive 2013/36/EU separately for the risk of excessive leverage and for
other types of risks. The justification should be institution-specific and should provide a clear indication of the main drivers underlying the additional own funds requirement, including the risks and elements of risks contributing to additional own funds requirements.
415. In justifying additional own funds requirements competent authorities should refer to the
extent possible to the categories and subcategories/elements of risk as described in Title 6 and Sections 7.2 and 7.3, taking into account the existing definitions of specific types of risks in the applicable legislation, and they should aim at overall comparability across institutions.
416. In the justification of additional own fundsrequirements competent authorities should also
identify the main deficiencies to be covered by these requirements until they are addressed, in line with paragraphs 386 and 387. Taking into consideration appropriate supervisory measures in accordance with Title 10, competent authorities should request institutions to identify appropriate actions to rectify these deficiencies and communicate expected timelines for rectifying the deficiencies.
417. Competent authorities should communicate to institutions the appropriate minimum
composition of additional own funds requirements separately for the risk of excessive leverage and for other types of risk. Where competent authorities use the derogation of the third subparagraph of Article 104a(4) of Directive 2013/36/EU by requiring a higher quality of capital than set out in the first and second subparagraphs of that Article, they should provide clear justification for that decision pointing out specific circumstances of the institution that lead to the need for a higher quality of capital. In their justifications competent authorities should refer to elements such as:
a. the specific nature of the institution, its shareholders and, where relevant, the structure of the group, potentially affecting the possibility to raise capital depending on the characteristics of certain capital instruments; b. the specific nature of risk faced by the individual institution, potentially leading to particularly rapid depletion of CET1 capital.
418. Competent authorities should communicate the final results of the SREP assessment to the
relevant resolution authorities. Competent authorities should provide the information on the

additional own funds requirements that is requested by the resolution authorities for the purpose of the estimation referred to in Commission Delegated Regulation (EU) 2021/1118 42 .
419. Where considering the possibility of requiring a higher quality of capital competent
authorities should aim to avoid overlaps with other existing requirements within the relevant TREA-based or leverage ratio-based stack of requirements and with MREL.
7.7 Meeting requirements in stressed conditions
420. Competent authorities should determine by means of stress testing the adequacy of the
institution’s own funds (quantity and composition) in stressed conditions and whether supervisory measures, including P2G, P2G-LR, revised capital planning and other measures as set out in Title 10 are necessary to address potential inadequacies.
421. To assess capital adequacy in stressed conditions, competent authorities should consider:
a. the use of the qualitative outcomes (e.g. deficiencies identified in risk management and control) of institutions’ stress tests and supervisory stress testing; and b. the use of the quantitative outcomes of institutions’ stress tests, if the ICAAP is deemed reliable in accordance with paragraph 375, and of supervisory stress tests (i.e. outcomes in terms of changes in own funds ratios), pursuant to Article 100 of Directive 2013/36/EU as specified in Title 12 of these guidelines, and including, for example:
i. prescribing specific ‘anchor’ scenarios/assumptions to be implemented by
institutions; and
ii. conducting system-wide stress tests using consistent methodologies and
scenarios run either by institutions or by supervisors.
422. Competent authorities should assess as appropriate the quantitative outcomes of stress
tests with regard to the adequacy and quality of the institution's own funds and determine whether the quantity and quality of own funds are sufficient to cover applicable capital requirements, and in particular:
a. OCR including its combined buffer requirements under the baseline scenario over a forward-looking time horizon of at least 2 years; and 42 Commission Delegated Regulation (EU) 2021/1118 of 26 March 2021 supplementing Directive 2014/59/EU of the European Parliament and of the Council with regard to regulatory technical standards specifying the methodology to be used by resolution authorities to estimate the requirement referred to in Article 104a of Directive 2013/36/EU of the European Parliament and of the Council and the combined buffer requirement for resolution entities at the resolution group consolidated level where the resolution group is not subject to those requirements under that Directive.

b. TSCR under the adverse scenarios over a forward-looking time horizon of at least 2 years.
7.7.1 Using P2G to address the quantitative outcomes of stress testing
Determining and setting P2G and P2G-LR
423. Competent authorities should determine P2G and P2G-LR as specified in this section, and,
where the determination leads to a positive value, they should set P2G or P2G-LR to address supervisory concerns about the sensitivity of the institution to the adverse scenarios used in the supervisory stress tests.
424. P2G is the amount of capital that should be set to reach the overall level of own funds
considered appropriate under the SREP and the outcomes of supervisory stress tests. The level of P2G should protect against the potential breach of TSCR in the adverse scenario The level of P2G-LR should protect against the breach of TSLRR in the adverse scenario. Where the quantitative outcomes of the supervisory stress tests suggest that the institution is not expected to breach its TSCR under the adverse stress test scenario, competent authorities may decide not to set P2G. Similarly, competent authorities may decide not to set P2G-LR where TSLRR is not expected to be breached under the adverse stress test scenario.
425. Competent authorities should determine and set P2G and P2G-LR based on the outcomes
of the adverse scenario of the relevant supervisory stress tests, including the EU-wide stress tests performed by the EBA or any other relevant supervisory stress tests performed on a system-wide basis using a multi-factor scenario analysis over a forward-looking horizon of at least 2 years (either top-down or bottom-up).
426. On the basis of establishing a proportionate approach for non-Category 1 institutions and
subsidiaries of cross-border groups, for setting and updating P2G and P2G-LR competent authorities may consider the outcomes of simplified forms of supervisory stress tests (e.g. through the use of supervisory prescribed ‘anchor’ scenarios, sensitivity analysis, top-down stress tests conducted by designated authorities, portfolio level impacts from consolidated level stress tests), past supervisory stress tests or institutions’ stress tests in accordance with paragraph 421. The simplified forms of supervisory stress tests may be carried out on an individual basis rather than as part of the system-wide exercise.
427. Competent authorities should determine and set P2G and P2G-LR in accordance with the
minimum engagement model specified in Section 2.2.4. In particular, the minimum frequency with which P2G and P2G-LR are determined and set should be the frequency of the capital adequacy assessment under the SREP minimum-engagement model. In particular, the simplified forms of supervisory stress tests as referred to in paragraph 426426 are not expected to have a greater frequency than the SREP, unless this is considered necessary by the competent authority.
428. Notwithstanding the previous paragraph, competent authorities:

a. should assess whether the existing P2G and P2G-LR level is still appropriate whenever the results of new supervisory stress tests are available, and revise the level of P2G and P2G-LR if necessary; b. may determine P2G and P2G-LR only every second year instead of annually, including for institutions for which capital adequacy, according to the SREP minimum engagement model, should be assessed annually (e.g. SREP Category 1 institutions). However, in the year that follows the year of determining P2G, competent authorities should assess, on the basis of all relevant information, including outcomes of past supervisory stress tests, together with additional sensitivity analysis (i.e. simplified forms of supervisory stress testing), whether P2G and P2G-LR are still relevant or need to be updated.
429. Competent authorities should generally not use P2G to cover aspects of risks that should
be covered by the additional own funds requirements in accordance with Section 7.2 of these guidelines. Similarly, P2G-LR should not cover those aspects of risk of excessive leverage that are covered by the additional own funds requirements in accordance with Section 7.3 of these guidelines.
430. When determining the size of P2G, competent authorities should ensure that it is set at a
level appropriate to cover at least the anticipated maximum stress impact, which should be calculated based on the changes in the CET1 ratio (i.e. considering both movements in CET1 capital and TREA) in the worst year of stress and taking into account the level of applicable capital requirements and the considerations set out in paragraphs 422422 and 432 to 436. The maximum stress impact for the purpose of setting the P2G should be understood as the difference between the lowest CET1 ratio in the adverse scenario over the stress test horizon and the actual CET1 ratio at the starting point. With regard to the determination of the size of P2G-LR, the maximum stress impact should be calculated based on the changes in the Tier 1 capital in the worst year of stress and taking into account the applicable leverage ratio capital requirements. The maximum stress impact for the purpose of setting the P2G-LR should be understood as the difference between the lowest leverage ratio in the adverse scenario over the stress test horizon and the actual leverage ratio at the starting point.
431. Competent authorities should obtain the P2G starting point specific for each institution by
offsetting elements that already cover risks reflected in the maximum stress impact. In particular, competent authorities should offset the relevant measures, in particular capital conservation buffer, as specified in paragraph 435435. In addition, when setting the P2G and P2G-LR starting points, competent authorities may consider, where relevant, other adjustments to the maximum stress impact related to the static balance sheet assumption or the different time horizon between the stress test exercise and the time of the starting point.
432. Where setting the P2G and P2G-LR, competent authorities should ensure an adequate link
between the P2G and P2G-LR starting points and, respectively, the final P2G and P2G-LR. For this purpose, they may decide to use a bucketing approach to classify institutions according to

the P2G and P2G-LR starting points, based on the relevant supervisory stress tests set out in paragraph 425 or based on other approaches set out in paragraph 426. Consequently, competent authorities may assign a fixed range of respectively P2G or P2G-LR levels to each bucket and set the final P2G and P2G-LR within the range of the assigned bucket or, exceptionally, outside the range of the relevant bucket, based on the institution-specific considerations. Competent authorities should aim to avoid cliff effects between buckets, for instance by allowing partial overlap between the P2G or P2G-LR levels for neighbouring bucket, and they should ensure that the resulting final P2G and P2G-LR are institution-specific.
433. When determining the final P2G and P2G-LR, competent authorities should consider,
where relevant, the following factors:
a. the year when the maximum stress impact occurs in relation to the starting point and time horizon of the scenarios used in the stress tests; b. the outcome of a reliable institution stress test, taking into account the specific scenario definitions and assumptions, in particular where they are deemed more relevant for the business model and risk profile of the institution or where the internal scenarios are more severe than the supervisory scenarios;
c. changes occurring after the cut-off date of the stress test exercise with a material
impact on the institutions’ risk profile or capital position (e.g. sale of nonperforming loans). These changes may include interim changes of the risk profile including structural changes in the institutions’ activity or balance sheet; d. relevant management mitigating actions of the institution that are deemed credible and highly certain following their supervisory assessment; e. information about and supervisory views on the relevance of supervisory stress testing to the institution’s strategy, financial plans and business model; f. reduced certainty on the actual sensitivity of the institution to adverse scenarios; g. any potential overlaps with the P2R or P2R-LR; h. the institution’s overall recovery capacity as specified in Article 12(3) of Commission Delegated Regulation (EU) 2016/1075 43 , where the institution’s calculation is considered sufficiently reliable and realistic;
i. the quality (composition) of the institution’s available own funds, including at the
worst year of stress; and
43 Commission Delegated Regulation (EU) 2016/1075 of 23 March 2016 supplementing Directive 2014/59/EU of the European Parliament and of the Council with regard to regulatory technical standards specifying the content of recovery plans.

j. whether or not the institution is under restructuring or resolution.
434. For the purpose of determining P2G in accordance with paragraph 433.b, competent
authorities should also consider the extent to which stress scenarios cover all the material risks contributing to the additional own funds requirements in TSCR. Competent authorities should in particular have regard to the fact that macroeconomic downturn scenarios may not entirely capture some risks, for example conduct risk, pension risk or some elements of credit concentration risk (e.g. single name concentration), that may amplify potential losses under the tested adverse scenarios.
435. In addition, competent authorities should consider the extent to which the existing
combined buffer requirements and other applicable measures already cover risks revealed by stress testing. Competent authorities should offset P2G against the capital conservation buffer (CCB), as P2G and the CCB overlap in nature. Furthermore, while no overlap is in principle expected between P2G and the countercyclical capital buffer (CCyB), competent authorities should, in exceptional cases, offset P2G on a case-by-case basis against the CCyB based on the consideration of underlying risks covered by the buffer and factored into the design of the scenarios used for the stress tests, after liaising with the macroprudential authority. Competent authorities should not offset P2G against the systemic risk buffers (G-SII/O-SII buffers and the systemic risk buffer), as those are intended to cover the risks an institution poses to the financial system. Similarly, competent authorities should not offset P2G-LR against the G-SII leverage ratio buffer requirement specified in Article 92(1a) of Regulation (EU) No 575/2013.
436. Where competent authorities determine P2G, they should add this guidance on top of the
OCR. Where competent authorities determine P2G-LR, they should add this guidance on top of OLRR. Competent authorities should consider OCR and OLRR as two separate stacks of requirements. Consequently, the available own funds can simultaneously be used to meet P2G and P2G-LR. Communication and composition of P2G and P2G-LR
437. When communicating P2G or P2G-LR to institutions, competent authorities should justify
their decisions. The justification should be institution-specific and should highlight the main elements of the methodology used to determine P2G or P2G-LR.
438. Where P2G or P2G-LR is set or updated, competent authorities should communicate to the
institution their levels and the relevant time limits for its establishment in accordance with paragraph 442442. Competent authorities should also explain the potential supervisory reaction to situations where P2G or P2G-LR is not met.
439. Competent authorities should communicate to institutions that P2G should be met with
CET1 eligible own funds and P2G-LR should be met in Tier 1 eligible own funds. Both P2G and

P2G-LR should be incorporated into their capital planning and risk management frameworks, including the risk appetite framework and recovery planning.
440. Competent authorities should also communicate to institutions that own funds held for the
purposes of P2G cannot be used to meet any of the elements of OCR and that P2G-LR cannot be used to meet any of the elements of OLRR.
441. Competent authorities should additionally communicate to institutions and where
relevant, other competent authorities, all applicable own funds ratios affected by P2G (CET1, T1 and total own funds) and leverage ratio requirement affected by P2G-LR.
442. When setting and communicating to the institutions time limits to establish P2G or P2G-LR,
competent authorities should consider at least the following:
a. whether or not an institution is under the restructuring or resolution; and b. the potential implications that CET1 denominated P2G or P2G-LR may have for other parts of the capital requirements and the ability of institutions to issue additional Tier 1 (AT1) or Tier 2 (T2) instruments.
7.7.2 Capital planning and other supervisory measures to address capital adequacy in
stressed conditions
Capital planning
443. When the quantitative outcomes of the stress tests referred to in Section 7.7.1 indicate
that, under the given stress scenarios, an institution will not be able to meet the applicable capital requirements, competent authorities should require the institution to submit a credible capital plan that addresses the risk of not meeting its applicable capital requirements.
444. To determine the credibility of the capital plan, the competent authority should consider,
as appropriate:
a. whether the capital plan covers the entire assumed stress testing time horizon; b. whether the capital plan puts forward a set of credible mitigating and management actions, restricting dividend payments, etc.;
c. whether the institution is willing and able to take such actions in order to address
the breaches of the applicable capital requirements in the system-wide stress tests; d. whether those mitigating and management actions are subject to any legal or reputational constraints, for instance due to contrary or conflicting former public announcements (e.g. on dividend policies, business plans and risk appetite);

e. the probability that mitigating and management action would enable the institution to fully meet its applicable capital requirements within an appropriate timeframe; and f. whether the proposed actions are broadly in line with macroeconomic considerations and with known future regulatory changes affecting an institution within the scope and timeline of the assumed adverse scenarios; g. the range of recovery options and their analysis as set out in the institution’s recovery plan.
445. When assessing capital plans, the competent authority should, where appropriate,
following an effective dialogue with the institution, require the institution to make changes to those plans as appropriate, including to the proposed management actions, or require institutions to take additional mitigating actions that would become relevant given the scenarios and current macroeconomic conditions.
446. Competent authorities should expect institutions to implement the revised capital plan,
including further changes made based on the results of the supervisory assessment of and dialogue with the institution. Additional supervisory measures
447. Competent authorities should, where relevant, consider the application of the additional
supervisory measures specified in Title 10, to ensure that the institution is adequately capitalised in stressed conditions.
448. In particular, where the quantitative outcomes of the stress tests indicate that the
institution is likely to breach its applicable capital requirements under the adverse scenario within the following 12 months, the competent authorities should, where appropriate, treat such information as one of the possible circumstances within the meaning of Article 102(1)(b) of Directive 2013/36/EU. In such cases, the competent authorities should apply appropriate measures in accordance with Article 104(1) of Directive 2013/36/EU aimed at ensuring sufficient levels of own funds. In particular, when such measures relate to capital, competent authorities should in particular consider one or both of the following, as defined in Article 104(1)(a) and (f):
a. requiring institutions to hold an appropriate amount of additional own funds in the form of a nominal amount, considering the outcome of the SREP assessment; b. requiring a reduction in the inherent risk of an institution’s activities, products and systems.
7.8 Summary of findings and scoring

Following the above assessment, competent authorities should form a view on whether
existing own funds resources provide sound coverage of the risks to which the institution is or might be exposed. This view should be reflected in a summary of findings, accompanied by a viability score based on the considerations specified in Table 8.
Table 8 - Supervisory considerations for assigning a score to capital adequacy
Score Supervisory view Considerations
1 The quantity and composition of own funds held pose a low level of risk to the viability of the institution.

The institution is able to comfortably
meet its P2G and P2G LR.
The institution holds a level of own funds
comfortably above its OCR and OLRR, and is expected to do so in the future.
Stress testing does not reveal any
discernible risk regarding the impact of a severe but plausible economic downturn on own funds or leverage.
The free flow of capital between entities
in the group, where relevant, is not impeded, or all entities are well capitalised above supervisory requirements.
The institution has a plausible and
credible capital plan that has the potential to be effective if required.
There is no material/a very low risk of
excessive leverage.
2 The quantity and composition of own funds held pose a medium-low level of risk to the viability of the institution.
The institution has difficulty meeting its
P2G or P2G LR. Management mitigating actions to address this are assessed as credible.
The institution is near to breaching some
of its capital buffers but is still clearly above its TSCR and TSLRR.
Stress testing reveals a low level of risk
regarding the impact of a severe but plausible economic downturn on own funds or leverage, but management actions to address this seem credible.
The free flow of capital between entities
in the group, where relevant, is or could be marginally impeded.
The institution has a plausible and
credible capital plan that, although not without risk, has the potential to be effective if required.
There is a low level of risk of excessive
leverage.

Score Supervisory view Considerations
3 The quantity and composition of own funds held pose a medium-high level of risk to the viability of the institution.

The institution does not meet its P2G or
P2G LR. There are concerns about the credibility of management mitigating actions to address this.
The institution is using some of its capital
buffers. There is potential for the institution to breach its TSCR or TSLRR if the situation deteriorates.
Stress testing reveals a medium level of
risk regarding the impact of a severe but plausible economic downturn on own funds or leverage. Management actions may not credibly address this.
The free flow of capital between entities
in the group, where relevant, is impeded.
The institution has a capital plan that is
unlikely to be effective.
There is a medium level of risk of
excessive leverage.
4 The quantity and composition of own funds held pose a high level of risk to the viability of the institution.
The institution does not meet its P2G or
P2G LR (or deliberately has not established P2G or P2G LR) and will not be able to do so in the foreseeable future. Management mitigating actions to address this are assessed as not credible.
The institution is near to breaching its
TSCR or TSLRR.
Stress testing reveals that TSCR or TSLRR
would be breached near the beginning of a severe but plausible economic downturn. Management actions will not credibly address this.
The free flow of capital between entities
in the group, where relevant, is impeded.
The institution has no capital plan, or
one that is manifestly inadequate.
There is a high level of risk of excessive
leverage.

Assessing risks to liquidity and funding
8.1 General considerations
450. Competent authorities should assess the risks to liquidity and funding that have been
identified as material for the institution. The purpose of this title is to provide common methodologies to be considered when assessing individual risks and risk management and controls. It is not intended to be exhaustive and gives leeway to competent authorities to take into account other additional criteria that may be deemed relevant based on their experience and the specific features of the institution.
451. This title provides competent authorities with a set of common elements for the
assessment of risks to liquidity and funding.
452. The methodology comprises three main components:
a. assessment of inherent liquidity risk; b. assessment of inherent funding risk; and
c. assessment of liquidity and funding risk management.
453. In the assessment of risks to liquidity and funding, competent authorities should verify the
institution’s compliance with minimum EU regulatory requirements, the liquidity coverage ratio (LCR), as specified in Commission Delegated Regulation (EU) 2015/61 44 and the net stable funding ratio (NSFR), as established in Title IV of Part Six of the Regulation (EU) No 575/2013. However, these guidelines extend the scope of the assessment beyond those minimum requirements, aiming to allow competent authorities to form a comprehensive view of the risks.
454. This assessment flow is represented graphically in Figure 5.
44 Commission Delegated Regulation (EU) 2015/61 of 10 October 2014 to supplement Regulation (EU) No 575/2013 of the European Parliament and the Council with regard to liquidity coverage requirement for Credit Institutions.

Figure 5. Elements of the assessment of risks to liquidity and funding
455. Following the criteria specified in this title, competent authorities should assess all three
components to form a view on the level of inherent liquidity and funding risk faced by the institution, and on the quality of the institution’s liquidity and funding risk management and controls. Given that liquidity risk and funding risk and their management are interconnected and interdependent, the section for the assessment of liquidity and funding risk management and controls is the same for both risks.
456. In conducting the assessment of risks to liquidity and funding as part of the SREP,
competent authorities may use a combination of information sources, including:
a. outcomes from the analysis of the institution’s business model, particularly those that may help with understanding the key sources of risks to liquidity and funding; b. information from the monitoring of key indicators;
c. supervisory reporting, and particularly the information provided by the institution
in its liquidity and funding risk reporting pursuant to Article 415 of Regulation (EU) No 575/2013; d. outcomes of the various supervisory activities; e. information from AML/CFT competent authorities with a potential impact on liquidity and funding position; f. information provided by the institution, including information from the ILAAP; g. findings and observations from internal or external audit reports; Assessment of risks to liquidity and funding Assessment of liquidity and funding risk management Assessment of inherent liquidity risk(including intraday) Assessment of inherent funding risk Liquidity risk score Funding risk score Liquidity risk assessment Funding risk assessment Liq/fund risk management assessment

h. recommendations, guidelines and guidance included in LCR and NSFR implementation reports issued by the EBA, as well as warnings and recommendations issued by macroprudential authorities or the ESRB; and
i. risks identified in other institutions operating a similar business model (the peer
group).
457. In their implementation of the methodologies and common elements specified in this title,
competent authorities should identify relevant quantitative indicators and other metrics, which could be also used to monitor of key indicators as specified in Title 3.
458. The outcome of the assessment of each individual risk should be reflected in a summary of
findings that provides an explanation of the main risk drivers and a score, as explained in the following sections.
8.2 Assessing liquidity risk
459. Competent authorities should assess the institution’s short- and medium-term liquidity risk
over an appropriate set of time horizons, including intraday periods, to ensure that the institution maintains adequate levels of liquidity buffers, under both normal and stressed conditions. This assessment includes the following elements:
a. evaluation of liquidity needs in the short and medium term; b. evaluation of intraday liquidity risk;
c. evaluation of liquidity buffer and counterbalancing capacity; and
d. supervisory liquidity stress testing.
460. For the assessment of liquidity needs, buffers and counterbalancing capacity under normal
conditions, competent authorities should support the analysis with evidence from the reporting templates for additional monitoring metrics as specified and introduced in the ITS on supervisory reporting 45 . Competent authorities may perform less granular intraday liquidity risk evaluation and liquidity stress testing, where this is justified by lower materiality of these sources of risk, especially for Category 3 and Category 4 institutions. Evaluation of liquidity needs in the short and medium term
461. Competent authorities should assess the institution’s liquidity needs in the short and
medium term under both normal and stressed conditions (shocks). They should take into account:
45 Commission Implementing Regulation (EU) 2021/451.

a. the institution’s stressed liquidity needs at different times, in particular before 30 days, between 30 days and 3 months, and after 3 to 12 months, and specifically the effect on the institution’s liquidity needs (net cash outflows) of severe but plausible stresses, to cover idiosyncratic, market-wide and combined shocks; and b. the size, location and currency of the liquidity needs and, where an institution operates in different material currencies, the separate impacts of shocks in the different currencies, to reflect currency convertibility risk.
462. Competent authorities should support the assessment of short-term liquidity risk by
analysing, as a minimum, the LCR as specified in Commission Delegated Regulation (EU) 2015/61, and in particular:
a. whether the institution is correctly reporting its LCR position; and b. whether the LCR adequately identifies the institution’s liquidity needs.
463. In evaluating the impact of shocks on the institution’s liquidity needs, competent
authorities should take into account all material sources of liquidity risk for the institution. In particular, they should take into account, as relevant:
a. the possibility that any applicable EU regulatory requirement would not adequately identify the institution’s liquidity needs in the event of the type of stress scenario used for the requirement, including where maturities are shorter than 30 days. b. risks arising in respect of wholesale counterparties regarding on-balance-sheet items and funding concentrations, and taking into account actions the institution may take to preserve its reputation/franchise;
c. risks arising in respect of contingent cash flows/off-balance-sheet items (for
example, credit lines, margin calls) and activities (for example, liquidity support for unconsolidated special-purpose vehicles beyond contractual obligations), taking into account actions the institution may take to preserve its reputation/franchise; d. inflows and outflows on a gross basis as well as a net basis: where there are very high inflows and outflows, competent authorities should pay specific attention to the risk to the institution when inflows are not received when expected, even when the net outflow risk is limited; e. risks arising in respect of retail counterparties, taking into account actions the institution may take to preserve its reputation/franchise. For this purpose, competent authorities should make use of the methodology on the classification of retail deposits into different risk buckets, pursuant to Articles 24 and 25 of Commission Delegated Regulation (EU) 2015/61 ;

f. the risk that excessive risks in the medium- to long-term funding profile will adversely affect the behaviour of counterparties relevant to the short-term liquidity position; and g. risk arising in the context of fiduciary deposits 46 . Evaluation of intraday liquidity risk
464. Competent authorities should assess the institution’s exposure to intraday liquidity risk for
a selected time horizon, including the intraday availability of liquid assets given the unpredictable nature of unexpected intraday outflows or lack of inflows. Competent authorities may take into account potentially lower materiality of this source of risk, especially for Category 3 and Category 4 institutions. For all other institutions, where this source of risk is considered material, this assessment should include, as a minimum, an evaluation of intraday liquidity available or accessible under normal conditions as well as under financial or operational stress (e.g. IT failures, legal constraints on the transfer of funds, suspension/termination of access to correspondent banking services and/or clearing services for currencies, commodities or instruments significant for the institution).
465. For those jurisdictions where reporting on intraday risk is not yet available, competent
authorities should rely on the institution’s own analysis of intraday liquidity risk. Evaluation of liquidity buffer and counterbalancing capacity
466. Competent authorities should assess the adequacy of the institution’s liquidity buffer and
counterbalancing capacity to meet its liquidity needs within a month as well as over different time horizons, potentially up to 1 year, including overnight. This assessment should take into account:
a. the directly available liquidity buffers or the institution’s survival periods under different stress scenarios; b. the overall counterbalancing capacity available to the institution over the full period of the relevant stress scenario;
c. the characteristics, such as severity and duration, of different stress scenarios and
periods considered in the evaluation of the institution’s liquidity needs; d. the amount of assets that would need to be liquidated over the relevant time horizons; 46 The best practices are available in the EBA report: Monitoring of liquidity coverage ratio implementation in the EU – Second report (EBA/REP/2021/07).

e. whether the actual liquidity buffer and counterbalancing capacity, including the quality of liquid assets, are in line with the institution’s liquidity risk appetite; and f. the classification and quality of liquid assets, as specified in Commission Delegated Regulation (EU) 2015/61 (LCR Delegated Regulation) .
467. Competent authorities should assess the institution’s ability to monetise its liquid assets in
a timely fashion to meet its liquidity needs during a stress period. They should take into account:
a. whether the institution tests its market access by selling or repo-ing on a periodic basis; b. whether there are high concentrations that may represent a risk of overestimation of the liquidity buffer and counterbalancing capacity;
c. whether the assets in the buffer are unencumbered (as defined in the EBA
Guidelines on disclosure of encumbered and unencumbered assets 48), under the control of the relevant staff and readily available to a liquidity management function; d. whether the denomination of the liquid assets is consistent with the distribution of liquidity needs by currency; e. where the institution has borrowed liquid assets, whether it has to return them during a short-term liquidity stress period, which would mean that the institution would no longer have them available to meet its stressed outflows considering the net effect of the transaction; and f. the likely value of committed liquidity facilities, where competent authorities determine that such facilities can to some extent be included in the counterbalancing capacity. Supervisory liquidity stress testing
468. Competent authorities should use liquidity stress tests, defined and run by the competent
authorities, as an independent tool to assess short- and medium-term liquidity risks, to:
a. identify liquidity risks over different time horizons and in various stress scenarios. Stress scenarios should be anchored to the 30-day LCR stress assumptions, but competent authorities may extend the scope of their assessment by exploring risks 47 Commission Delegated Regulation (EU) 2015/61 of 10 October 2014 to supplement Regulation (EU) No 575/2013 of the European Parliament and the Council with regard to liquidity coverage requirement for Credit Institutions (OJ L 11, 17.1.2015, p. 1–36). 48 EBA Guidelines on disclosure of encumbered and unencumbered assets (EBA/GL/2014/03)

within 30 days as well as beyond 30 days, and altering the LCR assumptions to reflect risks not adequately covered in the LCR; b. inform their own view of liquidity risks in addition to the information from the institution’s internal stress tests;
c. identify and quantify specific areas of liquidity risk; and
d. inform their view on the overall liquidity risk to which the institution is exposed, which will enable them to compare the relative risk of institutions. As a minimum, this should include a supervisory stress test combining institution-specific and market-wide stress.
469. Competent authorities may assess the possible change in and sensitivity of the liquidity
coverage requirement following the application of Articles 412(3) and 414 of Regulation (EU) No 575/2013 during mild stress scenarios, by means of supervisory or institution liquidityspecific stress testing. The scenarios applied for this assessment should typically be less severe (e.g. only market-wide stress) than the scenarios used to test the survival of the institution (market-wide and systemic stress) and consequently reflect situations in which institutions would not be expected to use their minimum liquidity buffer. When performing supervisory liquidity stress testing for Category 3 and Category 4 institutions, competent authorities may use fewer scenarios and apply lower granularity of the analysis than for other institutions.
8.3 Assessing inherent funding risk
470. Competent authorities should assess the institution’s funding risk and whether the
medium- and long-term assets and off-balance-sheet items are adequately met with a range of stable funding instruments under both normal and stressed conditions. This assessment includes the following elements:
a. evaluation of the institution’s funding profile; b. evaluation of risks to the stability of the funding profile;
c. evaluation of actual market access; and
d. evaluation of expected change in funding risks based on the institution’s funding plan. Evaluation of the institution’s funding profile
471. Competent authorities should assess the appropriateness of the institution’s funding
profile, including both medium- and long-term contractual and behavioural mismatches, in relation to its business model, strategy and risk appetite. More specifically, they should take into account:

a. whether the institution’s medium- and long-term assets and off-balance-sheet items are adequately met with a range of stable funding instruments, pursuant to
Article 413 of Regulation (EU) No 575/2013, and whether its actual mismatches
over the relevant time horizons are within acceptable boundaries in relation to the specific business model of the institution; b. whether – in light of the competent authority’s view on the institution’s desired funding profile – the institution’s actual funding profile falls short of its desired profile;
c. (local) regulatory and contractual factors affecting the behavioural characteristics
of funding providers (e.g. regulations regarding clearing, bail-in, deposit guarantee schemes, etc., as they may influence the behaviour of funding providers), particularly when there are material changes or differences between jurisdictions in which the institution operates; and d. that maturity transformation will lead to a certain level of mismatches but that these must remain within manageable and controllable boundaries to prevent collapse of the business model during stress periods or changes in market circumstances. e. where available, any supplementary information received from the AML/CFT supervisor on the exposure to ML/TF risks and the potential deficiencies of the ML/TF risk management system of the institution that could increase funding risk.
472. Competent authorities should support the assessment of the institution’s funding profile
by analysing, as a minimum, the NSFR as specified in Title IV of Part Six of Regulation (EU) No 575/2013, and in particular:
a. whether the institution is correctly reporting its NSFR position; and b. whether the NSFR adequately identifies the institution’s stable funding needs.
473. Competent authorities should assess whether potential shortcomings arising from the
institution’s funding profile, such as maturity mismatches breaching acceptable boundaries, excessive concentrations of funding sources, excessive levels of asset encumbrance or inappropriate or unstable funding of long-term assets, could lead to an unacceptable increase in the cost of funding for the institution. They should take into account:
a. the risk of funding being rolled over at higher interest rates where there is an excessive dependence on specific sources of funding, the funding needs of the institution soar or the sources of funding perceive the institution as having a riskier profile, especially when it is not likely that those higher costs will be transferred automatically to clients; and

b. whether an increasing level of asset encumbrance above acceptable limits reduces access to and increases the price of unsecured funding. Evaluation of risks to the stability of the funding profile
474. Competent authorities should consider factors that may reduce the stability of the funding
profile in relation to the type and characteristics of assets, off-balance-sheet items and liabilities. They should take into account:
a. the possibility that any applicable EU regulatory requirement would not adequately identify the stability of the institution’s funding profile under normal or stress scenarios, including longer than 1-year time horizons; b. the fact that some specific asset classes will be more significant than others to the institution and/or the system;
c. the structural maturity mismatch between assets and liabilities in different
significant currencies, where applicable, as well as in aggregate, and how currency mismatches overlaying structural maturity mismatches affects the overall risk to the stability of the funding profile; and d. appropriate structural funding metrics (appropriate to the institution’s business model). Examples of structural funding metrics may include loan/deposit ratio, customer funding gap and behaviourally adjusted maturity ladder; e. funding characteristics that could indicate increased ML/TF risks and concerns from a prudential perspective (such as dependence on non-resident deposits especially from high-risk jurisdictions (as identified by the European Commission), deposits with foreign booking locations not consistent with the business model, or unusual interest rate settings compared to peers that are not consistent with the product type or institution’s business model). Where such characteristics are identified, competent authorities should liaise with the AML/CFT supervisor to obtain their assessment on the ML/TF risk management system and determine the impact on the funding risk 49 .
475. Competent authorities should assess risks to the sustainability of the funding profile arising
from concentrations in funding sources. They should take into account the following factors, as relevant:
a. concentrations in different respects, notably and where applicable: the type of funding instruments used, specific funding markets, single or connected counterparties and other concentration risks that may affect access to funding in the future (focusing on the markets and instruments relevant to the long-term In accordance with the EBA AML/CFT Cooperation Guidelines (EBA/GL/2021/15).

funding profile and noting that their view on concentration risk in the short-term liquidity profile may be relevant); and b. the risk that asset encumbrance may have an adverse effect on the market’s appetite for the unsecured debt of the institution (in the context of the specific characteristics of the market(s) in which the institution operates and the institution’s business model). Factors for this assessment may include:

the total amount of encumbered and/or borrowed assets compared with
the balance sheet;
the availability of free assets (assets that are unencumbered but that may
be encumbered), especially when considered in relation to total unsecured wholesale funding;
the level of overcollateralisation relative to the capital base;
overcollateralisation refers to the extent to which the value of the assets used to obtain secured funding exceeds the notional amount of funding obtained (e.g. if EUR 120 of assets are used for EUR 100 of secured funding, the overcollateralisation is 20); and
the implications of the level of overcollateralisation for the deposit
insurance scheme if the institution fails.
Evaluation of actual market access

Competent authorities should be aware of the institution’s actual market access and
current and future threats to this market access. They should take into account the following factors, as relevant a. any information of which they are aware, including information from the institution itself, indicating that the institution makes high demands on particular markets or counterparties (including central banks) that are important to it, relative to those markets’/counterparties’ capacity; b. any significant or unexpected changes in the issuance of debt of which competent authorities become aware in each significant market (including in significant currencies); note that competent authorities would expect institutions to alert them to any such changes. They should also assess whether any such changes are due to the strategic choices of the institution or whether they are signs of reduced market access;
c. the risk that news about the institution may negatively influence the market
(perception/confidence) and therefore market access. Such news may or may not yet be known to the market; and

d. signs that short-term liquidity risks (e.g. when short-term liquidity risk is assessed as high) may reduce the access the institution has to its major funding markets. Evaluation of expected change in funding risks based on the institution’s funding plan
477. Competent authorities should assess the expected change in funding risks based on the
institution’s funding plan. This assessment should take into account the following aspects:
a. the way the institution’s funding plan, when executed in full, will affect the institution’s funding risks, bearing in mind that the execution of the funding plan may increase or decrease the risks in the funding profile; and b. the supervisory view of the feasibility of the plan.
8.4 Assessing liquidity and funding risk management
478. To achieve a comprehensive understanding of the institution’s liquidity and funding risk
profile, competent authorities should also review the governance and risk management framework underlying its liquidity and funding risk. To this end, competent authorities should assess:
a. the liquidity risk strategy and liquidity risk appetite; b. the organisational framework, policies and procedures;
c. risk identification, measurement, management, monitoring and reporting;
d. the institution’s liquidity-specific stress testing; e. the internal control framework for liquidity risk management; f. the institution’s liquidity contingency plans; and g. the institution’s funding plans. Liquidity risk strategy and liquidity risk appetite
479. Competent authorities should assess whether the institution appropriately defines and
communicates its liquidity risk strategy and liquidity risk appetite. They should take into account:
a. whether the liquidity risk strategy and liquidity risk appetite are established, approved and updated by the management body; b. whether the institution has an appropriate framework in place to ensure that the liquidity risk strategy is effectively communicated to relevant staff;

c. whether the liquidity risk strategy and appetite are clearly defined, properly
documented, effectively implemented and communicated to all relevant staff; d. whether the liquidity risk appetite is appropriate for the institution considering its business model, overall risk tolerance, role in the financial system, financial condition and funding capacity; and e. whether the institution’s liquidity risk strategy and appetite framework is properly integrated within its overall risk appetite framework. Organisational framework, policies and procedures
480. Competent authorities should assess whether the institution has appropriate
arrangements for the governance and management of liquidity and funding risk. For this assessment, competent authorities should take into account:
a. whether the management body approves the governance and policies for managing liquidity and funding risk and discusses and reviews them regularly; b. whether senior management is responsible for developing and implementing the policies and procedures for managing liquidity and funding risk;
c. whether senior management ensures that the decisions of the management body
are monitored; d. whether the liquidity and funding risk management framework is internally coherent and ensures ILAAP is comprehensive, and is well integrated into the institution’s wider risk management process; e. whether the policies and procedures are appropriate for the institution, taking into account its liquidity risk appetite; and f. whether the policies and procedures are properly defined, formalised and effectively communicated throughout the institution.
481. Competent authorities should assess whether the institution has an appropriate
organisational framework for liquidity and funding risk management, measurement and control functions, with sufficient human and technical resources to develop and implement these functions and to carry out the required monitoring tasks. They should take into account:
a. whether the liquidity risk control and monitoring systems and processes are controlled by independent control functions; b. whether the risk management, measurement and control functions cover liquidity risk in the entire institution (including branches), and in particular all areas where liquidity risk can be taken, mitigated or monitored;

c. whether the institution has a set of liquidity and funding policy documents that are
adequate for promoting prudent behaviour by the institution’s staff (including with regard to deposit taking) and allowing for efficient operation of the control functions; and d. whether the institution has appropriate internal written policies and procedures for the management of liquidity and funding risk, as well as the adequacy of the institution’s liquidity and funding risk management framework.
482. Competent authorities should assess the adequacy of the institution’s approach to
maintaining market access in its significant funding markets. They should take into account:
a. the institution’s approach to maintaining an ongoing presence in the markets (testing market access); for specific small institutions or specialised business models, testing of access to markets may not be relevant; b. the institution’s approach to developing strong relationships with funding providers to lower the risk of its access being reduced; and
c. any evidence that the institution would continue to have ongoing market access in
times of stress (even though it may be more expensive for the institution to do so at such times). Risk identification, measurement, management, monitoring and reporting
483. Competent authorities should assess whether the institution has an appropriate
framework and IT systems for identifying and measuring liquidity and funding risk, in line with the institution’s size, complexity, risk appetite and risk-taking capacity. They should take the following factors into account:
a. whether the institution has implemented appropriate methods for projecting its cash flows over an appropriate set of time horizons, assuming business-as-usual and stress situations, and comprehensively across material risk drivers; b. whether the institution uses appropriate key assumptions and methodologies, which are regularly reviewed, recognising interaction between different risks (credit, market, etc.) arising from both on- and off-balance sheet items;
c. when relevant, whether all material legal entities, branches and subsidiaries in the
jurisdiction in which the institution is active are included; and d. whether the institution understands its ability to access financial instruments wherever they are held, having regard to any legal, regulatory and operating restrictions on their use, including, for example, the inaccessibility of assets due to encumbrance during different time horizons.

Competent authorities should assess whether institutions have an appropriate reporting
framework for liquidity and funding risk. They should take into account:
a. whether there is a set of reporting criteria agreed by senior management, specifying the scope, manner and frequency of liquidity and funding risk reporting and who is responsible for preparing the reports; b. the quality and appropriateness of information systems, management information and internal information flows supporting liquidity and funding risk management and whether the data and information used by the institution are understandable for the target audience, accurate and usable (e.g. timely, not overly complex, within the correct scope, etc.); and
c. whether specific reports and documentation containing comprehensive and easily
accessible information on liquidity risk are submitted regularly to the appropriate recipients (such as the management body, senior management or an asset-liability committee).
Competent authorities should assess the adequacy of the process of measuring intraday
liquidity risk, especially for those institutions that participate in payment, settlement and clearing systems. They should take into account:
a. whether the institution adequately monitors and controls cash flows and liquid resources available to meet intraday requirements and forecasts when cash flows will occur during the day; and b. whether the institution carries out adequate specific stress testing for intraday operations (where the institution should consider similar scenarios to those specified above).
Competent authorities should assess whether the institution has an adequate set of
indicators regarding the liquidity and funding position that are appropriate to the business model and the nature, scale and complexity of the institution. They should take into account:
a. whether the indicators adequately reflect the institution’s liquidity risk profile, such as:

the degree of diversification of liquid assets in the liquidity buffer between
the various categories of liquid assets and within the same category of liquid assets and any other relevant diversification factors, such as types of issuers, counterparties or the geographical location of those issuers and counterparties;
the degree of consistency between the currency denomination of their
liquid assets and the distribution by currency of their net liquidity outflows;

b. whether the indicators adequately cover key liquidity risk aspects related to potential cliff risks linked to, among others:

the concentration of outflows maturities, considering also any potential
early withdrawal of liabilities, particularly in the short and medium term;
the central bank support programmes;
c. whether the indicators adequately cover the institution’s key structural funding
vulnerabilities, covering the following aspects, where appropriate:
the degree of dependence on a single market or an excessively small
number of markets/counterparties;
the ‘stickiness’ of funding sources and factors driving behaviour;
the concentration of activities in different currencies, namely the degree
of consistency between the currency denomination of the available stable funding and the distribution by currency of the required stable funding;
the concentration of funding from specific lenders, including central banks,
in the short, medium and long term;
major concentrations of maturities and maturity gaps over the longer
term; and d. whether the indicators are adequately documented, periodically revised, used as inputs to define the risk appetite of the institution, part of management reporting and used for setting operating limits. Institution’s liquidity-specific stress testing

Competent authorities should assess whether an institution has implemented adequate
liquidity-specific stress testing as part of its overall stress testing programme, in accordance with the EBA Guidelines on institutions’ stress testing, to understand the impact of adverse events on its risk exposure and on the quantitative and qualitative adequacy of its liquid assets, and to determine whether the institution’s liquidity holdings are sufficient to cover risks that may crystallise during different types of stress scenarios and/or to address risks posed by control, governance or other deficiencies. For this purpose, competent authorities should take into account whether the institution’s stress testing framework is appropriate for:
a. determining the institution’s survival horizon given its existing liquidity buffer and stable sources of funding, and taking into account the institution’s risk appetite, during a severe but plausible liquidity stress period;

b. analysing the impact of stress scenarios on its consolidated group-wide liquidity position and on the liquidity position of individual entities and business lines; and
c. understanding where risks could arise, regardless of its organisational structure
and the degree of centralised liquidity risk management.
488. Competent authorities should also assess whether additional tests are needed for
individual entities and/or liquidity subgroups that are exposed to significant liquidity risks. These tests should take into account the consequences of the scenarios over different time horizons, including on an intraday basis.
489. Competent authorities should ensure that the institution provides the modelled impact of
different types of stress scenarios, as well as a number of sensitivity tests (on the basis of proportionality). Careful consideration should be given to the assessment of the design of stress scenarios and the variety of shocks simulated in them, taking into account whether, in this design, the institution not only considers the past, but also makes use of hypotheses based on expert judgement. Competent authorities should analyse whether the following scenarios are considered as a minimum:
a. short-term and prolonged; b. institution-specific and market-wide (occurring simultaneously in a variety of markets); and
c. a combination of (i) and (ii).
490. An important aspect that competent authorities should consider when assessing the
institution’s stress testing framework is the modelling of the impact of the hypothetical stress scenario(s) on the institution’s cash flows and on its counterbalancing capacity and survival horizon, and whether the modelling reflects the different impacts that economic stress may have on both an institution’s assets and its in- and outflows.
491. Competent authorities should also assess whether the institution takes a conservative
approach to setting stress testing assumptions. Depending on the type and severity of the scenario, competent authorities should consider, as relevant, the appropriateness of a number of assumptions, in particular:
a. the run-off of retail funding; b. the reduction of secured and unsecured wholesale funding;
c. the correlation between funding markets and diversification across different
markets; d. additional contingent off-balance sheet exposures;

e. funding tenors (e.g. where the funding provider has call options); f. the impact of any deterioration of the institution’s credit rating; g. FX convertibility and access to foreign exchange markets and correspondent banking accounts; h. the ability to transfer liquidity across entities, sectors and countries;
i. estimates of future balance-sheet growth; and
j. due to reputational risks, an implicit requirement for the institution to roll over assets and to extend or maintain other forms of liquidity support.
492. Competent authorities should assess whether the management framework of the
institution’s liquidity-specific stress testing is appropriate and whether it is properly integrated into the overall risk management strategy. They should take into account:
a. whether the extent and frequency of stress tests are appropriate to the nature and complexity of the institution, its liquidity risk exposures and its relative importance in the financial system; b. whether the outcomes of stress testing are integrated into the institution’s strategic planning process for liquidity and funding and used to increase the effectiveness of liquidity management in the event of a crisis, including in the institution’s liquidity contingency and recovery plan;
c. whether the institution has an adequate process for identifying suitable risk factors
for conducting stress tests, having regard to all material vulnerabilities that can undermine the liquidity position of the particular institution; d. whether assumptions and scenarios are reviewed and updated sufficiently frequently; and e. where the liquidity management of a group is being assessed, whether the institution pays adequate attention to any potential obstacles to the transfer of liquidity within the group. Liquidity risk internal control framework
493. Competent authorities should assess whether the institution has a strong and
comprehensive internal limit and control framework and sound safeguards to mitigate or limit its liquidity risk in line with its risk appetite. They should take into account whether:
a. the limit and control framework is adequate for the institution’s complexity, size and business model and reflects the different material drivers of liquidity risk, such

as maturity mismatches, currency mismatches, derivatives transactions, collateral management, off-balance-sheet items and intraday liquidity risk; b. the institution has limits in place to ensure consistency between the currency denomination of their liquid assets and the distribution by currency of their net liquidity outflows in accordance with Article 8(6) of Commission Delegated Regulation (EU) 2015/61;
c. the institution has implemented adequate limits and monitoring systems that are
consistent with its liquidity risk appetite and that make use of the outcomes of liquidity stress tests; d. the risk limits are regularly reviewed by the competent bodies of the institution and clearly communicated to all relevant business lines; e. there are clear and transparent procedures regarding how individual liquidity risk limits are approved and reviewed; f. there are clear and transparent procedures regarding how compliance with individual liquidity risk limits are monitored and how limit breaches are handled (including clear escalation and reporting procedures); and g. the limit and control framework helps the institution to ensure the availability of a diversified funding structure and sufficient and accessible liquid assets.
494. Competent authorities should assess whether the institution has implemented an
adequate transfer pricing system as part of the liquidity risk control framework. They should take into account:
a. whether the institution’s transfer pricing system covers all material business activities; b. whether the institution’s funds transfer pricing system incorporates all relevant liquidity costs, benefits and risks;
c. whether the resulting mechanism allows management to give appropriate
incentives for managing liquidity risk; d. whether the transfer pricing methodology and its calibration are reviewed and updated appropriately given the size and complexity of the institution; e. whether the transfer pricing system and its methodology are communicated to the relevant staff; and f. as an additional factor, whether the institution’s policy on incorporating the funds transfer pricing (FTP) methodology into the internal pricing framework is used for

assessing and deciding on transactions with customers (this includes both sides of the balance sheet, e.g. granting loans and taking deposits).
495. Competent authorities should assess whether the institution has adequate controls
regarding the liquid-assets buffer. They should take into account whether:
a. the control framework covers the timely monitoring of the liquid-assets buffer, including the quality of the assets, immediate availability to the group entity using the assets to cover liquidity risks and any impediments to their timely conversion into cash; b. the institution has concentration limits in place between the various categories of liquid assets and within the same category of liquid assets in the liquidity buffer (by counterparty, type of issuer or the geographical location of those issuers and counterparties) in accordance with Article 8(1) of Commission Delegated Regulation (EU) 2015/61; and
c. the institution has an appropriate policy on monitoring market conditions that can
affect its ability to sell or repo assets quickly in the market.
Liquidity contingency plans
496. Competent authorities should assess whether the institution’s liquidity contingency plan
(LCP) adequately specifies the policies, procedures and action plans for responding to severe potential disruptions to the institution’s ability to fund itself. They should take into account the content and scope of contingency funding measures included in the LCP, and in particular factors such as:
a. whether the LCP adequately explains governance arrangements for its activation and maintenance. b. whether the LCP appropriately reflects the institution’s liquidity-specific and wider risk profile.
c. whether the institution has a framework of liquidity early warning indicators,
including among others those established as liquidity indicators in the EBA GL on recovery plan indicators that are likely to be effective in enabling the institution to identify deteriorating market circumstances in a timely manner and to determine quickly what actions need to be taken. d. whether the LCP describes clearly that the LCR liquidity buffer is designed to be used in case of stress, even if that leads to LCR values below 100%, including that it is part of the expected management of liquidity risk under stress that subsequent communications to senior management take place if established lower LCR values are reached. The LCP should clearly reflect and describe how liquidity risk should

be managed under stress to steer towards targeted LCR levels as closely as possible. e. whether the LCP clearly articulates all material (potential) funding sources, including the estimated amounts available for the different sources of liquidity and the estimated time needed to obtain funds from them. f. whether the measures are in line with the institution’s overall risk strategy and liquidity risk appetite. g. the appropriateness of the assumptions regarding the role of central bank funding in the institution’s LCP. Examples of factors competent authorities may consider could include the institution’s views on:

the current and future availability of potential alternative funding sources
connected to central bank lending programmes;
the types of lending facilities, the acceptable collateral and the operational
procedures for accessing central bank funds; and
the circumstances under which central bank funding would be needed, the
amount required and the period for which such a use of central bank funding would probably be required.

Competent authorities should assess whether the actions described in the LCP are feasible
in relation to the stress scenarios in which they are meant to be taken. They should take into account factors such as:
a. the level of consistency and interaction between the institution’s liquidity-related stress tests, its LCP and its liquidity early warning indicators; b. whether the actions defined in the LCP appear likely to enable the institution to react adequately to a range of possible scenarios of severe liquidity stress, including institution-specific and market-wide stress, as well as the potential interaction between them; and
c. whether the actions defined in the LCP are prudently quantified in terms of
liquidity-generating capacity under stressed conditions and the time required to execute them, taking into account operational requirements such as pledging collateral at a central bank.
Competent authorities should assess the appropriateness of the institution’s governance
framework with respect to its LCP. They should take into account factors such as:

a. the appropriateness of escalation and prioritisation procedures detailing when and how each of the actions can and should be activated; b. whether the institution has adequate policies and procedures with respect to communication within the institution and with external parties; and
c. the degree of consistency between the LCP and the institution’s business continuity
plans.
Funding plans
499. Competent authorities should assess whether the funding plan is feasible and appropriate
in relation to the nature, scale and complexity of the institution, its current and projected activities and its liquidity and funding profile. They should take into account factors such as:
a. whether the funding plan is robust in terms of its ability to support the projected business activities under adverse scenarios; b. the expected change in the institution’s funding profile arising from the execution of the funding plan and whether this is suitable given the institution’s activities and business model;
c. whether the funding plan supports any required or desired improvements in the
institution’s funding profile; d. their own view on the (changes in) market activity planned by institutions in their jurisdiction on an aggregated level, and what that means for the feasibility of individual funding plans; e. whether the funding plan is:

integrated with the overall strategic plan of the institution;
consistent with its business model; and
consistent with its liquidity risk appetite;

In addition, competent authorities may consider:
a. whether the institution adequately analyses and is aware of the appropriateness and adequacy of the funding plan given the institution’s current liquidity and funding positions and their projected development. As part of this, competent authorities may consider whether the institution’s senior management can explain why the funding plan is feasible and where its weaknesses lie;

b. the institution’s policy for determining what funding dimensions and what markets are significant to the institution (and whether it is adequate);
c. the time horizon envisaged by the institution for migration to a different funding
profile, if required or desired, bearing in mind that there may be risks involved if migration towards the end state is either too fast or too slow; and d. whether the funding plan contains different strategies and clear management procedures for timely implementation of strategy changes.
501. Competent authorities should assess whether the institution’s funding plan is appropriately
implemented. As a minimum, they should take into account:
a. whether the funding plan is properly documented and communicated to all the relevant staff; and b. whether the funding plan is embedded in the day-to-day operations of the institution, especially in the funding decision-making process.
502. In addition, competent authorities may take into account whether the institution is able to
reconcile the funding plan with the data provided to competent authorities in the funding plan template.
503. Competent authorities should consider the quality of the institution’s processes for
monitoring the execution of the funding plan and its ability to react to deviations in a timely manner. For this assessment, competent authorities should take into account factors such as:
a. the quality of the updates to (senior) management regarding the current status of the execution of the funding plan; b. whether the funding plan envisages alternative fall-back measures to be implemented if there are changes in the market conditions; and
c. the policy and practice of the institution regarding the regular review and updating
of the funding plan when the actual funding raised significantly differs from the funding plan.
8.5 Summary of findings and scoring
504. Following the above assessment, competent authorities should form a view on the
institution’s funding and liquidity risks. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in Tables 9 and 10.

Table 9. Supervisory considerations for assigning a score to liquidity risk
Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls There is a low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.

There is non-material/very low
risk arising from mismatches
(e.g. between maturities, currencies, etc.).
The size and composition of the
liquidity buffer is adequate and appropriate.
The level of other drivers of
liquidity risk (e.g. reputational risk, inability to transfer intragroup liquidity, etc.) is not material/very low.
There is consistency
between the institution’s liquidity risk policy and strategy and its overall strategy and risk appetite.
The organisational
framework for liquidity risk is robust with clear responsibilities and a clear separation of tasks between risk-takers and management and control functions.
Liquidity risk
measurement, monitoring and reporting systems are appropriate.
Internal limits and the
control framework for liquidity risk are sound and are in line with the institution’s risk management strategy and risk appetite. There is a mediumlow risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
Mismatches (e.g. between
maturities, currencies, etc.) entail low to medium risk.
The risk posed by the size and
composition of the liquidity buffer is low to medium.
The level of other drivers of
liquidity risk (e.g. reputational risk, inability to transfer intragroup liquidity, etc.) is low to medium. There is a mediumhigh risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
Mismatches (e.g. between
maturities, currencies, etc.) entail medium to high risk.
The risk posed by the size and
composition of the liquidity buffer is medium to high.
The level of other drivers of
liquidity risk (e.g. reputational risk, inability to transfer intragroup liquidity, etc.) is medium to high.
There is not full
consistency between the institution’s liquidity risk policy and strategy and its overall strategy and risk appetite.
The organisational
framework for liquidity risk does not sufficiently separate responsibilities and tasks between risktakers and management and control functions.
Liquidity risk
measurement, monitoring and reporting systems are not undertaken with sufficient accuracy and frequency. There is a high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
Mismatches (e.g. between
maturities, currencies, etc.) entail high risk.
The risk posed by the size and
composition of the liquidity buffer is high.
The level of other drivers of
liquidity risk (e.g. reputational

Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls risk, inability to transfer intragroup liquidity, etc.) is high.

Internal limits and the
control framework for liquidity risk are not in line with the institution’s risk management strategy or risk appetite.
Table 10. Supervisory considerations for assigning a score to funding risk
Risk score
Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls There is a low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
There is non-material/very low
risk from the institution’s funding profile or its sustainability.
The risk posed by the stability of
funding is not material.
Other drivers of funding risk (e.g.
reputational risk, access to funding markets, etc.) are not material/very low.
There is consistency
between the institution’s funding risk policy and strategy and its overall strategy and risk appetite.
The organisational
framework for funding risk is robust with clear responsibilities and a clear separation of tasks between risk-takers and management and control functions.
Funding risk
measurement, monitoring and reporting systems are appropriate.
Internal limits and the
control framework for funding risk are sound and are in line with the institution’s risk management strategy and risk appetite. There is a mediumlow risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The risk posed by the
institution’s funding profile and its sustainability is low to medium.
The risk posed by the stability of
funding is low to medium.
Other drivers of funding risk (e.g.
reputational risk, access to funding markets, etc.) are low to medium.
There is a mediumhigh risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The risk posed by the
institution’s funding profile and its sustainability is medium to high.
The risk posed by the stability of
funding is medium to high.
Other drivers of funding risk (e.g.
reputational risk, access to
There is not full
consistency between the institution’s funding risk policy and strategy and its overall strategy and risk appetite.
The organisational
framework for funding risk

funding markets, etc.) are medium to high. does not sufficiently separate responsibilities and tasks between risktakers and management and control functions.

Funding risk
measurement, monitoring and reporting systems are not undertaken with sufficient accuracy and frequency.
Internal limits and the
control framework for funding risk are not in line with the institution’s risk management strategy or risk appetite. There is a high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls.
The risk posed by the
institution’s funding profile and its sustainability is high.
The risk posed by the stability of
funding is high.
Other drivers of funding risk (e.g.
reputational risk, access to funding markets, etc.) are high.

SREP liquidity assessment
9.1 General considerations
505. Competent authorities should determine through the SREP liquidity assessment whether
the liquidity and stable funding held by the institution provides appropriate coverage of the risks to liquidity and funding assessed in accordance with Title 8. Competent authorities should also determine through the SREP liquidity assessment whether it is necessary to set specific liquidity requirements to cover risks to liquidity and funding to which an institution is or might be exposed.
506. Competent authorities should consider the institution’s liquidity buffers, counterbalancing
capacity and funding profile, as well as its ILAAP and arrangements, policies, processes and mechanisms for measuring and managing liquidity and funding risk, as a key determinant of the institution’s viability. This determination should be summarised and reflected in a score based on the criteria specified at the end of this title.
507. The outcomes of the ILAAP, where applicable and relevant, should inform the competent
authority’s conclusion on liquidity adequacy.
508. Competent authorities should conduct the SREP liquidity assessment process using the
following steps:
a. overall assessment of liquidity; b. determination of the need for specific liquidity measures;
c. quantification of potential specific liquidity requirements – benchmark
calculations; d. articulation of specific liquidity requirements; and e. determination of the liquidity score.
9.2 Overall assessment of liquidity
509. To assess whether the liquidity held by an institution provides appropriate coverage of risks
to liquidity and funding, competent authorities should use the following sources of information:
a. the institution’s ILAAP; b. the outcomes of the assessment of liquidity risk;

c. the outcomes of the assessment of funding risk;
d. the outcome of the supervisory benchmark calculation; and e. other relevant inputs (from on-site inspections, peer group analysis, stress testing, etc.).
510. Competent authorities should consider the reliability of the institution’s ILAAP, including
metrics for liquidity and funding risk used by the institution.
511. When assessing the institution’s ILAAP framework – including, where relevant, internal
methodologies for the calculation of internal liquidity requirements – competent authorities should assess whether ILAAP calculations are:
a. credible: whether the calculations/methodologies used properly cover the risks they are looking to address; and b. understandable: whether there is a clear breakdown and summary of the underlying components of the ILAAP calculations.
512. For the assessment of the institution’s liquidity adequacy, competent authorities should
also combine their assessments of liquidity risk and funding risk. in particular, they should take into account findings regarding:
a. risks not covered by liquidity requirements specified in Commission Delegated Regulation (EU) 2015/61, as regards the LCR, or in the Regulation (EU) No 575/2013 as regards the NSFR, including intraday liquidity risk and liquidity risk beyond the 30-day time period as well as funding risk beyond 1 year; b. other risks not adequately covered and measured by the institution, as a result of underestimation of outflows, overestimation of inflows, overestimation of the liquidity value of buffer assets or counterbalancing capacity, or unavailability from an operational point of view of liquid assets (assets not available for sale, assets that are encumbered, etc.);
c. specific concentrations of counterbalancing capacity and/or funding by
counterparty and/or product/type; d. funding gaps in specific maturity buckets in the short, medium and long term; e. appropriate coverage of funding gaps in different currencies; f. cliff effects; and g. other relevant outcomes of the supervisory liquidity stress tests.

Competent authorities should translate this overall assessment into a liquidity score, which
should reflect the view of competent authorities on the threats to the institution’s viability that may arise from risks to liquidity and funding.
9.3 Determining the need for specific liquidity requirements
Competent authorities should decide on the necessity of specific supervisory liquidity
requirements for the institution based on their supervisory judgement and following dialogue with the institution, taking into account the following:
a. the institution’s business model and strategy and the supervisory assessment of them; b. information from the institution’s ILAAP; and
c. the supervisory assessment of risks to liquidity and funding, including the
assessment of inherent liquidity risk, inherent funding risk and liquidity and funding risk management and controls, taking into account the possibility that risks and vulnerabilities identified may exacerbate each other.
When competent authorities conclude that specific liquidity requirements are needed to
address liquidity and funding concerns, they should decide on the application of quantitative requirements, as covered in this title, and/or on the application of qualitative requirements, as covered in Title 10.
When setting structural, long-term supervisory requirements, competent authorities
should consider the need for additional short/medium-term requirements as an interim solution to mitigate the risks that persist while the structural requirements produce the desired effects.
Where competent authorities conclude that there is a high risk that the institution’s cost of
funding will increase unacceptably, they should consider measures, including setting additional own funds requirements (as covered in Title 7) to compensate for the increased P&L impact if the institution cannot pass the increased costs of funding to its customers, or requesting changes to the funding structure, to mitigate the funding-cost risk.
9.4 Determination of specific quantitative liquidity requirements
Competent authorities should develop and apply supervisory liquidity benchmarks as
quantitative tools to support their assessment of whether the liquidity held by the institution provides sound coverage of risks to liquidity and funding. They should be used to provide a prudent, consistent, transparent and comparable benchmark with which to calculate and compare specific quantitative liquidity requirements for institutions.
When developing supervisory liquidity benchmarks, competent authorities should take into
account the following criteria:
a. benchmarks should be prudent, consistent and transparent; b. benchmarks should be developed using the supervisory assessment of risks to liquidity and funding and the supervisory liquidity stress tests; supervisory liquidity stress testing should be a core part of the benchmark;
c. benchmarks should provide comparable outcomes and calculations so that
quantifications of liquidity requirements for institutions with similar business models and risk profiles can be compared; and d. benchmarks should help supervisors to specify the appropriate level of liquidity for an institution.
Given the variety of different business models operated by institutions, the outcome of the
supervisory benchmarks may not be appropriate in every instance for every institution. Competent authorities should address this by using the most appropriate benchmark where alternatives are available, and/or by applying judgement to the outcome of the benchmark to account for business-model-specific considerations.
Competent authorities should assess the suitability of any benchmarks applied to
institutions and continually review and update them in light of the experience of using them.
When competent authorities take supervisory benchmarks into consideration for the
determination of specific liquidity requirements, as part of the dialogue, they should explain to the institution the rationale and general underlying principles behind the benchmarks.
Where competent authorities have not developed their own benchmark for the
quantification of specific quantitative liquidity requirements, they can apply a benchmark using the following steps particularly in the case of liquidity risk:
a. comparative analysis, under stressed conditions, of net cash outflows and eligible liquid assets over a set of time horizons: up to 1 month (including overnight), from 1 month to 3 months and from 3 months to 1 year; for this purpose, competent authorities should project net outflows (gross outflows and inflows) and counterbalancing capacity throughout different maturity buckets, considering stressed conditions (for example, prudent valuation under stress assumptions for liquid assets versus current valuation under normal conditions and after a haircut), building a stressed maturity ladder for the year ahead; b. based on the assessment of the stressed maturity ladder, estimation of the survival period of the institution;

c. determination of the desired/supervisory minimum survival period, taking into
account the institution’s risk profile and market and macroeconomic conditions; and d. if the desired/supervisory minimum survival period is longer than the institution’s current survival period, competent authorities may estimate additional amounts of liquid assets (additional liquidity buffers) to be held by the institution to extend its survival period to the minimum required.
524. A key input to the competent authority’s benchmarks for the quantification of specific
quantitative liquidity requirements will be the data collected through the supervisory reporting under Article 415 of Regulation (EU) No 575/2013 on liquidity and on stable funding on an individual and consolidated basis and on additional liquidity monitoring metrics. The design of benchmarks will be influenced by the content of this reporting and the implementation of benchmarks will depend on when the reports are available.
525. Below are some examples of the possible approaches:
a. Example 1: institution with an initial liquidity buffer of EUR 1 200 mln Cumulative inflows and cumulative outflows estimated under stressed conditions are projected through a time horizon of 5 months. During this time horizon, the institution makes use of the liquidity buffer each time inflows fall below outflows. The result is that, under the stressed conditions defined, the institution would be able to survive 4.5 months, which is longer than the minimum survival period set by supervisors (in this example, 3 months):

Table 11. Illustrative example of benchmark for liquidity quantification
Figure 6. Illustrative example of setting specific quantitative liquidity requirement
Time horizon in months cumulative outflows cumulative inflows cumulative net outflows net liquidity position (buffer - cumulative net outflows) Liquidity available at day 0 1,200 511 405 106 1,094 598 465 133 1,067 659 531 128 1,072 787 563 224 976 841 642 199 1,001 933 693 240 960 1,037 731 306 894 1,084 788 295 905 1,230 833 397 803 1,311 875 435 765 1,433 875 558 642 1,440 876 564 636 1,465 882 583 617 1,471 889 582 618 1,485 891 594 606 1,485 911 574 626 1,492 916 576 624 1,493 916 577 623 1,581 918 663 537 1,618 945 673 527 1,666 956 710 490 1,719 993 726 474 1,885 1,030 856 344 1,965 1,065 900 300 2,078 1,099 980 220 2,192 1,131 1,061 139 Survival period 2,415 1,163 1,252 -52 2,496 1,194 1,302 -102 2,669 1,224 1,445 -245 2,764 1,253 1,511 -311

b. Example 2: the supervisory minimum survival period is set at 3 months. An alternative measure to setting a minimum survival period, which can also address the supervisory concern that the gap between inflows and outflows is unacceptably high, is to set a cap on outflows. In the figure below, the mechanism for setting a cap on outflows is shown by the black horizontal bar. An institution is required to reduce its outflows to a level below the cap. The cap can be set for one or more time buckets and for net outflows (following correction for inflows) or gross outflows. The alternative of adding a buffer requirement instead is shown in the third column:
Figure 7. Illustrative example of setting specific quantitative liquidity requirements
9.5 Articulation of specific quantitative liquidity requirements
526. To articulate the specific quantitative liquidity requirements appropriately, competent
authorities should use one of the following approaches, unless another approach is considered more appropriate in specific circumstances:
a. Approach 1 – require an LCR higher than the regulatory minimum, of such a size that shortcomings identified are sufficiently mitigated; b. Approach 2 – require a minimum survival period of such a length that identified shortcomings are sufficiently mitigated; the survival period can be set either directly, as a requirement, or indirectly, by setting a cap on the amount of outflows over the relevant time buckets considered; competent authorities may require different types of liquid assets (e.g. assets eligible for central banks), to cover risks not (adequately) covered by the LCR; <30 D 31-90 D liquidity buffer Buffer add-on vs. cap on outflows inflows outflows buffer add-on LCR minimum buffer cap on outflows

c. Approach 3 – require a minimum total amount of liquid assets or
counterbalancing capacity, either as a minimum total amount or as a minimum amount in excess of the applicable regulatory minimum, of such a size that identified shortcomings are sufficiently mitigated; competent authorities may set requirements for the composition of liquid assets, including operational requirements (e.g. direct convertibility to cash, or deposit of the liquid assets at the central bank).
527. To articulate the specific quantitative stable funding requirements appropriately,
competent authorities should use one of the following approaches, unless another approach is considered more appropriate in specific circumstances:
a. Approach 4 – require a NSFR higher than the regulatory minimum, of such a size that shortcomings identified are sufficiently mitigated; b. Approach 5 – require a minimum total amount of available stable funding, either as a minimum total amount or as a minimum amount in excess of the applicable regulatory minimum, of such a size that identified shortcomings are sufficiently mitigated.
528. To ensure there is consistency, competent authorities should structure specific quantitative
liquidity requirements in such a manner as to deliver broadly consistent prudential outcomes across institutions, bearing in mind that the types of requirements specified may differ between institutions because of their individual circumstances. In addition to the quantity, the structure should specify the expected composition and nature of the requirement. In all cases, it should specify the supervisory requirement and any applicable Directive 2013/36/EU requirements. Liquidity buffers and counterbalancing capacity held by the institution to meet supervisory requirements should be available for use by the institution during times of stress.
529. When setting the specific quantitative liquidity requirements and communicating them to
the institution, competent authorities should ensure that they are immediately notified by the institution if it does not meet the requirements, or does not expect to meet the requirements in the short term. Competent authorities should ensure that this notification is submitted without undue delay by the institution, accompanied by a plan drawn up by the institution for the timely restoration of compliance with the requirements. Competent authorities should assess the feasibility of the institution’s restoration plan and take appropriate supervisory measures if the plan is not considered feasible. Where the plan is considered feasible, competent authorities should: determine any necessary interim supervisory measures based on the circumstances of the institution; monitor the implementation of the restoration plan; and closely monitor the institution’s liquidity position, asking the institution to increase its reporting frequency if necessary.
530. Notwithstanding the above, competent authorities may also set qualitative requirements
in the form of restrictions/caps/limits on mismatches, concentrations, risk appetite,

quantitative restrictions on the issuance of secured loans, etc., in accordance with the criteria specified in Title 10 of the guidelines.
531. Below are some examples of the different approaches for the structure of specific
quantitative liquidity requirements:
Example of specific requirements articulation
As of 1 January 2021 and until otherwise directed, Bank X is required to:
a. Approach 1 – ensure that its counterbalancing capacity is at all times equal to or higher than e.g. 125% of its liquidity net outflows as measured in the LCR. b. Approach 2 – ensure that its counterbalancing capacity results at all times in a survival period that is greater than or equal to 3 months, measured by the internal liquidity stress test / the maturity ladder / specific metrics developed by the supervisor.
c. Approach 3:

ensure that its counterbalancing capacity is at all times equal to or higher than
EUR X billion; or
ensure that its counterbalancing capacity is at all times equal to or higher than
EUR X billion in excess of the minimum requirement under the LCR. d. Approach 4 – ensure that its available stable funding is at all times equal to or higher than e.g. 125% of its required stable funding as measured in the NSFR. e. Approach 5:
ensure that its available stable funding is at all times equal to or higher than EUR X billion;
or
ensure that its available stable funding is at all times equal to or higher than EUR X billion
in excess of the minimum requirement under the NSFR.
9.6 Summary of findings and scoring

Following the above assessment, competent authorities should form a view on whether
existing liquidity resources provide sound coverage of the risks to which the institution is or might be exposed. This view should be reflected in a summary of findings, accompanied by a viability score based on the considerations specified in Table 12.
For the joint decision (where relevant), competent authorities should use the liquidity
assessment and score to determine whether the liquidity resources are adequate.
Table 12. Supervisory considerations for assigning a score to liquidity adequacy
Score Supervisory view Considerations
1 The institution’s liquidity position and funding profile pose a low level of risk to the viability of the institution.

The institution’s counterbalancing
capacity and liquidity buffers are comfortably above specific supervisory quantitative requirements and are expected to remain so in the future.
The composition and stability of longerterm funding (>1 year) pose nonmaterial/very low risk in relation to the
activities and business model of the institution.
The free flow of liquidity between
entities in the group, where relevant, is not impeded, or all entities have a counterbalancing capacity and liquidity buffers above supervisory requirements.
The institution has a plausible and
credible liquidity contingency plan that has the potential to be effective if required. 2 The institution’s liquidity position and/or funding profile pose a medium-low level of risk to the viability of the institution.
The institution’s counterbalancing
capacity and liquidity buffers are above the specific supervisory quantitative requirements, but there is a risk that they will not remain so.
The composition and stability of longerterm funding (>1 year) pose a low level
of risk in relation to the activities and business model of the institution.
The free flow of liquidity between
entities in the group, where relevant, is or could be marginally impeded.
The institution has a plausible and
credible liquidity contingency plan that, although not without risk, has the potential to be effective if required. 3 The institution’s liquidity position and/or funding profile pose a medium-high level of risk to the viability of the institution.
The institution’s counterbalancing
capacity and liquidity buffers are deteriorating and/or are below specific supervisory quantitative requirements, and there are concerns about the institution’s ability to restore compliance

Score Supervisory view Considerations with these requirements in a timely manner.

The composition and stability of longerterm funding (>1 year) pose a medium
level of risk in relation to the activities and business model of the institution.
The free flow of liquidity between
entities in the group, where relevant, is impeded.
The institution has a liquidity
contingency plan that is unlikely to be effective.
4 The institution’s liquidity position and/or funding profile pose a high level of risk to the viability of the institution.
The institution’s counterbalancing
capacity and liquidity buffers are rapidly deteriorating and/or are below the specific supervisory quantitative requirements, and there are serious concerns about the institution’s ability to restore compliance with these requirements in a timely manner.
The composition and stability of longerterm funding (>1 year) pose a high level
of risk in relation to the activities and business model of the institution.
The free flow of liquidity between
entities in the group, where relevant, is severely impeded.
The institution has no liquidity
contingency plan, or one that is manifestly inadequate.

Overall SREP assessment and application of supervisory measures
10.1 General considerations
534. This title covers the combination of the findings of the assessments of the SREP elements
into the overall SREP assessment. It also addresses the application by competent authorities of supervisory measures to address deficiencies identified through the assessment of the SREP elements. Competent authorities may apply supervisory measures as specified in Directive 2013/36/EU (Articles 102, 104 and 105) and national law, and, when applicable, early intervention measures as specified in Article 27 of Directive 2014/59/EU, or any combination of the above.
535. Competent authorities should exercise their supervisory powers on the basis of deficiencies
identified during the assessments of the individual SREP elements and taking into account the overall SREP assessment, including the score, considering the following:
a. the materiality of the deficiencies/vulnerabilities and the potential prudential impact of not addressing the issue (i.e. whether it is necessary to address the issue with a specific measure); b. whether the measures are consistent with/proportionate to their overall assessment of a particular SREP element (and the overall SREP assessment);
c. whether supervisory or other administrative measures are needed to address
prudential deficiencies/vulnerabilities related to ML/TF risks within their supervisory remit after having liaised with the relevant AML/CFT supervisors in accordance with Section 8 of the AML/CFT Cooperation Guidelines 50; d. whether the deficiencies/vulnerabilities have already been addressed/covered by other measures; e. whether other measures would achieve the same objective with less of an administrative and financial impact on the institution; f. the optimal level and duration of application of the measure to achieve the supervisory objective; 50 Guidelines on cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Directive 2013/36/EU (EBA/GL/2021/15).

g. the possibility that risks and vulnerabilities identified may be correlated or selfreinforcing, or both, meriting an increase in the rigorousness of supervisory measures; and h. the results of resolvability assessment by the resolution authority, including the related work programme, with a view to ensuring consistency of supervisory actions.
536. When applying supervisory measures to address specific deficiencies identified in the
assessment of SREP elements, competent authorities should take into account overall quantitative own funds and liquidity requirements to be applied based on the criteria specified in Titles 7 and 9.
537. When applying supervisory measures to address prudential deficiencies related to ML/TF
risk, competent authorities should engage with AML/CFT supervisors so that the underlying deficiencies/vulnerabilities are adequately addressed by the appropriate measures within the respective remit of AML/CFT supervisors and competent authorities from their respective perspectives 51 .
538. Competent authorities may take supervisory measures directly linked to the outcomes of
any supervisory activities (e.g. on-site examinations, assessments of the suitability of members of the management body and key functions, etc.) where the outcomes of such activities necessitate immediate application of supervisory measures to address material deficiencies.
10.2 Overall SREP assessment
539. In determining the overall SREP assessment, competent authorities should consider the
findings of the assessments of the SREP elements, specifically:
a. the risks to which the institution is or may be exposed; b. the likelihood that the institution’s governance, control deficiencies and/or business model or strategy are likely to exacerbate or mitigate these risks, or expose the institution to new sources of risk;
c. whether the institution’s own funds and liquidity resources provide sound
coverage of these risks; and d. the potential for positive and negative interaction between the elements (e.g. competent authorities may consider a strong capital position as a potential mitigating factor for certain concerns identified in the area of liquidity and funding, or by contrast, that a weak capital position may exacerbate concerns in that area). 51 In accordance with the EBA AML/CFT Cooperation Guidelines (EBA/GL/2021/15).

On the basis of these considerations, competent authorities should determine the
institution’s viability, defined as its proximity to a point of non-viability on the basis of the adequacy of its own funds and liquidity resources, governance, controls and/or business model or strategy to cover the risks to which it is or may be exposed.
On the basis of this determination, competent authorities should:
a. take any supervisory measures necessary to address concerns; b. determine future supervisory resourcing and planning for the institution, including whether any specific supervisory activities should be planned for the institution as
part of the Supervisory Examination Programme;
c. determine the need for early intervention measures as specified in Article 27 of
Directive 2014/59/EU; and d. determine whether the institution can be considered to be ‘failing or likely to fail’ within the meaning of Article 32 of Directive 2014/59/EU.
The overall SREP assessment should be reflected in a viability score based on the
considerations specified in Table 13 and clearly documented in an annual summary of the overall SREP assessment. This annual summary should also include the overall SREP score and scores for elements of the SREP, and any supervisory findings made over the course of the previous 12 months.
Table 13. Supervisory considerations for assigning the overall SREP score
Score Supervisory view Considerations
1 The risks identified pose a low level of risk to the viability of the institution.

The institution’s business model and
strategy do not raise concerns.
The internal governance and institutionwide control arrangements do not raise
concerns.
The institution’s risks to capital and
liquidity pose a non-material/a very low risk of a significant prudential impact.
The composition and quantity of own
funds held do not raise concerns.
The institution’s liquidity position and
funding profile do not raise concerns.
No material concerns about the credibility
and feasibility of the institution’s recovery plan including its overall recovery capacity.

Score Supervisory view Considerations
2 The risks identified pose a mediumlow level of risk to the viability of the institution.

There is a low to medium level of concern
about the institution’s business model and strategy.
There is a low to medium level of concern
about the institution’s governance or institution-wide control arrangements.
There is a low to medium level of risk of a
significant prudential impact caused by risks to capital and liquidity.
There is a low to medium level of concern
about the composition and quantity of own funds held.
There is a low to medium level of concern
about the institution's liquidity position and/or funding profile.
There is a low to medium level of concern
about the credibility and feasibility of the institution’s recovery plan including its overall recovery capacity. 3 The risks identified pose a mediumhigh level of risk to the viability of the institution.
There is a medium to high level of concern
about the institution’s business model and strategy.
There is a medium to high level of concern
about the institution’s governance or institution-wide control arrangements.
There is a medium to high level of risk of a
significant prudential impact caused by risks to capital and liquidity.
There is a medium to high level of concern
about the composition and quantity of own funds held by the institution.
There is a medium to high level of concern
about the institution’s liquidity position and/or funding profile.
There is a medium to high level of concern
about the credibility and feasibility of the institution’s recovery plan including its overall recovery capacity. 4 The risks identified pose a high level of risk to the viability of the institution.
There is a high level of concern about the
institution’s business model and strategy.
There is a high level of concern about the
institution’s governance or institutionwide control arrangements.

Score Supervisory view Considerations

There is a high level of risk of a significant
prudential impact caused by risks to capital and liquidity.
There is a high level of concern about the
composition and quantity of own funds held by the institution.
There is a high level of concern about the
institution’s liquidity position and/or funding profile.
There is a high level of concern about the
credibility and feasibility of the institution’s recovery plan including its overall recovery capacity. F The institution is considered to be ‘failing or likely to fail’.
There is an immediate risk to the viability
of the institution.
The institution meets the conditions for
failing or likely to fail, as specified in
Article 32(4) of Directive 2014/59/EU 52
.

When determining that an institution is ‘failing or likely to fail’, as reflected by an overall
SREP score of ‘F’, competent authorities should engage with the resolution authorities to consult on findings following the procedure specified in Article 32 of Directive 2014/59/EU.
10.3 Application of capital measures
Competent authorities should impose additional own funds requirements and establish
own funds expectations by setting TSCR and determining P2G where relevant in accordance with the process and criteria specified in Title 7.
Notwithstanding the requirements referred to in the previous paragraph, competent
authorities may, on the basis of the vulnerabilities and deficiencies identified in the assessment of SREP elements, impose additional capital measures including:
52 In particular, the competent authority is of the view that (1) the institution infringes, or there are objective elements to support a determination that the institution will, in the near future, infringe, the requirements for continuing authorisation in a way that would justify the withdrawal of the authorisation by the competent authority, for reasons including but not limited to the fact that the institution has incurred or is likely to incur losses that will deplete all or a significant amount of its own funds; (2) the institution’s assets are, or there are objective elements to support a determination that the institution’s assets will, in the near future, be, less than its liabilities; or (3) the institution is, or there are objective elements to support a determination that the institution will, in the near future, be, unable to pay its debts or other liabilities as they fall due.
Article 32(4)(d) of Directive 2014/59/EU also identifies extraordinary public support criteria for the determination of
whether an institution is failing or likely to fail, but these criteria are not considered for the purpose of SREP and the determination made by the competent authorities.

a. requiring the institution to use net profits to strengthen own funds in accordance with Article 104(1)(h) of Directive 2013/36/EU; b. restricting or prohibiting distributions or interest payments by the institution to shareholders, members or holders of Additional Tier 1 instruments where such a prohibition does not constitute an event of default of the institution in accordance with Article 104(1)(i) of Directive 2013/36/EU; and/or
c. requiring the institution to apply a specific provisioning policy or treatment of
assets in terms of own funds requirements in accordance with Article 104(1)(d) of Directive 2013/36/EU.
10.4 Application of liquidity measures
546. Competent authorities should impose specific liquidity requirements in accordance with
the process and criteria specified in Title 9.
547. Notwithstanding the specific quantitative requirements referred to in the previous
paragraph, competent authorities may, on the basis of the vulnerabilities and deficiencies identified in the assessment of risks to liquidity and funding, impose additional liquidity measures including:
a. imposing specific liquidity requirements, including restrictions on maturity mismatches between assets and liabilities in accordance with Article 104(1)(k) of Directive 2013/36/EU; and/or, b. imposing administrative penalties or other administrative measures, including prudential charges, in accordance with Article 105 of Directive 2013/36/EU.
10.5 Application of other supervisory measures
548. To address specific deficiencies identified in the assessment of SREP elements, competent
authorities may consider applying measures that are not directly linked to quantitative capital or liquidity requirements. This section provides a non-exhaustive list of possible supervisory measures that can be applied based on Articles 104 and 105 of Directive 2013/36/EU. Competent authorities may apply other supervisory measures as set out in those articles if these are more appropriate to address the identified deficiencies as described in this section. The choice of measures should take into account the results of assessment performed in accordance with Titles 4, 5, 6 and 8 of these guidelines.
549. If after liaising with the AML/CFT competent authority, there is a need for competent
authorities to address prudential deficiencies/vulnerabilities related to ML/TF risks as a result of the SREP elements assessment, competent authorities should set additional own funds requirements only where this is considered more appropriate than other supervisory measures.

If additional own funds requirements are imposed, they should be used as an interim measure while the deficiencies are addressed. Business model analysis
550. Supervisory measures to address deficiencies identified in the BMA are likely to involve
requiring the institution to adjust governance and control arrangements to help with the implementation of the business model and strategy, or limiting certain business activities.
551. In accordance with Article 104(1)(b) of Directive 2013/36/EU, competent authorities may
require the institution to make adjustments to risk management and control arrangements, or to governance arrangements, to match the desired business model or strategy, by means including:
a. adjusting the financial plan assumed in the strategy, if it is not supported by internal capital planning or credible assumptions; b. requiring changes to organisational structures, reinforcement of risk management and control functions and arrangements to support the implementation of the business model or strategy; and/or
c. requiring changes to and reinforcement of IT systems to support the
implementation of the business model or strategy.
552. In accordance with Article 104(1)(e) of Directive 2013/36/EU, competent authorities may
require the institution to make changes to the business model or strategy where:
a. they are not supported by appropriate organisational, governance or risk control and management arrangements; b. they are not supported by capital and operational plans, including allocation of appropriate financial, human and technological (IT) resources; and/or
c. there are significant concerns about the sustainability of the business model.
553. In accordance with Article 104(1)(f) of Directive 2013/36/EU, competent authorities may:
a. require institutions to reduce the risk inherent in the products they originate/distribute, by means including:
o requiring changes to the risks inherent in certain product offerings; and/or o requiring improvements to the governance and control arrangements for product development and maintenance;

b. require the institution to reduce the risk inherent in its systems, by various means including:
o requiring improvements to the systems, or increasing the level of investment or speeding-up the implementation of new systems; and/or o requiring improvements to the governance and control arrangements for system development and maintenance;
c. require institutions to reduce the risk inherent in their activities, including
outsourced activities, by various means including:
o requiring changes to or reduction of certain activities with a view to reducing their inherent risk; and/or o requiring improvements to governance and control arrangements and oversight of outsourced activities. Internal governance and institution-wide controls
554. Supervisory measures to address deficiencies identified in the assessment of internal
governance and institution-wide controls may focus on requiring the institution to strengthen governance and control arrangements, or reducing the risk inherent in its products, systems and operations.
555. In accordance with Article 104(1)(b) of Directive 2013/36/EU, competent authorities may:
a. require the institution to make changes to its overall governance arrangements and organisation, by means including requiring:
o changes to the organisational or functional structure, including reporting lines; o amendments to risk policies or how they are developed and implemented across the organisation; and/or o an increase in the transparency of governance arrangements; b. require the institution to make changes to the organisation, composition or working arrangements of the management body;
c. require the institution to strengthen its overall risk management arrangements, by
means including requiring:
o changes to (a reduction in) risk appetite, or the governance arrangements for setting risk appetite, and the development of the overall risk strategy;

o improvements to ICAAP or ILAAP procedures and models, where they are not deemed fit for purpose; o enhancement of stress testing capacities and the overall stress testing programme; and/or o enhancements to contingency planning; d. require the institution to strengthen internal control arrangements and functions, by means including requiring:
o the independence and adequate staffing of the internal audit function; and/or o improvements to the internal reporting process to ensure that reporting to the management body is appropriate; e. require the institution to enhance information systems or business continuity arrangements, for example by requiring:
o improvements in the reliability of systems; and/or o development and testing of business continuity plans.
556. In accordance with Article 104(1)(g) of Directive 2013/36/EU, competent authorities may
require the institution to:
a. make changes to remuneration polices; and/or b. limit variable remuneration as a percentage of net revenues.
557. Based on the outcomes of the qualitative review of stress testing programmes and if
deficiencies are identified, competent authorities should require the institution:
a. to develop a plan of remedial action aimed at improving stress testing programmes and practices. Where material shortcomings are identified in how an institution addresses the outputs of stress tests, or if management actions are not deemed credible, competent authorities should require the institution to take further remedial actions, including requirements to make changes to the institution’s capital plan; b. where appropriate, to run specific prescribed scenarios (or elements of those) or using specific assumptions. Credit and counterparty risk
558. Supervisory measures to address deficiencies identified in the assessment of the credit and
counterparty risk and the associated management and control arrangements are likely to focus

on requiring the institution to reduce the level of inherent risk or strengthening management and control arrangements.
559. In accordance with Article 104(1)(b) of Directive 2013/36/EU, competent authorities may
require the institution to:
a. involve the management body or its committees more actively in relevant credit decisions; b. improve credit risk measurement systems;
c. improve controls on credit processes, including credit granting, monitoring and
recovery; d. enhance collateral management, evaluation and monitoring; and/or e. enhance the quality and frequency of reporting on credit risk to the management body and senior management.
560. In accordance with Article 104(1)(d) of Directive 2013/36/EU, competent authorities may
require the institution to:
a. apply a specific provisioning policy, and – where permitted by accounting rules and regulations – require it to increase provisions; b. adjust internal risk parameters and/or risk weights used to calculate risk exposure amounts for specific products, sectors or types of obligors; and/or
c. apply higher haircuts to the value of collateral.
561. In accordance with Article 104(1)(e) and (f) of Directive 2013/36/EU, competent authorities
may require the institution to:
a. reduce large exposures or other sources of credit concentration risk; b. tighten credit-granting criteria for all or some product or obligor categories;
c. reduce its exposure to, or acquire protection for, specific types of facilities (e.g.
mortgages, export finance, commercial real estate, securitisations, etc.), obligor categories, sectors, countries, etc.; and/or d. implement an appropriate strategy to reduce the amount or share of nonperforming exposures. Market risk

Supervisory measures to address deficiencies identified in the assessment of market risk
and the associated management and control arrangements are likely to focus on requiring the institution to reduce the level of inherent risk or to strengthen management and control arrangements.
In accordance with Article 104(1)(b) of Directive 2013/36/EU, competent authorities may
require the institution to address deficiencies identified with regard to the institution’s ability to identify, measure, monitor and control market risk, by means including:
a. enhancing the performance of the institution’s internal approaches, or of its backtesting or stress testing capacity; b. enhancing the quality and frequency of the market risk reporting to the institution’s management body and senior management; and/or
c. requiring more frequent and in-depth internal audits of market activity.
In accordance with Article 104(1)(e) of Directive 2013/36/EU, competent authorities may:
a. restrict investment in certain products when the institution’s policies and procedures do not ensure that the risk from those products will be adequately covered and controlled; b. require the institution to present a plan to reduce its exposures to distressed assets and/or illiquid positions gradually; and/or
c. require the divestment of financial products when the valuation processes of the
institution do not produce conservative valuations that comply with the standards of Regulation (EU) No 575/2013.
In accordance with Article 104(1)(f) of Directive 2013/36/EU, competent authorities may:
a. require the institution to reduce the level of inherent market risk (through hedging or sale of assets) when significant shortcomings have been found in the institution’s measurement systems; and/or b. require the institution to increase the amount of derivatives settled through central counterparties (CCPs). Operational risk
Supervisory measures to address deficiencies identified in the assessment of operational
risk and the associated management and control arrangements are likely to focus on requiring the institution to reduce the level of inherent risk or strengthening management and control arrangements.
In accordance with Article 104(1)(b) of Directive 2013/36/EU, competent authorities may:
a. require the institution to involve the management body or its committees more actively in operational risk management decisions; b. require the institution to consider inherent operational risk when approving new products and systems; and/or
c. require the institution to improve operational risk identification and measurement
systems.
In accordance with Article 104(1)(e) and (f) of Directive 2013/36/EU, competent authorities
may:
a. require the institution to reduce the scope and/or extent of outsourcing activities including restructuring or exiting from outsourcing arrangements and switching to another service provider; b. require the institution to mitigate operational risk exposures (e.g. with insurance, introduction of more control points, etc.);
c. require the institution to take specific corrective measures to enhance its overall
internal governance arrangements including risk management framework and internal controls; d. require the institution to define and monitor specific KRIs and/or KPIs; e. restrict or limit the business, operations or network of institutions or to request the divestment of activities that pose excessive risks to the soundness of an institution; and/or f. require the reduction of the risk inherent in the activities, products and systems of institutions, including the ML/TF risks with prudential implications. Interest rate risk from non-trading activities
Irrespective of the requirement to hold additional own funds pursuant to Article 104(1)(a)
of Directive 2013/36/EU, competent authorities should consider the application of supervisory measures in the following cases:
a. when any of the cases referred to in points (a) or (b) of Article 98(5) of Directive 2013/36/EU apply; or b. when the outcomes of the SREP reveal any deficiency in the institution’s assessment of the inherent level of IRRBB and the associated management and control arrangements.
In accordance with Article 104(1)(b) of Directive 2013/36/EU, competent authorities may
require the institution to take action to address deficiencies in its ability to identify, measure, monitor and control interest rate risk from non-trading activities, for example to:
a. enhance its stress testing capacity; and/or b. enhance reporting of IRRBB management information to the institution’s management body and senior management.
In accordance with Article 104(1)(f) of Directive 2013/36/EU, competent authorities may
require the institution to apply variations to internal limits to reduce the risk inherent in activities, products and systems.
In accordance with Article 104(1)(j) of Directive 2013/36/EU and subject to paragraph (2)
of that Article, competent authorities may require additional or more frequent reporting of the institution’s IRRBB positions.
Where considered necessary, competent authorities may also apply measures in
accordance with Article 84(3) of Directive 2013/36/EU.
Liquidity risk
In accordance with Article 104(1)(k) of Directive 2013/36/EU and as established in
paragraphs (1) and (6) of Article 8 of Commission Delegated Regulation (EU) 2015/61 to specify the LCR, as regards diversification of the liquidity buffer and currency consistency between liquid assets and net outflows, competent authorities may:
a. impose requirements on the concentration of the liquid assets held, including:
o requirements for the composition of the institution’s liquid-assets profile in respect of counterparties, currency, etc.; and/or o caps, limits or restrictions on funding concentrations; b. impose restrictions on short-term contractual or behavioural maturity mismatches between assets and liabilities, including:
o limits on maturity mismatches (in specific time buckets) between assets and liabilities; o limits on minimum survival periods; and/or o limits on dependency on certain short-term funding sources, such as money market funding.
In accordance with Article 104(1)(j) of Directive 2013/36/EU and subject to paragraph (2)
of that Article, competent authorities may impose a requirement for the institution to provide more frequent reporting on liquidity positions, including:
a. the frequency of regulatory reporting on LCR; and/or b. the frequency and granularity of other liquidity reports, such as ‘additional monitoring metrics’.
In accordance with Article 104(1)(b) of Directive 2013/36/EU, competent authorities may
require action to be taken to address deficiencies identified with regard to the institution’s ability to identify, measure, monitor and control liquidity risk, by means including:
a. enhancing its stress testing capacity to improve its ability to identify and quantify material sources of liquidity risk to the institution; b. enhancing its ability to monetise its liquid assets;
c. enhancing its liquidity contingency plan and liquidity early warning indicators
framework; and/or d. enhancing reporting of liquidity management information to the institution’s management body and senior management. Funding risk
In accordance with Article 104(1)(k) of Directive 2013/36/EU and taking into account Article
428b(5) of Regulation (EU) No 575/2013, as regards currency consistency between available and required stable funding in the NSFR, competent authorities may require action to be taken to amend the institution’s funding profile, including:
a. reducing its dependency on certain (potentially volatile) funding markets, such as wholesale funding; b. reducing the concentration of its funding profile with respect to counterparties, peaks in the long-term maturity profile, (mismatches in) currencies, etc.; and/or
c. reducing the amount of its encumbered assets, potentially differentiating between
total encumbrance and overcollateralisation (e.g. for covered bonds, margin calls, etc.).
In accordance with Article 104(1)(j) of Directive 2013/36/EU and subject to paragraph (2)
of that Article, competent authorities may require additional or more frequent reporting on the institution’s funding positions, including:

a. increased frequency of regulatory reporting relevant to the monitoring of the funding profile (such as the NSFR report and ‘additional monitoring metrics’); and/or b. increased frequency of reporting on the institution’s funding plan to the supervisor.
579. In accordance with Article 104(1)(b) of Directive 2013/36/EU, competent authorities may:
a. require actions to be taken to address deficiencies identified with regard to the institution’s control of funding risk, including:
o enhancing reporting on funding risk to the institution’s management body and senior management; o restating or enhancing the funding plan; and/or o placing limits on its risk appetite; b. enhance the institution’s stress testing capabilities by means including requiring the institution to cover a longer stress period.
10.6 Supervisory reaction to a situation where TSCR or OCR is not
met
580. TSCR is a legally binding requirement that institutions have to meet at all times, including
in stressed conditions. If TSCR set in accordance with these guidelines is no longer met, the competent authorities should consider additional intervention powers in accordance with Directives 2013/36/EU and 2014/59/EU, including withdrawal of authorisation in accordance with Article 18(d) of Directive 2013/36/EU, application of early intervention measures in accordance with Article 27 of Directive 2014/59/EU and resolution actions in accordance with that Directive. When exercising those powers competent authorities should consider whether measures are proportionate to the circumstances and their judgement on how the situation is likely to develop.
581. A breach of TSCR should also be considered in determining if an institution is failing or likely
to fail in accordance with Article 32(4)(a) of Directive 2014/59/EU and the EBA Guidelines on the interpretation of the different circumstances when an institution shall be considered as failing or likely to fail, as it is one of the conditions under which the competent authorities may withdraw authorisation in accordance with Article 18(d) of Directive 2013/36/EU.
582. Competent authorities should also monitor whether the institutions meet the OCR. Where
necessary, competent authorities should take measures to ensure that institutions comply with requirements set out in Articles 141 to 142 of Directive 2013/36/EU.
10.7 Supervisory reaction to a situation where P2G is not met

Competent authorities should monitor whether the amount of own funds expected
according to P2G is established and maintained by the institution over time.
When the institution’s own funds drop, or are likely to drop, below the level determined
by P2G, the competent authority should expect the institution to notify it and prepare a revised capital plan. In its notification, the institution should explain what adverse consequences are likely to force it to do so and what actions are envisaged for the eventual restoration of compliance with P2G as part of an enhanced supervisory dialogue.
There are generally three situations to be considered by a competent authority in which an
institution could fail to meet its P2G. a. Where the level of own funds falls below the level of P2G (while remaining above OCR) in institution-specific or external circumstances in which risks that P2G was aimed at covering have materialised, the competent authority may allow the institution to temporarily operate below the level of P2G provided that the revised capital plan is considered credible in accordance with the criteria set out in Section
7.7.2. The competent authority may also consider adjusting the level of P2G where
appropriate. b. Where the level of own funds falls below the level of P2G (while remaining above the OCR) in institution-specific or external circumstances as a result of the materialisation of risks that P2G was not aimed at covering, competent authorities should expect the institution to increase the level of own funds to the level of P2G within an appropriate timeline.
c. Where the institution disregards P2G, does not incorporate it into it risk
management framework or does not establish own funds to meet P2G within the time limits set in accordance with paragraph 438, this may lead to competent authorities applying additional supervisory measures as set out in Sections 10.3 and 10.5. Where the permission to operate below the level of P2G as referred to in point (a) has not been granted and the institution’s own funds are repeatedly below the level of P2G, the competent authority should impose additional own funds requirements in accordance with Title 7.
Notwithstanding particular supervisory responses in accordance with the previous
paragraph, competent authorities may also consider the application of the capital and additional supervisory measures set out in Sections 10.3 and 10.5, where these are deemed more appropriate to address the reasons for the own funds falling below the level determined by P2G.

10.8 Interaction between supervisory and early intervention
measures
587. In addition to the supervisory measures referred to in this title, competent authorities may
apply early intervention measures as specified in Article 27 of Directive 2014/59/EU, which are intended to supplement the set of supervisory measures specified in Articles 104 and 105 of Directive 2013/36/EU.
588. Competent authorities should apply early intervention measures without prejudice to any
other supervisory measures, and when applying early intervention measures, should choose the most appropriate measure(s) to ensure a response that is proportionate to the particular circumstances.
10.9 Interaction between supervisory and macroprudential
measures
589. Where an institution is subject to macroprudential measures and the SREP assessment
determines that these macroprudential measures do not adequately address the institutionspecific risk profile or deficiencies present in the institution (i.e. the institution is exposed to or poses a higher level of risk than the level targeted by the macroprudential measure, or the deficiencies identified are more material than those targeted by the measure), competent authorities should consider supplementing the macroprudential measures with additional institution-specific measures.
10.10 Interaction between supervisory and AML/CFT measures
590. Where competent authorities in the course of exercising their supervisory activities have
reasonable indications of deficiencies in the institution’s systems and controls framework or the internal governance framework that are related to AML/CFT or reasonable grounds to suspect that the institution has increased exposure to ML/TF risks, they should:
a. notify the AML/CFT supervisor of these deficiencies and risks as soon as they are identified and liaise with them in line with the AML/CFT Cooperation Guidelines 53; b. assess the impact that such deficiencies and risks may have on the prudential situation of the institution;
c. liaise with AML/CFT supervisors and in line with the respective authorities’
mandates and functions, consider the most appropriate prudential supervisory measures to address these deficiencies and risks in addition to any measures taken by the AML/CFT supervisors. 53 EBA AML/CFT Cooperation Guidelines (EBA/GL/2021/15).

Where the competent authorities are notified or become aware of supervisory measures
or sanctions planned or imposed by the AML/CFT supervisors, they should consider whether and how the potential prudential implications of the weaknesses and failures identified by the AML/CFT supervisors need to be mitigated.

Application of the SREP to cross-border groups
592. This title addresses the application of the common SREP procedures and methodology as
specified in these guidelines in relation to cross-border groups and their entities. It also provides links with the joint assessment and decision process to be carried out pursuant to
Article 113 of Directive 2013/36/EU and Commission Implementing Regulation
(EU) No 710/2014 with regard to conditions of application of the joint decision process for institution-specific prudential requirements.
593. In the SREP, competent authorities should also consider the potential ML/TF risks, taking
into account input received from the AML/CFT competent authority of the Member State where a parent undertaking is established as well as AML/CFT supervisors responsible for the AML/CFT supervision of establishments of the group in different jurisdictions, in particular the assessments of ML/TF risks, material weaknesses and breaches of AML/CFT legislation, that are linked to the cross-border banking group structure.
594. When assessing prudential implications of ML/TF risks in the SREP for a cross-border group,
competent authorities should leverage the information obtained through bilateral engagements with relevant AML/CFT competent authorities in accordance with the AML/CFT Cooperation Guidelines and through their participation in AML/CFT colleges 54 and prudential colleges.
11.1 Application of the SREP to cross-border groups
595. When applying the SREP and these guidelines to cross-border groups, competent
authorities should assess the viability of the group as a whole, as well as its individual entities. This can be done by dividing the process into two stages: (1) competent authorities make an initial assessment of entities under their direct supervision, and (2) competent authorities jointly discuss and finalise the assessment within the framework of colleges of supervisors pursuant to the requirements of Articles 113 and 116 of Directive 2013/36/EU.
596. In accordance with the scope of application of the guidelines as discussed in Title 1:
a. consolidating supervisors should perform the initial assessment of the parent undertaking and the group of institutions on a consolidated level; and 54 AML/CFT colleges as defined in the Joint guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions (‘The AML/CFT Colleges Guidelines’).

b. competent authorities should perform the initial assessment on the entities under their supervision (individual, or sub-consolidated, where relevant).
597. Where these guidelines are applied to the subsidiaries of a cross-border group as specified
in the paragraph above, competent authorities for subsidiaries should, when performing their initial assessment, primarily consider institutions on an individual basis, i.e. assess the business model, strategy, internal governance and institution-wide controls, risksto capital and liquidity, and capital and liquidity adequacy of an entity as they would a standalone institution. The findings from such initial assessments, where relevant, should also include identification of key vulnerabilities in the cross-border or group context, which may be related to the reliance of an institution on its parent/group for funding, capital, technological support, etc. In their initial assessments made on an individual basis, competent authorities should also reflect strengths and mitigating factors related to the entity being part of the group, which may be related to group technological support, financial support arrangements, etc.
598. The results of any such initial assessment of the SREP elements, including, if identified,
views on key dependencies on the parent/group, should serve as an input into the joint assessment and decision process pursuant to the requirements of Article 113 of Directive 2013/36/EU, and should therefore be discussed by the competent authorities within the framework of the colleges of supervisors established pursuant to Article 116 of Directive 2013/36/EU.
599. Following the discussions within the framework of colleges of supervisors and outcomes of
the joint assessment process, competent authorities should finalise their respective SREP assessments, making the necessary adjustments based on the outcomes of the college discussions.
600. Where a competent authority’s initial assessment has revealed specific deficiencies related
to intra-group positions (e.g. high concentration of exposures to the parent undertaking, reliance on intra-group funding, concerns about the sustainability of an entity’s strategy, etc.) negatively affecting the overall viability of the entity on an individual basis, competent authorities should, within the framework of the colleges of supervisors, discuss whether the final assessment of an entity should be changed considering the overall group dimension, including the consolidated group business model, strategy and existence and specific features of intra-group financial support arrangements.
601. Competent authorities should discuss and coordinate the following within the framework
of colleges of supervisors:
a. planning, including frequency, and timelines for performing the assessment of various SREP elements for the consolidated group and its entities to facilitate preparation of the group risk and liquidity risk reports required for the joint decisions as specified in Article 113 of Directive 2013/36/EU;

b. details of the application of benchmarks used for the assessment of SREP elements;
c. approach to assessing and scoring subcategories of risks individually, where such
subcategories have been identified as material; d. inputs required from the institution at consolidated and entity level for conducting the assessment of SREP elements, including those from the ICAAP and ILAAP; e. outcomes of the assessment, including the SREP scores assigned to various elements, and the overall SREP assessment and overall SREP score at consolidated and entity level. When discussing the assessment of individual risks to capital and liquidity, competent authorities should focus on the risks that are identified as material for the respective entities; f. cross-border prudential implications of ML/TF risks and concerns; and g. planned supervisory and early intervention measures, if relevant.
602. When preparing the summary of the overall SREP assessment for the cross-border group
and its entities, competent authorities should structure it in a way that will facilitate filling in the templates for the SREP report, group risk report, liquidity risk assessment and group liquidity risk assessment report templates required for the joint decision under Article 113 of Directive 2013/36/EU as specified in the Commission Implementing Regulation (EU) No 710/2014 with regard to conditions of application of the joint decision process for institution-specific prudential requirements.
11.2 SREP capital assessment and institution-specific prudential
requirements
603. The determination of capital adequacy and related requirements and guidance in
accordance with the process described in Title 7 for cross-border groups is part of the competent authorities’ joint decision process pursuant to Article 113 of Directive 2013/36/EU.
604. The exercise of supervisory powers and the taking of supervisory measures, including with
regard to imposing additional own funds pursuant to Article 104(1)(a) at consolidated or individual entity level as specified in Title 7 should be subject to the joint decision of the competent authorities pursuant to Article 113 of Directive 2013/36/EU.
605. For parent or subsidiary institutions of a cross-border group, the application of additional
own funds requirements pursuant to Article 104(1)(a) of Directive 2013/36/EU should be carried out in accordance with the joint decision process provided for in Article 113(1)(a) of that Directive.
606. In the context of discussions on the adequacy of the level of own funds and determining
additional own funds requirements, competent authorities should consider:

a. the assessment of the materiality of risks and deficiencies identified at both consolidated and individual entity level (i.e. which risks are material to the group as a whole and which are material to just one entity) and the level of own funds required to cover such risks; b. where deficiencies identified are common across all entities (e.g. same governance deficiencies present in all entities, or deficiencies in the models used across several entities), coordinating the assessment and supervisory response, and in particular, deciding whether measures should be imposed at a consolidated level or proportionally at entity level for the entities where common deficiencies are present;
c. outcomes of ICAAP assessments and views on the reliability of ICAAP calculations
and their use as an input in determining additional own funds requirements; d. outcomes of the supervisory benchmark calculations used to determine additional own funds requirements for all entities within the group and at a consolidated level; and e. additional own fundsrequirementsto be imposed on entities and at a consolidated level to ensure there is consistency of final own funds requirements and whether there is a need for transferring own funds from consolidated to entity level.
607. To determine the TSCR as specified in Title 7, competent authorities should consider the
same level of application as the joint decision requirements under Article 113(1)(a) of Directive 2013/36/EU. In particular, the TSCR and other capital measures, if applicable, should be set at consolidated and solo levels for entities operating in other Member States. For the subconsolidated level, the TSCR and other capital measures should cover only the parent undertaking of the sub-consolidated group to avoid double counting of additional own funds requirements considered by competent authorities for subsidiaries in other Member States.
608. If the outcome of the supervisory assessment of the risk of excessive leverage for the
parent or subsidiary institutions of a cross-border group is that additional own funds requirements to address the risk of excessive leverage should be set, that should be carried out in accordance with the joint decision process provided for in Article 113(1)(a) CRD and reflect the separate stack of own funds requirements based on the leverage ratio.
609. In the context of the discussions on the adequacy of the level of own funds to cover the risk
of excessive leverage and determining additional own funds requirements, competent authorities should consider:
a. aspects included in paragraph 394; b. additional own funds requirements to cover the risk of excessive leverage imposed on entities and at a consolidated level to ensure there is consistency of final own

funds requirements and whether there is a need for transferring own funds from consolidated to entity level.
610. All the relevant information regarding the determination of P2G (including its size, the
composition of own funds to cover it, and supervisory reaction) for parent or subsidiary institutions of a cross-border group should be shared among competent authorities and the setting of the P2G and P2G-LR should be carried out in accordance with the joint decision process pursuant to Article 113(1)(c), of Directive 2013/36/EU. In particular, competent authorities should discuss the approach to establishing P2G at solo level where no data from the supervisory stress tests is available at solo level, or, where relevant, agree on the application of P2G at consolidated level only.
611. The P2G and P2G-LR should be subject to joint decision of the competent authorities
pursuant to Article 113(1)(c) of Directive 2013/36/EU and should be duly reflected in the joint decision document prepared in accordance with Article 113 of Directive 2013/36/EU.
11.3 SREP liquidity assessment and institution-specific prudential
requirements
612. For Article 113(1)(b) of Directive 2013/36/EU, competent authorities should consider
‘matters’ to be significant and/or ‘findings’ to be material at least where:
a. specific quantitative liquidity requirements are proposed by competent authorities; and/or b. measures other than specific quantitative liquidity requirements are proposed by competent authorities and the score assigned to liquidity risk and/or funding risk is ‘3’ or ‘4’.
11.4 Application of other supervisory measures
613. Competent authorities responsible for the supervision of cross-border groups and their
entities should discuss and coordinate, where possible, application of all supervisory and early intervention measures to the group and/or its material entities to ensure that the most appropriate measures are consistently applied to the identified vulnerabilities, taking into account the group dimension, including inter-dependencies and intra-group arrangements as discussed above.
614. Competent authorities responsible for the prudential supervision of entities of a crossborder group should, when imposing supervisory or administrative measures including
sanctions on institutions for their failure to address deficiencies related to ML/TF risks adequately, liaise with the relevant AML/CFT supervisors in accordance with Section 8 of the

AML/CFT Cooperation Guidelines 55 and in line with the respective authorities’ mandates and functions, consider the most appropriate prudential supervisory measures to address these deficiencies and risks in addition to any measures taken by the AML/CFT supervisors. 55 EBA AML/CFT Cooperation Guidelines (EBA/GL/2021/15).

Supervisory stress testing
12.1 Use of supervisory stress testing by competent authorities
615. Competent authorities should, also on the basis of Article 100 of Directive 2013/36/EU, use
supervisory stress testing to facilitate the SREP and, in particular, supervisory assessment of its key elements, as described in Title 4 to Title 9. In particular, supervisory stress testing should help competent authorities, where appropriate, with the following:
a. The assessment of institutions’ individual risks to capital as referred to in Title 6, or risks to liquidity and funding as referred to in Title 8. b. The assessment of the reliability of institutions’ stress testing programmes, as well as the relevance, severity and plausibility of scenarios for institutions’ own stress tests used for ICAAP and ILAAP purposes. This may include challenging institutions’ main assumptions and risk drivers.
c. The assessment of institutions’ ability to meet TSCR and OCR in the context of the
assessment of capital adequacy, as specified in Section 7.7. Depending on the coverage and type of the supervisory stress test, this assessment may be limited only to some elements of TSCR covered by the design features of the supervisory stress testing (e.g. additional own fundsrequirements for individual risk categories, if the stress test covers only such risk categories). d. The determination of P2G for institutions. e. The identification of possible vulnerabilities or weaknesses in institutions’ risk management and controls on individual risk areas. f. The identification of possible deficiencies in overall governance arrangements or institution-wide controls: supervisory stress testing should be considered by competent authorities as an additional source of information for the purposes of the SREP assessment of internal governance and institution-wide controls referred to in Title 5. In particular, if a competent authority identifies by means of supervisory stress testing, deficiencies in the institution’s own stress testing programmes or supporting risk data infrastructure, these should be taken into account in the assessment of the overall governance and risk management framework of that institution. g. The determination of specific quantitative liquidity requirements in the context of the assessment of liquidity adequacy, especially where a competent authority has not developed specific supervisory benchmarks for liquidity requirements. Certain

elements of the liquidity supervisory stress tests should, where appropriate, be used as inputs when setting specific liquidity requirements for institutions (e.g. a comparative analysis, under adverse scenarios, of net cash outflows and eligible liquid assets over a set of time horizons, assessment of stressed maturity ladder), as specified in Section 9.4.
616. Furthermore, supervisory stress testing should help competent authorities to assess
supervisory organisational procedures and to plan supervisory resources, considering also other relevant information, in particular for the more frequent and in-depth assessment of certain SREP elements in the case of non-Category 1 institutions, and for the purposes of determining the scope of the supervisory examination programme required by Article 99 of Directive 2013/36/EU.
617. Competent authorities should also, where appropriate, use the scenarios and outcomes of
supervisory stress tests as additional sources of information in the assessment of institutions’ recovery plans, in particular when assessing the choice and severity of scenarios and assumptions used by the institution.
618. Competent authorities should also, where appropriate, use supervisory stress testing
outcomes to support the analysis needed for the purposes of granting various permissions and authorisations required by Regulation (EU) No 575/2013 or Directive 2013/36/EU, for example in relation to qualifying holdings, mergers and acquisitions, and shares buy-backs.
619. Competent authorities should also use the outcomes of supervisory stress testing, where
appropriate, to support a thematic analysis of the potential vulnerabilities of a group of institutions with similar risk profiles.
620. Competent authorities should also, where appropriate, use supervisory stress testing as a
way to motivate institutions to enhance their internal stress testing and risk management capabilities: in particular, a supervisory stress test with a bottom-up component could motivate institutions to further develop and improve their data aggregation, risk modelling and IT tools for stress testing and risk management purposes.
12.2 Key elements of supervisory stress testing
621. When deciding on the key elements of supervisory stress testing, competent authorities
should consider, inter alia, the following:
a. Coverage, in terms of covering certain risk factors or multiple risk factors, certain individual portfolios or activities or sectors/geographies, all or several portfolios. b. Design, in terms of the following: (1) sensitivity analysis (single-factor or simple multi-factor), (2) scenario analysis or (3) reverse stress testing. Competent authorities should choose the design that is most appropriate for the objective pursued by the stress test: sensitivity analysis to a single risk factor or multiple risk

factors should normally be favoured when assessing individual risk to capital or risks to liquidity or funding; the scenario analysis approach should normally be favoured when an assessment of overall capital adequacy is sought; while reverse stress testing may, inter alia, be deemed appropriate for assessing the severity of the scenarios used by the institution.
c. Scope, in terms of covering the perimeter of cross-border groups: for the purposes
of the assessment of the overall capital adequacy of the group, competent authorities should ensure that all relevant group entities are taken into account stress tests. d. Sample of institutions covered by the stress tests: when planning supervisory stress testing for more than one institution, competent authorities should consider the appropriate sample for the purposes of the exercise, in particular when using supervisory stress testing for thematic assessments of certain business lines/models or impact studies/assessments. e. Approach (top-down stress test, bottom-up stress test, combination of both, prescribing specific anchor scenarios for institutions).
622. When designing and conducting supervisory stress tests for SREP purposes, competent
authorities should consider the outcomes of asset quality reviews (AQR), where available, appropriate and not already incorporated into institutions’ financial statements. Combining supervisory stress testing with AQRs can be considered useful in ensuring that the balancesheet positions of the institutions covered by the supervisory stress tests are reported accurately with improved and comparable starting points across participating institutions.
623. Competent authorities may also consider setting predefined target capital ratios, especially
in the context of system-wide stress tests (including country-level stress tests), or setting general or idiosyncratic thresholds. In such cases, these must be suitable and by take into account supervisory objectives. Such targets or thresholds should apply consistently to the institutions within the scope of the supervisory stress tests.
12.3 Organisational and governance arrangements within
competent authorities
624. Competent authorities should establish an effective programme for supervisory stress
testing. This programme should be supported by appropriate organisation, governance and IT arrangements ensuring that supervisory stress tests can be conducted with appropriate frequency. The supervisory stress testing programme should support the effective implementation of the supervisory examination programme for individual institutions. The programme should also reflect how the competent authority takes decisions regarding the choice of forms of supervisory stress testing in close connection with the objectives of each exercise.

The governance, organisation and IT arrangements supporting the supervisory stress
testing programme should include at least the following:
a. Sufficient human and material resources, data and IT infrastructure to design and conduct supervisory stress tests. In particular, the supervisory stress testing programme should be supported by adequate data and an appropriate methodological approach covering all aspects, including scenarios and assumptions (e.g. templates, guidance, documentation), and ensuring both flexibility and appropriate levels of quality and controls. b. A quality assurance process covering stress testing design, development and execution, and the comparability of results across institutions.
c. The integration of supervisory stress testing into other relevant supervisory
processes. Hence, when required and subject to any legal constraints, the organisation should support the internal sharing of information and utilisation of all aspects of the stress testing programme (e.g. both quantitative and qualitative results).
As part of governance arrangements, competent authorities should ensure that the
supervisory stress testing programme is reviewed regularly, both qualitatively and quantitatively, to ensure that it is adequate.
Competent authorities should ensure that they have processes and arrangements in place
for an effective dialogue with institutions regarding supervisory stress tests and their outcomes. This dialogue should reflect the intended objectives, be established in particular but not exclusively when supervisory stress tests are run for the purposes of the assessment of the overall capital adequacy of institutions and be organised within the more general context of the SREP assessments as set out in these guidelines. For the purposes of such a dialogue both at the technical and managerial level, where relevant, the competent authorities should ensure that:
a. adequate, sufficiently detailed and accurate explanation and guidance is provided to institutions on the application of the methodologies and assumptions used in a bottom-up stress test; b. adequate, sufficiently detailed and accurate instructions are given to institutions with regard to the supporting information required by them to be submitted to competent authorities along with the results of the stress tests;
c. explanation is provided to institutions following discussions, where relevant, of the
outcomes of supervisory stress tests that lead to the application of supervisory measures. This should be considered by competent authorities in particular in the context of system-wide stress tests that trigger supervisory measures.
When applying supervisory stress testing to cross-border groups and their entities,
competent authorities should exchange information and, where practically possible, appropriately discuss the process within the framework of colleges of supervisors. In particular, competent authorities should ensure that relevant details on the methodologies, scenarios and major assumptions as well as the results of supervisory stress tests, especially those aimed at assessing capital or liquidity adequacy, are made available and discussed.
Competent authorities should also identify what information regarding supervisory stress
tests and their outcomes may be publicly disclosed, taking into account the intended purposes of the supervisory stress tests. When deciding on the public disclosure of the results or methodologies of supervisory stress tests, competent authorities should consider their own role in the exercise and the approach chosen (top-down stress test, bottom-up stress test) and also consider the extent of their own analysis to accompany published results.
12.4 Process and methodological considerations
The supervisory stress testing programme set out by the competent authorities should
ensure at least the following:
a. When designing methodologies and assumptions for use in supervisory stress tests, competent authorities should decide on the design and features of the exercise that are most suitable for its intended purpose, i.e. that are linked to the supervisory (or other) objectives set by the competent authority. b. When conducting supervisory stress tests on a wider sample of institutions, competent authorities may consider adopting the design of supervisory stress tests for different categories of institutions as set out in Section 2.4, especially if the exercise is top-down.
c. Competent authorities should consider the appropriate timelines for conducting
supervisory stress tests, including the time horizon of the scenarios and the period over which the management actions proposed by institutions in the stress test exercise are analysed. The timelines for the exercise should also factor in the dialogue with the institution, where relevant for the intended purpose of the exercise and the extent to which the data supplied by the participating institution will remain relevant. d. Competent authorities should consider, where relevant for the intended purpose of the exercise, all known future regulatory changes affecting institutions within the scope and time horizon of the exercise.
In the case of a scenario analysis stress test, competent authorities should decide whether
to run a single scenario to be applied to all institutions included in the scope of the exercise, or to develop institution-specific scenarios for individual institutions (the latter should not be seen

as relieving institutions from the responsibility of designing own scenarios for the purposes of ICAAP and ILAAP stress testing), or a combination of the two. Competent authorities should consider the transferability of capital and liquidity resources in stressed conditions and any possible impediments, including legal and operational impediments, that may exist.
632. Furthermore, the following aspects should be considered when developing the
methodologies for supervisory stress tests:
a. For the purposes of the assessment of capital adequacy, competent authorities should consider the impact of the stress test on the institution’s P&L, balance sheet, risk exposure amount and leverage ratio, and analyse the impact of the stress test on the capital ratios of institutions covered by the exercise. b. For the purposes of bottom-up stress tests, competent authorities should consider the extent to which they prescribe the methodologies for modelling institutions’ balance sheets and P&L. Indicatively, institutions’ balance sheets may be taken as static, allowing competent authorities to assess current risks over time. Alternatively, they may be allowed to be dynamic, permitting, for example, a more forward-looking exploration of how institutions’ business plans might evolve under the stress scenario or how credit volumes might evolve over time. For enhanced comparability, competent authorities may consider opting for the static balance sheet approach. Conversely, for enhanced feedback on institutions’ intended or planned reactions vis-a-vis stresses and shocks, the dynamic balance sheet approach may be favoured.
c. Competent authorities should consider how to take account of systemic feedback
or second-round effects in the stress tests, where relevant, recognising the limitations of providing ex ante assumptions in the case of bottom-up stress tests. d. For the purposes of bottom-up supervisory stress tests, competent authorities should aim to assess the impact of such exercises consistently and fairly across the institutions covered by supervisory stress tests, respecting the level playing field. Competent authorities should also consider the extent to which stress test results reflect differences in modelling choices and judgements among institutions, rather than true differences in the risks to which they are exposed.
633. Competent authorities should aim to assess model risk across stress testing exercises and
have access to different types of comparative information. It is recommended to have, where appropriate, several perspectives/benchmarks. It is important to recognise that all models are imperfect and to clearly identify known and potential weaknesses. Understanding these limitations and weaknesses of individual institutions’ stress testing models can inform the supervisory stress testing process and mitigate potential problems arising from model risk.

Annexes
Annex 1. Operational risk, examples of the link between losses and
risk drivers
To illustrate how operational risk manifests itself, it is necessary to understand the relationship between the drivers of a specific risk event and the impact (i.e. outcome) of the risk event. Some examples are given in the following table 56 . 56 Root cause gives rise to a risk event resulting in an impact or multiple outcomes, some of which are quantifiable. Driver Risk event Impact types (outcomes) People Arson – a deliberate act committed by a person Fire – the event • Death/injury

Financial loss/cost
Property damage
Customer disruption
Process Manual error Inaccurate accounts • Financial loss
Reworking accounts
Systems
IT software fault ATMs shut down/unavailable
Customer complaints
Compensation
Reputational damage
Regulatory censure
External
Very severe ice storm Buildings inaccessible/invocation of contingency arrangements
Customer disruption
Financial loss
Repair costs

Annex 2. Key features and differences between P2R and P2G
P2R P2G
Nature
Requirement on top of Pillar 1 and below the combined buffer requirement set in accordance with Article 104 of the CRD Expectation on top of the combined buffer requirement Scope (1) Risk of unexpected losses over 12- months period not covered by minimum requirements; (2) risk of expected losses over 12 months insufficiently covered by provisions; (3) risk of underestimation of risk due to model deficiencies; (4) risks arising from governance deficiencies Quantitative outcomes of relevant stress tests (other potential areas to be explored further) Determination Calculation takes into account ICAAP figures, where assessed as reliable, supported by, for example, supervisory benchmarks applied in relation to ICAAP calculations, supervisory judgement, etc. Calculation based on the maximum impact of the adverse scenario on the CET1 ratio, adjusted, for example, for credible mitigating actions and other factors, and offset against the own funds held to meet the CCB and in exceptional cases the CCyB if it covers the same risks assumed in the stress test Quality of capital Regulatory eligible own funds, at least in the same composition as Pillar 1 [CET1 only] Relevance for the restrictions on distributions under Article 141 of Directive 2013/36/EU Yes No Communication to institution
Part of the TSCR ratio articulated in
relation to all Pillar 1 ratios (total own funds, T1, CET1) As a separate ratio, not part of TSCR or OCR, explaining how it affects all capital ratios (T1 and total own funds)

Compliance
Requirements to be met at all times, including in stressed conditions Institutions are expected to incorporate P2G into their capital planning, risk management and recovery planning, and operate above P2G Supervisory response to breaches All supervisory measures can be applied; a breach is a potential condition for the withdrawal of authorisation; an institution in breach is considered failing or likely to fail for resolution purposes No automatic link between the level of own funds falling below P2G and specific supervisory measures, but would trigger enhanced supervisory dialogue and engagement with an institution, as there is a need to provide a credible capital plan

Accompanying documents
1.1 Draft cost-benefit analysis / impact assessment
I. Introduction
The Directive amending the Capital Requirements Directive (CRD 5) entered into force on 27 June 2019 and became applicable on 29 December 2020 with the exception of some provisions. According to the EBA risk reduction package roadmaps 57 , the EBA should amend the SREP guidelines in order to be aligned to the new changes introduced in the Pillar 2 framework. The changes introduced by CRD V include: (i) the incorporation of elements related to ML/TF risks; (ii) more detailed clarifications on the conditions for setting the Pillar 2 capital add-ons and the quality of required capital; (iii) the introduction of capital add-ons for the risk of excessive leverage; (iv) the microprudential perspective of Pillar 2 capital add-ons in order to avoid overlaps with macroprudential tools; (v) the inclusion of the Pillar 2 guidance as part of the joint decision on institution-specific prudential requirements; and (vi) the mandate to consider inclusion of ESG risks. Lastly, the framework for the interest rate risk in the non-trading book (IRRBB) is modified with the introduction of the credit spread risk in the banking book (CSRBB), a common and simplified standardised approach for IRRBB and the inclusion of the net interest income (NII) perspective to the economic value of equity (EVE) for the purposes of interest rate risk management, disclosures and prudential supervision. In addition, proportionality provisions applicable to small and noncomplex institutions and to large institutions were introduced in the revised Capital Requirements Regulation (CRR 2). This regulatory classification should also be reflected in the application of the proportionality principle in the SREP. In order to incorporate the relevant CRD V / CRR 2 provisions into the already existing set of guidelines that set the basis of the day-to-day work of supervisors, a second revision of the SREP guidelines was undertaken.
II. Policy objectives
The scope of the second revision of the SREP guidelines is focused on the incorporation of the elements related to proportionality, guidance on how to take into account ML/TF risks in the SREP, the incorporation of the microprudential perspective of Pillar 2, the clarification for setting Pillar 2 capital add-ons and the alignment of Pillar 2 guidance to the new CRD V provisions. Other elements, 57 https://www.eba.europa.eu/sites/default/documents/files/document_library//EBA%20Risk%20Reduction%20Packag e%20Roadmaps.docx.pdf

related to the inclusion of ESG risks into the SREP and the review of the supervisory assessment of IRRBB management and controls will take place in a further review of the SREP guidelines. The elements related to ML/TF risks that have been incorporated into the guidelines are fully aligned with the Opinion on how to take into account ML/TF risks in the Supervisory Review and Evaluation Process, published in November 2020 58 .
III. Baseline scenario
The common EU SREP framework has been applied since 2016, with the first version of the guidelines first published in December 2014 and that entered into force in January 2016. The version of the guidelines that is currently applicable is the Revised EBA Guidelines on common procedures and methodology for the supervisory review and evaluation process and supervisory stress testing 59, which was the result of a first review of the SREP guidelines undertaken in 2018. This first revision introduced P2G, integrated supervisory stress tests, detailed supervisory assessment of banks’ stress testing, clarified certain aspects of the scoring framework, introduced a better explanation of the interaction between the SREP elements and the articulation of the total SREP capital requirements (TSCR) and overall capital requirements (OCR), among others.
IV. Options considered
The following policy options were assessed during the drafting process in order to make the SREP guidelines aligned with CRD V provisions. Minimum engagement model: categorisation review In CRR 2, a definition of ‘small and non-complex institutions’ is introduced in order to make disclosure and prudential requirements simpler and more conservative for these institutions. For this, the following options were assessed in order to apply proportionality principle into the SREP guidelines. Option 1: Maintain current categorisation Under the current SREP Guidelines, competent authorities should classify all institutions under their supervisory remit into four categories according to their size, structure and internal organisation, and according to the nature, scope and complexity of their activities, as well as the level of systemic risk. The difference between the categories translates into different minimum frequency of the assessment of all the SREP elements, which is set on an annual basis for Category 1, every 2 years 58 https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Opinions/2020/935606/O pinion%20on%20how%20to%20take%20into%20account%20MLTF%20risks%20in%20SREP.pdf 59 https://www.eba.europa.eu/sites/default/documents/files/documents/10180/2282666/6c2e3962-6b95-4753-a7dc68070a5ba662/Revised%20Guidelines%20on%20SREP%20%28EBA-GL-2018-03%29.pdf

for Category 2 and every 3 years for Categories 3 and 4. Therefore, under the current framework, there is almost no difference in treatment between Categories 3 and 4. Option 2: Adapt the categorisation to the proportionality provisions introduced in CRD V This option ensures that the definition of small and non-complex institutions is reflected in the SREP categorisation and a more detailed guidance in that regard is provided, allowing better differentiation between the SREP Categories 3 and 4. With additional flexibility granted to the supervisor in allocation of institutions to categories, this option creates a possibility to better allocate supervisory resources. This option will create more differentiation between the categories applicable to small institutions (3 and 4), reducing the burden for those small and non-complex institutions that could be reclassified from Category 3 to Category 4. Category 4 will be the one with the lowest engagement frequency, which ensures appropriate application of the proportionality principle. Option 2 is the preferred option. Methodology of setting additional own funds requirements (P2R) Option 1: Further clarifications on a risk-by-risk approach This option implements Article 104a of CRD V into the SREP guidelines, including clarification that the process for setting additional own funds requirements should be divided into two steps: (a) the determination of the capital considered adequate by the competent authority; (b) the determination of additional own fundsrequirements by deducting the relevant Pillar 1 requirement from the capital considered adequate. Thus, Pillar 1 requirements is the floor for the calculation of Pillar 2. Further clarifications on the application of this approach on a risk-by risk basis allow greater consistency of supervisory approaches and level playing field for EU institutions. Option 2: Current approach Under this option, the current guidance would remain largely unchanged, apart from clarification that the risks considered should be institution-specific (i.e. systemic risk would be eliminated from the scope of Pillar 2 add-ons, in line with CRD V). This option ensures flexibility to competent authorities and promotes continuation of current practices, but may also reinforce inconsistencies among supervisory practices, affecting level playing field for institutions. Option 1 is the preferred option. Role of ICAAP in the methodology for setting P2R Option 1: ICAAP calculations are the starting point for P2R determination (current approach).

The current approach set in the guidelines set the ICAAP as the starting point for the P2R determination, supplemented by other relevant inputs. However, according to the CRD, ICAAP should be taken into account, which means that there is the possibility of considering other possible sources of information at the same level of importance as ICAAP for the purposes of P2R (i.e. supervisory reporting and benchmark calculations and other relevant inputs). While this approach puts particular emphasis on the use of ICAAP and encourages institutions to improve its quality for the purpose of internal risk management, it may not be appropriate to apply it in cases where the ICAAP calculations are not sufficiently reliable. Furthermore, given different methodologies used by institutions as well as different levels of conservatism, this approach may pose a challenge in ensuring overall comparability of the outcomes between institutions. Option 2: ICAAP used for identification and assessment of risks and, if reliable, considered for the quantification of P2R Under this option, it is recognised that ICAAP carries a lot of valuable information, not only in the form of calculations of economic capital, but also the qualitative information related to risk management. Therefore, even in cases where ICAAP calculations are not sufficiently reliable, the qualitative information is a valuable input for identification and assessment of risks. For the purpose of the P2R quantification ICAAP calculations should be taken into account only if they are reliable, together with other sources of information, such as benchmark calculations and other relevant inputs. This option will still keep ICAAP as the most prominent source of information for SREP purposes, while ensuring compliance with CRD V and recognising the need to consider other relevant inputs. Option 2 is the preferred option. Methodology of setting P2G Option 1: Bucketing approach This proposed methodology maintains the main policy choices of the 2018 revision in order to calculate P2G: (i) usage of the adverse scenario of stress tests; (ii) consideration of the worst year of the scenario; (iii) the offsetting of P2G against elements of the combined capital buffer with potential overlap (i.e. Capital Conservation Buffer); and (iv) P2G should meet with CET1 capital. As the novelty in the proposed methodology institutions would be classified into buckets of capital depletion under the maximum stress test impact, calculated based on the changes in the CET1 ratio and the TREA in the worst year of stress under the adverse scenario of the relevant stress test. The buckets would be defined on an absolute basis in order to be institution-specific as prescribed by
Article 104b of CRD. Under this methodology, the P2G starting point would be the result of the
difference between the stress test maximum depletion under the adverse scenario and elements of overlapping (i.e. 2.5% of Capital Conservation Buffer, other adjustments like the Static Balance Sheet Assumption, etc.). This option would ensure the level playing field in the EU by the harmonisation of the P2G methodology. At the same time, the possibility to apply additional adjustments in line with the guidance provided allows flexibility to address specific situations.

Option 2: Current approach
The current approach, in which flexibility is granted to competent authorities, would be maintained. Therefore, different methodologies for the calculation of P2G would remain in place across the EU, not all of them based on the results of the adverse scenario of the stress test. This heterogeneity brings a high level of dispersion in the final outcomes of P2G and poses a risk for the level playing field across the EU. Option 1 is the preferred option. Quality of capital to cover P2G-LR To enhance supervisory convergence and level playing field between institutions, the SREP Guidelines specify the quality of capital competent authorities should require institutions to hold to meet P2G-LR. Option 1: Coverage of P2G-LR using CET1 capital P2G-LR is set to cover potential losses revealed by supervisory stress scenarios, and ultimately aims at allowing an institution to meet its TSLRR under stress conditions. Using CET1 capital to cover P2G-LR ensures a timely and efficient loss absorption capacity. Moreover, under such an option, the quality of capital to cover P2G-LR will mirror the quality of capital to cover P2G ensuring consistency between such requirements. Option 2: Coverage of P2G-LR using Tier 1 capital The leverage ratio overall capital requirements, including the leverage ratio G-SII buffer, shall be covered using Tier 1 capital. Under this option, the coverage of P2G-LR is aligned with such requirements, easing competent authorities’ monitoring of the leverage ratio-based capital requirements. Moreover, Article 104b of the CRD does not prescribe any capital quality to cover P2G-LR, requiring only an appropriate level ‘own funds’ in light of their loss-absorption capabilities under stress conditions. Based on the current legal framework (notably the CRR and the EBA RTS on own funds), reinforced by the EBA work on the monitoring of capital instruments strengthening the consistency and quality of such instruments, AT1 capital is therefore considered of sufficient quality to timely and effectively absorb losses under stress conditions. Option 2 is the preferred option. Incorporation of ML/TF risks in the Supervisory Review and Evaluation Process

In view of Article 97(6) of CRD V and further to the action plan on AML adopted by the Council of the European Union 60, the EBA needs to provide common guidance on how to assess ML/TF risks in prudential supervisory activities and in the context of the supervisory review and evaluation process. In view of the urgency to provide advice on this topic, the EBA published an Opinion on how to take into account ML/TF risks in the SREP 61. The opinion provides advice at a high level on the subject in anticipation of the more detailed common guidance included in the revised SREP Guidelines. Therefore, the policy options described below were already set out in the opinion. Approach Option 1: Include the guidance on the prudential treatment of ML/TF risks and concerns in a separate section of the SREP Guidelines Under this option, the treatment of ML/TF risks in the SREP process would form part of a different title of the guidelines, separated from other titles included (i.e. business model, internal governance, capital and liquidity and funding) and treated as a separate SREP component. This approach would not be fully aligned with CRD V, because from the paragraph added into Article 97 (amending Directive 2013/36/EU) it is inferred that the ML/TF risk is expected to be assessed within the other areas (in particular the evaluation of the governance arrangements, the business model or the activities of an institution). The paragraph introduced an explicit requirement for prudential supervisors to immediately notify the EBA and the AML/CFT supervisor of the institution where a review gives reasonable grounds to suspect that, in connection with that institution, money laundering or terrorist financing is being or has been committed or attempted, or there is increased risk thereof. Therefore, this option would add clarity about how to assess ML/TF risks from a prudential perspective (as all the elements to be assessed would be part of a separate section), but there could be duplication with other areas already covered in the SREP process (business model, internal governance and controls, etc.) as the ML/TF weaknesses are closely related to those areas. This could lead to overlaps in the overall assessment. Option 2: Adopt an integrated approach This option embeds the prudential treatment of ML/TF risks in the relevant sections of other areas to which it relates (such as internal governance, operational risk, business model analysis, etc.). As ML/TF risks are related to other areas included in relevant sections of the SREP guidelines, it would only be necessary to update the relevant sections with specific guidance of how to incorporate ML/TF risks. Moreover, this option is aligned with current supervisory practices, as pointed out by several authorities during the drafting process. Therefore, this option would not represent a 60 https://www.consilium.europa.eu/media/37283/st15164-en18.pdf 61
https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Opinions/2020/935606/O pinion%20on%20how%20to%20take%20into%20account%20MLTF%20risks%20in%20SREP.pdf

significant change in the SREP guidelines (as only updates on relevant sections would be needed) and would be aligned to current practices. The adoption of an integrated approach to the inclusion of ML/TF risks in the SREP is in line with
Article 97 of Directive 2013/36/EU, and reflects the delineation of the respective roles of competent
authorities and AML/CFT supervisors.
Option 2 is the preferred option.
Scoring
Regarding the process of assigning scores to assess the level of ML/TF risk, two options were considered, that ML/TF risks and concerns should either form part of a separate risk score or they should be considered within the scores of the risk to which ML/TF risk is related. Option 1: Separate scoring for ML/TF risk Under this option, ML/TF risk would be scored separately from the other risks. In order to build the scores, the supervisory considerations on the risk would be closely related to the other areas involved in which ML/TF has been identified (i.e. internal governance, operational risk, etc.). Moreover, this policy decision is closely related to the integrated approach assessed above. Thus, as it was decided to opt for an integrated approach in order to assess ML/TF risks under the SREP (instead of creating a separated section or the SREP component for ML/TF risk), the scoring should not be misaligned with this choice and thus the scores are related to the current existing titles of the guidelines. Option 2: Embed ML/TF risk into the scores for the other risks Under this option and the assessment related to ML/TF risk would serve as a relevant input to the scores of the relevant related areas. For example, as ML/TF concerns related to the credit granting process and origin of funds to repay are considered within Title 6 of assessing risks to capital, the assessment of prudential supervisor on this specific topic should feed the score of risks to capital. This option is more aligned with the integrated approach selected in order to review the SREP guidelines and would avoid creating overlaps with the other risk scores. The option not to create a separate ML/TF risk score also reflects the delineation of the respective roles of competent authorities and AML/CFT supervisors. Option 2 is the preferred option. Sources of information Option 1: Prudential warning signals that may alert an increased exposure to ML/TF risks be included in the monitoring of key indicators for the SREP

Under this option, the incorporation of ML/TF risks into the SREP would be based solely on information related and obtained from prudential reporting. This option would be sufficient for Title 3 (monitoring of key indicators), in order to build quantitative indicators based on prudential reporting. However, for the rest of the areas (business models, internal governance and controls), the input from AML/CFT supervisors related to findings from their assessments and material weaknesses in AML/CFT controls, would be key to ensuring that the prudential supervisor is considering all the information available that could be useful to relate these material weaknesses to risks that could lead to prudential shortcomings. Option 2: Information based on prudential indicators to identify ML/TF risk and information obtained from AML/CFT supervisors Under this option, prudential supervisors will also consider the outcomes of the assessments conducted by AML/CFT competent authorities into the SREP assessment of business models, operational risk, credit risk, liquidity and funding and internal governance and institution-wide controls as an additional source of information. AML/CFT competent authorities have the expertise and legal mandate 62 to supervise whether and how effectively the ML/TF risk is managed within a credit institution and to assess to which ML/TF risks is the credit institution exposed. Therefore, the option to cooperate with AML/CFT competent authorities is the preferred option as prudential supervisors could obtain from them relevant outcomes from their supervisory activities (e.g. findings from inspections) or outcomes of their monitoring of ML/TF risks. Option 2 is the preferred option.
V. Impact assessment (data collection)
In order to assess the impact of the revision of the guidelines, a survey has been addressed to EU competent authorities. The submitted data is composed by 192 banks that are under the direct supervision of 27 national competent authorities and represent 58% of European banking sector’ assets. The sample is heterogeneous, composed by 81 systemic banks, 40 medium sized banks and 79 institutions with consolidated assets below EUR 5 bn (of which 8 of them are considered systemic). In terms of the SREP categorisation, the sample is also heterogeneous, composed of 92 banks classified in the SREP Category 1, 33 banks classified in the SREP Category 2, 41 banks classified in the SREP Category 3 and 18 banks classified in the SREP Category 4. The data refers to the SREP categorisation and applicable levels of P2R and P2G as of December 2020. Proportionality Data has also been requested for institutions with consolidated assets below EUR 5 bn, which would be eligible from a quantitative perspective as ‘small and non-complex institutions’. Among the 79 institutions of the sample that account with consolidated assets below EUR 5 bn as of December 62 Under Article 48(1) of AMLD, AML/CFT competent authorities are tasked with effectively monitoring the compliance of credit institutions with those requirements.

2020, 71 of them have their SREP categorisation informed. Of these, 70% are classified in categories 1 to 3, with Category 3 appearing as the most predominant. Therefore, these institutions, which would be mainly classified in Category 4 will benefit from a more proportionate approach for Pillar 2 purposes and thus the purpose of the proportionality provisions introduced into the guidelines would be fulfilled, and consistency would be ensured in the scope of the application of proportionality for the small and non-complex institutions across the different Pillars.
Figure 8: SREP categorisation of small and non-complex institutions, December 2020 data
Sources: EBA calculations based on the results of the data collection.
P2R methodology
Under the CRD V, P2R will not only cover risks excluded or not explicitly addressed in Pillar 1, but also risks underestimated in Pillar 1. Pillar 1 acts as a floor for the own funds requirements for a given risk. In the survey, most jurisdictions (24 out of 27 respondents) stated that their methodology to obtain P2R considers risks underestimated in Pillar 1. The rest (3 out of 26) use P2R to cover risks not adequately captured in Pillar 1: one uses P2R to cover only IRRBB, other covers IRRBB and concentration risk and other covers maturity risk, risk weight floor for corporate exposures and risk weight floor for exposures covered by commercial real estate. Among the 24 jurisdictions that cover Pillar 1 risks with P2R, 23 of them also use P2R to cover risks excluded or not explicitly addressed in the Pillar 1 framework. Therefore, most jurisdictions (23 out of 27) are aligned with the methodology for setting P2R of considering Pillar 1 risks and additional risks not addressed in Pillar 1 and they set the Pillar 1 floor on a risk-by-risk basis. Thus, the cost of implementing this methodology in the EU banking sector is moderate. Chart 2 shows the number of banks that account with P2R add-ons of each of the risks considered. More than half of the banks of the sample account with add-ons related to Pillar 1 risks (credit, 1 2 3 4 Not classified Categorization of small and non-complex institutions

market and operational risk) and add-ons related to risks not captured by Pillar 1 (IRRBB and concentration risk). Thus, this is another evidence about the high level of implementation of the risk-by-risk approach for obtaining the total level of P2R, considering Pillar 1 and Pillar 2 risks.
Figure 9: Number of banks per P2R add-on applied for each risk, December 2020 data
Sources: EBA calculations based on the results of the data collection.
The survey also included cells that permitted competent authorities to discretionarily submit other risks considered for P2R (see Chart 3). For example, some banks account with a P2R on risks not explicitly addressed in Pillar 1 (foreign currency risk of credit portfolios) and on other risks not fully captured in Pillar 1 (reputational, strategic risk, AML). Lastly, another 3 banks have P2R on systemic risk, which would not be fully compliant with the provision of CRD V to apply P2R on an institutionspecific basis. 107 113 37 37 Credit and counterparty risk IRRBB Operational risk Business model (viability and sustainability) Internal governance/internal control Market risk Concentration risk Risk to liquidity Capital adequacy Funding risk Settlement risk Liquidity adequacy Risk of excessive leverage

Figure 10: P2R add-ons by additional risks considered by competent authorities, number of banks
per add-on, December 2020 data
Sources: EBA calculations based on the results of the data collection.
Quality of capital to meet P2R
The composition of additional own funds requirements was clarified further in paragraph 389 of the revised version of the guidelines to incorporate the requirement of Article 104a(4) of CRD V. Around 45% of the banks of the sample are above the minimum requirement of 56.25% of Common Equity Tier 1 (CET 1). Among the rest, half of the sample are slightly below the requirement but five outlier banks are far from the minimum requirement. Therefore, the impact of complying with the composition of P2R is medium, given the fact that more than half of the sample is currently below the minimum. 1 Reputational risk FX lending risk Strategic risk AML risk Other risks Pension risk Systemic Risk Residual risk Risks associated with outsourced activities Sovereign risk

Figure 11: P2R covered with CET1 capital, distribution of banks in each bucket of coverage,
December 2020 data
Sources: EBA calculations based on the results of the data collection. Number of banks in each interval of proportion of P2R covered with CET 1 capital. P2G methodology P2G is included in Article 104b of CRD V and competent authorities should develop their methodology to apply P2G to the institutions under their direct supervision. Out of the 27 respondents, 7 competent authorities do not apply P2G yet to the institutions supervised by them, 3 competent authorities do not apply P2G based on stress test results and 7 competent authorities apply either caps or floors in the P2G calculation (i.e. not purely an institution-specific calculation as prescribed in CRD V). Thus, more than half of the competent authorities (17 out of 27) would need modifications in their P2G methodology. The impact of this is expected to be medium. The methodologies used are divergent. For example, one competent authority uses a bucketing methodology according to the CET 1 depletion in the adverse scenario, other calculates P2G as a difference between capital depletion plus a hurdle rate and the sum of Pillar 1, Pillar 2 and capital conservation buffer and another uses ICAAP parameters on a risk-by-risk basis. This divergence is translated in a high deviation in P2G across countries, as can be observed in Chart 4, which has been obtained for each country that account with at least two banks with positive P2G value.

Figure 12: P2G communicated to the banks, December 2020 data
Sources: EBA calculations based on the results of the data collection. Weighted average (by consolidated assets) considering competent authorities with at least 2 banks with positive P2G value, two competent authorities with only one bank with positive P2G were excluded from the calculations. Among the competent authorities that calculate P2G based on stress test result without applying caps or floor in the calculation, the final P2G applied shows a high correlation with the depletion of the adverse scenario of the stress test. However, this only occurs for less than half of the banks of the sample (86 banks from 17 countries), which represents a significant proportion of the banks of the sample with positive P2G value (103 banks from 20 countries). Therefore, the majority of competent authorities that apply positive values of P2G are using methodologies based on ST results. However, a few jurisdictions that currently do not apply P2G based on stress test results or do not have any methodology to set P2G would need to align their methodologies to incorporate P2G and to amend their P2G methodology in order to consider the adverse scenario of the stress test without caps and floors. 0% 1% 1% 2% 2% 3% Ctry 1 Ctry 2 Ctry 3 Ctry 4 Ctry 5 Ctry 6 Ctry 7 Ctry 8 Ctry 9 Ctry 10 Ctry 11 Ctry 12 Ctry 13 Ctry 14 Ctry 15 Ctry 16 Ctry 17 Ctry 18 Ctry 19 P2G communicated to the banks

Figure 13: Correlation between the stress test depletion under the adverse scenario and the final
P2G communicated to banks
Sources: EBA calculations based on the results of the data collection.
R² = 0.5902
0%
5%
10%
15%
20%
25%
30%
0% 5% 10% 15% 20% 25% 30% 35%
Final P2G communicated to banks
ST depletion under the adverse scenario

1.2 Feedback on the public consultation and on the opinion of
the BSG
The EBA publicly consulted on the draft proposal contained in this paper. The consultation period lasted for 3 months and ended on 28 September 2021. Eight responses were received, of which 7 were published on the EBA website. This paper presents a summary of the key points and other comments arising from the consultation, the analysis and discussion triggered by these comments and the actions taken to address them if deemed necessary. In many cases several industry bodies made similar comments or the same body repeated its comments in the response to different questions. In such cases, the comments and EBA analysis are included in the section of this paper where EBA considers them most appropriate. Changes to the draft Guidelines have been incorporated as a result of the responses received during the public consultation. Summary of key issues and the EBA’s response The comments received by the EBA touched upon a broad range of areas addressed in the guidelines and more specifically: categorisation of the credit institutions, business model analysis, assessment of the internal governance and institution-wide controls, assessment of risks to capital, assessment of risks to liquidity and funding risk, assessment of the risk of excessive leverage, calculation of additional own funds requirements and the P2G, as well as application of supervisory measures. Other comments were specifically targeting the proposed provisions related to the incorporation of ML/TF risks in the SREP. The respondents raised a number of comments of a more general nature. These included in particular the opportunity to introduce further proportionality and simplification in the text of the guidelines, arguing that more clarity is needed with regard to the practical application of the general principle of proportionality reflected in the guidelines. Furthermore, many respondents raised the issue of the role of the ICAAP in the assessment of capital adequacy and the setting of P2R and P2G, advocating stronger incorporation of the ICAAP information and estimates into the overall framework for setting additional own funds requirements. One of the most commented areas was the assessment of the risk of excessive leverage and the related additional own funds requirements and guidance (P2R-LR and P2G-LR). Given the novelty of these requirements, several respondents expressed concerns about the application of the proposed guidance and appropriate calibration of the P2R-LR and P2G-LR. The EBA has taken into account the response received from the Banking Stakeholder Group (BSG).

The BSG encouraged the EBA to further reflect the principle of proportionality throughout the text of the guidelines, it pointed out the need to take into account the SPE/MPE organisational structure in the context of the assessment of the internal governance and stressed the importance of addressing ICT as a separate source of risk. The objective of enhanced transparency was welcomed by the BSG, and also in the context of the communication and justification of additional own funds requirements to institutions. Finally, the BSG indicated it shared the view of the EBA that there should be complementarity between supervisory authorities and encouraged the EBA to keep working on the proposed line to ensure fluent coordination without creating an overwhelming flow of demands to institutions.

Summary of responses to the consultation and EBA’s analysis General comments Date of application Some respondents asked the EBA about the planned date of application of the Guidelines. They pointed out that as the GL are unlikely to be finalised and the translations made available until the beginning of 2022, the GL should not enter into force until 1 January 2023. In line with the comments the date of application is set as 1 January 2023. However, competent authorities are encouraged to introduce these revised provisions to the extent possible already in the 2022 SREP cycle, especially taking into account the national transposition of CRD V. Paragraph 14 amended. MPE/SPE organisational models Some respondents suggested that the text of the GL should explicitly recognise the difference between MPE (multiple point of entry) and SPE (single point of entry) organisational models. More specifically, the respondents claimed that supervisors should appropriately consider in their assessment that MPE models imply a decentralised management of capital and liquidity (thus their organisational structure envisages the presence of different subsidiaries) whereas SPE models entail centralised management. In the opinion of the respondents, the areas covered by the supervisory assessment where these different organisational models have an impact are those related to liquidity and business model. In the case of liquidity, for instance, the respondents argued that directly comparing banks having an MPE with those having an SPE model might be inaccurate and thus lead to incorrect conclusions. Similarly, for business model analysis it was claimed In accordance with the requirements laid out in Directive 2013/36/EU, the SREP is carried out in principle at the solo and the consolidated level. When performing the assessment at the consolidated level, competent authorities should take into account the structure of the group and the relations between specific entities of the group. Already in the preliminary assessment of the business model competent authorities should take into account, among others, any major geographies, subsidiaries, branches and business lines. These aspects are then further explored in the qualitative and quantitative analysis of the business model. The terminology of SPE/MPE is used in the context of resolution strategies. However, different resolution tools or combinations thereof may be applied in cases of bank failures (e.g. sale of business, asset separation and bail-in). Therefore, this is addressed in the SREP GL in a more general manner, by the requirement that in conducting the business model analysis competent New paragraph 419 and additional clarifications in paragraphs 76(e) and 536 (g) and (h).

that the independence among subsidiaries (for banks having an MPE model) should be taken into account when performing the supervisory assessment. authorities should take into account the recovery and resolution plans. The level of application of the SREP is clarified in
Section 1.3 of the guidelines. In the specific context of
liquidity, it is already recognised that ‘when an institution has established a liquidity sub-group pursuant to Article 8 of Regulation (EU) No 575/2013, competent authorities should conduct their assessment of risks to liquidity and funding, and apply supervisory measures, for the entities covered by such subgroup at the level of the liquidity sub-group’. Therefore, no further changes are considered necessary in the Guidelines to specifically reflect MPE/SPE organisational models. However, some additional clarifications are introduced in the context of the use of recovery and resolution plans as a source of information for the SREP, and the cooperation with resolution authorities. AML/CFT related comments Definition of money laundering and terrorist financing One respondent suggested to amend the definition of money laundering and terrorist financing included in the definitions section in order to make reference to Article 1 of Directive (EU) 2015/849 (AMLD). The EBA opted to refer to an existing definition of money laundering and terrorist financing risk in order to maintain consistency across the different EBA guidelines. Whereas the same definition is included for ML/TF risk in the EBA Guidelines on ML/TF risk factors (EBA/GL/2021/02) and in the EBA Guidelines on riskbased supervision (EBA/GL/2021/16), the definition in the latter more clearly refers to ML/TF risk hence Reference for ML/TF risk definition in
Section 1.2 has been
amended from the
Risk factor
Guidelines to the
Risk-based supervision
Guidelines
(EBA/GL/2021/16).

the reference has been amended to refer to the Riskbased supervision guidelines. Holistic approach to inclusion of ML/TF risks in the SREP Several respondents indicated competent authorities should take a holistic approach to avoid the inclusion of ML/TF risks as a separate risk category into the different SREP components automatically resulting in downgrading the SREP score. According to the respondents, such an integrated approach should also ensure any supervisory measures imposed under the SREP should follow this integrated approach and not look at ML/TF risk in isolation to other risks. A few respondents suggested to use a hybrid solution using an integrated approach to incorporate ML/TF risks in the existing SREP elements, but with an individualised assessment and scoring for ML/TF risks. The EBA has taken an integrated approach to incorporating ML/TF risks into the SREP, rather than creating a separate risk category with a separate risk score. In that respect, there will only be an impact on the SREP scores in as far as there is a prudential impact of the ML/TF risks on the related risks. With regard to the proposed hybrid solution, the EBA notes the point and wishes to clarify that the integrated approach has been taken in order to avoid overlaps with the AML/CFT supervisory function that is responsible for the supervision, assessment and scoring of ML/TF risks. No changes made. Focus on residual ML/TF risk Several respondents indicated that when incorporating ML/TF risks in the SREP, competent authorities should focus on the residual risk-taking into account if processes are implemented by the institution that enable appropriate management of the risk. ML/TF risks are not assessed and scored as a separate risk under the SREP. In line with the integrated approach, the prudential impact of ML/TF risks feeds into the assessment and scoring of the related risks. Under the assessment and scoring approach in the SREP as explained in Section 2.2.1, scores should represent the residual risk. Furthermore, not all the SREP elements are risks per se, for example the business model analysis is much broader, hence the references to ML/TF risks in this respect should be seen in this context. No changes made.

Risk of overlap between prudential and AML/CFT supervisory functions Whereas it was pointed out that the inclusion of ML/TF risks will enhance the SREP supervisory framework by adding more clarity and greater harmonisation, several respondents voiced concern that there could be a possible risk of overlap between the prudential and AML/CFT supervisory functions. Such an overlap would lead to a possible duplication of reporting, and assessment of ML/TF risks and potential double penalties for the same breach in the context of both the supervision under Directive (EU) 2015/849 (AMLD) and under the SREP. In this context, one respondent indicated it should be avoided that the various phases of the SREP process would be hampered due to a lack of effective coordination and timely information exchange between supervisory authorities. Linked to this, some respondents also pointed out that only the AML/CFT supervisors have the expertise to assess the ML/TF risks, and that the competent authorities should rely on the expertise of the AML/CFT supervisors to assess the ML/TF risks. The guidelines should not lead to duplication of reporting as no additional reporting requirements are established for institutions through these guidelines. As regards the assessment of the ML/TF risks, as clarified in the background and rationale section, and in line with the integrated approach, the ML/TF risks only feed into the SREP assessment in as far as there is a prudential impact on the related risks, whereas the ML/TF risks under Directive (EU) 2015/849 (AMLD) are assessed by the AML/CFT supervisor. Also, in line with the EBA AML/CFT Cooperation Guidelines under CRD Article 117(6) (EBA/GL/2021/15), competent authorities and AML/CFT supervisors should ensure a timely exchange of the relevant outcomes of their respective assessments and information regarding the supervisory measures and sanctions within their supervisory remit. The structured cooperation and mutual information under these guidelines should allow prudential and AML/CFT supervisors to inform their respective supervisory activities and avoid unnecessary duplications or interference of supervisory measures. Whereas a reference to the AML/CFT Cooperation Guidelines was already included in a number of places, references to these guidelines have now been added in paragraphs 74, 87(e), 101, 146, 475(e) and 536. References to AML/CFT Cooperation Guidelines (EBA/GL/2021/15) have been added at relevant instances. Respect of different roles and responsibilities of competent Several respondents highlighted the importance to acknowledge and respect the different roles and responsibilities of competent authorities and The EBA agrees on the importance of acknowledging and respecting the different roles, responsibilities and expertise of competent authorities and AML/CFT Suggested changes on the interaction with AML/CFT

authorities and AML/CFT supervisors
AML/CFT supervisors when incorporating ML/TF risks in the SREP Guidelines, and to acknowledge the expertise of AML/CFT supervisors with regard to ML/TF risks. supervisors, as underlined in the second subsection of the background and rationale section. To further clarify this throughout the guidelines, the following paragraphs have been reworded (as further explained below): 87(e), 101, 310, 472, 591 and 613. supervisors are further explained at relevant instances. Respect of different roles and responsibilities of competent authorities and AML/CFT supervisors in the context of business model analysis One respondent suggested to reword paragraph 86(e) of the CP in order to clarify that in the context of the business model analysis, competent authorities need to rely on the assessment of ML/TF risks and their mitigation by AML/CFT supervisors. The EBA agrees on the importance of acknowledging and respecting the different roles, responsibilities and expertise of competent authorities and AML/CFT supervisors. Paragraph 74 of Title 4 already sets out the interaction with the AML/CFT supervisor in the context of the business model analysis, so a crossreference to this paragraph was added. However, the business model analysis is focused on the broader context of the business model and not assessed as a risk per se. It should also be noted that the SREP Guidelines are addressed to competent authorities, the guidelines cannot be used to impose any obligations on AML/CFT supervisors. With regard to the cooperation and information exchange between competent authorities and AML/CFT supervisors, the SREP Guidelines are complemented by the EBA AML/CFT Cooperation Guidelines under CRD Article 117(6) (EBA/GL/2021/15). Paragraph 87(e) has been reworded to refer to the interaction with the AML/CFT supervisor Another respondent suggested to reword paragraph 94(c) of the CP in order to clarify that in the context of the business model analysis, The EBA agrees on the importance of acknowledging and respecting the different roles, responsibilities and expertise of competent authorities and AML/CFT No changes made.

competent authorities need to rely on the assessment of ML/TF risks and their mitigation by AML/CFT supervisors. supervisors. In the instance of paragraph 95(c) the proposed suggestion was not included, as the excessive concentration will remain a vulnerability for the institution regardless of the mitigating measures put in place by the institution. Respect of different roles and responsibilities of competent authorities and AML/CFT supervisors in the context of the internal governance assessment One respondent suggested to reword paragraph 100 of the CP in order to clarify that in the context of the internal governance assessment, competent authorities need to rely on the assessment of the AML/CFT arrangements and mechanisms by AML/CFT supervisors. The EBA agrees on the importance of acknowledging and respecting the different roles, responsibilities and expertise of competent authorities and AML/CFT supervisors. Paragraph 101 has been reworded to make it clearer that whereas the competent authorities should verify the existence of the governance arrangements and mechanisms related to AML/CFT, their actual assessment is performed by the AML/CFT supervisor. Paragraph 101 has been reworded to refer to the interaction with the AML/CFT supervisor with regard to their assessment of the institutions’ arrangements and mechanisms related to AML/CFT Respect of different roles and responsibilities of competent authorities and AML/CFT supervisors in the context of credit risk assessment One respondent suggested to reword paragraph 170 of the CP in order to clarify that the verification of whether the institution has included the consideration of ML/TF risks in the context of the credit granting process, and whether the institutions has put in place systems and controls to ensure funds to repay loans are from legitimate sources and are within the remit of the AML/CFT supervisor. The respondent also suggested to focus on the most significant transactions since they generate the greatest impact in terms of ML/TF risks. A few respondents pointed out that crossreferences should be added to relevant guidelines The EBA notes the comment and would like to clarify that the provision in paragraph 171 does not make reference to the assessment of individual transactions, but rather to the verification of whether systems and controls have been put in place. The provision also refers to the verification of whether such systems and controls are in place rather than the actual assessment of the effectiveness of these systems and controls, which indeed would be within the remit of the AML/CFT supervisor. The EBA acknowledges the need to use crossreferences to other guidelines rather than repeating the content of those guidelines. In paragraph 171 No changes made.

rather than repeating the content of these guidelines such as in paragraph 170. such a cross-reference is made although a bit more extended in order to clarify the context of the provision. One respondent suggested to reword paragraph 233(d) of the CP in order to clarify that the verification of whether there are checks in place to identify, assess and manage ML/TF risks to which the institution is exposed as a result of the credit granting activities is within the remit of the AML/CFT supervisor. Another respondent suggested to reword paragraph 223(d) of the CP in order to clarify that the verification of whether the policies and procedures also specify how ML/TF risks to which the institution is exposed as a result of the creditgranting activities are identified, assessed and managed is within the remit of the AML/CFT supervisor. The provisions do not make reference to the assessment of the actual effectiveness of the policies and procedures, which indeed would be within the remit of the AML/CFT supervisor. No changes made. Respect of different roles and responsibilities of competent authorities and AML/CFT supervisors in the context of operational risk assessment One respondent suggested to reword paragraph 308 of the CP in order to clarify that the assessment of operational risk management, measurement and controls in relation to ML/TF risks is the responsibility of the AML/CFT supervisor. In line with the comment the link was made with the assessment by the AML/CFT supervisor. Paragraph 309 has been reworded to make the link with the ML/TF risk assessment provided by the AML/CFT supervisor. Another respondent suggested to add in paragraph 324 of the CP that the assessment of reputational The commented provision does not refer to ML/TF risks specifically. No changes made.

risk related to ML/TF risks is provided by the AML/CFT supervisor.
Respect of different roles and responsibilities of competent authorities and AML/CFT supervisors in the context of liquidity and funding risk assessment One respondent suggested to reword paragraph 469(e) of the CP to clarify that the AML/CFT supervisor should assess the quality of the ML/TF risk management system in the context of the assessment of the funding risk. The EBA agrees on the importance of acknowledging and respecting the different roles, responsibilities and expertise of competent authorities and AML/CFT supervisors. Whereas the AML/CFT supervisor would not assess the funding profile of the institution as such, the ML/TF risk assessment from the AML/CFT supervisor could have an impact on the funding profile so in that respect the competent authorities should take into account the ML/TF risk assessment findings where relevant. Paragraph 472(e) has been reworded to make the link with the ML/TF risk assessment provided by the AML/CFT supervisor. Another respondent suggested to add to paragraph 472 (e) of the CP that the competent authorities should liaise with the AML/CFT supervisor to obtain their assessment of the ML/TF risk management system and determine the impact on the funding risk. The EBA agrees on the importance of acknowledging and respecting the different roles, responsibilities and expertise of competent authorities and AML/CFT supervisors. In this respect, competent authorities should use the assessment of the AML/CFT supervisor on the ML/TF risk management system and the impact on the funding risk. Paragraph 475(e) has been reworded to make the link with the assessment of the ML/TF risk management system provided by the AML/CFT supervisor. Respect of different roles and responsibilities of competent authorities and AML/CFT supervisors in the context of measures One respondent suggested to add to paragraph 588 of the CP that the AML/CFT supervisor should duly check the deficiencies and risks related to ML/TF risks prior to the competent authorities’ assessment of their impact on the prudential situation of the institution. The EBA acknowledges the need for competent authorities to liaise with AML/CFT supervisors when they have reasonable indications of deficiencies in the institution’s systems and controls framework or internal governance framework that are related to AML/CFT. Whereas the provision already referred to the need for prudential supervisors to notify the AML/CFT supervisor in this context, the wording in Paragraph 591 has been expanded for competent authorities to liaise with the AML/CFT supervisor

paragraph 591 has been further elaborated on in this respect.
Respect of different roles and responsibilities of competent authorities and AML/CFT supervisors in the context of measures for entities of crossborder groups One respondent suggested to expand in paragraph 610 of the CP the part on the interaction with the AML/CFT supervisor in the context of imposing measures for entities of cross-border groups. Whereas the necessary interaction with the AML/CFT supervisor was already included in this provision and a cross-reference was already made to the relevant
section of the EBA AML/CFT Cooperation Guidelines,
following the comment received this was further elaborated on in paragraph 613. Paragraph 614 has been reworded to elaborate on the interaction with AML/CFT supervisors References to risks in the Guidelines include ML/TF risks Several respondents indicated that footnote 18 of the CP refers to the fact that: ‘any reference to risks in these guidelines should include money laundering and terrorist financing risks’ and despite this mention, on a number of occasions throughout the guidelines, ML/TF risks are explicitly mentioned causing a lack of clarity as to whether the risks only include ML/TF risks when this is explicitly mentioned or every time the word ‘risk’ appears in the document. The EBA acknowledges that any reference to risks should include ML/TF risks and the fact that on different occasions in the guidelines ML/TF risks are mentioned could be perceived as confusing. The EBA wishes to clarify that also for other risks, specific risks are singled out throughout the guidelines in order to provide specific guidance with regard to that particular risk. The reference to risks including ML/TF risks has been moved to paragraph 5 of the Guidelines. In the scoring grid for operational risk, reference is made to ‘all relevant risks including ML/TF risk’ in order to draw the attention of competent authorities. As this could be seen as superfluous, the reference has been removed from the scoring grid.
Table 6 was
amended to remove the superfluous reference to all relevant risks ‘including ML/TF risk’. Management body knowledge, skills and experience regarding ML/TF risks and procedures (paragraph 147(b) of the CP) Several respondents suggested to remove from paragraph 147(b) of the CP the reference to individual knowledge, skills and experience regarding ML/TF risks and the relevant procedures stating that the same level of expertise cannot be The assessment under paragraph 148 is based on the requirement for the management body to have individually and collectively adequate knowledge, skills and experience regarding the ML/TF risks and the relevant procedures under the Joint ESMA and Paragraph 148 has been reworded to ensure cross-

expected in respect of each of the directors, and what matters is the collective awareness of ML/TF risks. The respondents also pointed out that in their view the Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU (EBA/GL/2021/06) do not require the management body to individually have adequate knowledge, skills and experience regarding the ML/TF risks and the relevant procedures, but only collectively. EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU (EBA/GL/2021/06). The relevant paragraph was reworded to ensure alignment and cross-reference to the relevant guidelines. reference to the relevant guidelines. Alignment of paragraph 147(b) of the CP with the EBA Guidelines on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer Several respondents pointed out the link between the assessment of the suitability of the management body under paragraph 147 of the CP and the EBA Guidelines on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer (EBA/CP/2021/31) and suggested to ensure both are aligned and to include a cross-reference to these guidelines. The EBA acknowledges paragraph 148 needs to be aligned to the EBA Guidelines on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer (EBA/CP/2021/31). The cross reference to these guidelines was included in the paragraph as suggested, although, as these guidelines are addressed to AML/CFT supervisors, the competent authorities will need to rely on the assessment of the AML/CFT supervisor in this respect. Paragraph 148 has been reworded to include the reference to the EBA Guidelines on the AML/CFT Compliance Officer Reference to transposition of Directive (EU) 2015/849 (paragraph 147(c) of the CP) One respondent suggested to remove the reference to the transposition of Directive (EU) 2015/849 as EBA guidelines cannot take primacy over national law and the comply-or-explain procedure allows competent authorities to declare that they will not comply with the EBA guidelines if they deem that their national law does not allow it. The EBA notes the comment and has reworded paragraph 148 removing the reference to the transposition of Directive (EU) 2015/849. Paragraph 148 has been reworded removing the reference to the transposition of Directive (EU) 2015/849.

Roles of the management body in its supervisory function and management function (paragraph 147(d) of the CP) One respondent suggested to clarify that the management body in its responsibility to ensure that compliance with AML/CFT requirements is in place in the context of the institution’s business and risk strategy should act both in its supervisory function and in its management function. The EBA notes the comment and has reworded paragraph 148 to ensure alignment and crossreference to the relevant guidelines. Paragraph 148 has been reworded to ensure crossreference to the relevant guidelines. Avoiding overlap with existing requirements Several respondents pointed out that there are a number of areas where overlap should be avoided with existing regulation and requirements that consider the same issues to prevent a dual impact on institutions. An example cited in reference to the overlap with existing requirements is paragraph 147 of the CP in the internal governance assessment. The SREP Guidelines are not addressed to institutions but to competent authorities for the purpose of their SREP assessment. In that respect the guidelines include provisions on the supervisory assessment of institutions’ compliance with requirements that are set out in other regulatory products which in itself are addressed to institutions. The guidance for the supervisory assessment is based on the existing requirements and thus does not create a dual impact on the institution. Paragraph 148 does not duplicate the requirement for institutions, but it addresses the assessment by competent authorities of the requirement laid out in the joint ESMA/EBA Guidelines (EBA/GL/2021/06). No changes made. Distribution of responsibilities between AML/CFT supervisors, financial intelligence units and law enforcement authorities One respondent pointed out that, in their view, only the AML/CFT supervisor should be responsible for identifying the sources of operational risk to which an institution is exposed in the area of ML/TF risks, and competent authorities should not rely on information received from financial intelligence units and law enforcement authorities in this respect. The respondent suggested to reword paragraph 278 of the CP to clarify that for the Paragraph 279 refers to the determination of the scope of the assessment of operational risk in general, not only to the ML/TF risks. In that respect the EBA would not agree with competent authorities only relying on information from financial intelligence units, law enforcement authorities and other relevant information if it has been duly investigated by the AML/CFT supervisor, though the sentence in this paragraph has been shortened. Paragraph 279 has been reworded in order to shorten the sentence.

determination of the scope of the assessment of operational risk competent authorities should only take into account other relevant information received from financial intelligence units and law enforcement authorities or other publicly available information ‘after due investigation by the AML/CFT supervisor’. Exposure to ML/TF risk regardless of the institution’s size or financial soundness (paragraph 307) One respondent suggested to remove paragraph 307 of the CP from Section 6.4 on the assessment of operational risk to the background and rationale as it concerns general considerations. Paragraph 308 is in this section in view of the link with the reputational risk. No changes made. Comments related to proportionality and simplification Further simplification of the guidelines Most respondents welcomed the possibility of simplifying the assessment to be performed by the competent authorities for the SREP even though most of the answers were pointing at the introduction of more proportionality. One respondent suggested that further simplification and readability of the guidelines could be achieved through graphs such as illustrating values and stacking order including the proposed leverage ratio requirement, or the addition of a standardised template for the communication of the SREP outcome which would provide competent authorities and institutions with a simplified view of the SREP decisions.

Another respondent pointed out that the
The EBA welcomes the comment and wishes to clarify that whereas the current review strengthens the proportionality principle in the SREP Guidelines as described below, further adjustments aimed at simplifying the text of the guidelines may be considered in the next review. In line with the suggestion, a graph has been included in the background and rationale section to illustrate the two different stacks of requirements and better clarify the interaction between them. The current text already uses references extensively. Where other regulatory products already set out requirements for the competent authorities, repetitions are avoided and cross-references made. It is also to be noted that the SREP Guidelines set out requirements for the assessment by the competent A graph has been added in the background and rationale section to illustrate the TREAbased versus the LRbased stack of own funds requirements.

simplification could be achieved by using references rather than repeating the requirements of other regulatory products. authorities, not requirements for institutions. In that respect there is a link with the related guidelines though no duplication of the requirement. Granularity of the SREP assessment in view of materiality of risks A number of respondents suggested to clarify in the guidelines that irrespective of the size and category of the institution, the granularity of the SREP assessment can be adapted considering the materiality of specific risks for the institution in question. Along these lines, one respondent suggested introducing some indicators (such as quantitative limits in retribution for the identification of risktakers, the 1% threshold for NPLs in developing countries, etc.) to further enhance the application of the principle of proportionality. A few respondents pointed out that the reference in paragraph 53 of the CP to the tailoring of the scope and depth of the review of the individual SREP elements to the specific risk profile of the institution for Category 4 banks should be described more concretely. The EBA acknowledges that regardless of the size and categorisation of an institution, the granularity of the SREP assessment can be adapted according to the risk profile of the specific institution in order to ensure that the SREP remains focused on the most material risks. Whereas this was already included in paragraphs 56 and 58, it has been further clarified in a specific additional Subsection 2.4.6. The introduction of specific indicators and thresholds was not considered appropriate to avoid overly mechanistic application of the SREP. Competent authorities should be able to make their own assessment of the materiality of risks, given specific circumstances of the institution. However, some limited indicators were introduced, for instance through a reference to small banking book criteria in the context of the assessment of market risk. Given the above clarifications added across the guidelines, the text of paragraph 53 stating that the scope and depth of the review of the individual SREP elements should be tailored to the specific risk profile of the institution can be kept unchanged at this stage, though it has been made more apparent. Addition of Subsection 2.4.6 on the focus and granularity of the SREP assessment Inclusion of the reference to the tailoring of the scope and depth of the review of the individual SREP elements for the SREP Category 4 institutions in paragraph 53(c). Specific guidance on application of proportionality A number of respondents suggested to provide specific guidance on the application of The EBA notes the suggestions to provide specific guidance on proportionality throughout the Clarifications on the application of

throughout the SREP
Guidelines proportionality throughout the guidelines, and in particular in Titles 5, 6 and 8. One example mentioned where proportionality application could be included is paragraph 493 of the CP as according to the respondent the concentration limits go too far for smaller and medium-sized institutions. guidelines. Whereas the proportionality principle as set out in Section 2.4 applies throughout the guidelines, following the feedback the EBA has added guidance on proportionality in the most relevant titles (6 and 8) further specifying the application of the general proportionality principle. The aim is to allow competent authorities to perform a lighter assessment on some specific risk areas (such as for instance market risk, liquidity and funding risk) in the case of small and medium-sized institutions with a low exposure to these sources of risks. proportionality added in paragraphs 182, 191, 195, 197, 200 (credit and counterparty risk), 238, 240 (market risk), 293, 305 (operational risk), 461, 464, 465, 470, 476, 477 and 492 (liquidity and funding risk). Further differentiation between the SREP categories One respondent suggested to include further differentiation in the guidelines between SREP Categories 3 and 4. The respondent suggested that for instance a longer period could be envisaged compared to the 3 years currently foreseen for the exercise of the SREP assessment for Category 4 institutions, which is a point that was also brought up by other respondents. A few respondents suggested to clarify that the 3- yearly assessment of the SREP should cover the main elements of the SREP and not all individual criteria mentioned in the Guidelines The respondent also suggested to introduce a more clear distinction between SREP Categories 2 and 3. Whereas the assessment every 3 years of the individual SREP elements is seen as a minimum also for the SREP Category-4 institutions, as outlined in
Table 1, the scope and depth of the review can be
tailored to the specific risk profile of the institution.
This has been made more apparent in paragraph 53.
The notion of ‘SREP element’ as used throughout the guidelines is defined in Title 1 (i.e. ‘SREP element’ means one of the following: business model analysis, assessment of internal governance and institutionwide risk controls, assessment of risks to capital, the SREP capital assessment, assessment of risks to liquidity and funding, or the SREP liquidity assessment). As for the differentiation between categories 2 and 3, the EBA would like to clarify that as opposed to Category 2 institutions, Category 3 institutions are small to medium (as opposed to medium to large) and mainly operate domestically or with non-significant Provisions of paragraph 53 have been made more apparent. No changes made. with regard to Categories 2-3

cross-border operations, and in a limited number of business lines.
Further differentiation between ‘small and noncomplex’ institutions A few respondents suggested to include further differentiation between small and non-complex institutions based on capital market orientation similar to the distinction made for disclosures in the CRR. Whereas in CRR Article 433(2) there is a differentiation in some disclosure requirements for small and non-complex institutions that are nonlisted, this is not considered a relevant criterion for the frequency or intensity of the SREP and would therefore not have an impact on Pillar 2. No changes made. Use of CRR classifications of large and small and noncomplex institutions for Pillar 2 purposes A few respondents questioned whether it is appropriate to use the CRR classifications of ‘large’ and ‘small and non-complex’ institutions for Pillar 2 purposes as they were primarily defined for the purposes of granting reporting and disclosure relief. The respondents proposed to leave competent authorities with the possibility to apply other relevant criteria, such as the business model and other criteria referred to in the EBA’s discussion paper on proportionality assessment methodology (EBA/DP/2021/03). In this context, one of the respondents suggested in particular to allow competent authorities to apply other relevant criteria and classify an institution as SREP Category 4 even if the CRR criteria for ‘small and non-complex institution’ are not met. Whereas the CRR classification has been linked to the Pillar 2 categorisation in order to ensure consistency in the treatment of institutions across the different Pillars, the provisions do include other relevant criteria for the categorisation. Also for SREP Category 4 other criteria are included in
Section 2.1.1. In this respect, Category 4 will include
institutions defined as ‘small and non-complex’ under the CRR, as well as all other small non-complex institutions that do not fall into categories 1 to 3 (e.g. with a limited scope of activities and non-significant market shares in their lines of business). No changes made. Title 5: Internal governance and institution-wide controls Suitability of key function holders Several respondents pointed out that the scope of the assessment of key function holders should not be the same as for members of the management The assessment of key function holders is one necessary measure to ensure robust governance arrangements required by Directive 2013/36/EU No changes made.

body. It should therefore be limited to initial assessments and exclude re-assessments. under Articles 74 and 88. Directive 2014/65/EU shares the same approach under Article 9(1) (which recalls Article 88 of Directive 2013/36/EU) and under
Article 16(2). These provisions are clarified in the EBA
Guidelines on the assessment of the suitability of members of the management body and key function holders (EBA/GL/2021/06). Competent authorities should ensure that all key function holders within an institution are suitable. The suitability assessments of the key function holders for significant institutions should be performed by competent authorities at least at the consolidating institution’s level. Implementation of a diversity policy Several respondents pointed out that assessing the implementation of a diversity policy for the composition of the management body and within the institutions’ recruitment policy would go beyond the provisions of the EBA Guidelines on suitability of the management body (EBA/GL/2021/06) and would contradict European and national anti-discrimination regulations. Some respondents evidenced that some institutions (especially public law institutions) have no influence on the composition of the supervisory body resulting notably from election outcomes, or appointments, and therefore cannot ensure a wide range of experience, knowledge, skills and values.
Article 91(10) of Directive 2013/36/EU specifically
refers to diversity to be taken into account for the selection of members of the management body. The EBA is mandated by Article 91(12) of that Directive to issue guidelines detailing such a notion of diversity. The EBA Guidelines on the assessment of the suitability of members of the management body (EBA/GL/2021/06) require diversity within the management body, both in its executive and supervisory functions, as it leads to a broader range of experience, knowledge, skills and value, therefore enhancing the functioning of such a body. Additionally, those Guidelines require diversity criteria to be reflected in the recruitment policy to ensure a sufficiently diverse pool of members of the management body. The SREP Guidelines have been clarified on that basis. Paragraph 103(c) amended to further reflect the provisions of the EBA Guidelines on the assessment of the suitability of members of the management body.

The abovementioned EBA Guidelines clarify the requirements of Article 91(10) of Directive 2013/36/EU. Diversity criteria should accompany anti-discrimination rules, as part of robust governance arrangements. This principle is without prejudice to national laws regarding antidiscrimination. The SREP Guidelines have been clarified on that basis. The EBA is aware of some specific legal structures and their resulting challenges. However, the provisions of Directive 2013/36/EU apply to all institutions, therefore requiring the ad hoc nomination committee to consider requirements on the composition and suitability of the management body. Implementation of internal whistleblowing procedures With regard to the assessment of internal whistleblowing procedures, several respondents considered that ensuring information could be submitted in an anonymised way goes beyond the requirements set out in Directive (EU) 2019/2037, as that Directive only refers to confidentiality of identity. The provisions of the SREP Guidelines are in line with
Article 71 of Directive 2013/36/EU requiring
appropriate protection of employees of institutions who report breaches committed within the institution against retaliation, discrimination, or other types of unfair treatment, and with the EBA Guidelines on Internal Governance (EBA/GL/2021/05) leaving the possibility for the staff to ask for anonymity towards the management body and other relevant functions to avoid pressure from the institution. Such anonymity does not impede the institution to get further clarification on the report and could be waived in line with national law in the context of further investigations or subsequent judicial proceedings. The clarification with regard to Paragraph 105(e) amended to further reflect the provisions of the EBA Guidelines on Internal Governance.

the right for anonymity was included in the SREP Guidelines.
Identification and monitoring of conflict of interest One respondent highlighted that the requirements regarding the identification and monitoring of potential conflict of interest resulting from transactions with the management body and related parties are already covered in the EBA Guidelines on Internal Governance. While the EBA Guidelines on Internal Governance (EBA/GL/2021/05), as cross-referred in the SREP Guidelines, describe the responsibilities of the management body to set up and implement a framework for identifying and managing conflicts of interest in the context of granting loans and entering into other transactions with members of the management body and their related parties, the SREP Guidelines specify responsibilities of the competent authorities to assess whether such a framework has been correctly identified and implemented. No changes made. Code of conduct Respondents stated that the code of conduct set by institutions is usually addressed to employees who do not engage in major economic offenses. Therefore, they suggested to amend the scope of such a code of conduct, focusing more on individual misconduct. Tax offenses, antitrust practices and other offenses and misconduct are relevant factors that should be considered within the code of conduct, which should be addressed to all employees, including senior management and members of the management body. The likelihood of any stakeholders engaging in such activities should not be the basis for developing and adopting high ethical and professional standards. No changes made. Allocation between fixed and variable elements of remuneration One respondent suggested to further align the SREP guidelines with paragraph 134 of the EBA Guidelines on sound remuneration policies (EBA/GL/2021/04) regarding the allocation of different components between variable and fixed elements of remuneration, especially the allocation of allowances. The EBA Guidelines on sound remuneration (EBA/GL/2021/04) require institutions to consider particular remuneration components, notably allowances. Institutions should analyse such allowances and allocate them to the variable and fixed components of remuneration. The SREP Guidelines already adequately reflect the EBA Guidelines on sound remuneration. No changes made.

Final Report on Guidelines on common procedures and methodologies for SREP and supervisory stress testing

Lineage: Superseded

Timeline